JP2009044516A - Generation method of broadcast cipher and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain flexible covering of a client terminal by extending an object of an SD method to a multiple tree and to reduce a size of a broadcast key block. <P>SOLUTION: A client terminal is assigned to an end node of "a" branch tree, a label of absolute value ¾K¾ bits is assigned to all of the nodes of the tree, and the label is generated by using one directional function. The label is assigned to each client terminal, all of the proper client terminals are covered by a plurality of difference trees, a content key is encrypted for each cover prepared, and a broadcast key block is generated by integrating the content keys encrypted. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a broadcast cipher generation method and program using the SD method in a-ary trees.

  In the content distribution service, it is necessary to encrypt and distribute the content for copyright protection. As one of the methods, broadcast encryption is a technique for distributing a content key only to legitimate client terminals.

  Here, the content key is a key for encrypting the distributed content. In the broadcast encryption, a plurality of keys (key bundles) are stored in advance in each client terminal. This key ring is different for each client terminal and is not updated. The key management server encrypts the content key and creates a broadcast key block based on the revoked client terminal list. Distribute the created broadcast key block to each client terminal. The client terminal that has received the broadcast key block attempts to decrypt the content key using a key ring stored in itself. A legitimate client terminal can correctly decrypt the content key from the broadcast key block. On the other hand, the disabled client terminal cannot decrypt the content key from the broadcast key block. FIG. 4 shows a conceptual diagram of broadcast encryption.

  By the way, as the most obvious method for realizing broadcast encryption, there is a method in which individual keys different for each client terminal are stored, and a content key encrypted with each individual key is used as a broadcast key block. However, this method has a problem that the broadcast key block increases in proportion to the total number of client terminals.

  Therefore, as shown in Non-Patent Document 1, a complete subtree method (CS method) has been proposed in which a key is hierarchized based on a tree structure and a broadcast key block is configured. This method has a feature that the size of the broadcast key block can be reduced as compared with the above method. The specific procedure is shown below.

(1) Key allocation method <Procedure 1> Let N be the total number of client terminals. A client terminal is assigned to the terminal node (leaf node) of the a-tree. Here, if not a N = a ^h, legitimate client terminal N number, since it is regarded as placing client terminal disabling a h ^-N (base), of generality as N = a ^h I will not lose. The following description will be made as N = ^{a h.}

<Procedure 2> A key is generated and assigned to each node of the tree structure created in the above procedure.

<Procedure 3> Each client terminal is assigned to each node (leaf node) at the end of the tree.

<Procedure 4> A key is arranged in each client terminal. Here, it is assumed that the client terminal assigned to the leaf node x possesses keys assigned to all nodes on the route from the root node to the leaf node x. In the example of FIG. 5, the leftmost client terminal has keys k ₁ , k ₂ , k _4, and k ₈ assigned to the nodes ₁ , ₂ , _4, and ₈ .

(2) Generation of broadcast key block <Procedure 1> A valid client terminal is covered with a partial tree. In the example of FIG. 5, client terminals other than the invalidated client terminal assigned to the node 12 are covered with three subtrees having nodes 2, 7, and 13 as vertices.

<Procedure 2> The content key is encrypted with the key assigned to the node at the top of the subtree obtained in Procedure 1. A concatenation of a plurality of encrypted content keys obtained here is defined as a broadcast key block. In the example of FIG. 5, the content key K is encrypted with the keys k ₂ , k _7, and k ₁₃ . The broadcast key block BKB is the number 1 obtained by concatenating these encrypted content keys.

Other than the client terminals that are assigned to the node 12 is held at least one key of the key k _2, k ₇ and k _13. Therefore, the content key K can be decrypted from the broadcast key block. On the other hand, since the terminal assigned to the node 12 does not have any of the keys k ₂ , k _7, and k ₁₃ (here, the held keys are k ₁ , k ₃ , k _6, and k ₁₂ ). ) The content key K cannot be decrypted from the broadcast key block.

