JP2007215150A - Content distribution apparatus and content viewing apparatus, view charge encryption device, view charge tabulation device and view charge decryption device, and view charge encryption program, view charge tabulation program and view charge decryption program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an anonymous charging system capable of performing charging processing while keeping a viewer anonymous. <P>SOLUTION: The anonymous charging system S is characterized in comprising: a content distribution apparatus 1 for distributing contents; a content viewing apparatus 2 for generating encrypted charging information by encrypting charging information corresponding to contents that a viewer has viewed, using a public key of a homomorphic public key encryption system disclosed beforehand; a view charge tabulation device 4 for generating pay amount information to a content provider while encrypting it from the encrypted charging information; and a view charge decryption device 5 for decrypting the encrypted charging information and the encrypted pay amount information using a private key paired with the public key of the homomorphic public key encryption system. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a content billing system capable of concealing a viewing history of a viewer who views content and performing billing management.

  In recent years, broadcasting has become multi-channel, and viewers can view channels and programs (contents) according to their preferences. Broadcasters scramble many channels and programs and distribute them as pay broadcasts. As a form of contract between a broadcaster and a viewer in this pay broadcast, there are a form in which a contract is made in units of channels, a form in which a contract is made in units of programs, and the like (for example, Patent Document 1 and Patent Document 2).

When making a contract in such a channel unit, a flat fee is generally charged that charges a fixed amount by a monthly contract such as one month. When making a contract in a program unit, the viewing fee for the viewed program Pay per view (PPV) billing is generally performed in which billing is performed by accumulating the total amount. In PPV charging, the viewer's receiving device accumulates the history of the viewed program as the viewing history, notifies the broadcaster of the viewing history, or notifies the broadcaster of the program to be viewed in advance. The billing process is performed for each program.
In this way, the broadcaster charges the viewer by monthly flat charge, PPV charge for each program, or a combination of these.

In addition, in recent years, with the rapid spread of high-speed communication service (FTTH: Fiber To The Home) using optical fiber, content distribution using the Internet has become possible. Also in this content distribution, the content provider generally uses monthly flat billing, PPV billing for each content, or a combination of these.
JP-A-11-177959 (paragraphs 0019 to 0066) JP-A-11-252529 (paragraphs 0016 to 0073)

  Unlike the PPV billing, the flat billing described above does not have a detailed fee system such as a program unit. For this reason, flat billing is the same for both viewers who are watching many programs in the channel and viewers who are not watching so much, which gives viewers an inequality. Therefore, it is not a preferable contract form. On the other hand, since the PPV billing described above charges for each program viewed by the viewer, the viewer will not be charged unnecessary for the program that is not viewed. I can say that.

However, since PPV billing requires the broadcaster to be notified of the viewing history and the like, privacy information, which is personal preference such as which program the viewer has watched, is known to the broadcaster. There is a problem from the viewpoint of protection. On the other hand, flat billing is excellent in terms of protecting the privacy of individual viewers because the broadcaster does not know which program the viewer has viewed.
As described above, the conventional chargeable billing system has problems such as giving viewers an unequal viewing fee and not protecting the privacy of viewers.

  The present invention has been made in view of the above-described problems, and can perform billing processing while maintaining the anonymity of the viewer while maintaining a detailed fee system such as a program unit. An object of the present invention is to provide a content distribution device, a content viewing device, a viewing fee encryption device, a viewing fee aggregation device, a viewing fee decryption device, a viewing fee encryption program, a viewing fee aggregation program, and a viewing fee decryption program And

  The present invention was created to achieve the above object, and the viewing fee encryption apparatus according to claim 1 is provided in a content viewing apparatus for presenting content to a viewer, and the viewer Is a viewing fee encryption apparatus that encrypts information indicating the contents of the fee for the content viewed by the user, and is configured to include billing information extraction means and encryption means.

  In such a configuration, the viewing fee encryption apparatus generates charging information by extracting information related to the fee from viewing history information of viewing the content by the charging information extraction unit. As a result, the viewing fee encryption apparatus can collect the fee for the content viewed by the viewer in units of content (programs), and can generate billing information indicating how much the viewer should be charged. The fee indicated by the billing information is also a payment fee paid to the content provider.

  Then, the viewing fee encryption apparatus encrypts the billing information with the public key of the homomorphic public key encryption method that has been disclosed in advance by the encryption means. This public key is information that is publicly disclosed in the financial institution that actually performs the accounting process. By encrypting the billing information using this homomorphic public key cryptosystem, the result of multiplying the encrypted billing information becomes the information obtained by encrypting the total fee. As a result, a billing aggregation organization such as a credit company multiplies the encrypted billing information and notifies the financial institution, so that the financial institution has a secret key paired with the public key. Even if the decryption is performed, only the total fee can be obtained, and the viewing history of the viewer can be kept secret.

  The content viewing apparatus according to claim 2 is a content viewing apparatus that presents content to a viewer, and generates encrypted billing information obtained by encrypting information indicating a fee for the content viewed by the viewer. The viewing fee encryption apparatus according to Item 1 is provided.

  In such a configuration, the content viewing apparatus includes a viewing fee encryption device, so that the billing information is extracted by extracting information related to the fee from the viewing history information of viewing the content, and the public key of the homomorphic public key cryptosystem is used. Encrypt with Note that this viewing fee encryption device is preferably incorporated in the content viewing device as a tamper-resistant security module.

  Further, the viewing fee totaling device according to claim 3 is a viewing fee totaling device for totalizing the encrypted billing information generated in the content viewing device according to claim 2 in an encrypted state, wherein the fee information storage means And a payment amount information calculation means.

  In such a configuration, the viewing fee totaling apparatus stores the encrypted billing information generated by the content viewing apparatus in the fee information storage means. The viewing fee totaling apparatus individually multiplies the information corresponding to the content provider in the encrypted billing information stored in the fee information storage means. Since this encrypted billing information is encrypted with the public key of the homomorphic public key cryptosystem, the multiplication result is information obtained by encrypting the total fee paid to the content provider (encrypted payment amount information). It becomes.

  Further, the viewing fee decrypting device according to claim 4 is aggregated by the encrypted billing information encrypted by the viewing fee encryption device according to claim 1 and the viewing fee counting device according to claim 3. The viewing fee decrypting device decrypts the encrypted payment amount information, and includes a homomorphic key generation unit, a billing information decryption unit, a payment amount information decryption unit, and an amount verification unit.

In such a configuration, the viewing fee decryption apparatus generates a public key and a secret key that are key pairs in the homomorphic public key cryptosystem by the homomorphic key generation unit. Then, the viewing fee decrypting apparatus decrypts the encrypted billing information as the billing information by the billing information decrypting unit using the secret key generated by the homomorphic key generating unit. This billing information is information indicating the total amount of money billed to the viewer.
In addition, the viewing fee decrypting device decrypts the encrypted payment amount information as the payment amount information by the payment amount information decrypting unit using the secret key generated by the homomorphic key generation unit, and the payment amount information in the content distribution device Generate a fee verification parameter for verifying. This payment amount information is information indicating the total fee paid to the content provider.
Then, the viewing fee decryption apparatus compares the billing information and the payment amount information by the amount verification means and performs verification.

  Furthermore, the content viewing device according to claim 5 is the content viewing device according to claim 2, wherein the billing amount indicated by the billing information generated by the billing information extracting means and the viewing fee decoding according to claim 4 are provided. A billing amount verification means for verifying the billing amount by comparing with the billing amount indicated by the billing information decrypted by the apparatus is provided.

  In this configuration, the content viewing apparatus verifies the billing amount by comparing the billing amount indicated by the billing information generated by the billing information extraction unit with the actually billed amount by the billing amount verification unit. . As a result, it is possible to detect that tampering or the like has been performed on the amount actually charged.

  The content distribution device according to claim 6 is the content distribution device for distributing content, and the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 3 is used for viewing and listening according to claim 4. Payment amount verification means for verifying the payment amount information by decrypting with the public key generated by the fee decryption device and the fee verification parameter and comparing with the payment amount information decrypted by the viewing fee decryption device It was set as the structure provided.

In such a configuration, the content distribution apparatus uses the payment amount verification means to convert the encrypted payment amount information into payment amount information based on the public key of the homomorphic public key cryptosystem generated by the viewing fee decryption device and the fee verification parameter. Encrypt. This payment amount information is information that should be the same as the payment amount information collected by the viewing fee decryption apparatus.
Then, the content distribution device compares the decrypted payment amount information with the payment amount information decrypted by the viewing fee decryption device by the payment amount verification means. As a result, it is possible to detect that the payment amount has been altered.

  The content distribution device according to claim 7 is the content distribution device that distributes content, and the payment amount information decrypted by the viewing fee decryption device according to claim 4 is generated by the viewing fee decryption device. The encrypted payment amount information is generated by encrypting with the public key and the fee verification parameter, and the encrypted payment amount information is calculated by comparing with the encrypted payment amount information collected by the viewing fee aggregation device according to claim 3. The payment amount verification means for verifying the information on the payment amount is provided.

In such a configuration, the content distribution apparatus uses the payment amount verification means to convert the payment amount information as encrypted payment amount information based on the public key of the homomorphic public key cryptosystem generated by the viewing fee decryption device and the fee verification parameter. Encrypt. This encrypted payment amount information is information that should be the same as the encrypted payment amount information generated by the viewing fee counting apparatus.
Then, the content distribution device compares the encrypted payment amount information with the encrypted payment amount information generated by the viewing fee totaling device by the payment amount verification means. As a result, it is possible to detect that the payment amount has been altered.

  Furthermore, the viewing fee encryption program according to claim 8 is configured to cause a computer to function as billing information extraction means and encryption means in order to encrypt information indicating the contents of the fee for the content viewed by the viewer. It was.

  In such a configuration, the viewing fee encryption program generates billing information by extracting information related to the fee from viewing history information of viewing the content by the billing information extracting means. Also, the viewing fee encryption program encrypts the billing information with the public key of the homomorphic public key encryption method that has been made public by the encryption means.

  In addition, the viewing fee totaling program according to claim 9 is configured to count the encrypted billing information generated in the content viewing apparatus according to claim 2 while encrypting the computer as a payment amount information calculating unit. The configuration is to function.

  In such a configuration, the viewing fee totaling program individually multiplies the information corresponding to the content provider in the encrypted billing information stored in the fee information storage unit by the payment amount information calculation unit. Since this encrypted billing information is encrypted with the public key of the homomorphic public key cryptosystem, the multiplication result is information obtained by encrypting the total fee paid to the content provider (encrypted payment amount information). It becomes.

  Furthermore, the viewing fee decryption program according to claim 10 is aggregated by the encrypted billing information encrypted by the viewing fee encryption device according to claim 1 and the viewing fee aggregation device according to claim 3. In order to decrypt the encrypted payment amount information, the computer is configured to function as a homomorphic key generation unit, an accounting information decryption unit, a payment amount information decryption unit, and an amount verification unit.

In such a configuration, the viewing fee decryption program generates a public key and a secret key that are key pairs in the homomorphic public key cryptosystem by the homomorphic key generation unit. Then, the viewing fee decryption program decrypts the encrypted billing information as billing information by the billing information decryption unit using the secret key generated by the homomorphic key generation unit. This billing information is information indicating the total amount of money billed to the viewer.
In addition, the viewing fee decryption program decrypts the encrypted payment amount information as the payment amount information by the payment amount information decryption unit using the secret key generated by the homomorphic key generation unit. This payment amount information is information indicating the total fee paid to the content provider.
Then, the viewing fee decryption program compares the billing information with the payment amount information by the amount verification means and performs verification.

  The viewing fee encryption apparatus according to claim 11 is provided in a content viewing device that presents content to a viewer, and the viewing fee encryption that encrypts information indicating a fee for the content viewed by the viewer. And a charging information extracting means and an encryption means for performing encryption with a public key and a random number.

In such a configuration, the viewing fee encryption apparatus generates charging information by extracting information related to the fee from viewing history information of viewing the content by the charging information extraction unit.
Then, the viewing fee encryption apparatus encrypts the billing information using a public key of a homomorphic public key cryptosystem that has been disclosed in advance and a random number generated in the content distribution apparatus that distributes the content.

  Furthermore, the content viewing device according to claim 12 is a content viewing device that presents content to a viewer, and generates encrypted billing information obtained by encrypting information indicating a fee for the content viewed by the viewer. The viewing fee encryption apparatus according to Item 11 is provided.

  In such a configuration, the content viewing apparatus includes a viewing fee encryption device, so that the billing information is extracted by extracting information related to the fee from the viewing history information of viewing the content, and the public key of the homomorphic public key cryptosystem is used. Encrypt with

  A viewing fee totaling device according to claim 13 is a viewing fee totaling device for totalizing encrypted billing information generated in the content viewing device according to claim 12 while encrypting the fee. And a payment amount information calculation means.

  In such a configuration, the viewing fee totaling apparatus stores the encrypted billing information generated by the content viewing apparatus in the fee information storage means. The viewing fee totaling apparatus individually multiplies the information corresponding to the content provider in the encrypted billing information stored in the fee information storage means. Since this encrypted billing information is encrypted with the public key of the homomorphic public key cryptosystem, the multiplication result is information obtained by encrypting the total fee paid to the content provider (encrypted payment amount information). It becomes.

  Furthermore, the viewing fee decrypting device according to claim 14 is counted by the encrypted billing information encrypted by the viewing fee encryption device according to claim 11 and the viewing fee counting device according to claim 13. The viewing fee decrypting device decrypts the encrypted payment amount information, and includes a homomorphic key generation unit, a billing information decryption unit, a payment amount information decryption unit, and an amount verification unit.

In such a configuration, the viewing fee decryption apparatus generates a public key and a secret key that are key pairs in the homomorphic public key cryptosystem by the homomorphic key generation unit. Then, the viewing fee decrypting device decrypts the encrypted billing information as the billing information by the billing information decrypting unit using the secret key generated by the homomorphic key generating unit and the random number generated by the content distribution device. This billing information is information indicating the total amount of money billed to the viewer.
In addition, the viewing fee decrypting device decrypts the encrypted payment amount information as the payment amount information by the payment amount information decrypting unit using the secret key generated by the homomorphic key generation unit, and the payment amount information in the content distribution device Generate a fee verification parameter for verifying. This payment amount information is information indicating the total fee paid to the content provider.
Then, the viewing fee decryption apparatus compares the billing information and the payment amount information by the amount verification means and performs verification.

  Further, the content viewing device according to claim 15 is the content viewing device according to claim 12, wherein the billing amount indicated by the billing information generated by the billing information extracting means and the viewing fee according to claim 14 are provided. A billing amount verification means for verifying the billing amount by comparing with the billing amount indicated by the billing information decrypted by the decryption device is provided.

  In this configuration, the content viewing apparatus verifies the billing amount by comparing the billing amount indicated by the billing information generated by the billing information extraction unit with the actually billed amount by the billing amount verification unit. . As a result, it is possible to detect that tampering or the like has been performed on the amount actually charged.

  Further, the content distribution device according to claim 16 decrypts the encrypted payment amount information aggregated by the random number generation means and the viewing fee aggregation device, and compares it with the payment amount information decrypted by the viewing fee decryption device. And a payment amount verification means for verifying the amount information.

  In such a configuration, the content distribution device generates a random number by the random number generation means. Then, the content distribution device decrypts the encrypted payment amount information aggregated by the viewing fee aggregation device by the payment amount verification means with the public key generated by the viewing fee decryption device and the fee verification parameter, and the viewing fee The payment amount information is verified by comparing with the payment amount information decrypted by the decryption device using the secret key and the random number.

  Furthermore, the content distribution device according to claim 17 encrypts the payment amount information decrypted by the random number generation means and the viewing fee decryption device, and compares it with the encrypted payment amount information aggregated by the viewing fee aggregation device. And a payment amount verification means for verifying the amount information.

  In such a configuration, the content distribution device generates a random number by the random number generation means. Then, the content distribution device uses the payment amount verification means to determine the payment amount information decrypted by the viewing fee decryption device using the secret key and the random number, the public key generated by the viewing fee decryption device, and the fee verification parameter, The encrypted payment amount information is generated by encrypting the encrypted payment amount information, and the encrypted payment amount information is verified by comparing the encrypted payment amount information with the viewing fee totaling apparatus.

  The content viewing apparatus according to claim 18 is a content viewing apparatus for presenting content to a viewer, comprising: a viewing fee encryption apparatus including billing information extraction means and encryption means; and random number seed reception Means and random number generation means.

  In such a configuration, the content viewing apparatus receives a seed for generating a random number by the random number seed receiving unit, and generates a random number from the received seed by the random number generating unit. Then, the content viewing device generates billing information by extracting information related to the fee from the viewing history information of viewing the content by the billing information extracting unit of the viewing fee encryption device, and pre-published by the encryption unit in advance. The encrypted charging information is generated by encrypting the charging information with the public key and random number of the homomorphic public key encryption method.

The present invention has the following excellent effects.
According to the first, second, or eighth aspect of the invention, the billing information is encrypted with the public key of the homomorphic public key cryptosystem that is publicly disclosed in advance in the financial institution. When this encrypted billing information is multiplied, it becomes information obtained by encrypting the total fee. Therefore, by multiplying the encrypted billing information by a billing aggregation organization, which is a third organization such as a credit company, for example, a financial institution that actually performs billing processing can decrypt only the total fee. In addition, the billing aggregation organization cannot decrypt the billing information because it does not hold the private key of the financial institution that decrypts the encrypted billing information. As a result, the accounting process can be performed while the viewing history of the viewer is kept secret.

According to the third, ninth, or thirteenth aspect of the present invention, it is possible to extract the payment amount to the content provider from the encrypted billing information while being encrypted.
According to the invention of claim 4, 10 or 14, it is possible to decrypt the payment amount for the content provider and the billing amount for the viewer while keeping the viewing history of the viewer secret. it can.

