JP3982013B2 - Access control information generating apparatus and method - Google Patents

Description

利用者Ｕのトークンはτ’を出力する。
２）利用者プログラムＰは、以下の計算を行い、暗号鍵Ｋを取り出す。
【００５０】
【数２１】
Ｋｓ＝ｒ^-1τ’ ｍｏｄ ｎ （１３）
３）取り出した鍵Ｋｓにより、利用者プログラムＰは暗号化されたコンテンツの復号を行い、コンテンツの利用を行う。
【００５１】
δｕｓは、利用者毎に異なる秘密情報ｄｕと、コンテンツ毎に異なるＤｓとから生成されるので、利用者およびコンテンツ毎に異なるアクセス制御を容易にかつ確実に実現することができる。
【００５２】
ＲＳＡ暗号を用いる場合
ＲＳＡ暗号を用いる場合、上記のＲａｂｉｎ暗号を用いる場合に対し、トークン発行と、利用者の秘密情報の取り出し方が異なる。
【００５３】
（準備）
センタは、トークン発行時、ＲＳＡ公開鍵暗号の手法にしたがって、管理者ＭＡの秘密鍵ｄｍと、これに対応する公開鍵ｅｍ（法をｎ_mとする）とを生成する。センタは、ｄｍを管理者ＭＡのトークンＴｍに封じ込めて管理者ＭＡに発行する。ｅｍは公開情報とする。さらに、利用者毎に固有の秘密鍵ｄｕを生成し、これを利用者のトークンに封じ込めて利用者に発行する。
【００５４】
（利用者の秘密情報の取り出し）
利用者のトークンＴｕは、管理者ＭＡの公開鍵ｅｍで、利用者の秘密鍵ｄｕを
【００５５】
【数２２】
Ｃ＝ｄｕ^em ｍｏｄ ｎ_m （１４）
のように暗号化しそれを管理者に送付する。管理者ＭＡのトークンは、秘密鍵ｄｍで、これを復号し、利用者の秘密鍵を得る。
【００５６】
【数２３】
ｄｕ＝Ｃ^dm ｍｏｄ ｎ_m （１５）
【００５７】
アクセス制御情報の生成、コンテンツの施錠、およびアクセス制御の手順はＲａｂｉｎ暗号を用いた場合と同様であり、説明を繰り返さない。
【００５８】
［アクセス制御情報生成装置の構成］
つぎに、本発明によるアクセス制御情報生成装置の構成について説明する。本実施例においては、アクセス制御情報生成装置はコンテンツの管理者のトークンとして実現される。図１に本発明によるアクセス制御情報生成装置１０８の基本構成を示す。図１において、アクセス制御情報生成装置１０８は、利用者の公開情報１０１および資源に関する情報１０２を受け取ってアクセス制御情報１０９を出力するものである。アクセス制御情報生成装置１０８は、情報入力部１０３、利用者秘密情報生成部１０４、データバス１０５、アクセス制御情報生成部１０６、情報出力部１０７および内部情報記憶部１１０を含んで構成されている。
【００５９】
この構成において、情報入力部１０３から入力された利用者の情報１０１は、データバス１０５を経由して利用者秘密情報生成部１０４に送られる。利用者秘密情報生成部１０４は、利用者の情報１０１から利用者の秘密情報を生成する。例えば、利用者の秘密情報として、利用者の秘密鍵ｄｕを生成することを考える。この場合、公知の技術であるＲＳＡ（Ｒｉｖｅｓｔ−Ｓｈａｍｉｒ−Ａｄｅｌｍａｎ）暗号を利用することができる。利用者の情報として、ｄｕをアクセス制御情報生成装置１０８の所有者である管理者（以下、単に管理者という）の公開鍵Ｅｍ（法数ｎ_m）を用いて、暗号化したＣを入力する。すなわち、
【００６０】
【数２４】
Ｃ＝ｄｕ^Em ｍｏｄ ｎ_m
となる。利用者の情報として、Ｃとｎ_mを情報入力部１０３に入力する。入力されたＣとｎ_mはデータバス１０５を経由して利用者秘密情報生成部１０４に送られる。利用者秘密情報生成部１０４では、内部情報記憶部１１０に記憶された管理者の秘密鍵開鍵Ｄｍを用いて、Ｃを