  However, this method has a problem that the size of the broadcast key block increases depending on the number of invalidated client terminals. That is, if the order of the tree structure is a, the total number of client terminals is N, the number of invalidated client terminals is r, and the size of the content key K is | K |, the size of the broadcast key block is It has been shown.

  Therefore, Non-Patent Document 1 proposes a Subset Difference Method (SD method) that configures a broadcast key block using a difference tree (subset difference tree). In this SD method, it is shown that the size of the broadcast block is a maximum of Formula 3, and the average is Formula 4.

In the SD method, the client terminal uses a cryptographically secure one-way function h: {0, 1} ^{| K |} → {0, 1} ^{3 | K |} . Here, h from the beginning of the (L) | K | those extracted bit _h l (L), the following | K | those extracted bit _h k (L), the last | K | extracted bits This is h _r (L). h _l (L) and h _r (L) are used to derive a label of a child node from a label L of a certain node, and h _k (L) is used to derive a key from the label L. The specific procedure is shown below.

(1) Label allocation processing <Procedure 1> N is the total number of client terminals. A client terminal is assigned to a node (leaf node) at the end of the binary tree. Here, if N = ^2h , N valid client terminals and 2 ^ h−N (invalidated) client terminals may be considered to be arranged, so that N = ^2h is a generality. Not lose. In the following description, N = ^2h .
<Procedure 2> | K | -bit label l (x, x) is arbitrarily assigned to all nodes of the tree. Then, the number of labels 5 is generated using a one-way function. Here, when there is a subtree including node x as a vertex and node y, node y is said to be a descendant of node x. Descendant (x) represents a set of descendants of node x.

<Procedure 3> A label is assigned to the client terminal. The set L of labels held by the client terminal assigned to the leaf node x is as shown in Equation 6 below.

Where Path (i, j) is a set of nodes (including node i and node j) included in the path from node i to node j, and Sibling (i) is the same parent node as node i Is a set of nodes (not including node i). For example, in FIG. 6, Path (1, 8) = {1, 2, 4, 8} and Sibling (4) = {5}. L (ALL) is a label used when there is no invalidated client terminal. In the example of FIG. 6, the client terminal assigned to the leaf node 8 has the following label number 7. Specifically,
l (1,3), l (1,5), l (1,9), l (2,5), l (2,9), l (4.9), l (ALL).

(2) Broadcast key block configuration method <Procedure 1> All valid client terminals are covered with a plurality of difference trees. Here, the difference tree is a tree structure in which a partial tree having a node as a vertex is excluded from a partial tree having a node as a vertex. In the example of FIG. 6, a valid client terminal is covered with only one difference tree. This difference tree is obtained by excluding a partial tree having node 5 as a vertex from a partial tree having node 1 as a vertex.

<Procedure 2> A key is assigned to the obtained difference tree. Here, the content key K is encrypted with the key k (i, j) for the difference tree from which the subtree having the node i as the vertex and the node j as the vertex is excluded. However, k (i, j) is derived from the label l (i, j) by using the one-way function h, using Equation 8.

    A concatenation of a plurality of encryption keys obtained here is a broadcast key block. In the example of FIG. 6, the broadcast key block BKB is expressed by Equation 9.

  For example, the labels held by the client terminals assigned to the node 15 are l (1,2), l (1,6), l (1,14), l (3,6), l (3 , 14), l (7, 14), l (ALL). A key can be derived from these labels using a one-way function, and the content key K can be decrypted. First, the label l (1,5) is derived from the label l (1,2) as Equation 10.

  Next, the key k (1, 5) is derived as Equation 11. On the other hand, the label held by the third client terminal from the left that is invalidated is l (1,3), l (1,4), l (1,11), l (2,4). , L (2,11), l (5,11), l (ALL), but labels l (1,2) and l (1,5) for deriving the key k (1,5) Do not own. For this reason, the content key K cannot be decrypted.

Dalit Naor, Moni Naor, and Jeff Lotspiech, “Revocation and Tracing Schemes for Stateless Receivers,” Proc of Crypt 2001, Lecture Notes in Computer 39. 41-62, 2001.