According to the invention described in claim 5 or claim 15, billing information for the content actually viewed by the viewer can be verified by the viewer. As a result, a distribution system capable of accurate billing processing can be realized.
According to the invention described in claim 6 or claim 16, by decrypting the encrypted payment amount information aggregated by the viewing fee aggregation device, the decrypted result and the payment amount decrypted by the viewing fee decryption device Information can be verified on the content provider side, and a distribution system capable of accurate billing processing can be realized.
According to the invention described in claim 7 or claim 17, by encrypting the payment amount decrypted by the viewing fee decryption apparatus actually paid in the financial institution, the encrypted result and the viewing fee aggregation The encrypted payment amount information aggregated by the apparatus can be verified on the content provider side, and a distribution system capable of accurate billing processing can be realized.

According to the invention of claim 11, claim 12 or claim 18, the public key of the homomorphic public key cryptosystem publicly disclosed in the financial institution, and the random number generated in the content distribution apparatus on the provider side To encrypt the billing information. When this encrypted billing information is multiplied, it becomes information obtained by encrypting the total fee. Therefore, by multiplying the encrypted billing information by a billing aggregation organization, which is a third organization such as a credit company, for example, a financial institution that actually performs billing processing can decrypt only the total fee. In addition, the billing aggregation organization cannot decrypt the billing information because it does not hold the private key of the financial institution that decrypts the encrypted billing information. As a result, the accounting process can be performed while the viewing history of the viewer is kept secret.
Further, according to the present invention, since the charging information is encrypted by homomorphic encryption using a random number generated by the content distribution device, that is, a random number that can be known only by the provider side, Replacement or the like can be prevented.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment: Configuration of Anonymous Charging System]
First, the configuration of the anonymous billing system according to the first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of the anonymous billing system. The anonymous billing system S conceals the user's viewing history for billing according to the content (broadcast program) viewed by the viewer (hereinafter referred to as user) and payment to the provider of the content (hereinafter referred to as provider). It is a system that performs as it is. Here, the anonymous billing system S includes a content distribution device 1, a content viewing device 2 (security module 3), a viewing fee totaling device 4, and a viewing fee decrypting device 5, each via a network N. It is connected. A plurality of devices (1 to 5) may exist.

  The content distribution apparatus 1 is disposed on the provider (here, broadcaster) side, and distributes content to the content viewing apparatus 2 via a broadcast wave W such as satellite / terrestrial broadcast. Here, although the content distribution apparatus 1 is described as distributing content via the broadcast wave W, the content is distributed via a cable, or the content is distributed via the Internet or the like. It doesn't matter.

The content viewing device 2 receives content via the broadcast wave W, and decodes and presents the content to the user. In addition, the content viewing apparatus 2 uses the quasi-isomorphic public key cryptosystem that pre-publishes information (charge information) indicating the contents of the fee according to the content viewed by the user in the viewing fee decryption device 5 on the financial institution side. It is also encrypted with a public key, and transmitted to the viewing fee totaling device 4 on the accounting totaling institution side and the viewing fee decoding device 5 on the financial institution side. Note that the provider fee information encrypted by encrypting the payment amount for each provider is transmitted to the viewing fee totaling device 4, and the entire fee for the content viewed by the user is encrypted to the viewing fee decrypting device 5. Billing information (encrypted billing information) is transmitted.
In addition, here, the content viewing device 2 includes a security module (viewing fee encryption device) 3 such as an IC card, and the security module 3 encrypts fee information.

  Since the content viewing apparatus 2 encrypts fee information with a public key that is publicly disclosed in advance by the financial institution, the billing aggregation organization identifies which content the user has viewed from the encrypted fee information. I can't do it. As a result, the content viewed by the user can be kept secret from the billing aggregation organization.

  The viewing fee totaling device 4 is installed in a billing totaling organization such as a credit company or a CAS (Conditional Access System) operating company, and from the fee information encrypted by the content viewing device 2 (encrypted provider-specific fee information) to the provider. The payment amount information indicating the total payment amount is aggregated while being encrypted. The payment amount information (encrypted payment amount information) collected in an encrypted form is transmitted to the viewing fee decryption device 5 of the financial institution.

  The viewing fee decrypting device 5 is installed in a financial institution such as a bank, and quasi-isomorphously discloses the encrypted billing information notified from the content viewing device 2 and the encrypted payment information collected by the viewing fee collecting device 4. Decryption is performed using a secret key of a key encryption method. Then, the financial institution charges the user the amount indicated by the charging information obtained by decrypting the encrypted billing information, and pays the amount indicated by the payment amount information obtained by decrypting the encrypted payment amount information to the provider. The billing information and the payment amount information decrypted with this secret key only indicate the total fee. Thereby, the content viewed by the user can be kept secret.

  In this anonymous billing system S, as a ciphering method, a “Simplified Paillier cipher” that is a homomorphic public key cipher is incorporated into “Twin Encryption”. We will use it. This "Simplified Paillier cipher" was written by D. Catalano, R. Gennaro, N. Howgrave-Graham, PQNguyen in "Paillier's Cryptosystem Revisited", Proc. Of ACM CCS 2001, pp. 206-214, 2001. This is a proposed method. "Twin Encryption" was proposed by M.Naor and M.Yung in "Public-Key Cryptosystems Provably Secure against Chosen Ciphertext Attacks", Proc. Of STOC '90, pp. 427-437, 1990. It is a method.

(About knowledge proof for Twin Encryption)
Here, the knowledge proof for Twin Encryption used in this embodiment will be described.
This knowledge proof proves that when the two ciphertexts a ₀ and a ₁ are represented by the following equation (1), these ciphertexts are obtained by encrypting the same plaintext M.

Here, (n ₀ , e ₀ ) and (n ₁ , e ₁ ) are the public keys PK = (pk ₀ = (n ₀ , e ₀ ), pk ₁ = (n ₁ , e ₁ ) in this embodiment. ), R ₀ is a random number satisfying r ₀ ∈Z _n0 ^*, and r ₁ is a random number satisfying r ₁ ∈Z _n1 ^* . Hereinafter, it is proved by the procedures (i) to (iv) that the two ciphertexts of the formula (1) are obtained by encrypting the same plaintext M.
(I) Random numbers α ₀ εZ _n0 ^* and α ₁ εZ _n1 ^* are selected, and the values (commit values y ₀ , y ₁ ) shown in the following equation (2) are calculated. Here, M ′ is a decrypted ciphertext obtained by encrypting the plaintext M.

(Ii) A value (changing value c) shown in the following equation (3) is calculated. However, H (•) is a hash function.

(Iii) The value (provided value KP) shown in the following equation (4) is calculated.

(Iv) By confirming that the following expression (5) holds, it is proved that the two ciphertexts a ₀ and a _{1 in the} expression (1) are the same plaintext M encrypted. . Here, the proof value KP = (c, z, u ₀ , u ₁ ).

  Hereinafter, each component of the anonymous billing system S will be described in detail.

(Configuration of content distribution device)
First, the configuration of the content distribution apparatus will be described with reference to FIG. 2 (refer to FIG. 1 as appropriate). FIG. 2 is a block diagram showing the configuration of the content distribution apparatus. Here, the content distribution apparatus 1 includes a content storage unit 10, a content encryption unit 11, an encrypted content storage unit 12, a broadcast transmission unit 13, and a verification unit 14.

  The content storage means 10 stores raw data of broadcast content (programs) and is a general storage device such as a hard disk.

  The content encryption unit 11 encrypts the content stored in the content storage unit 10. The content (encrypted content) encrypted by the content encryption unit 11 is stored in the encrypted content storage unit 12. Note that the encryption in the content encryption unit 11 is performed by, for example, a scramble key used in a conditional access system (CAS).

  The encrypted content storage unit 12 stores the encrypted content encrypted by the content encryption unit 11, and is a storage device such as a hard disk.

The broadcast transmission unit 13 broadcasts the encrypted content stored in the encrypted content storage unit 12 via the broadcast wave W based on a predetermined program organization. Note that the broadcast transmission means 13 also broadcasts fee-based information (for example, viewing fees) of content by an electronic program guide or the like.
The encrypted content transmitted from the broadcast transmitting means 13 is received by the content viewing device 2, and the user views the content.

  The verification means 14 verifies the payment amount paid by the financial institution. Here, the verification unit 14 includes an encrypted payment amount information reception unit 14a, a payment amount information reception unit 14b, a payment amount verification unit 14c, a public key reception unit 14d, and a public key storage unit 14e. .

The encrypted payment amount information receiving means 14a receives the encrypted payment amount information obtained by encrypting the payment amount to the provider for the viewing of the user from the viewing fee aggregation device 4 on the charging aggregation organization side via the network N. Is received. It should be noted that this encrypted payment amount information is added with a proof value (see equation (4) above) for the encrypted payment amount information in the viewing fee totaling device 4 (encrypted payment amount information with proof).
The encrypted payment amount information is information encrypted by the content viewing apparatus 2 using the Simplified Paillier cipher that is a homomorphic public key cryptosystem. The encrypted payment amount information and the provider decryption parameter are output to the payment amount verification means 14c.

The payment amount information receiving means 14b receives the payment amount information indicating the payment amount to the provider for the user's viewing from the viewing fee decoding device 5 of the financial institution via the network N. The payment amount information received by the payment amount information receiving unit 14b is output to the payment amount verification unit 14c.
Further, since the viewing fee decryption apparatus 5 also transmits a provider decryption parameter (a fee verification parameter: details will be described later) as information necessary for verifying the encrypted payment amount information, this payment amount information receiving means In 14b, the provider decoding parameter is also received.

The payment amount verification means 14c determines whether the encrypted payment amount information received by the encrypted payment amount information receiving means 14a and the payment amount information received by the payment amount information receiving means 14b indicate the same amount. It is to verify.
This payment amount verification means 14c decrypts the encrypted payment amount information received by the encrypted payment amount information reception means 14a based on the public key stored in the public key storage means 14e. Specifically, the payment amount verification unit 14c decrypts the payment amount according to the following equation (6). Since the encrypted payment amount information is duplicated, the respective encrypted payment amount information is C _{Pj, sum, 0} , C _{Pj, sum, 1} , and the provider decryption parameter is r ′ _{Pj, sum, 0} , r ' _{Pj, sum, 1} and the public key is PK = (pk ₀ = (n ₀ , e ₀ ), pk ₁ = (n ₁ , e ₁ )). As a result, two pieces of payment amount information (P " _{Pj, sum, 0} , P" _{Pj, sum, 1} ) are also generated.

Then, the payment amount verification unit 14c compares the decrypted payment amount information with the payment amount information received by the payment amount information reception unit 14b, thereby verifying the payment amount notified from the viewing fee decryption apparatus 5. I do.
Here, the payment amount verification means 14c has the two pieces of decrypted payment amount information P " _{Pj, sum, 0} and P" _{Pj, sum, 1} equal, and one of them, for example, payment amount information P " _{Pj , Sum, 0} is determined to be correct if the payment amount information P ′ _{Pj, sum, 0} received by the payment amount information receiving means 14b is equal to the payment amount information receiving means 14b. The display is performed on a display device (not shown).

Here, the payment amount verification unit 14c verifies the encrypted payment amount information received by the encrypted payment amount information reception unit 14a by comparing it with the payment amount information received by the payment amount information reception unit 14b. However, verification may be performed by encrypting the payment amount information received by the payment amount information receiving unit 14b and comparing it with the encrypted payment amount information received by the encrypted payment amount information receiving unit 14a.
Specifically, the payment amount verification unit 14c encrypts the payment amount information received by the payment amount information reception unit 14b according to the following expression (7). Since the payment amount information is duplicated, the respective payment amount information is P ′ _{Pj, sum, 0} , P ′ _{Pj, sum, 1} , and the provider decryption parameter is r ′ _{Pj, sum, 0} , r ′ _{Pj. , Sum, 1} and the public key is PK = (pk ₀ = (n ₀ , e ₀ ), pk ₁ = (n ₁ , e ₁ )).

Then, the payment amount verification means 14c has the two encrypted encrypted payment amount information C " _{Pj, sum, 0} and C" _{Pj, sum, 1} equal to each other, for example, the encrypted payment amount When the information C ″ _{Pj, sum, 0} is equal to the encrypted payment amount information _{CPj, sum, 0} received by the encrypted payment amount information receiving means 14a, it is determined that the payment amount is correct.

  The public key receiving unit 14d receives the public key from the viewing fee decrypting apparatus 5 on the financial institution side via the network N. The public key received by the public key receiving unit 14d is stored in the public key storage unit 14e.

The public key storage unit 14e stores the public key received by the public key reception unit 14d, and is a general storage device such as a memory or a hard disk.
By configuring the content distribution apparatus 1 in this way, the provider can realize a broadcast form that allows charging for viewing of each content. Here, although the content distribution apparatus 1 has been described with one apparatus configuration, the content storage unit 10, the content encryption unit 11, the encrypted content storage unit 12, the broadcast transmission unit 13, and the verification unit 14 are connected to a content server, The encryption device, the encrypted content server, the broadcast transmission device, and the verification device may be separated.

(Configuration of content viewing device)
Next, the configuration of the content viewing apparatus will be described with reference to FIG. 3 (refer to FIG. 1 as appropriate). FIG. 3 is a block diagram showing a configuration of a content viewing apparatus provided with a security module (viewing fee encryption apparatus). Here, the content viewing apparatus 2 includes a broadcast receiving unit 20, a content decrypting unit 21, a public key receiving unit 22, a public key storage unit 23, a viewing history encryption key generating unit 24, and a viewing history encryption key. The storage unit 25, the encrypted viewing history storage unit 26, the charge information transmission unit 27, the charging information reception unit 28, the charging amount verification unit 29, and the security module 3 are provided. The content viewing device 2 is connected to an input device R such as a remote controller (remote control device) and a keyboard and a display device D such as a display and a speaker.

  The broadcast receiving means 20 receives content (encrypted content) broadcast from the content distribution apparatus 1 via the broadcast wave W. The encrypted content received by the broadcast receiving unit 20 is output to the content decrypting unit 21.

  The content decrypting means 21 decrypts the encrypted content received by the broadcast receiving means 20 and outputs it to the display device D. The content decrypting means 21 displays a confirmation screen for confirming whether or not to agree to the billing if the content is charged when the content viewing reservation is made by the electronic program guide or the like. D is displayed. Then, the content decrypting means 21 distributes the encrypted content by the broadcast wave W when information indicating an agreement for charging (for example, pressing of the “decision button”) is input from the user via the input device R. Is decrypted with the decryption key. At this time, the content decrypting means 21 outputs viewing information such as the fee and channel of the viewed content to the security module 3.

  The public key receiving means 22 receives an encryption key for encrypting billing information from the viewing fee decryption apparatus 5 of the financial institution via the network N. Note that this encryption key is a public key of a homomorphic public key encryption method that is disclosed in advance by the viewing fee decryption apparatus 5. The encryption key received by the public key receiving unit 22 is stored in the public key storage unit 23.

  The public key storage unit 23 stores the encryption key (public key) received by the public key reception unit 22, and is a general storage device such as a memory or a hard disk.

The viewing history encryption key generation unit 24 generates an encryption key for encrypting the viewing history of the content viewed by the user. The encryption key generated by the viewing history encryption key generation unit 24 is stored in the viewing history encryption key storage unit 25. Here, the viewing history encryption key generation unit 24 generates an encryption key by a common key encryption method such as AES (Advanced Encryption Standard).
Note that the viewing history encryption key generation unit 24 may generate a key pair of a public key and a secret key using a public key encryption method. In this case, the viewing history encryption unit 3c and the viewing history decryption unit 3d of the security module 3 to be described later use different encryption keys of any one of the key pairs. However, it is preferable to use the common key encryption method rather than the public key encryption method in order to realize high speed in the apparatus.

  The viewing history encryption key storage unit 25 stores the encryption key generated by the viewing history encryption key generation unit 24, and is a general storage device such as a tamper resistant memory or a hard disk. The encryption key stored in the viewing history encryption key storage unit 25 is read by the security module 3.

  The encrypted viewing history storage means 26 stores an encrypted viewing history (encrypted viewing history), and is a general storage device such as a tamper resistant memory and a hard disk. The encrypted viewing history stored in the encrypted viewing history storage means 26 is written and read by the security module 3.

  The fee information transmitting means 27 is for transmitting the encrypted fee information generated by the security module 3. Here, the fee information transmitting means 27 aggregates the fee information for each provider (the fee information for each encrypted provider) and the billing information (the encrypted billing information) via the network N as the fee information. The data is transmitted to the device 4 and the viewing fee decoding device 5. The fee information transmitting means 27 preferably adds an electronic signature to the encrypted provider-specific fee information and the encrypted billing information.

The billing information receiving means 28 receives billing information indicating the total fee charged for user viewing from the viewing fee decoding device 5 on the financial institution side via the network N. Since the viewing fee decoding device 5 also transmits user decoding parameters (details will be described later) for decoding the charging information, this charging information receiving means 28 also receives the user decoding parameters. .
The billing information and user decryption parameters received by the billing information receiving unit 28 are output to the billing amount verifying unit 29. If the electronic signature is added to the accounting information, the accounting information receiving unit 28 verifies the accounting information.

The billing amount verification unit 29 compares the billing amount indicated by the billing information generated by the security module 3 with the billing amount indicated by the billing information received by the billing information receiving unit 28, thereby charging the billed amount. The amount is verified.
Here, the billing amount verification unit 29 uses the following formula (8) for the encrypted billing information C _{sum, Ui} for the user i (i = 1,..., Nu) generated by the encryption unit 3b of the security module 3. As shown in FIG. 4, decryption is performed using the user decryption parameter r ′ _{sum, Ui} received by the billing information receiving means 28 and the public key PK = (n ₀ , e ₀ ) stored in the public key storage means 23.