  However, the above-mentioned CS method targets a general tree structure (a-tree), whereas the SD method targets only a binary tree. There was a problem that it was not done.

  Therefore, the present invention has been made in view of the above-described problems, and by extending the target of the SD method to a multi-way tree, more flexible client terminal coverage can be realized, and the size of the broadcast key block can be reduced. An object of the present invention is to provide a broadcast cipher generation method and program that can be used.

The present invention proposes the following matters in order to solve the above problems.
(1) The present invention is a broadcast cipher generation method using an SD method in a general tree structure (a-tree), and includes a first step of assigning a client terminal to a terminal node of the a-tree, Assigning a label of | K | bits to all nodes of the tree and using a one-way function to generate a label, a third step of assigning a label to each client terminal, and all valid A fourth step of covering the client terminal with a plurality of difference trees, and a fifth step of encrypting a content key for each created cover and concatenating the encrypted content keys to generate a broadcast key block And a broadcast cipher generation method characterized by comprising:

  According to the present invention, a client terminal is allocated to a node at the end of the a-tree, a label of | K | bits is allocated to all nodes of the tree, and a label is generated using a one-way function. Then, a label is assigned to each client terminal, all legitimate client terminals are covered with a plurality of difference trees, a content key is encrypted for each created cover, and the encrypted content keys are concatenated and broadcast. Generate a key block. Therefore, the SD method can be applied to a general tree structure and the size of the broadcast key block can be reduced.

(2) In the present invention, in the broadcast cipher generation method of (1), the one-way function is a function that outputs n + 1 times the label length n, and | K | from the head of h (L) H ₁ (L) from which the bit is extracted, h ₂ (L) from which the next | K | bit is extracted, h ₃ (L) from which the next | K | bit is extracted, (A-1) | K | +1 bit to a | K | bit are extracted as h _a (L), and the last | K | bit is extracted as h _k (L). Sometimes h ₁ (L), h ₂ (L),..., H _a (L) are used to derive the label of a child node from the label L of a node, and h _k (L) is used as the label L A method for generating broadcast ciphers, which is used to derive content keys from To have.

According to the present invention, the one-way function is a function that outputs n + 1 times the label length n, and h ₁ (L) is obtained by extracting | K | bits from the head of h (L). From which the | K | bit is extracted, h ₂ (L), and the next | K | bit is extracted from h ₃ (L),..., (A-1) | K | a | K | those extracted to bit _h a (L), the last | K | those extracted _bit, when set to _{h k (L), h 1} (L), h 2 (L ), ..., from the label L of the nodes in the h a _(L), used to derive the label of the child nodes, it is used to derive the content key h k a _(L) from the label L. Therefore, the content key can be decrypted by using the one-way function from the label held by each client terminal.

  (3) The present invention is a program for causing a computer to execute a broadcast cipher generation method using the SD method in a general tree structure (a tree), and a client terminal is connected to a node at the end of the a tree. A second step of assigning a label of | K | bits to all nodes of the tree and generating a label using a one-way function, and a third step of assigning a label to each client terminal A fourth step of covering all legitimate client terminals with a plurality of difference trees, encrypting a content key for each created cover, and concatenating the encrypted content keys to a broadcast key A program for causing a computer to execute a fifth step of generating a block is proposed.

  According to the present invention, a client terminal is allocated to a node at the end of the a-tree, a label of | K | bits is allocated to all nodes of the tree, and a label is generated using a one-way function. Then, a label is assigned to each client terminal, all legitimate client terminals are covered with a plurality of difference trees, a content key is encrypted for each created cover, and the encrypted content keys are concatenated and broadcast. Generate a key block. Therefore, the SD method can be applied to a general tree structure and the size of the broadcast key block can be reduced.