Then, the billing amount verifying unit 29 compares the billing information P ′ _{sum, Ui} received by the billing information receiving unit 28 with the billing information P ″ _{sum, Ui} decrypted by the equation (8) to verify the billing information. The billing amount verification unit 29 displays the verification result on the display device D.
As a result, the user can confirm whether or not charging is normally performed. If the billing amount is correct, the billing amount verifying unit 29 deletes the viewing history subject to billing from the encrypted viewing history storage unit 26 after user confirmation.

(Configuration of security module [viewing fee encryption device])
Next, the configuration of the security module 3 will be described with reference to FIG.
The security module (viewing fee encryption device) 3 encrypts information indicating the contents of charging for the content viewed by the user in the content viewing device 2. Further, the security module 3 has a function of encrypting history information that is a history of content viewed by the user.
The security module 3 is an IC card having tamper resistance, and is detachable from the content viewing device 2. Here, the security module 3 includes billing information extraction means 3a, encryption means 3b, viewing history encryption means 3c, and viewing history decryption means 3d.

  The billing information extraction unit 3a generates billing information by extracting information about charges from viewing history information indicating the history of content viewed by the user. The billing information extraction unit 3a generates billing information viewed by the user within a predetermined period (for example, one month) from the viewing history information decoded by the viewing history decoding unit 3d described later. When charging is performed one by one at the stage of viewing the content, the charging information is generated based on viewing information (contents viewing history information) decrypted by the content decrypting means 21 described later.

  Here, an example of viewing history information and billing information will be described with reference to FIGS. FIG. 6 is a data configuration diagram illustrating an example of viewing history information. FIG. 7 is a data structure diagram showing an example of billing information.

As shown in FIG. 6, the viewing history information is composed of “date / time”, “channel”, “program name”, and “charge” data when the user views the content to be charged.
Here, “date and time” is information indicating the date, time, etc., when the user viewed the content. In FIG. 6, the date is shown as “date and time”. The “channel” is information indicating a selected channel on which the viewed content is broadcast. In addition, the provider who delivered the content can be specified by this channel. Further, the “program name” is information indicating a name given to the viewed content. The “charge” is information indicating the viewing fee of the content that has been viewed.

As shown in FIG. 7, the billing information is composed of data of “channel”, “charge”, and “total charge”.
Here, “channel” and “charge” are information extracted from the viewing history information shown in FIG. The “total fee” is information indicating the total amount of the “fee” amount.
Returning to FIG. 3, the description of the internal configuration of the security module 3 will be continued.

The encryption unit 3b encrypts the billing information extracted by the billing information extraction unit 3a with a public key (encryption key) of a homomorphic public key cryptosystem that is publicly disclosed in advance in a financial institution. Here, the encryption unit 3b encrypts the total fee and the provider-specific fee that is the fee for each channel.
Specifically, the encryption unit 3b generates encrypted billing information C _{sum, Ui} by Simplified Paillier encryption as shown in the following equation (9).

Here, P _{sum, Ui} is a total charge, and r _Ui is a random number that satisfies r _Ui εZ _n0 ^* .
Furthermore, as shown in the following equation (10), the encryption unit 3b incorporates the Simplified Paillier cipher into the Twin Encryption, so that the charge information C for each provider j (j = 1,..., Np) _{Pj, Ui} ({C _{Pj, Ui} } _{j = 1,..., Np} ) is generated.

Here, KP _{Pj, Ui} is a knowledge proof, and is generated in the same manner as the above equation (4). Further, P _{Pj, Ui} is a provider-specific fee, r _{Pj, Ui, 0} is {r _{Pj, Ui, 0} } _{j = 1,..., Np} ∈Z _n0 ^* , r _{Pj, Ui, 1} is {r _{Pj, Ui, 1} } _{j = 1,..., Np} ∈ Z _n1 ^* .
The encrypted charging information C _{sum, Ui} and the encrypted provider-specific fee information _{CPj, Ui} generated in this way are output to the fee information transmitting means 27.

  The viewing history encryption unit 3c encrypts viewing history information indicating the history of content viewed by the user. The viewing history encryption unit 3c generates viewing history information by adding the latest viewing information decrypted by the content decrypting unit 21 to the past viewing history information decrypted by the viewing history decrypting unit 3d. Then, encryption is performed using the viewing history encryption key stored in the viewing history encryption key storage unit 25. The viewing history encryption unit 3 c stores the encrypted viewing history in the encrypted viewing history storage unit 26. As a result, the contents of the encrypted viewing history storage means 26 are updated.

  The viewing history decrypting unit 3d decrypts the encrypted viewing history stored in the encrypted viewing history storage unit 26 into viewing history information using the viewing history encryption key stored in the viewing history encryption key storage unit 25. To do. When the charging information is extracted from the viewing history information in the charging information extraction unit 3a, the viewing history decoding unit 3d is activated from the charging information extraction unit 3a, and the decoded viewing history information is stored in the charging information extraction unit 3a. Output to. When the viewing history information is updated in the viewing history encryption unit 3c, the viewing history decryption unit 3d is activated from the viewing history encryption unit 3c, and the decrypted viewing history information is converted into the viewing history encryption unit 3c. Output to.

By configuring the security module 3 in this way, billing information and viewing history information are encrypted in the security module 3, so that the risk of being read from the outside can be reduced.
The security module 3 can be realized by causing the CPU in the security module 3 to operate as a program (viewing fee encryption program) that functions as each means described above.

  By configuring the content viewing apparatus 2 with the security module 3 as described above, the content viewing apparatus 2 can transmit the charging information in units of content to the charging aggregation organization in an encrypted state. Note that this encrypted billing information is encrypted with a public key that is publicly available at financial institutions, and therefore cannot be decrypted by the billing aggregation organization, and the user's viewing history is kept secret. can do.

  The configuration of the content viewing device 2 including the security module 3 has been described above, but the present invention is not limited to this configuration. For example, when the billing information is not transmitted from the financial institution via the network N but is notified by mail or the like, the billing information receiving unit 28 and the billing amount verifying unit 29 can be omitted from the configuration.

(Configuration of viewing fee counting device)
Next, referring to FIG. 4 (refer to FIG. 1 as appropriate), the configuration of the viewing fee counting apparatus will be described. FIG. 4 is a block diagram showing the configuration of the viewing fee totaling apparatus. Here, the viewing fee totaling apparatus 4 includes a fee information receiving unit 40, a fee information storage unit 41, a public key receiving unit 42, a public key storage unit 43, a payment amount totaling unit 44, and a proof unit 45. I have.

The fee information receiving means 40 receives the encrypted provider-specific fee information as fee information from the content viewing apparatus 2 via the network N. The encrypted provider-specific fee information received by the fee information receiving means 40 is stored in the fee information storage means 41.
The fee information storage means 41 stores fee information and is a general storage device such as a memory or a hard disk. Here, the charge information storage means 41 stores encrypted provider-specific charge information.

The public key receiving means 42 receives the public key of the homomorphic public key cryptosystem disclosed in the viewing fee decrypting apparatus 5 of the financial institution via the network N. The public key received by the public key receiving unit 42 is stored in the public key storage unit 43.
The public key storage unit 43 stores the public key received by the public key reception unit 42 and is a general storage device such as a memory or a hard disk.

  The payment amount totaling means 44 totals the payment amount for each provider with encryption. Here, the payment amount totaling unit 44 includes a payment amount information calculation unit 44a and a payment amount information transmission unit 44b.

The payment amount information calculation unit 44a calculates encrypted payment amount information for each provider in the encrypted provider-specific fee information stored in the fee information storage unit 41. Note that in the Pillar cipher, the multiplication result obtained by multiplying the encrypted information is equal to the information obtained by encrypting the addition result obtained by adding the information (plain text) before encryption.
Therefore, the payment amount information calculation means 44a performs the following (11) for the encrypted provider-specific fee information C _{Pj, Ui} (= (C _{Pj, Ui, 0} , C _{Pj, Ui, 1} , KP _{Pj, Ui} )). As shown in the formula, encrypted payment amount information C ′ _{Pj, sum} which is a total for each channel Pj (provider) is calculated. Note that n ₀ and n ₁ are part of the public key stored in the public key storage unit 43.

As described above, the payment amount information calculation unit 44a calculates encrypted payment amount information obtained by encrypting the fee information for each provider while being encrypted from the encrypted provider-specific fee information.
The encrypted payment amount information calculated by the payment amount information calculation unit 44a is output to the payment amount information transmission unit 44b.

The payment amount information transmission unit 44b transmits the encrypted payment amount information calculated by the payment amount information calculation unit 44a to the viewing fee decryption apparatus 5 of the financial institution via the network N.
Further, here, it is desirable that the payment amount information transmitting unit 44b adds an electronic signature to the encrypted payment amount information using the signature key of the billing aggregation organization.

  The certifying means 45 proves the encrypted payment amount information aggregated by the payment amount aggregation means 44. Here, the certifying means 45 includes a proof value receiving means 45a, a proof value verifying means 45b, and a proof-added payment amount information transmitting means 45c.

  The proof value receiving unit 45 a receives the proof value for the encrypted payment amount information from the viewing fee decrypting device 5 via the network N. This proof value is a knowledge proof for the encrypted payment amount information aggregated by the payment amount aggregation means 44.

The proof value verification means 45b verifies the proof value (knowledge proof) based on the encrypted payment amount information aggregated by the payment amount aggregation means 44 and the proof value received by the proof value reception means 45a. is there. The proof value verification means 45b sends the proof value encrypted payment amount information obtained by adding the proof value verification result (“true” or “false”) to the proof value payment amount information transmission means 45c. Output.
Here, since the knowledge proof is used as the proof value, the proof value verifying unit 45b verifies the knowledge proof KP _{Pj, sum} received by the proof value receiving unit 45a. This knowledge proof verification method is performed based on whether or not the relationship shown in the equation (5) is satisfied.

The certified payment amount information transmitting unit 45c transmits the encrypted payment amount information with proof verified by the verification value verification unit 45b and added with the verification result to the content distribution apparatus 1 via the network N.
Thus, the viewing fee totaling device 4 can verify the validity of the payment amount information with the viewing fee decrypting device 5 described later.

  By configuring the viewing fee totaling device 4 in this way, the viewing fee totaling device 4 can generate a payment amount for each provider from the encrypted provider-specific fee information while being encrypted. In this viewing fee totaling apparatus 4, since the payment amount information is generated in an encrypted state, the user's viewing history can be kept secret.

  Although the configuration of the viewing fee totaling device 4 has been described above, the viewing fee totaling device 4 can be operated by a viewing fee totaling program that causes a general computer to function as each means described above.

(Configuration of viewing fee decoding device)
Next, the configuration of the viewing fee decoding apparatus will be described with reference to FIG. 5 (refer to FIG. 1 as appropriate). FIG. 5 is a block diagram showing the configuration of the viewing fee decoding apparatus. Here, the viewing fee decryption apparatus 5 includes a homomorphic key generation unit 50, a key storage unit 51, a public key transmission unit 52, a charge control unit 53, a payment control unit 54, and an amount verification unit 55. ing.

The homomorphic key generation means 50 generates a public key and a secret key that are key pairs in the homomorphic public key cryptosystem.
Here, the homomorphic key generation means 50 selects prime numbers p ₀ , q ₀ , p ₁ , q ₁ using a security parameter s that is a numerical value (for example, key length) indicating the level of security. However, when n ₀ = p ₀ q ₀ and n ₁ = p ₁ q ₁ , | n ₀ | = s and | n ₁ | = s.
Next, the homomorphic key generation means 50 generates e ₀ ∈Z _n0 and e _{1 such} that gcd (e ₀ , λ (n ₀ ² )) = 1 and gcd (e ₁ , λ (n ₁ ² )) = _1. ΕZ _n1 is selected. Here, gcd (•) indicates a function for calculating the greatest common divisor, and λ (•) indicates a Carmichael lambda function.

Then, the homomorphic key generation means 50 uses PK = (pk ₀ = (n ₀ , e ₀ ), pk ₁ = (n ₁ , e ₁ )) as a public key, and e ₀ d ₀ = 1 mod n ₀ , Let d ₀ ∈Z _n0 and d ₁ ∈Z _n1 satisfying e ₁ d ₁ = 1 mod n ₁ be a secret key SK = (d ₀ , d ₁ ).
The public key PK = (pk ₀ = (n ₀ , e ₀ ), pk ₁ = (n ₁ , e ₁ )) generated by the homomorphic key generation unit 50 is output to the public key transmission unit 52. The public key PK and the secret key SK are stored in the key storage unit 51.

  The key storage unit 51 stores the keys (public key PK and secret key SK) generated by the homomorphic key generation unit 50, and is a general storage device such as a memory or a hard disk. The key stored in the key storage unit 51 is read out by the charging control unit 53 and the payment control unit 54 in order to decrypt the information encrypted by the public key generated by the homomorphic key generation unit 50.

  The public key transmission unit 52 uses the public key generated by the homomorphic key generation unit 50 as an encryption key for encrypting the billing information via the network N, the content distribution device 1, the content viewing device 2, and This is transmitted to the viewing fee totaling device 4.

  The charging control means 53 performs charging processing for the content user based on the encrypted charging information generated by the content viewing apparatus 2. Here, charging control means 53 includes charging information receiving means 53a, charging information decoding means 53b, and charging information notification means 53c.

The billing information receiving means 53a receives the encrypted billing information generated by the content viewing apparatus 2 via the network N. The billing information receiving unit 53a verifies the user-side electronic signature added to the encrypted billing information by the content viewing apparatus 2 using a verification key that is paired with the signature key.
Then, the billing information receiving unit 53a outputs the encrypted billing information to the billing information decrypting unit 53b only when the signature verification result is correct.
Note that the verification key used for this signature verification is acquired in advance from the content viewing apparatus 2 and stored in verification key storage means (not shown).

The billing information decrypting unit 53b decrypts the encrypted billing information received by the billing information receiving unit 53a. This encrypted billing information is encrypted with the public key generated by the homomorphic key generation means 50 in the content viewing apparatus 2. Therefore, the billing information decryption unit 53b decrypts the encrypted billing information using the public key and the secret key stored in the key storage unit 51.
Here, the billing information decrypting means 53b decrypts the encrypted billing information C _{sum, Ui} as shown in the following equation (12), billing information (billing total amount) P ′ _{sum, Ui} , and user decryption parameters r ′ _{sum, Ui} is generated. The user decryption parameter is information for decrypting the encrypted billing information in the content viewing apparatus 2 (see the above formula (8)).

  This user decryption parameter and billing information are output to billing information notification means 53c. Further, the billing information is output to the amount verification means 55.

  The billing information notifying unit 53c transmits billing information indicating the billing amount for the user (amount for the total fee) decrypted by the billing information decrypting unit 53b to the content viewing apparatus 2 via the network N. . Here, it is assumed that the billing information notifying unit 53c transmits the billing information with the user decoding parameter added. Further, the billing information notifying unit 53c adds an electronic signature to the billing information using the signature key of the billing aggregation organization. This billing information may be notified to the user by means of mail or the like without going through the network N. Further, the billing information notifying unit 53c notifies the billing information to a business computer (not shown) that deducts the billing amount from the user's bank account or the like, thereby causing the billing business to be executed.

  The payment control means 54 performs a payment process for the content provider based on the encrypted payment amount information aggregated by the viewing fee aggregation device 4 of the accounting aggregation organization. Here, the payment control unit 54 includes a payment amount information reception unit 54a, a payment amount information decryption unit 54b, a payment amount information notification unit 54c, a proof value generation unit 54d, and a proof value transmission unit 54e. .

The payment amount information receiving unit 54 a receives encrypted payment amount information for each provider, which is aggregated by the viewing fee aggregation device 4, via the network N. The payment amount information receiving unit 54a verifies the electronic signature added to the encrypted payment amount information by the viewing fee totaling apparatus 4 using a verification key that is paired with the signature key.
Then, the payment amount information receiving unit 54a outputs the encrypted payment amount information to the payment amount information decrypting unit 54b only when the result of the signature verification is correct.

The payment amount information decrypting unit 54b decrypts the encrypted payment amount information received by the payment amount information receiving unit 54a. This encrypted payment amount information is generated by multiplying the provider-specific fee information encrypted by the public key generated by the homomorphic key generation means 50. Therefore, the payment amount information decrypting unit 54 b decrypts the encrypted payment amount information using the public key and the secret key stored in the key storage unit 51.
Here, the payment amount information decrypting means 54b decrypts the duplicated encrypted payment amount information _{CPj, sum, 0} , _{CPj, sum, 1} as shown in the following equation (13), and the amount information for payment. (Payment total amount) P ′ _{Pj, sum, 0} , P ′ _{Pj, sum, 1} and provider decryption parameters r ′ _{Pj, sum, 0} , r ′ _{Pj, sum, 1} are generated. The provider decryption parameter (charge verification parameter) is information for verifying the encrypted payment amount information in the content distribution apparatus 1 (see the above formula (6)). The payment amount information and the provider decryption parameter are output to the payment amount information notification unit 54c. Further, the payment amount information is output to the proof value generation unit 54 d and the amount verification unit 55.

  The payment amount information notifying unit 54c transmits payment amount information indicating the payment amount to the provider decrypted by the payment amount information decrypting unit 54b to the content distribution apparatus 1 via the network N. Here, the payment amount information notifying unit 54c transmits the payment amount information with the provider decryption parameter added thereto. Furthermore, the payment amount information notifying unit 54c adds an electronic signature to the payment amount information using the signature key of the financial institution. This payment amount information may be notified to the provider by means of mail or the like without using the network N. Further, the payment amount information notifying means 54c performs actual payment processing by notifying the payment amount information to a business computer (not shown) that pays the payment amount to the provider's bank account or the like.

The proof value generation unit 54d generates a proof value indicating whether or not the payment amount information is a valid value. The proof value generated by the proof value generation means 54d is output to the proof value transmission means 54e.
Here, the above-described knowledge proof for Twin Encryption is used as the proof value. That is, the proof value generation unit 54d receives the duplexed encrypted payment amount information _{CPj, sum} = ( _{CPj, sum, 0} , _{CPj, sum, 1} ) received by the payment amount information reception unit 54a, and the payment amount information. A knowledge proof KP _{Pj, sum} is generated based on the payment amount information decrypted by the decryption means 54b. The generation of the knowledge proof is calculated by the above equation (4).

  The proof value transmitting unit 54e transmits the proof value (knowledge proof) generated by the proof value generating unit 54d to the viewing fee counting apparatus 4 via the network N.

The amount verification unit 55 compares the amount of charge for the user (billing information) decrypted by the billing information decryption unit 53b with the amount of payment for the provider decrypted by the payment amount information decryption unit 54b (payment amount information), This is to verify whether the amount is the same.
Here, the payment amount information is duplicated. Therefore, the money amount verification means 55 compares the payment amount information P ′ _{Pj, sum, 0} and P ′ _{Pj, sum, 1} to verify the validity.
Further, the money amount verification means 55 obtains and compares the sum of the billing information and the payment amount information. That is, as shown in the following equation (14), the amount verification means 55 determines the total payment amount P ′ _{P, sum} of the provider (j = 1,..., Np) and the user (i = 1,..., Nu). _Is verified by calculating and comparing the total charge amount P ′ _{sum, U.}

  The money amount verification means 55 displays the verification result on a display device (not shown). As a result, the billing amount and the payment amount can be verified in the financial institution, and accurate billing distribution can be realized.

By configuring the viewing fee decryption device 5 in this way, the viewing fee decryption device 5 can decrypt the payment amount for each provider and the charge amount for each user. In the viewing fee decoding apparatus 5, since the billing amount is the total fee of the viewed content, it is not possible to determine which content the user has viewed. Thereby, a user's viewing history can be kept secret.
Although the configuration of the viewing fee decoding apparatus 5 has been described above, the viewing fee decoding apparatus 5 can be operated by a viewing fee decoding program that causes a general computer to function as each unit described above.

[First Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the first embodiment of the present invention will be described. Here, after explaining the outline of the overall operation of the anonymous charging system S, the initialization operation, the content viewing / viewing history collection operation, and the charging / payment operation will be specifically described. .

(Overview of operation)
First, an overview of the overall operation of the anonymous billing system S will be described with reference to FIG. 8 (refer to FIG. 1 as appropriate). FIG. 8 is a sequence diagram showing the overall operation of the anonymous billing system according to the first embodiment.
First, the anonymous billing system S generates a key (public key, secret key) in the homomorphic public key cryptosystem in the viewing fee decryption apparatus 5 on the financial institution side, and issues (publicizes) the public key as an encryption key. (Step S1).

Then, the content viewing device 2 transmits the encrypted provider-specific fee information (encrypted provider-specific fee information) to the viewing fee aggregation device 4 of the billing aggregation organization as the user views the content. The converted charging information (encrypted charging information) is transmitted to the viewing fee decrypting apparatus 5 of the financial institution (step S2).
Thereafter, the anonymous billing system S encrypts the total amount of the payment amount to the provider from the encrypted provider-specific fee information transmitted from the content viewing device 2 of all users in the viewing fee totaling device 4 while encrypting it. It is calculated as the information on the amount of payment and is sent to the viewing fee decrypting device 5 of the financial institution (step S3).

Then, the anonymous billing system S decrypts the billing and payment amount in the viewing fee decrypting device 5 (step S4). Then, the billing and payment amount are collated to verify whether or not the two amounts are the same, and an evaluation value indicating the validity of the payment amount is transmitted to the viewing fee totaling apparatus 4 (step S5).
Then, the anonymous billing system S verifies the proof value in the viewing fee totaling device 4 and transmits encrypted payment amount information (certified encrypted payment amount information) to which the proof value is added to the content distribution device 1. (Step S6).

Thereafter, the anonymous charging system S transmits the charging information to the content viewing device 2 and transmits the payment amount information to the content distribution device 1.
Then, the anonymous billing system S verifies the billing amount in the content viewing device 2 (step S7), and verifies the payment amount in the content distribution device 1 (step S8).
Hereinafter, the operation of the anonymous billing system S will be described in detail.

(Initialization operation)
First, the initialization operation of the anonymous charging system S will be described with reference to FIG. FIG. 9 is a flowchart showing the initialization operation of the anonymous billing system. This initialization operation corresponds to step S1 in FIG.

[User action]
First, the content viewing apparatus 2 generates a viewing history encryption key (encryption key) for encrypting the viewing history by the viewing history encryption key generation unit 24 (step S10), and the listening history encryption key Is stored in the viewing history encryption key storage means 25 (step S11).

[Operations of financial institutions]
On the other hand, the viewing fee decrypting apparatus 5 uses the homomorphic key generating means 50 to generate a key pair (public key and secret key) in the homomorphic public key cryptosystem for encrypting the billing information (step S12). The viewing fee decryption apparatus 5 stores the key pair in the key storage unit 51 (step S13), and the public key transmission unit 52 uses the public key as an encryption key for encrypting the billing information. Are transmitted to the content distribution device 1, the content viewing device 2, and the viewing fee totaling device 4 (step S14).

[Operation on the provider side]
Thereafter, the content distribution apparatus 1 receives the public key transmitted in step S14 by the public key receiving unit 14d (step S15) and stores it in the public key storage unit 14e (step S16).

[User action]
Further, the content viewing apparatus 2 receives the public key transmitted in step S14 by the public key receiving unit 22 (step S17) and stores it in the public key storage unit 23 (step S18).
[Billing Aggregation Operation]
Further, the viewing fee totaling apparatus 4 receives the public key transmitted in step S14 by the public key receiving means 42 (step S19), and stores it in the public key storage means 43 (step S20).
With the above operation, the content viewing apparatus 2 is ready to encrypt the viewing fee when the user views the content.

(Content viewing / viewing history collection operation)
Next, referring to FIG. 10 (refer to FIGS. 1 to 3 as appropriate for the configuration), content viewing and viewing history collection operations in the anonymous billing system S will be described. FIG. 10 is a flowchart showing content viewing and viewing history collection operations in the anonymous billing system. This operation corresponds to step S2 in FIG.

[Operation on the provider side]
First, in the content distribution apparatus 1 on the provider side, the content for broadcasting is stored in the content storage unit 10 before the broadcast by the content encryption unit 11 (step S30), and stored in the encrypted content storage unit 12. (Step S31).
Then, the content distribution apparatus 1 reads out the encrypted content stored in the encrypted content storage unit 12 by the broadcast transmission unit 13 based on a predetermined program organization and transmits it via the broadcast wave W (step). S32).

[User action]
On the other hand, in the content viewing apparatus 2, the content decoding means 21 allows the user to make a viewing reservation for the content using an electronic program guide or the like. Confirmation is performed (step S33). When the user agrees to charge, the subsequent operations are executed.
That is, the content viewing apparatus 2 receives content (encrypted content) by the broadcast receiving means 20 (step S34). Then, the content viewing device 2 decrypts the encrypted content by the content decrypting means 21 (step S35) and outputs it to the display device D (step S36). At this stage, the user can view the content via the display device D.

Also, the content viewing device 2 outputs viewing information such as the fee and channel of the viewed content from the content decrypting means 21 to the security module 3 at the time of decryption in step S35. Then, the content viewing apparatus 2 uses the security module 3 to perform viewing history update processing.
That is, the security module 3 determines whether there is a viewing history (encrypted viewing history) that has not yet been charged in the encrypted viewing history storage unit 26 (step S37).

Here, when the encrypted viewing history exists (Yes in step S37), the security module 3 encrypts the viewing history decrypting unit 3d using the encryption key stored in the viewing history encryption key storage unit 25. The encrypted viewing history is decrypted (step S38).
Then, the security module 3 generates an updated viewing history by adding viewing information collected at the time of decryption in step S35 to the viewing history decrypted in step S38 by the viewing history encryption means 3c (step S35). S39), the process proceeds to step S41.

On the other hand, if the encrypted viewing history does not exist (No in step S37), the security module 3 uses the viewing history encryption unit 3c to generate viewing information collected at the time of decryption in step S35 as a new viewing history. (Step S40).
Thereafter, the security module 3 encrypts the viewing history using the encryption key stored in the viewing history encryption key storage unit 25 by the viewing history encryption unit 3c (step S41), and the encrypted viewing history storage unit 26 stores the encrypted viewing history (encrypted viewing history) (step S42).
With the above operation, when the user views the content in the content viewing device 2, the viewing history is sequentially stored in the content viewing device 2.

(Billing / Payment)
Next, charging and payment operations in the anonymous charging system S will be described with reference to FIG. FIG. 11 is a flowchart showing charging and payment operations in the anonymous charging system. This operation is performed in accordance with the timing of billing or payment (for example, once a month or the end of the month). This operation corresponds to the operation after step S2 in FIG.

[User action]
The content viewing apparatus 2 decrypts the encrypted viewing history using the encryption key stored in the viewing history encryption key storage unit 25 by the viewing history decrypting unit 3d of the security module 3 (step S50).
Then, the content viewing apparatus 2 extracts the fee information (provider-specific fee information) for each provider from the viewing history information decrypted in step S50 by the billing information extracting unit 3a of the security module 3, and the public key storage unit 23 The encryption provider-specific fee information is generated by encrypting using the public key stored in (step S51).
Further, the content viewing apparatus 2 generates encrypted billing information by encrypting the total fee for viewing using the public key stored in the public key storage unit 23 (step S52).

Then, the content viewing device 2 transmits the encrypted provider-specific fee information to the viewing fee aggregation device 4 of the accounting aggregation organization via the network N by the fee information transmission means 27 (step S53). At the time of transmission, an electronic signature is added to the fee information for each encrypted provider.
Further, the content viewing apparatus 2 transmits the encrypted charging information to the viewing fee decrypting apparatus 5 of the financial institution via the network N by the fee information transmitting means 27 (step S54). At the time of transmission, an electronic signature is added to the encrypted billing information.

[Billing Aggregation Operation]
Then, the viewing fee totaling apparatus 4 receives the fee information by encryption provider via the network N by the fee information receiving means 40 and stores it in the fee information storage means 41 (step S55).
In addition, the viewing fee totaling apparatus 4 multiplies the fee information by encryption provider stored in the fee information storage unit 41 by the payment amount information calculation unit 44a of the payment amount totaling unit 44, so that the fee information for each provider is obtained. Then, the encrypted payment amount information is calculated (step S56).
Then, the viewing fee totaling device 4 transmits the encrypted payment amount information calculated in step S56 to the viewing fee decrypting device 5 of the financial institution by the payment amount information transmitting unit 44b (step S57). At the time of transmission, an electronic signature is added to the encrypted payment amount information.

[Operations of financial institutions]
Also, the viewing fee decrypting device 5 receives the encrypted billing information obtained by encrypting the total billing fee for each user transmitted from the content viewing device 2 in step S54 by the billing information receiving unit 53a of the billing control unit 53. (Step S58). In step S58, the user-side electronic signature added to the encrypted billing information is also verified.
Then, only when this verification result is correct, the viewing fee decryption apparatus 5 decrypts the encrypted billing information using the secret key stored in the key storage unit 51 by the billing information decrypting unit 53b (step S59). ). As a result, the total fee for the content viewed by the user is decrypted as billing information.

Further, the viewing fee decrypting device 5 receives the encrypted payment amount information for each provider transmitted from the viewing fee totaling device 4 in step S57 by the payment amount information receiving unit 54a of the payment control unit 54 (step S60). . In step S60, the electronic signature on the billing and accounting institution side added to the encrypted payment amount information is also verified.
Then, only when this verification result is correct, the viewing fee decryption apparatus 5 uses the payment amount information decryption unit 54b to decrypt the encrypted payment amount information using the secret key stored in the key storage unit 51 ( Step S61). As a result, the payment amount for the provider is decrypted as payment amount information.

  Then, the viewing fee decryption apparatus 5 verifies the amount of money by comparing the billing information decrypted in step S59 with the payment amount information decrypted in step S61 by the amount verification means 55 (step S62). . This verification result is displayed on a display device (not shown).

Then, the viewing fee decryption apparatus 5 generates a proof value indicating whether or not the payment amount information is a valid value by the proof value generation unit 54d (step S63), and the proof value by the proof value transmission unit 54e. Is transmitted to the viewing fee counting apparatus 4 via the network N (step S64).
Thereafter, the viewing fee decrypting apparatus 5 causes the billing information notifying means 53c to perform billing work by notifying the billing information to a business computer (not shown) that deducts the billed amount from the user's bank account or the like ( Step S65).

In addition, the viewing fee decrypting device 5 adds an electronic signature to the billing information by the billing information notifying unit 53c and transmits it to the content viewing device 2 via the network N, so that the user views the user. The total charge for the content is notified (step S66).
In addition, the viewing fee decrypting apparatus 5 executes the payment operation by notifying the payment amount information to a business computer (not shown) that pays the payment amount to the provider's bank account or the like by the payment amount information notifying means 54c. (Step S67).
Also, the viewing fee decrypting device 5 adds the electronic signature to the payment amount information by the payment amount information notifying means 54c and transmits it to the content distribution device 1 via the network N, thereby paying the provider. The amount is notified (step S68).

[Billing Aggregation Operation]
Also, the viewing fee totaling apparatus 4 receives the proof value via the network N by the proof value receiving means 45a of the proof means 45 (step S69).
Then, the viewing fee totaling apparatus 4 verifies the proof value by the proof value verification means 45b based on the encrypted payment amount information calculated in step S56 and the proof value received by the proof value reception means 45a (step). S70). Then, the certified payment amount information transmitting unit 45c transmits the certified payment amount information to which the verification result has been added to the content distribution apparatus 1 via the network N (step S71).

[Operation on the provider side]
Then, the content distribution apparatus 1 receives the encrypted payment amount information with proof transmitted in step S71 by the encrypted payment amount information receiving unit 14a (step S72). Further, the content distribution apparatus 1 receives the payment amount information transmitted in step S68 by the payment amount information receiving means 14b (step S73).
Then, the content distribution apparatus 1 verifies the payment amount by comparing the certified encrypted payment amount information received in step S72 with the payment amount information received in step S73 by the payment amount verification unit 14c (step S72). S74). Accordingly, the provider can confirm whether or not the amount actually paid to the provider is correct.

[User action]
On the other hand, the content viewing apparatus 2 receives the charging information transmitted from the viewing fee decoding apparatus 5 in step S66 by the charging information receiving means 28 (step S75).
Then, the content viewing apparatus 2 verifies the electronic signature added to the billing information, and generates the billing amount indicated by the billing information and the security module 3 by the billing amount verification means 29 only when the verification result is correct. The charged amount of money charged is verified by comparing the charged amount of money (step S76). If the verification result is correct, the content viewing apparatus 2 deletes the target viewing history (encrypted viewing history) from the encrypted viewing history storage unit 26 by the charge amount verification unit 29 (step S77).

  With the above operation, the anonymous charging system S can perform the charging process for the user and the payment process for the provider while keeping the viewing history of the user secret. Further, since the anonymous billing system S can verify the amount actually charged and the amount paid, it is possible to check data tampering, calculation errors, and the like.

[Second Embodiment: Configuration of Anonymous Charging System]
Next, the configuration of the anonymous billing system according to the second embodiment of the present invention will be described with reference to FIG. Anonymous charging system S _B according to the second embodiment, like the anonymous charging system S described in the first embodiment, the charging user corresponding to the content (broadcast program) who watched, and a payment for the provider In this system, the user's viewing history is kept secret. Here, anonymous charging system S _B includes a content delivery apparatus 1B, a content viewing apparatus 2B (security module 3B), the viewing fee collection apparatus 4B, a viewing fee decoder 5B, are connected via a network N ing. A plurality of devices (1B to 5B) may exist.
Here, the difference between anonymous billing system S and anonymous charging system S _B is the flow of data of the accounting information and payment amount information is different.

In the anonymous billing system S, the content viewing apparatus 2 previously separates billing information for the user and payment amount information for each provider. In contrast, in the anonymous charging system S _B, in viewing fee collection apparatus 4B, the encrypted accounting information received from the content viewing apparatus 2B, and a separation of the payment amount information encrypted.
Hereinafter, the description will focus on differences from the anonymous charging system S _B and anonymous billing system S.

(Configuration of content distribution device)
FIG. 13 is a block diagram illustrating a configuration of a content distribution apparatus according to the second embodiment. In the content distribution device 1 shown in FIG. 2, the encrypted payment amount information with proof is received from the viewing fee totaling device 4, but in the content distribution device 1B shown in FIG. 13, the proof value is received from the viewing fee totaling device 4B. The only difference is that it receives encrypted payment amount information without the. Thus, since the content distribution apparatus 1B has the same configuration as the content distribution apparatus 1, the same reference numerals are given and description thereof is omitted.

(Configuration of content viewing device)
Next, the configuration of the content viewing apparatus will be described with reference to FIG. 14 (refer to FIG. 12 as appropriate). FIG. 14 is a block diagram illustrating a configuration of a content viewing apparatus including a security module (viewing fee encryption apparatus) according to the second embodiment. Since the configuration other than the charge information transmitting unit 27B is the same as that of the content viewing apparatus 2 described with reference to FIG.

  The fee information transmission means 27B uses the encrypted provider-specific fee information (encrypted provider-specific fee information) and billing information (encrypted billing information) generated by the security module 3 as encrypted fee information. N is transmitted to the viewing fee counting device 4B. Here, the fee information transmitting unit 27B adds an electronic signature to the encrypted fee information. The electronic signature may be individually added to the encryption provider-specific fee information and the encryption billing information.

(Configuration of viewing fee counting device)
Next, referring to FIG. 15 (refer to FIG. 12 as appropriate), the configuration of the viewing fee counting apparatus will be described. FIG. 15 is a block diagram illustrating a configuration of a viewing fee totaling apparatus according to the second embodiment. The viewing fee totaling device 4B omits the certifying means 45 from the viewing fee totaling device 4 described in FIG. 4, adds a billing amount totaling unit 46, and changes the functions of the fee information receiving unit 40B and the payment amount totaling unit 44. Configured. Since the configuration other than the fee information receiving unit 40B, the payment amount totaling unit 44B, and the billing amount totaling unit 46 is the same as that of the viewing fee totaling device 4 described with reference to FIG. To do.