(4) In the present invention, in the program of (3), the one-way function is a function that outputs n + 1 times the label length n, and | K | bits are extracted from the head of h (L) H ₁ (L), the next | K | bit extracted, h ₂ (L), the next | K | bit extracted h ₃ (L), (a-1) ) | K | +1 bit to a | K | th bit are extracted as h _a (L), and the last extracted | K | bit is set as h _k (L). ₁ (L), h ₂ (L),..., H _a (L) are used to derive the label of the child node from the label L of a certain node, and h _k (L) is used as the content key from the label L. We propose a program that is characterized by being used for deriving.

According to the present invention, the one-way function is a function that outputs n + 1 times the label length n, and h ₁ (L) is obtained by extracting | K | bits from the head of h (L). From which the | K | bit is extracted, h ₂ (L), and the next | K | bit is extracted from h ₃ (L),..., (A-1) | K | a | K | those extracted to bit _h a (L), the last | K | those extracted _bit, when set to _{h k (L), h 1} (L), h 2 (L ,..., H _a (L) is used to derive the label of the child node from the label L of a certain node, and h _k (L) is used to derive the content key from the label L. Therefore, the content key can be decrypted by using the one-way function from the label held by each client terminal.

  According to the present invention, by extending the target of the SD method to a multi-way tree, it is possible to realize more flexible client terminal coverage and to reduce the size of the broadcast key block.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

  A broadcast cipher generation method according to the present embodiment will be described with reference to FIG.

(1) Label allocation processing <Step S101>
First, let N be the total number of client terminals. Then, a client terminal is assigned to the terminal node (leaf node) of the a-ary tree. Here, if not a N = a ^h, legitimate client terminal N number, since it is regarded as placing client terminal disabling a h ^-N (base), generality and N = a ^h Not lose. The following description is made with N = ^{a h.}

<Step S102>
Arbitrarily assign | K | -bit label l (x, x) to all nodes in the tree. Thereafter, a label is generated as shown in Expression 12 using a one-way function.

<Step S103>
Assign a label to the client terminal. A set L of labels held by the client terminal assigned to the leaf node x is expressed by Equation 13.

(2) Broadcast key block configuration method <step S104>
All valid client terminals are covered with a plurality of difference trees. The difference tree in this method is a node y ₁ , y ₂ ,..., Y _m that is a descendant of the node x from a subtree having the node x as a vertex (where 1 ≦ m ≦ a−1) This is a tree structure excluding a subtree having a vertex at. Here, it is assumed that the nodes y ₁ , y ₂ ,..., Y _m have the same node as a parent node. That is, these nodes are in a sibling positional relationship.

<Step S105>
Create a broadcast key block. The content key is encrypted for each cover created in step S104. Here, an apex node x, the node y _1, y _2, · · ·, to produce a number 14 keys follows for differential trees excluding subtree whose vertices y _m. Next, the content key is encrypted using the generated key. All these encrypted content keys are concatenated to form a broadcast key block.

  Therefore, according to the broadcast cipher generation method according to the present embodiment, the SD method can be applied to a general tree structure, and the size of the broadcast key block can be reduced.