  The fee information receiving means 40B receives encrypted billing information as fee information from the content viewing apparatus 2 via the network N. The encrypted billing information received by the fee information receiving means 40B is stored in the fee information storage means 41B.

  The payment amount totaling means 44B totals the payment amount for each provider with encryption. Here, the payment amount totaling unit 44B includes a payment amount information calculation unit 44a and a payment amount information transmission unit 44Bb. The payment amount information calculating unit 44a is the same as the viewing fee totaling apparatus 4 described with reference to FIG.

  The payment amount information transmission unit 44Bb sends the encrypted payment amount information calculated by the payment amount information calculation unit 44a to the content distribution device 1B on the provider side and the viewing fee decryption device 5 of the financial institution via the network N. To be sent.

  The billing amount totaling means 46 sums up the billing amount for each user with encryption. Here, the billing amount totaling unit 46 includes a billing amount information extracting unit 46a and a billing amount information transmitting unit 46b.

The billing amount information extraction unit 46 a extracts information for each user from the encrypted billing information stored in the fee information storage unit 41. That is, the billing amount information extraction unit 46a generates encrypted billing amount information obtained by encrypting the total billing fee for each user by extracting information corresponding to the billing user from the encrypted billing information.
The encrypted billing amount information extracted by the billing amount information extracting unit 46a is output to the billing amount information transmitting unit 46b.

The billing amount information transmitting unit 46b transmits the encrypted billing amount information extracted by the billing amount information extracting unit 46a to the viewing fee decrypting apparatus 5B of the financial institution via the network N. Here, the billing amount information transmitting unit 46b adds an electronic signature to the encrypted billing amount information using the signature key of the billing aggregation organization.
In this way, by configuring the viewing fee aggregation device 4B, the viewing fee aggregation device 4B can aggregate the billing amount for each user and the payment amount for each provider with encryption.

(Configuration of viewing fee decoding device)
FIG. 16 is a block diagram illustrating a configuration of a viewing fee decoding apparatus according to the second embodiment. The viewing fee decryption device 5B shown in FIG. 16 is configured by omitting the proof value generation unit 54d and the proof value transmission unit 54e from the viewing fee decryption device 5 described in FIG. Other configurations are the same as those of the viewing fee decoding apparatus 5 described with reference to FIG.

[Second Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the second embodiment of the present invention will be described.
(Overview of operation)
First, with reference to FIG. 17 (appropriately with reference to Figure 12), explaining the outline of the overall operation of the anonymous charging system S _B. FIG. 17 is a sequence diagram showing the overall operation of the anonymous billing system according to the second embodiment.

First, an anonymous charging system S _B is issued, the viewing fee decoder 5B of the financial institution side, key (public key, private key) in the homomorphic public key encryption method to generate the public key as the encryption key (public) (Step S100).
Then, the content viewing device 2B transmits the encrypted fee information (encrypted fee information) to the viewing fee totaling device 4B of the billing totaling organization as the user views the content (step S101).

Thereafter, the anonymous charging system S _B, in viewing fee collection apparatus 4B, the encrypted charge information transmitted from the content viewing apparatus 2, by extracting the information corresponding to the user to be billed, the billing for each user The encrypted charge amount information obtained by encrypting the total fee is generated and transmitted to the viewing fee decrypting device 5B of the financial institution (step S102). Further, the viewing fee totaling apparatus 4B calculates the total amount of the payment amount to the provider from the encrypted fee information as encrypted payment amount information while being encrypted, and transmits it to the viewing fee decryption apparatus 5 (step S103). .

The anonymous charging system _{S B,} in viewing fee decoder 5B, decodes the billing and payment amount (step S104).
The content anonymous charging system S _B, in viewing fee decoding apparatus 5B, and collates the decrypted billing and payment amount, to verify whether the two amounts are identical, the billing information indicating a charge amount The payment amount information indicating the payment amount is transmitted to the viewing device 2B and transmitted to the content distribution device 1B (step S105).
The anonymous charging system _{S B} is the content viewing apparatus 2B, verifies the billing amount (step S106), the content delivery apparatus 1B, to verify the payment amount (step S107).

Next, detailed description will be given of the operation of the anonymous charging system S _B. Note that the initialization operation and the content viewing / viewing history collection operation are the same as the anonymous billing system S described with reference to FIGS. 9 and 10 and thus will not be described, and only the billing and payment operations will be described.

(Billing / Payment)
(The configuration, appropriately diagram 12-16 see) Referring to FIG. 18 to be described billing and payment operations in the anonymous charging system _{S B.} FIG. 18 is a flowchart showing charging and payment operations in the anonymous charging system. This operation is performed in accordance with the timing of billing or payment (for example, once a month or the end of the month). This operation corresponds to the operation after step S101 in FIG.

[User action]
The content viewing apparatus 2B decrypts the encrypted viewing history using the encryption key stored in the viewing history encryption key storage unit 25 by the viewing history decrypting unit 3d of the security module 3 (step S110).
Then, the content viewing apparatus 2B generates encrypted billing information by encrypting the total fee for viewing using the public key stored in the public key storage unit 23 (step S111).
Thereafter, the content viewing apparatus 2B transmits the encrypted billing information (encrypted billing information) by the charge information transmitting means 27B to the viewing charge totaling apparatus 4B of the billing totaling organization via the network N (step S112). ). At the time of transmission, an electronic signature is added to the encrypted billing information.

[Billing Aggregation Operation]
Then, the viewing fee totaling apparatus 4B receives the encrypted charging information via the network N by the fee information receiving unit 40B (step S113) and stores it in the fee information storage unit 41 (step S114).
Also, the viewing fee totaling apparatus 4B extracts the information for each user from the encrypted billing information stored in the fee information storage unit 41 by the billing amount information extracting unit 46a of the billing amount totaling unit 46, so that the user Encrypted charge amount information in which the total charge for each charge is encrypted is generated (step S115). Then, the viewing fee totaling apparatus 4B adds an electronic signature to the encrypted billing amount information generated in step S115 by the billing amount information transmitting unit 46b, and transmits it to the viewing fee decryption device 5B on the financial institution side (step S116). .

Further, the viewing fee totaling apparatus 4B uses the payment amount information calculating unit 44a of the payment amount totaling unit 44B to make a channel (provider) to be paid included in the encrypted billing information stored in the fee information storage unit 41. Each time, the encrypted fee information for each provider is calculated by multiplying the encrypted fee information for each provider (step S117).
Then, the viewing fee totaling apparatus 4B adds an electronic signature to the encrypted payment amount information calculated in step S117 by the payment amount information transmitting unit 44Bb, and the viewing fee decrypting device 5B on the financial institution side and the content on the provider side It transmits to the distribution apparatus 1B (step S118).
Note that the operations from Steps S115 to S116 and the operations from Steps S117 to S118 may be performed by changing their order, or may be performed in parallel.

[Operations of financial institutions]
The viewing fee decrypting device 5B receives the encrypted billing information obtained by encrypting the total fee charged for each user, transmitted from the viewing fee totaling device 4B in step S116, by the billing information receiving unit 53a of the billing control unit 53. (Step S119). At this time, the billing information receiving means 53a verifies the electronic signature on the billing tabulation institution added to the encrypted billing information and verifies the electronic signature on the user side.

Then, the viewing fee decrypting apparatus 5B decrypts the encrypted billing information using the secret key stored in the key storage unit 51 by the billing information decrypting unit 53b only when the verification result of the electronic signature is correct ( Step S120). As a result, the total fee for the content viewed by the user is decrypted as billing information.
In addition, the viewing fee decrypting device 5B receives the encrypted payment amount information for each provider transmitted from the viewing fee totaling device 4B in step S118 by the payment amount information receiving unit 54a of the payment control unit 54B (step S121). . At this time, the payment amount information receiving means 54a verifies the electronic signature of the accounting / aggregation institution added to the encrypted payment amount information.

Then, the viewing fee decrypting device 5B decrypts the encrypted payment amount information by using the private key stored in the key storage unit 51 by the payment amount information decrypting unit 54b only when the verification result of the electronic signature is correct. (Step S122). As a result, the payment amount for the provider is decrypted as payment amount information.
Then, the viewing fee decryption apparatus 5B verifies the amount of money by comparing the billing information decrypted in step S120 with the payment amount information decrypted in step S122 by the amount verification means 55 (step S123). . This verification result is displayed on a display device (not shown).
Thereafter, the viewing fee decrypting apparatus 5B causes the billing information notifying means 53c to perform billing work by notifying billing information to a business computer (not shown) that deducts the billing amount from the user's bank account or the like ( Step S124).

In addition, the viewing fee decrypting device 5B adds an electronic signature to the billing information by the billing information notifying unit 53c and transmits it to the content viewing device 2B via the network N, so that the user views the user. The total fee for the content is notified (step S125).
In addition, the viewing fee decryption apparatus 5B executes the payment operation by notifying the payment amount information to a business computer (not shown) that pays the payment amount to the provider's bank account or the like by the payment amount information notifying means 54c. (Step S126).
Also, the viewing fee decrypting device 5B adds the electronic signature to the payment amount information by the payment amount information notifying means 54c and transmits it to the content distribution device 1B via the network N, thereby paying the provider. The amount is notified (step S127).

[Operation on the provider side]
Then, the content distribution device 1B receives the encrypted payment amount information transmitted in step S118 by the encrypted payment amount information receiving unit 14a (step S128). In addition, the content distribution apparatus 1B receives the payment amount information transmitted in step S127 by the payment amount information receiving unit 14b (step S129).
Then, the content distribution apparatus 1B compares the encrypted payment amount information received in step S128 with the payment amount information received in step S129 by the payment amount verification unit 14c, and verifies the payment amount (step S130). . Accordingly, the provider can confirm whether or not the amount actually paid to the provider is correct.

[User action]
On the other hand, the content viewing device 2B receives the billing information transmitted from the viewing fee decryption device 5B in step S125 by the billing information receiving means 28 (step S131).
Then, the content viewing apparatus 2B verifies the electronic signature added to the billing information, and generates the billing amount indicated by the billing information and the security module 3 by the billing amount verification means 29 only when the verification result is correct. The charged amount of money charged is verified by comparing the charged amount of money (step S132). When the verification result is correct, the content viewing apparatus 2B deletes the target viewing history (encrypted viewing history) from the encrypted viewing history storage unit 26 by the charge amount verification unit 29 (step S133).

By the above operation, the anonymous charging system S _B includes a charging process for the user, the payment process for the provider, can be carried out while concealing the viewing history of the user. Further, the anonymous charging system S _B is actually charging amount that was, it is possible to verify the amount paid, it is possible to check the data tampering, errors, etc. calculations.

[Third Embodiment: Configuration of Anonymous Charging System]
Next, the configuration of the anonymous billing system according to the third embodiment of the present invention will be described with reference to FIG. Anonymous billing system S _C according to the third embodiment, like the anonymous charging system S described in the first embodiment, the charging user corresponding to the content (broadcast program) who watched, and a payment for the provider In this system, the user's viewing history is kept secret. Here, anonymous billing system S _C is a content distribution apparatus 1C, the content viewing apparatus 2C (security module 3C), and viewing fee collection apparatus 4, and a viewing fee decoding apparatus 5C, are connected via a network N ing. There may be a plurality of each device. The viewing fee totaling device 4 is the same as the device described with reference to FIG.

Anonymous billing system S _C, at the time of encrypting the accounting information for the content viewed by the user, that is encrypted using a random number that can not know the generation method only the provider side, different from the anonymous billing system S Yes.
Hereinafter, the description will focus on differences from the anonymous billing system S _C and anonymous billing system S.

(Configuration of content distribution device)
First, the configuration of the content distribution apparatus will be described with reference to FIG. 20 (refer to FIG. 19 as appropriate). FIG. 20 is a block diagram illustrating a configuration of a content distribution apparatus according to the third embodiment. The content distribution apparatus 1C is configured by adding a random number generation means 15 and a random number transmission means 16 to the content distribution apparatus 1 described in FIG. The other configuration is the same as that of the content distribution apparatus 1 described with reference to FIG.

The random number generation means 15 generates different random numbers for each user. The random number for each user generated by the random number generation unit 15 is output to the random number transmission unit 16.
Here, the random number generation means 15 generates a random number for each user with reference to the public key (stored in the public key storage means 14e) disclosed by the viewing fee decryption apparatus 5C on the financial institution side. That is, the random number generation unit 15, satisfies integer in the following (15) _{((e 1,0, e 1,1)} , ..., (e m, 0, e m, 1), (e p _{, 0} , ep _{, 1} )), and a random number (( _r1,0 , _r1,1 ), ..., for each user (1, ..., m) as shown in the following equation (16): (R _{m, 0} , r _{m, 1} )) is generated. However, g ₀ and g ₁ are generators, and random numbers satisfying g ₀ εZ _n0 and g ₁ εZ _n1 , respectively, and n ₀ , n 1, e _0, and e ₁ are part of the public key. Here, the random number generation means 15 generates the random numbers r _{p, 0} and r _{p, 1} together in order to verify the validity of the provider.

The random number transmission means 16 transmits the random number generated by the random number generation means 15 to the content viewing apparatus 2C and the viewing fee decoding apparatus 5C via the network N.
The random number transmission means 16 sends random numbers ((r _1,0 , r _1,1 ),..., (R _{m, 0} , r _{m, 1} )) for each user (1,. ) To the content viewing apparatus 2C, and the provider verification random numbers (r _{p, 0} and r _{p, 1} ) are transmitted to the viewing fee decoding apparatus 5C.
In this way, by configuring the content distribution device 1C, it is possible to transmit random numbers whose generation method can be known only on the provider side to the content viewing device 2C and the viewing fee decoding device 5C.

(Configuration of content viewing device)
Next, the configuration of the content viewing apparatus will be described with reference to FIG. 21 (refer to FIG. 19 as appropriate). FIG. 21 is a block diagram illustrating a configuration of a content viewing apparatus including a security module (viewing fee encryption apparatus) according to the third embodiment. The content viewing apparatus 2C is configured by adding the random number receiving means 30 and the random number storage means 31 to the content viewing apparatus 2 described in FIG. 3 and changing the function of the encryption means 3b of the security module 3. ing. Since the configuration other than the random number receiving unit 30, the random number storage unit 31, and the encryption unit 3Cb is the same as the configuration of the content viewing apparatus 2 described with reference to FIG. 3, the same reference numerals are given and description thereof is omitted.

The random number receiving means 30 receives random numbers from the content distribution apparatus 1C via the network N. The random number received by the random number receiving unit 30 is stored in the random number storage unit 31.
The random number storage unit 31 stores the random number received by the random number reception unit 30 and is a general storage device such as a memory or a hard disk.

The encryption means 3Cb is based on the public key (encryption key) of the homomorphic public key cryptosystem publicly disclosed in the financial institution and the random number stored in the random number storage means 31, and the charging information extraction means 3a The billing information extracted in step 1 is encrypted. Here, the encryption unit 3Cb encrypts the total fee and the provider-specific fee that is the fee for each channel.
Specifically, the encryption unit 3Cb generates the encrypted billing information C _{sum, Ui} from the above equation (9), and the provider j (j = 1,..., Np) from the following equation (17): Charge information for each encryption provider C _{Pj, Ui} ({C _{Pj, Ui} } _{j = 1,..., Np} ) is generated.

Here, C ^(old) _{Pj, Ui, 0} and C ^(old) _{Pj, Ui, 1} are the encryption provider-specific fee information C _{Pj, Ui, 0} and C _{Pj, Ui,} generated by the above equation (10) _{. 1} is the same. In addition, the random numbers r _{Ui, 0} and r _{Ui, 1} are random numbers calculated by the equation (16) stored in the random number storage unit 31, respectively.
The encrypted billing information C _{sum, Ui} (formula (9)) and the encrypted provider-specific charge information _{CPj, Ui} (formula (17)) generated in this way are output to the charge information transmission means 27. Is done.
In this way, by configuring the content viewing apparatus 2C, the provider-specific fee information is encrypted using a random number whose generation method can only be known on the provider side.

(Configuration of viewing fee decoding device)
Next, the configuration of the viewing fee decoding apparatus will be described with reference to FIG. 22 (see FIG. 19 as appropriate). FIG. 22 is a block diagram illustrating a configuration of a viewing fee decoding apparatus according to the third embodiment. The viewing fee decryption apparatus 5C adds a random number receiving means 56 and a random number storage means 57 to the viewing fee decryption apparatus 5 described with reference to FIG. 5 and functions as the payment amount information decrypting means 54b of the payment control means 54. Changed and configured. The configuration other than the random number receiving unit 56, the random number storage unit 57, and the payment amount information decoding unit 54Cb is the same as that of the viewing fee decoding apparatus 5 described with reference to FIG. .

The random number receiving means 56 receives random numbers from the content distribution apparatus 1C via the network N. The random number received by the random number receiving unit 56 is stored in the random number storage unit 57.
The random number storage unit 57 stores the random number received by the random number reception unit 56 and is a general storage device such as a memory or a hard disk.

  The payment amount information decrypting unit 54Cb decrypts the encrypted payment amount information received by the payment amount information receiving unit 54a. The encrypted payment amount information is multiplied by the provider-specific fee information encrypted by the public key generated by the homomorphic key generation unit 50 and the random number generated by the random number generation unit 15 (see FIG. 20). Is generated. Therefore, the payment amount information decrypting unit 54 Cb decrypts the encrypted payment amount information using the public key and the private key stored in the key storage unit 51 and the random number stored in the random number storage unit 57.