<Example>
Next, referring to FIG. 2 and FIG. 3, an embodiment taking the case of a quadtree as an example will be shown.
In the two examples, it is assumed that the following labels are assigned to each client terminal as a precondition.
c1: l (1,3), l (1,4), l (1,5), l (1,7), l (1,8), l (1,9), l (2,7) , L (2,8), l (2,9), l (ALL)
c2: l (1,3), l (1,4), l (1,5), l (1,6), l (1,8), l (1,9), l (2,6) , L (2,8), l (2,9), l (ALL)
c3: l (1,3), l (1,4), l (1,5), l (1,6), l (1,7), l (1,9), l (2,6) , L (2,7), l (2,9), l (ALL)
c4: l (1,3), l (1,4), l (1,5), l (1,6), l (1,7), l (1,8), l (2,6) , L (2,7), l (2,8), l (ALL)
c5: l (1,2), l (1,4), l (1,5), l (1,11), l (1,12), l (1,13), l (3,11) , L (3, 12), l (3, 13), l (ALL)
c6: l (1,2), l (1,4), l (1,5), l (1,10), l (1,12), l (1,13), l (3,10) , L (3, 12), l (3, 13), l (ALL)
c7: l (1,2), l (1,4), l (1,5), l (1,10), l (1,11), l (1,13), l (3,10) , L (3, 11), l (3, 13), l (ALL)
c8: l (1,2), l (1,4), l (1,5), l (1,10), l (1,11), l (1,12), l (3,10) , L (3, 11), l (3, 12), l (ALL)
c9: l (1,2), l (1,3), l (1,5), l (1,15), l (1,16), l (1,17), l (4,15) , l (4,16), l (4,17), l (ALL)
c10: l (1,2), l (1,3), l (1,5), l (1,14), l (1,16), l (1,17), l (4,14) , L (4, 16), l (4, 17), l (ALL)
c11: l (1,2), l (1,3), l (1,5), l (1,14), l (1,15), l (1,17), l (4,14) , L (4, 15), l (4, 17), l (ALL)
c12: l (1,2), l (1,3), l (1,5), l (1,14), l (1,15), l (1,16), l (4,14) , L (4, 15), l (4, 16), l (ALL)
c13: l (1,2), l (1,3), l (1,4), l (1,19), l (1,20), l (1,21), l (5,19) , L (5, 20), l (5, 21), l (ALL)
c14: l (1,2), l (1,3), l (1,4), l (1,18), l (1,20), l (1,21), l (5,18) , L (5, 20), l (5, 21), l (ALL)
c15: l (1,2), l (1,3), l (1,4), l (1,18), l (1,19), l (1,21), l (5,18) , L (5, 19), l (5, 21), l (ALL)
c16: l (1,2), l (1,3), l (1,4), l (1,18), l (1,19), l (1,20), l (5,18) , L (5, 19), l (5, 20), l (ALL)

<Example 1>
In FIG. 2, c3, c6, c8, c10, c11, c12 and c13 are invalid client terminals, and the other terminals are valid terminals. In this case, a valid client terminal is covered with four difference trees.
At this time, the broadcast key block BKB is as shown in Equation 15.

  Here, since the legitimate client terminals C1, c2, and c4 have the label l (2, 8), the key k (2, 8) is obtained from this label by using the one-way function. Thus, the content key can be decrypted.

  Further, since the legitimate client terminals c5 and c7 have both the label l (3, 11) and the label l (3, 13), a key is calculated from these labels using a one-way function. The content key can be decrypted as shown in FIG.

  Also, since the legitimate client terminal c9 has all the labels l (4,15), l (4,16) and l (4,17), the 18 Thus, the content key can be decrypted.

  Further, since the legitimate client terminals c14, c15, and c16 have the label l (5, 18), the key k (5, 18) is expressed by the following equation 19 using the one-way function. And the content key can be decrypted.

  On the other hand, the disabled client terminal c3 does not hold the label l (2,8), and therefore cannot derive the key k (2,8). Also, since none of the labels l (3, *), l (4, *), l (5, *) (* is an arbitrary integer) is held, the key (Expression 20), the key (Expression 21), and the key None of k (5, 8) can be derived. Therefore, the content key cannot be decrypted.

  In addition, the revoked client terminals c6 and c8 have only one of the label l (3, 11) and the label l (3, 13). Therefore, the keys (both 22) ) Cannot be derived. Also, since none of the label l (2, *), label l (4, *) and label l (5, *) (* is an arbitrary integer) is held, the key k (2, 8), the key (number Neither 23) nor the key k (5, 8) can be derived. Therefore, the content key cannot be decrypted.

  Furthermore, the invalidated client terminals c10, c11, and c12 have only two of label l (4, 15), label l (4, 16), and label l (4, 17). A key (Equation 24) that requires all three labels cannot be derived. Also, since none of the label l (2, *), label l (3, *) and label l (5, *) (* is an arbitrary integer) is held, the key k (2, 8), the key (number 25) and key k (5, 8) cannot be derived. Therefore, the content key cannot be decrypted.