Here, the payment amount information decrypting means 54Cb decrypts the duplicated encrypted payment amount information _{CPj, sum, 0} , _{CPj, sum, 1} as shown in the following equation (18), and the payment amount information (Payment total amount) P ′ _{Pj, sum, 0} , P ′ _{Pj, sum, 1} and provider decryption parameters r ′ _{Pj, sum, 0} , r ′ _{Pj, sum, 1} are generated. Note that C ^(old) _{Pj, sum, 0} and C ^(old) _{Pj, sum, 1} indicate encrypted payment amount information before decryption, respectively, and C ^(new) _{Pj, sum, 0,} and C ^(new) _{Pj, sum, and 1} indicate payment amount information after decryption, respectively. The provider decryption parameter (charge verification parameter) is information for verifying the encrypted payment amount information in the content distribution apparatus 1C (see the above formula (6)).

The payment amount information and the provider decryption parameter are output to the payment amount information notification unit 54c. Further, the payment amount information is output to the proof value generation unit 54 d and the amount verification unit 55.
In this way, by configuring the viewing fee decrypting device 5C, the payment amount information is decrypted with a random number whose generation method can only be known on the provider side. Accordingly, the financial institution can verify the validity of the provider by checking the amount in the amount verification means 55.

[Third Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the third embodiment of the present invention will be described. Here, only the difference from the operation of the anonymous billing system according to the first embodiment will be described.

(Overview of operation)
First, with reference (see appropriately 19) to FIG. 23, the overall operation of the anonymous charging system S _C, the difference between the overall operation of the anonymous charging system S will be described.
Anonymous billing system S _C is the content distribution apparatus 1C of the provider side, operation of generating a different random number for each user (step S 1 b) is different from the anonymous billing system S. The random number generated in step S1b is transmitted (issued) to the content viewing device 2C and the viewing fee decryption device 5C.

Thereafter, in the content viewing apparatus 2C, along with the user viewing the content (step S2b), the fee information for each encrypted provider and the encrypted billing information are generated by the random numbers issued in step S1b.
In the viewing fee decrypting device 5C, when the viewing fee totaling device 4 decrypts the encrypted payment amount information calculated from the fee information for each encrypted provider (step S4b), the random number issued in step S1b is used. The

Then, initialization and operation and billing and payment operation anonymous charging system S _C, the difference between the operations of the anonymous charging system S will be described. The content viewing / viewing history collection operation is the same as the anonymous billing system S described with reference to FIG.

(Initialization operation)
First, (for configuration, appropriately diagram 20-22 see) Referring to FIG. 24, the initialization operation and anonymous charging system S _C, the difference between the initialization operation anonymous charging system S will be described. This operation is equivalent to step S1 and step S1b in FIG.

[Operation on the provider side]
After step S16, the content distribution device 1C generates a different random number for each user by the random number generation means 15 (step SC10). Then, the content distribution device 1C transmits the random number generated in step SC10 to the content viewing device 2C and the viewing fee decryption device 5C by the random number transmission means 16 (step SC11).

[User action]
Then, the content viewing apparatus 2C receives the random number transmitted in step SC11 by the random number receiving means 30 (step SC12) and stores it in the random number storage means 31 (step SC13).

[Operations of financial institutions]
In addition, the viewing fee decrypting apparatus 5C receives the random number transmitted at step SC11 by the random number receiving means 56 (step SC14) and stores it in the random number storage means 57 (step SC15).
Through the above operation, random numbers are distributed from the provider side to the user side and the financial institution side, and the content viewing apparatus 2C is ready to encrypt the viewing fee when the user views the content.

(Billing / Payment)
Next, (for configuration, appropriately diagram 20 see Figure 22) Referring to FIG. 25 to the billing and payment operation anonymous charging system S _C, the difference between the charging and payment operation anonymous charging system S will be described .

[User action]
After step S50, the content viewing apparatus 2C acquires a random number from the random number storage unit 31 by the encryption unit 3Cb of the security module 3C (step SC50). Then, the content viewing apparatus 2C encrypts the fee for each provider, which is the fee for each channel, using the random number and the public key stored in the public key storage unit 23 by the encryption unit 3Cb. Charge information is generated (step S51b). The operation after step S52 is the same as the operation of the anonymous billing system S.

[Operations of financial institutions]
The viewing fee decryption apparatus 5C acquires a random number from the random number storage means 57 by the payment amount information decryption means 54Cb after step S60 (step SC51). Then, the viewing fee decrypting apparatus 5C decrypts the encrypted payment amount information received in step S60 by the payment amount information decrypting unit 54Cb with the random number and the public key and private key stored in the key storage unit 51 ( Step S61b). The operations after step S62 are the same as the operations of the anonymous billing system S.

By the above operation, the anonymous charging system S _C comprises a charging process for the user, the payment process for the provider, can be carried out while concealing the viewing history of the user. Further, the anonymous charging system S _C, since the payment amount information using a random number that can not know the generation method only provider is encrypted, is possible to detect the falsification of the payment amount information in the viewing fee collection apparatus 4 it can.

<< Random numbers to be generated >>
The random numbers described in the present embodiment are not limited to the above generation method. Specifically, it can be generated by a plurality of methods as described below.
(Random number generation method 1)
First, as a first example, the content distribution apparatus 1C uses the random number generation unit 15 to generate random numbers ((r ₁ , ₀ , r ₁ ) for each user (1,..., M) as shown in the following equation (19). _{, 1} ),..., (Rm _{, 0} , rm _{, 1} )). Where g ₀ and g ₁ are generators, random numbers such that g ₀ ∈Z _n0 ^* and g ₁ ∈Z _n1 ^* , respectively, n ₀ , n ₁ , e ₀ and e ₁ are part of the public key. is there.

The random numbers r _{p, 0} ⁻¹ and r _{p, 1} ⁻¹ are used as random numbers for verifying the validity of the provider Pj.
In this case, the viewing fee decrypting device 5C uses the payment amount information decrypting unit 54Cb to encrypt the payment amount information C using the random number r _{Pj, 0} ⁻¹ or r _{Pj, 1} ^{−1 according} to the following equation (20). _{Pj, sum, 0} , C _{Pj, sum, 1} are decoded.

(Random number generation method 2)
As a second example, the content distribution apparatus 1C causes the random number generation unit 15 to use a random number ((r ₁ , ₀ , r ₁ ) for each user (1,..., M) as shown in the following equation (21). _{, 1} ),..., (R _{m, 0} , r _{m, 1} )) and random numbers (r _{Pj, 0} and r _{Pj, 1} ) for verifying the validity of the provider. However, n ₀ and n ₁ are part of the public key.

In this case, the viewing fee decrypting device 5C uses the payment amount information decrypting unit 54Cb to encrypt the payment amount information C _{Pj, sum,} encrypted using the random number r _{Pj, 0} or r _{Pj, 1 according} to the following equation (22) _. Decode ₀ , _{CPj, sum, 1} .

[Fourth Embodiment: Configuration of Anonymous Charging System]
Next, the configuration of the anonymous billing system according to the fourth embodiment of the present invention will be described with reference to FIG. Anonymous billing system S _D according to the fourth embodiment, like the anonymous billing system S _C described in the third embodiment, by using a random number that can not know the generation method only the provider side, viewing the user This is a system that performs billing according to the content (broadcast program) and payment to the provider while keeping the user's viewing history secret. Here, the anonymous billing system _SD includes a content distribution device 1D, a content viewing device 2D, a viewing fee totaling device 4, and a viewing fee decoding device 5C, which are connected via a network N. There may be a plurality of each device. Viewing fee collection apparatus 4, and viewing fee decoding apparatus 5C is omitted because the third is the same as the anonymous billing system S _C described in the embodiments, the description the same reference numerals.

Anonymous billing system S _D is not a random number to the content viewing apparatus 2D, the point of delivering seed (random number seed) for generating a random number is different from the anonymous billing system S _C. Hereinafter, the description will focus on differences from the anonymous billing system S _D and anonymous billing system S _C.

(Configuration of content distribution device)
First, the configuration of the content distribution apparatus will be described with reference to FIG. 27 (refer to FIG. 26 as appropriate). FIG. 27 is a block diagram illustrating a configuration of a content distribution apparatus according to the fourth embodiment. The content distribution apparatus 1D adds the random number seed generation unit 17, the random number seed transmission unit 18, and the random number seed storage unit 19 to the content distribution apparatus 1C described with reference to FIG. 20, and the random number generation unit 15 and the random number transmission unit 16 functions are changed. The configuration other than the random number seed generation unit 17, the random number seed transmission unit 18, the random number seed storage unit 19, the random number generation unit 15D, and the random number transmission unit 16D is the same as the content distribution apparatus 1C described in FIG. Reference numerals are assigned and description is omitted.

  The random number seed generation means 17 generates a seed that serves as a source for generating a random number. Here, the random number seed generation means 17 generates (selects) an arbitrary numerical value as a random number seed, outputs it to the random number seed transmission means 18, and stores it in the random number seed storage means 19. Note that this random number seed is a different value for each user.

The random number seed transmission unit 18 transmits the random number seed generated by the random number seed generation unit 17 to the content viewing apparatus 2D via the network N.
The random number seed storage unit 19 stores the random number seed generated by the random number seed generation unit 17 and is a general storage device such as a memory or a hard disk.

The random number generation means 15D generates different random numbers for each user based on the random number seed stored in the random number seed storage means 19. The random number for each user generated by the random number generation unit 15D is output to the random number transmission unit 16D.
Note that the random number generation means 15D generates an arbitrary random number using the random number seed, and therefore, without using the random number generation method according to the expression (16), the random expression is used to calculate the expression (19) or the expression (21). Generate a random number that satisfies

The random number transmitting unit 16D transmits the random number generated by the random number generating unit 15D to the viewing fee decoding device 5C via the network N.
In this way, by configuring the content distribution device 1D, it is possible to transmit a random number whose generation method can be known only on the provider side to the viewing fee decoding device 5C. Also, the content distribution device 1D can generate the same random number by transmitting the random number seed to the content viewing device 2D, and can reduce the transmission cost compared to the case of sequentially transmitting the random number. it can.

(Configuration of content viewing device)
Next, the configuration of the content viewing apparatus will be described with reference to FIG. 28 (refer to FIG. 26 as appropriate). FIG. 28 is a block diagram illustrating a configuration of a content viewing apparatus according to the fourth embodiment. The content viewing apparatus 2D is configured by replacing the random number receiving means 30 and the random number storage means 31 of the content viewing apparatus 2C described in FIG. 21 with a random number seed receiving means 32, a random number seed storage means 33, and a random number generation means 34. ing. The configuration other than the random number seed receiving unit 32, the random number seed storage unit 33, and the random number generation unit 34 is the same as that of the content viewing apparatus 2C described with reference to FIG.

The random number seed receiving means 32 receives a random number seed from the content distribution apparatus 1D via the network N. The random number seed received by the random number seed receiving unit 32 is stored in the random number seed storage unit 33.
The random number seed storage unit 33 stores the random number seed received by the random number seed reception unit 32 and is a general storage device such as a memory or a hard disk.

The random number generation unit 34 generates a random number based on the random number seed stored in the random number seed storage unit 33. The random number generated by the random number generation means 34 is used in the encryption means 3Cb of the security module 3C.
The random number generation unit 34 is the same as the random number generation unit 15D (see FIG. 27) of the content distribution apparatus 1D, and generates the same random number from the same random number seed.
Thus, by configuring the content viewing apparatus 2D, the provider-specific fee information is encrypted with the same random number as the random number managed on the provider side.

[Fourth Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the fourth embodiment of the present invention will be described. Here, only the difference from the operation of the anonymous billing system according to the third embodiment will be described.

(Overview of operation)
First, with reference (see appropriate diagram 26) 29, the overall operation of the anonymous charging system S _D, the difference between the overall operation of the anonymous charging system S _C will be described.
The anonymous billing system _SD generates a different random number seed for each user in the content distribution apparatus 1D on the provider side (step S1c), and generates a random number using the random number seed (step S1d). The random number seed generated in step S1c is transmitted (issued) to the content viewing device 2D, and the random number generated in step S1d is transmitted (issued) to the viewing fee decryption device 5C.
Then, in the content viewing apparatus 2D, a random number is generated from the random number seed issued in step S1c (step S1e).

Then, initialization and operation and billing and payment operation anonymous charging system S _D, the difference between the operations of the anonymous charging system S _C will be described. The content viewing / viewing history collection operation is the same as the anonymous billing system S described with reference to FIG.

(Initialization operation)
First, (for configuration, appropriately diagram 27 and see FIG. 28) Referring to FIG. 30, the initialization operation and anonymous charging system S _D, the difference between the initialization operation anonymous charging system S _C will be described. This operation is equivalent to step S1 and step S1c in FIG.

[Operation on the provider side]
After step S16, the content distribution apparatus 1D generates a different random number seed for each user by the random number seed generation unit 17 (step SD10), and stores it in the random number seed storage unit 19 (step SD11). Then, the content distribution device 1D transmits the random number seed generated in step SD10 to the content viewing device 2D by the random number seed transmission means 18 (step SD12).

[User action]
Then, the content viewing apparatus 2D receives the random number seed transmitted in step SD12 by the random number seed receiving unit 32 (step SD13) and stores it in the random number seed storage unit 33 (step SD14).
Through the above operation, the random number seed is distributed from the provider side to the user side, and the content viewing apparatus 2C is ready to encrypt the viewing fee when the user views the content.

(Billing / Payment)
Next, (for configuration, appropriately 22, see FIGS. 27 and 28) Referring to FIG. 31 and a charging and payment operation anonymous charging system S _D, the billing and payment operation anonymous charging system S _C Explain the difference.

[User action]
After step S50, the content viewing apparatus 2D acquires a random number seed from the random number seed storage unit 33 by the random number generation unit 34 (step SD50), and generates a random number (step SD51). Step S51b subsequent operation is the same as the operation of the anonymous billing system _{S C.}

[Operation on the provider side]
The content distribution apparatus 1D acquires a random number seed from the random number seed storage unit 19 by using the random number generation unit 15D (step SD52), and generates a random number (step SD53). Then, the content distribution apparatus 1D transmits the random number generated in step SD53 to the viewing fee decoding apparatus 5C by the random number transmission means 16D (step SD54). Step S72 subsequent operation is the same as the operation of the anonymous billing system S _C.

[Operations of financial institutions]
And the viewing fee decoding apparatus 5C receives the random number transmitted in step SD54 by the random number receiving means 56 after step S60 (step SD55). Step For S61b subsequent operation is the same as the operation of the anonymous billing system S _C.
With the above operation, it is not necessary to transmit a random number from the provider side to the user side in the billing / payment operation, and the transmission cost can be reduced.

[Fifth Embodiment: Configuration of Anonymous Charging System]
Next, with reference to FIG. 32, the structure of the anonymous charging system which concerns on the 5th Embodiment of this invention is demonstrated. In anonymous charging system S _C described in the third embodiment, to generate the random number in the content distribution apparatus 1C of the provider side, the anonymous charging system S _E according to the fifth embodiment, view random number of the financial institution side The difference is that it is generated in the charge decryption device 5E.
Here, the anonymous billing system _SE includes a content distribution device 1, a content viewing device 2C, a viewing fee totaling device 4, and a viewing fee decoding device 5E, which are connected via a network N.
Since the configuration other than the viewing fee decoding device 5E is the same as that described in the first embodiment or the third embodiment, the same reference numerals are given and the description thereof is omitted.

(Configuration of viewing fee decoding device)
Here, with reference to FIG. 33 (refer to FIG. 32 as appropriate), the configuration of the viewing fee decoding apparatus will be described. FIG. 33 is a block diagram showing a configuration of a viewing fee decoding apparatus according to the fifth embodiment. The viewing fee decryption apparatus 5E is configured by omitting the random number receiving means 56 and adding a random number generation means 58 and a random number transmission means 59 from the viewing fee decryption apparatus 5C described with reference to FIG. Since the configuration other than the random number generation unit 58 and the random number transmission unit 59 is the same as that of the viewing fee decoding apparatus 5C described with reference to FIG. 22, the same reference numerals are given and description thereof is omitted.

The random number generator 58 generates a different random number for each user. The random number for each user generated by the random number generation unit 58 is stored in the random number storage unit 57.
The random number generation means 58 has the same function as the random number generation means 15 described with reference to FIG. 20, and generates a random number according to the equation (16). In addition, it is good also as generating a random number by the said (19) Formula or (210) Formula.

The random number transmission unit 59 transmits the random number generated by the random number generation unit 58 to the content viewing device 2C and the viewing fee decoding device 5C via the network N.
The random number transmission means 59 sends random numbers ((r _1,0 , r _1,1 ),..., (R _{m, 0} , r _{m, 1} )) for each user (1,. ) To the content viewing device 2C.
In this way, by configuring the viewing fee decryption device 5E, it is possible to transmit to the content viewing device 2C a random number whose generation method can only be known on the financial institution side.

[Fifth Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the fifth embodiment of the present invention will be described. Here, only the difference from the operation of the anonymous billing system according to the third embodiment will be described.

(Overview of operation)
Referring first (appropriately with reference to Figure 32) Figure 34, the overall operation of the anonymous charging system S _E, the difference between the overall operation of the anonymous charging system S _C will be described.
Anonymous billing system S _E, rather than the content distribution apparatus 1 of the provider side, the viewing fee decoding apparatus 5E of the financial institution side, to generate a different random number for each user (step S 1 f) point, different from the anonymous billing system S _C ing. The random number generated in step S1f is transmitted (issued) to the content viewing apparatus 2C.
The subsequent operation is similar to the anonymous billing system S _C.
Next, the initialization operation of the anonymous charging system S _E, the difference between the initialization operation anonymous charging system S _C will be described. As for billing and payment operations and the content viewing and viewing history collection operation is omitted because it is identical to the operation of the anonymous billing system S _C.

(Initialization operation)
Next, (for configuration, appropriately Figure 33 reference) Referring to FIG. 35 to the initialization operation of the anonymous charging system S _E, the difference between the initialization operation anonymous charging system S _C will be described. Note that this operation corresponds to step S1 and step S1f in FIG.