  Further, the invalidated client terminal c13 does not have the label l (5, 18), and therefore cannot derive the key k (5, 18). Also, since none of the label l (2, *), label l (3, *) and label l (4, *) (* is an arbitrary integer) is held, the key k (2,8), the key (number Neither 26) nor the key (Equation 27) can be derived. Therefore, the content key cannot be decrypted.

<Example 2>
In FIG. 3, c13 and c14 are disabled client terminals, and the other terminals are valid terminals. In this case, a valid client terminal is covered with two difference trees. At this time, the broadcast key block BKB is as shown in Equation 28.

  Since the legitimate client terminals c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11 and c12 have the label l (1, 5), the one-way function is derived from this label. The key (Equation 29) can be derived from Equation 30 using, and the content key can be decrypted.

  Further, since the legitimate client terminals c15 and c16 have both the label l (1,18) and the label l (1,19), the key (Equation 31) is used from these labels using a one-way function. ) Can be derived from Equation 32 to decrypt the content key.

  On the other hand, since the revoked client terminals c13 and c14 have only one of the label l (1,18) and the label l (1,19), a key that requires both of these labels for derivation ( Equation 33) cannot be derived. Further, since the label l (1,5) is not held, the label l (1,18) or l (1,19) cannot be derived. Therefore, the content key cannot be decrypted.

  The broadcast cipher generation method of the present invention is realized by recording the process of the broadcast cipher generation method on a computer-readable recording medium, causing the apparatus to read and execute the program recorded on the recording medium. Can do. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a processing flow concerning this embodiment. It is explanatory drawing which illustrated the quadtree type | mold SD method as an Example. It is explanatory drawing which illustrated the quadtree type | mold SD method as an Example. It is a conceptual diagram of the broadcast encryption which concerns on a prior art example. It is a conceptual diagram of CS method concerning a prior art example. It is a conceptual diagram of SD method concerning a prior art example.

Claims (4)

A method of generating a broadcast cipher using the SD method in a general tree structure (a branch tree),
A first step of assigning a client terminal to a terminal node of the a-tree;
Assigning a label of | K | bits to all nodes of the tree and generating a label using a one-way function;
A third step of assigning labels to each client terminal;
A fourth step of covering all valid client terminals with a plurality of difference trees;
A fifth step of encrypting a content key for each created cover and concatenating the encrypted content keys to generate a broadcast key block;
A broadcast cipher generation method characterized by comprising: The one-way function is a function that outputs n + 1 times the label length n. H ₁ (L) is obtained by extracting | K | bits from the head of h (L), and the next | K | bits. H ₂ (L) is extracted from the next bit, h ₃ (L) is extracted from the next | K | bit, and (a-1) | K | +1 bit to a | K | H ₁ (L), h ₂ (L),..., Where h _a (L) is the one extracted to the eye, and h _k (L) is the last | K | bit extracted. , H _a (L) is used for deriving a label of a child node from a label L of a certain node, and h _k (L) is used for deriving a content key from the label L. The broadcast cipher generation method described. A program for causing a computer to execute a broadcast cipher generation method using the SD method in a general tree structure (a branch tree),
A first step of assigning a client terminal to a terminal node of the a-tree;
Assigning a label of | K | bits to all nodes of the tree and generating a label using a one-way function;
A third step of assigning labels to each client terminal;
A fourth step of covering all valid client terminals with a plurality of difference trees;
A fifth step of encrypting a content key for each created cover and concatenating the encrypted content keys to generate a broadcast key block;
A program that causes a computer to execute. The one-way function is a function that outputs n + 1 times the label length n. H ₁ (L) is obtained by extracting | K | bits from the head of h (L), and the next | K | bits. H ₂ (L) is extracted from the next bit, h ₃ (L) is extracted from the next | K | bit, and (a-1) | K | +1 bit to a | K | H ₁ (L), h ₂ (L),..., Where h _a (L) is the one extracted to the eye, and h _k (L) is the last | K | bit extracted. , H _a (L) is used to derive a label of a child node from a label L of a certain node, and h _k (L) is used to derive a content key from the label L. The listed program.

Images