[Operations of financial institutions]
The viewing fee decoding apparatus 5E generates a random number different for each user by the random number generation means 58 after step S14 (step SE10). Then, the viewing fee decryption apparatus 5E stores the random number in the random number storage means 57, and then transmits the random number to the content viewing apparatus 2C by the random number transmission means 59 (step SE11).
Through the above operation, random numbers are distributed from the financial institution side to the user side, and the content viewing apparatus 2C is ready to encrypt the viewing fee when the user views the content.

[Sixth Embodiment: Configuration of Anonymous Charging System]
Next, the configuration of the anonymous billing system according to the sixth embodiment of the present invention will be described with reference to FIG. Fourth The anonymous charging system S _D described in the embodiments, but generates a random number seed in the content distribution apparatus 1D of the provider side, the anonymous charging system S _F according to the sixth embodiment, the financial institution side random number seed Are different in the viewing fee decoding apparatus 5F.

Here, anonymous billing system S _F includes a content distribution apparatus 1, and the content viewing apparatus 2F, the viewing fee collection apparatus 4, and a viewing fee decoding apparatus 5F, and is connected via a network N.
Since the content distribution device 1 and the viewing fee aggregation device 4 are the same as those described in the first embodiment, the same reference numerals are given and the description thereof is omitted.

(Configuration of content viewing device)
FIG. 37 is a block diagram showing a configuration of a content viewing apparatus according to the sixth embodiment. The content viewing device 2D shown in FIG. 28 receives the random number seed from the provider-side content distribution device 1D, but the content viewing device 2F shown in FIG. 37 receives the random number seed from the viewing fee decryption device 5F on the financial institution side. Only the reception is different. As described above, the content viewing device 2F has the same configuration as the content viewing device 2D, except that the random number seed is received from the same source.

(Configuration of viewing fee decoding device)
Next, the configuration of the viewing fee decoding apparatus will be described with reference to FIG. 38 (refer to FIG. 36 as appropriate). FIG. 38 is a block diagram showing a configuration of a viewing fee decoding apparatus according to the sixth embodiment. Note that the viewing fee decryption device 5F includes the random number storage unit 57, the random number generation unit 58, and the random number transmission unit 59 of the viewing fee decryption device 5E described with reference to FIG. 33, the random number seed generation unit 60, the random number seed storage unit 61, the random number seed. Instead of the transmission means 62 and the random number generation means 63, they are configured. Since the configuration other than the random number seed generation unit 60, the random number seed storage unit 61, the random number seed transmission unit 62, and the random number generation unit 63 has the same configuration as that of the viewing fee decoding apparatus 5E described with reference to FIG. The description is omitted.

The random number seed generating means 60 generates a seed (random number seed) that is a source for generating a random number. The random number seed generating means 60 has the same function as the random number seed generating means 17 described with reference to FIG. The random number seed generated by the random number seed generation unit 60 is stored in the random number seed storage unit 61.
The random number seed storage unit 61 stores the random number seed generated by the random number seed generation unit 60, and is a general storage device such as a memory or a hard disk.

The random number seed transmission means 62 transmits a random number seed to the content viewing apparatus 2F via the network N.
The random number generation unit 63 generates a different random number for each user based on the random number seed stored in the random number seed storage unit 61. The random number for each user generated by the random number generation unit 63 is used when the encrypted payment amount information received by the payment amount information receiving unit 54a is decrypted by the payment amount information decrypting unit 54Cb.
Thus, by configuring the viewing fee decryption device 5F, the viewing fee decryption device 5F can transmit a random number seed to the content viewing device 2F, generate the same random number, and sequentially transmit random numbers. Compared to the case, the transmission cost can be reduced.

[Sixth Embodiment: Operation of Anonymous Billing System]
Next, the operation of the anonymous billing system according to the sixth embodiment of the present invention will be described. Here, only the difference from the operation of the anonymous billing system according to the fifth embodiment will be described.

(Overview of operation)
First, with reference (see appropriate diagram 36) 39, the overall operation of the anonymous charging system S _F, the difference between the overall operation of the anonymous charging system S _E will be described.
Anonymous billing system S _F is the viewing fee decoding apparatus 5F of the financial institution side, generates a different random number seed for each user (step S1g), it generates a random number by the random number seed (Step S1h). The random number seed generated in step S1g is transmitted (issued) to the content viewing apparatus 2F.
Then, in the content viewing device 2F, a random number is generated from the random number seed issued in step S1g (step S1e).
The subsequent operation is similar to the operation of the anonymous billing system S _E.

Then, initialization and operation and billing and payment operation anonymous charging system S _F, the difference between the operations of the anonymous charging system S _E will be described. The content viewing / viewing history collection operation is the same as the anonymous billing system S described with reference to FIG.

(Initialization operation)
First, (for configuration, appropriately diagram 37 and see FIG. 38) Referring to FIG. 40, the initialization operation and anonymous charging system S _F, the difference between the initialization operation anonymous charging system S _E will be described. This operation is equivalent to step S1 and step S1g in FIG.

[Operations of financial institutions]
After the step S14, the viewing fee decrypting apparatus 5F generates a random number seed different for each user by the random number seed generating unit 60 (step SF10), and the random number seed transmitting unit 62 uses the random number seed generated in the step SF10 as the content. It transmits to the viewing device 2F (step SF11).

[User action]
Then, the content viewing apparatus 2F receives the random number seed transmitted in step SF12 by the random number seed receiving unit 32 (step SF12) and stores it in the random number seed storage unit 33 (step SF13).
With the above operation, the random number seed is distributed from the financial institution side to the user side, and the content viewing apparatus 2F is ready to encrypt the viewing fee when the user views the content.

(Billing / Payment)
Next, (for configuration, appropriately diagram 38 see) Referring to FIG. 41 to the billing and payment operation anonymous charging system S _F, the difference between the charging and payment operation anonymous charging system S _E will be described.

[Operations of financial institutions]
After the step S60, the viewing fee decryption apparatus 5F acquires the random number seed from the random number seed storage unit 61 by the random number generation unit 63 (step SF50), and generates a random number (step SF51). Step S61b subsequent operation is the same as the operation of the anonymous billing system _{S E.} The operation of the content viewing device 2F on the user side is the same as the operation of the content viewing device 2D described with reference to FIG.
With the above operation, it is not necessary to transmit random numbers from the financial institution side to the user side in the billing / payment operation, and the transmission cost can be reduced.

  As described above, the present invention realizes a homomorphic public key cryptosystem, “Simplified Paillier cipher” (simple Paillier cipher), using an encryption scheme and knowledge proof incorporated in “Twin Encryption”. Although various embodiments have been described, the present invention can also be realized using a single encryption method and an electronic signature.

[Seventh Embodiment: Anonymous Billing System]
Here, with reference to FIG. 42, the structure of the anonymous billing system according to the seventh embodiment of the present invention will be described. Anonymous billing system S _G according to the seventh embodiment, while an anonymous charging system S described in the first embodiment is realized by duplicating ciphers and knowledge proof, digital signature and a singlet encryption method The point that is realized is different.
Here, the anonymous billing system _SG includes a content distribution device 1G, a content viewing device 2G (security module 3G), a viewing fee totaling device 4G, and a viewing fee decrypting device 5G, which are connected via a network N. Yes. There may be a plurality of each device.
Hereinafter, the description will focus on differences from the anonymous billing system S _G and anonymous billing system S.

(Configuration of content distribution device)
FIG. 43 is a block diagram illustrating a configuration of a content distribution apparatus according to the seventh embodiment. The configuration other than the encrypted payment amount information receiving unit 14Ga and the payment amount verification unit 14Gc of the verification unit 14G is the same as the configuration of the content distribution apparatus 1 described in FIG. Omitted.

  The encrypted payment amount information receiving means 14Ga receives the encrypted payment amount information obtained by encrypting the payment amount to the provider for the user's viewing from the viewing fee totaling apparatus 4G on the charging aggregation organization side via the network N. Is received. It should be noted that an electronic signature is added to the encrypted payment amount information (signed encrypted payment amount information) in the viewing fee totaling device 4G.

The payment amount verification means 14Gc determines whether or not the encrypted payment amount information received by the encrypted payment amount information reception means 14Ga and the payment amount information received by the payment amount information reception means 14b indicate the same amount. It is to verify.
This payment amount verification means 14Gc decrypts the encrypted payment amount information received by the encrypted payment amount information reception means 14Ga based on the public key stored in the public key storage means 14e. Specifically, the payment amount verification unit 14Gc decrypts the payment amount according to the following equation (23). Note that the encrypted payment amount information is C _{Pj, sum} , the provider decryption parameter is r ′ _{Pj, sum} , and the public key is PK = (n, e). As a result, payment amount information P ″ _{Pj, sum} is generated.

Then, the payment amount verification unit 14Gc compares the decrypted payment amount information with the payment amount information received by the payment amount information reception unit 14b, thereby verifying the payment amount notified from the viewing fee decryption device 5G. I do.
Here determines, payment amount verification unit 14Gc is payment amount information _{P "Pj, sum} the payment amount information P _'Pj received by payment amount information receiving means _14b, if equal to _sum, and payment amount are correct. Note The payment amount verification means 14c displays the verification result on a display device (not shown).

Here, the payment amount verification means 14Gc decrypts the encrypted payment amount information received by the encrypted payment amount information reception means 14Ga and compares it with the payment amount information received by the payment amount information reception means 14b. However, verification may be performed by encrypting the payment amount information received by the payment amount information receiving unit 14b and comparing it with the encrypted payment amount information received by the encrypted payment amount information receiving unit 14Ga.
Specifically, the payment amount verification unit 14Gc encrypts the payment amount information received by the payment amount information reception unit 14b according to the following equation (24). The payment amount information is P ′ _{Pj, sum} , the provider decryption parameter is r ′ _{Pj, sum} , and the public key is PK = (n, e).

Then, the payment amount verification means 14c, when the encrypted payment amount information C ″ _{Pj, sum} is equal to the encrypted payment amount information CPj _{, sum} received by the encrypted payment amount information reception means 14Ga, the payment amount is correct. Is determined.

(Configuration of content viewing device)
FIG. 44 is a block diagram showing a configuration of a content viewing apparatus according to the seventh embodiment. Since the configuration other than the billing amount verification unit 29G and the security module 3G is the same as the configuration of the content viewing apparatus 2 described with reference to FIG. 3, the same reference numerals are given and the description thereof is omitted.

The billing amount verification unit 29G compares the billing amount indicated by the billing information generated by the security module 3G with the billing amount indicated by the billing information received by the billing information receiving unit 28, thereby charging the billed amount. The amount is verified.
Here, the billing amount verification unit 29G uses the following formula (25) for the encrypted billing information C _{sum, Ui} for the user i (i = 1,..., Nu) generated by the encryption unit 3Gb of the security module 3G. As shown in FIG. 4, decryption is performed using the user decryption parameter r ′ _{sum, Ui} received by the billing information receiving means 28 and the public key PK = (n, e) stored in the public key storage means 23.

Then, the billing amount verifying unit 29G compares the billing information P ′ _{sum, Ui} received by the billing information receiving unit 28 with the billing information P ″ _{sum, Ui} decrypted by the equation (25) to verify the billing information. Note that the billing amount verification unit 29G displays the verification result on the display device D.

(Configuration of security module [viewing fee encryption device])
Similarly, with reference to FIG. 44, the difference between the security modules will be described.
The security module 3G differs from the security module 3 described in FIG. 3 only in the function of the encryption means.
The encryption unit 3Gb encrypts the billing information extracted by the billing information extraction unit 3a with a public key (encryption key) of a homomorphic public key cryptosystem that is publicly disclosed in a financial institution. Here, the encryption unit 3Gb encrypts the total fee and the provider-specific fee that is the fee for each channel.
Specifically, the encryption unit 3Gb generates encrypted billing information C _{sum, Ui} by Simplified Paillier encryption as shown in the following equation (26).

Here, P _{sum, Ui} is a total charge, and r _Ui is a random number that satisfies r _Ui εZ _n0 ^* .
Further, the encryption means 3Gb adds the electronic signature to the Simplified Paillier cipher as shown in the following equation (27), so that the charge information for each provider j (j = 1,..., Np) Cs _{Pj, Ui} ({Cs _{Pj, Ui} } _{j = 1,..., Np} ) is generated.

Here, Sig _{Pj, Ui} is an electronic signature. Further, P _{Pj, Ui} is a provider-specific fee, and r _{Pj, Ui} is a random number satisfying r _{Pj, Ui} εZ _n ^* .
The encrypted charging information C _{sum, Ui} and the encrypted provider-specific fee information _{CPj, Ui} generated in this way are output to the fee information transmitting means 27.

(Configuration of viewing fee counting device)
FIG. 45 is a block diagram illustrating a configuration of a viewing fee totaling apparatus according to the seventh embodiment. The configuration other than the payment amount information calculation unit 44Ga and the certification unit 45G of the payment amount totaling unit 44G is the same as the configuration of the viewing fee totaling device 4 described in FIG. .

The payment amount information calculation means 44Ga calculates the encrypted payment amount information for each provider in the encrypted provider-specific fee information stored in the fee information storage means 41. Here, the payment amount information calculation means 44Ga, for the encrypted provider-specific fee information CPj _{, Ui} (= (CPj _{, Ui} , _{SigPj, Ui} )), as shown in the following equation (28), The encrypted payment amount information C ′ _{Pj, sum} , which is the total for each Pj (provider), is calculated. Note that n is a part of the public key stored in the public key storage unit 43.

As described above, the payment amount information calculation unit 44Ga calculates the encrypted payment amount information obtained by encrypting the fee information for each provider while being encrypted from the encrypted provider-specific fee information.
The encrypted payment amount information calculated by the payment amount information calculation unit 44a is output to the payment amount information transmission unit 44b.

  The certifying means 45G proves the encrypted payment amount information aggregated by the payment amount aggregation means 44G. Here, the certifying means 45G includes a signature receiving means 45Ga, a signature verification means 45Gb, and a signed payment amount information transmitting means 45Gc. In other words, the certifying means 45G certifies the payment amount information, which has been performed by the proof value in the viewing fee counting apparatus 4 described in FIG.

  The signature receiving unit 45Ga receives the signature for the encrypted payment amount information from the viewing fee decrypting device 5G via the network N.

  The signature verification unit 45Gb verifies the encrypted payment amount information aggregated by the payment amount aggregation unit 44G with the signature received by the signature reception unit 45Ga. The signature verification unit 45Gb outputs the signed payment information with the signature received by the signature reception unit 45Ga to the signed payment amount information transmission unit 45Gc.

  The signed payment amount information transmitting unit 45Gc transmits the encrypted payment amount information with signature, which is verified by the signature verification unit 45Gb and added with a signature, to the content distribution apparatus 1G via the network N.

(Configuration of viewing fee decoding device)
FIG. 46 is a block diagram showing a configuration of a viewing fee decoding apparatus according to the seventh embodiment. The configuration other than the homomorphic key generation unit 50G, the billing information decryption unit 53Gb, the payment amount information decryption unit 54Gb, the signature generation unit 54Gd, and the signature transmission unit 54Ge is the same as the configuration of the viewing fee decryption apparatus 5 described in FIG. Therefore, the same reference numerals are given and the description is omitted.

The homomorphic key generation means 50G generates a public key and a secret key that are key pairs in the homomorphic public key cryptosystem.
Here, the homomorphic key generation means 50G selects the prime numbers p and q using the security parameter s which is a numerical value (for example, key length) indicating the security level. However, when n = pq, | n | = s.
Next, the homomorphic key generation unit 50G selects eεZ _n that satisfies gcd (e, λ (n ² )) = 1. Here, gcd (•) indicates a function for calculating the greatest common divisor, and λ (•) indicates a Carmichael lambda function.

The homomorphic key generation unit 50G sets PK = (n, e) as a public key and sets dεZ _n ^* where ed = 1 mod n as a secret key SK = d.
The public key PK = (n, e) generated by the homomorphic key generation unit 50G is output to the public key transmission unit 52. The public key PK and the secret key SK are stored in the key storage unit 51.

The billing information decrypting unit 53Gb decrypts the encrypted billing information received by the billing information receiving unit 53a.
Here, the billing information decryption means 53Gb decrypts the encrypted billing information C _{sum, Ui} as shown in the following equation (29), billing information (billing total amount) P ′ _{sum, Ui} , and user decryption parameters r ′ _{sum, Ui} is generated. The user decryption parameter is information for decrypting the encrypted billing information in the content viewing apparatus 2G (see the above formula (23)).

  This user decryption parameter and billing information are output to billing information notification means 53c. Further, the billing information is output to the amount verification means 55.

The payment amount information decrypting unit 54Gb decrypts the encrypted payment amount information received by the payment amount information receiving unit 54a.
Here, the payment amount information decrypting means 54Gb decrypts the encrypted payment amount information C _{Pj, sum} as shown in the following equation (30), and the payment amount information (payment total amount) _{P′Pj, sum} , Provider decryption parameters r ′ _{Pj, sum} are generated. The provider decryption parameter is information for decrypting the encrypted payment amount information in the content distribution apparatus 1G (see the above formula (23)). The payment amount information and the provider decryption parameter are output to the payment amount information notification unit 54c.

The signature generation unit 54Gd generates a signature indicating whether or not the payment amount information is a valid value. The signature generated by the signature generation unit 54Gd is output to the signature transmission unit 54Ge. The signature may be any signature that guarantees safety such as DSA.
The signature transmission unit 54Ge transmits the signature generated by the signature generation unit 54Gd to the viewing fee counting apparatus 4G via the network N.

As described above, by configuring the Anonymous billing system S _G, it is possible to suppress the calculation amount of each device in comparison with the first embodiment.
Incidentally, the anonymous operation of the charging system S _G, compared to the anonymous billing system S of the first embodiment in that the encryption schemes differ, and in that the electronic signature in place of knowledge proof are used Since the operation is the same as that of the anonymous billing system S except for the difference, the description is omitted.
In addition, here, the anonymous charging system S according to the first embodiment has been described as being modified by the single encryption method and the electronic signature, but the anonymous charging system S _{B according} to the second embodiment described above is shown. In the same way, it is also possible to realize with a single encryption method and an electronic signature.

[Eighth Embodiment: Anonymous Billing System]
Furthermore, with reference to FIG. 47, the configuration of the anonymous billing system according to the eighth embodiment of the present invention will be described. Anonymous billing system S _H according to the eighth embodiment, while an anonymous charging system S _C described in the third embodiment is realized by duplicating ciphers and knowledge proof, single encryption method and the electronic The difference is realized by the signature.
Here, the anonymous billing system _SH includes a content distribution device 1H, a content viewing device 2H (security module 3H), a viewing fee totaling device 4G, and a viewing fee decrypting device 5H, which are connected via a network N. Yes. There may be a plurality of each device.
Hereinafter, the description will focus on differences from the anonymous billing system S _H and anonymous billing system S _C.

(Configuration of content distribution device)
FIG. 48 is a block diagram showing a configuration of a content distribution apparatus according to the eighth embodiment. The configuration other than the encrypted payment amount information receiving unit 14Ga and the payment amount verification unit 14Gc of the verification unit 14G and the random number generation unit 15H is the same as the configuration of the content distribution apparatus 1C described with reference to FIG. Further, the encrypted payment amount information receiving unit 14Ga and the payment amount verification unit 14Gc of the verification unit 14G are the same as the configuration of the content distribution apparatus 1G described with reference to FIG. Therefore, only the random number generation means 15H will be described here.

The random number generation means 15H generates different random numbers for each user. The random number for each user generated by the random number generation unit 15H is output to the random number transmission unit 16.
Here, the random number generation means 15H generates a random number for each user with reference to the public key (stored in the public key storage means 14e) disclosed by the viewing fee decryption apparatus 5H on the financial institution side. That is, the random number generation means 15H selects integers (e ₁ ,..., E _m , e _p ) that satisfy the condition shown in the following expression (31), and the user (1) as shown in the following expression (32) ,..., M) and random numbers (r ₁ ,..., R _m ) are generated. However, g is a generation _source, g∈Z n, and becomes a random number, n, and e is the part of the public key. Here, the random number generation means 15H, in order to verify the validity of the provider, to produce together a random number r _p.

(Configuration of content viewing device)
FIG. 49 is a block diagram showing a configuration of a content viewing apparatus according to the eighth embodiment. The configuration other than the charged amount verification means 29G and the security module 3H is the same as the configuration of the content viewing apparatus 2C described with reference to FIG. The billing amount verification means 29G has the same configuration as that of the content viewing apparatus 2G described with reference to FIG. Therefore, only the security module 3H will be described here.

(Configuration of security module [viewing fee encryption device])
The security module 3H differs from the security module 3C described in FIG. 21 only in the function of the encryption unit.
The encryption means 3Hb is based on the public key (encryption key) of the homomorphic public key cryptosystem publicly disclosed in the financial institution and the random number stored in the random number storage means 31, and the charging information extraction means 3a The billing information extracted in step 1 is encrypted. Here, the encryption unit 3Hb encrypts the total fee and the provider-specific fee that is the fee for each channel.
Specifically, the encryption unit 3Hb generates the encrypted billing information C _{sum, Ui} by the above equation (26) and adds an electronic signature to the Simplified Paillier cipher by the following equation (33). , The provider-specific fee information Cs _{Pj, Ui} ({Cs _{Pj, Ui} } _{j = 1,..., Np} ) for each provider j (j = _{1,..., Np} ) is generated.

Here, Sig _{Pj, Ui} is an electronic signature. The random number r _Ui is a random number calculated by the equation (32) stored in the random number storage unit 31.
The encrypted charging information C _{sum, Ui} and the encrypted provider-specific fee information _{CPj, Ui} generated in this way are output to the fee information transmitting means 27.

(Configuration of viewing fee decoding device)
FIG. 50 is a block diagram showing a configuration of a viewing fee decoding apparatus according to the eighth embodiment. The configuration other than the homomorphic key generation unit 50G, the payment amount information decryption unit 54Hb, the signature generation unit 54Gd, and the signature transmission unit 54Ge is the same as the configuration of the viewing fee decryption apparatus 5C described in FIG. The homomorphic key generation means 50G, signature generation means 54Gd, and signature transmission means 54Ge have the same configuration as the viewing fee decryption apparatus 5G described with reference to FIG. Therefore, only the payment amount information decrypting means 54Hb will be described here.

  The payment amount information decrypting unit 54Hb decrypts the encrypted payment amount information received by the payment amount information receiving unit 54a. The encrypted payment amount information is multiplied by the provider-specific fee information encrypted by the public key generated by the homomorphic key generation unit 50G and the random number generated by the random number generation unit 15H (see FIG. 48). Is generated. Therefore, the payment amount information decrypting unit 54Hb decrypts the encrypted payment amount information using the public key and the secret key stored in the key storage unit 51 and the random number stored in the random number storage unit 57.

Here, the payment amount information decrypting unit 54Hb decrypts the encrypted payment amount information C _{Pj, sum} as shown in the following equation (34), and the payment amount information (payment total amount) _{P′Pj, sum} , Provider decryption parameters r ′ _{Pj, sum} are generated. C ^(old) _{Pj, sum} indicates encrypted payment amount information before decryption, and C ^(new) _{Pj, sum} indicates payment amount information after decryption. The provider decryption parameter is information for decrypting the encrypted payment amount information in the content distribution apparatus 1H (see the above formula (23)).

  The payment amount information and the provider decryption parameter are output to the payment amount information notification unit 54c. Further, the payment amount information is output to the signature generation unit 54Gd and the amount verification unit 55.

As described above, by configuring the Anonymous billing system S _H, it is possible to suppress the calculation amount of each device in comparison with the third embodiment.
Note that the operation of the anonymous charging system S _H, as compared with the third anonymous charging system S _C embodiment, the point where encryption schemes differ, and the electronic signature is used in place of knowledge proof except that point are different is similar to the operation of the anonymous charging system S _C, it will not be described.
Further, here, the anonymous billing system S _C is a third embodiment, a fourth to sixth embodiments showed the modified example realized by a and the electronic signature single encryption method, which is the anonymous The accounting systems S _{D to} S _F can also be realized by a single encryption method and an electronic signature.

It is a block diagram which shows the structure of the anonymous billing system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening charge total apparatus which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 1st Embodiment of this invention. It is a data block diagram which shows an example of viewing history information. It is a data structure figure which shows an example of charging information. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the initialization operation | movement of the anonymous billing system which concerns on the 1st Embodiment of this invention. 5 is a flowchart showing content viewing and viewing history collection operations in the anonymous billing system according to the first embodiment of the present invention. It is a flowchart which shows the charging and payment operation | movement in the anonymous charging system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the content viewing apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening charge total apparatus which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows the charging and payment operation | movement in the anonymous charging system which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 3rd Embodiment of this invention. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows the initialization operation | movement of the anonymous billing system which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows the charging and payment operation | movement in the anonymous charging system which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 4th Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 4th Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 4th Embodiment of this invention. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 4th Embodiment of this invention. It is a flowchart which shows the initialization operation | movement of the anonymous billing system which concerns on the 4th Embodiment of this invention. It is a flowchart which shows the charging and payment operation | movement in the anonymous charging system which concerns on the 4th Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 5th Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 5th Embodiment of this invention. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 5th Embodiment of this invention. It is a flowchart which shows the initialization operation | movement of the anonymous billing system which concerns on the 5th Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 6th Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 6th Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 6th Embodiment of this invention. It is a sequence diagram which shows the operation | movement of the whole anonymous billing system which concerns on the 6th Embodiment of this invention. It is a flowchart which shows the initialization operation | movement of the anonymous billing system which concerns on the 6th Embodiment of this invention. It is a flowchart which shows the charging and payment operation | movement in the anonymous charging system which concerns on the 6th Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening charge total apparatus which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the anonymous billing system which concerns on the 8th Embodiment of this invention. It is a block diagram which shows the structure of the content delivery apparatus which concerns on the 8th Embodiment of this invention. It is a block diagram which shows the structure of the content viewing-and-listening apparatus provided with the security module (viewing fee encryption apparatus) which concerns on the 8th Embodiment of this invention. FIG. It is a block diagram which shows the structure of the viewing-and-listening price decoding apparatus which concerns on the 8th Embodiment of this invention.

Explanation of symbols

S Anonymous Billing System 1 Content Distribution Device 10 Content Storage Unit 11 Content Encryption Unit 12 Encrypted Content Storage Unit 13 Broadcast Transmission Unit 14 Verification Unit 14a Encrypted Payment Amount Information Reception Unit 14b Payment Amount Information Reception Unit 14c Payment Amount Verification Unit 14d Public key reception means 14e Public key storage means 15 Random number generation means 16 Random number transmission means 17 Random number seed generation means 18 Random number seed transmission means 19 Random number seed storage means 2 Content viewing device 20 Broadcast reception means 21 Content decryption means 22 Public key reception means 23 Public key storage means 24 Viewing history encryption key generation means 25 Viewing history encryption key storage means 26 Encrypted viewing history storage means 27 Fee information transmission means 28 Charge information reception means 29 Charge amount verification means 30 Random number reception means 31 Random number storage means 2 random number seed receiving unit 33 the random number seed storage unit 34 the random number generating means 3 the security module (viewing fee encryptor)
3a Billing information extracting means 3b Encrypting means 3c Viewing history encrypting means 3d Viewing history decrypting means 4 Viewing fee counting device 40 Fee information receiving means 41 Fee information storage means 42 Public key receiving means 43 Public key storage means 44 Payment amount counting means 44a Payment amount information calculation means 44b Payment amount information transmission means 45 Proof means 45a Proof value reception means 45b Proof value verification means 45c Proof payment amount information transmission means 46 Charge amount totaling means 46a Charge amount information extraction means 46b Charge amount information transmission means 5 viewing fee decryption device 50 homomorphic key generation means 51 key storage means 52 public key transmission means 53 charge control means 53a charge information reception means 53b charge information decryption means 53c charge information notification means 54 payment control means 54a payment amount information reception means 54b Payment amount information decryption means 54c Payment amount information notification means 54d Proof value generation means 54e Proof value transmission means 55 Amount verification means 56 Random number reception means 57 Random number storage means 58 Random number generation means 59 Random number transmission means 60 Random number seed generation means 61 Random number seed storage means 62 Random number seed transmission means 63 Random number generation means

Claims (18)

A viewing fee encryption device that is provided in a content viewing device that presents content to a viewer and that encrypts information indicating the fee for the content viewed by the viewer,
Billing information extracting means for generating billing information by extracting information related to a fee from viewing history information of viewing the content;
Encryption means for generating encrypted billing information by encrypting the billing information with a public key of a homomorphic public key cryptosystem published in advance;
A viewing fee encryption apparatus comprising: In a content viewing apparatus that presents content to a viewer,
2. The content viewing apparatus according to claim 1, further comprising encrypted billing information generated by encrypting information indicating a fee for the content viewed by the viewer. A viewing fee totaling device that totalizes encrypted billing information generated in the content viewing device according to claim 2 while being encrypted,
Charge information storage means for storing the encrypted charging information;
Payment amount information calculating means for calculating encrypted payment amount information by multiplying information corresponding to the content provider individually in the encrypted billing information stored in the fee information storage means;
A viewing fee counting device characterized by comprising: A viewing fee decrypting device that decrypts the encrypted billing information encrypted by the viewing fee encryption device according to claim 1 and the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 3. There,
A homomorphic key generating means for generating a public key and a secret key which are key pairs in the homomorphic public key cryptosystem;
Billing information decrypting means for decrypting the encrypted billing information as billing information using the secret key generated by the homomorphic key generating means;
The encrypted payment amount information is decrypted as payment amount information using the secret key generated by the homomorphic key generation means, and a fee verification parameter for verifying the payment amount information in the content distribution apparatus is generated. Payment amount information decryption means,
Amount verification means for comparing and verifying the billing information decrypted by the billing information decryption means and the payment amount information decrypted by the payment amount information decryption means;
A viewing fee decoding apparatus comprising: The content viewing / listening device according to claim 2,
By comparing the billing amount indicated by the billing information generated by the billing information extracting means with the billing amount indicated by the billing information decrypted by the viewing fee decoding device according to claim 4, the billing amount Billing amount verification means for verifying,
A content viewing apparatus comprising: In a content distribution device that distributes content,
The encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 3 is decrypted with the public key generated by the viewing fee decryption device according to claim 4 and a fee verification parameter, and the viewing fee is obtained. Payment amount verification means for verifying the payment amount information by comparing with the payment amount information decrypted by the decryption device,
A content distribution apparatus comprising: In a content distribution device that distributes content,
Encrypted payment amount information is generated by encrypting the payment amount information decrypted by the viewing fee decryption device according to claim 4 with the public key and the fee verification parameter generated by the viewing fee decryption device. A payment amount verification means for verifying the encrypted payment amount information by comparing with the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 3;
A content distribution apparatus comprising: In order to encrypt information that shows the fee details for the content viewed by the viewer,
Billing information extracting means for generating billing information by extracting information related to a fee from viewing history information of viewing the content;
Encryption means for generating encrypted billing information by encrypting the billing information with a public key of a homomorphic public key cryptosystem published in advance;
A viewing fee encryption program characterized in that it functions as In order to tabulate the encrypted billing information generated in the content viewing device according to claim 2 while encrypting the computer,
Payment amount information calculation means for calculating encrypted payment amount information by individually multiplying information corresponding to the content provider in the encrypted billing information stored in the charge information storage means,
A viewing fee totaling program characterized by functioning as In order to decrypt the encrypted billing information encrypted by the viewing fee encryption device according to claim 1 and the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 3, a computer is ,
A homomorphic key generating means for generating a public key and a secret key which are key pairs in the homomorphic public key cryptosystem;
Billing information decrypting means for decrypting the encrypted billing information as billing information using the secret key generated by the homomorphic key generating means,
Payment amount information decrypting means for decrypting the encrypted payment amount information as payment amount information with the secret key generated by the homomorphic key generation unit,
Amount verification means for comparing and verifying the billing information decrypted by the billing information decryption means and the payment amount information decrypted by the payment amount information decryption means,
A viewing fee decryption program characterized by being made to function as: A viewing fee encryption device that is provided in a content viewing device that presents content to a viewer and that encrypts information indicating the fee for the content viewed by the viewer,
Billing information extracting means for generating billing information by extracting information related to a fee from viewing history information of viewing the content;
Encryption that generates encrypted billing information by encrypting the billing information using a public key of a homomorphic public key cryptosystem that has been publicized in advance and a random number generated in a content distribution device that distributes the content Means,
A viewing fee encryption apparatus comprising: In a content viewing apparatus that presents content to a viewer,
12. The content viewing apparatus according to claim 11, comprising the viewing fee encryption apparatus according to claim 11, wherein encrypted billing information is generated by encrypting information indicating contents of a fee for the content viewed by the viewer. A viewing fee totaling device that totalizes encrypted billing information generated in the content viewing device according to claim 12 while encrypting the information.
Charge information storage means for storing the encrypted charging information;
Payment amount information calculating means for calculating encrypted payment amount information by multiplying information corresponding to the content provider individually in the encrypted billing information stored in the fee information storage means;
A viewing fee counting device characterized by comprising: A viewing fee decrypting device that decrypts the encrypted billing information encrypted by the viewing fee encryption device according to claim 11 and the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 13. There,
A homomorphic key generating means for generating a public key and a secret key which are key pairs in the homomorphic public key cryptosystem;
Billing information decrypting means for decrypting the encrypted billing information as billing information by using the secret key generated by the homomorphic key generating means and the random number generated in the content distribution device for distributing the content;
The encrypted payment amount information is decrypted as payment amount information using the secret key generated by the homomorphic key generation means, and a fee verification parameter for verifying the payment amount information in the content distribution apparatus is generated. Payment amount information decryption means,
Amount verification means for comparing and verifying the billing information decrypted by the billing information decryption means and the payment amount information decrypted by the payment amount information decryption means;
A viewing fee decoding apparatus comprising: The content viewing / listening device according to claim 12,
A billing amount indicated by the billing information generated by the billing information extraction means is compared with a billing amount indicated by the billing information decrypted by the viewing fee decrypting device according to claim 14, thereby Billing amount verification means for verifying,
A content viewing apparatus comprising: In a content distribution device that distributes content,
Random number generating means for generating a random number;
The encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 13 is decrypted with the public key and the fee verification parameter generated by the viewing fee decryption device according to claim 14, and the viewing fee is obtained. A payment amount verification means for verifying the payment amount information by comparing with the payment amount information decrypted by the secret key and the random number in the decryption device;
A content distribution apparatus comprising: In a content distribution device that distributes content,
Random number generating means for generating a random number;
The payment amount information decrypted with the private key and the random number by the viewing fee decryption device according to claim 14 is encrypted by encrypting with the public key and the fee verification parameter generated by the viewing fee decryption device. Payment amount verification means for verifying the encrypted payment amount information by generating encrypted payment amount information and comparing with the encrypted payment amount information aggregated by the viewing fee aggregation device according to claim 13;
A content distribution apparatus comprising: In a content viewing apparatus that presents content to a viewer,
Billing information extracting means for generating billing information by extracting information related to a fee from viewing history information of viewing the content;
A viewing fee encryption device comprising: encryption means for generating encrypted billing information by encrypting the billing information with a public key and a random number of a homomorphic public key cryptosystem published in advance;
And random number seed receiving means for receiving a seed for generating the random number;
Random number generating means for generating the random number from the seed received by the random number seed receiving means;
A content viewing apparatus comprising:

Images