【００６１】
【数２５】
ｄｕ＝Ｃ^Dm ｍｏｄ ｎ_m
のように、復号し、利用者の秘密情報ｄｕを生成する。ここで、Ｅｍ、Ｄｍは、ＲＳＡ公開鍵方式に基づいて生成された鍵ペアであり、
【００６２】
【数２６】
Ｅｍ・Ｄｍ≡１ ｍｏｄ Φ（ｎ_m）
である。ただしΦ（ｎ_m）はｎ_mのオイラー数である。
【００６３】
生成された利用者の秘密情報はデータバス１０５経由でアクセス制御情報制御部１０６に送られる。さらに情報入力部１０３から入力された資源に関する情報１０２もデータバス１０５経由でアクセス制御情報制御部１０６に送られる。アクセス制御情報制御部１０６は、利用者の秘密情報と資源に関する情報１０２からアクセス制御情報１０９を生成する。具体的には、前述のｄｕと、資源に関する情報としてＤｓを用いて、アクセス制御情報δｕｓを、
【００６４】
【数２７】
δｕｓ＝Ｄｓ−ｄｕ
のように計算する。ここでＤｓは、ある法数ｎを用いて、
【００６５】
【数２８】
Ｅｓ・Ｄｓ≡１Φ（ｎ）
のように生成された数であり、Ｅｓは、コンテンツの施錠に用いられる。
【００６６】
図２に本発明によるアクセス情報生成装置１０８の別の構成例を示す。図２において、図１と対応する箇所には対応する符号を付して詳細な説明を省略する。資源情報生成部２０１を設け、資源情報２０２をアクセス制御情報生成装置１０８内で生成するようにしている。
【００６７】
この構成において、利用者の秘密情報を生成するための動作は図１の場合と同様である。資源情報生成部２０１では、資源情報２０２を生成する。具体的には、まず法数ｎを生成する。次にＥｓを生成し、引き続き、
【００６８】
【数２９】
Ｅｓ・Ｄｓ≡１ ｍｏｄ ｎ
となるＤｓを例えばユークリッドの互除法を用いて生成する。生成されたＤｓはデータバスを経由し、アクセス制御情報生成部１０６に送られる。アクセス制御情報生成部１０６では前述のようにアクセス制御情報１０９を生成し出力する。さらに、Ｅｓを生成された資源情報２０２として、出力する。管理者は出力されたＥｓを用いてコンテンツに施錠する。
【００６９】
図３に、本発明によるアクセス制御情報生成装置１０８のもう１つ別の構成例を示す。この構成例においては、利用者の公開情報１０１および資源に関する情報１０２を受け取って、アクセス制御情報１０９および資源情報２０２を生成する。図３においても、図１または図２と対応する箇所には対応する符号を付した。
【００７０】
この構成において、利用者の秘密情報を生成するための動作は図１および図２の場合と同様である。資源に関する情報１０２として、Ｄｓと法数ｎを入力する。入力されたＤｓはデータバス１０５を経由して、資源情報生成部２０１に送られる。資源情報生成部２０１では、Ｄｓに対応するＥｓを資源情報２０２として、生成する。具体的には、
【００７１】
【数３０】
Ｅｓ・Ｄｓ≡１ ｍｏｄ ｎ
となるＥｓを例えばユークリッドの互除法を用いて生成する。入力されたＤｓはデータバス１０５を経由し、アクセス制御情報生成部１０６に送られる。アクセス制御情報生成部１０６では前述のようにアクセス制御情報１０９を生成し出力する。さらに、生成されたＥｓを生成された資源情報２０２として出力する。
【００７２】
図４に資源に関する情報の一構成例を示す。図４において、１０２は資源に関する情報、４０１は第一の資源情報、４０２は第二の資源情報である。第一の資源情報には、前述の、Ｅｓ、Ｄｓのいずれか一方が相当する。例えば、図１の構成ではＤｓとなり、図３の構成ではＥｓとなる。第二の資源情報は、資源の利用方法を記述した情報である。具体的には、有効期限、利用料金、有効利用回数、などが挙がられる。また図３において、資源に関する情報として、この第二の資源情報のみを入力し、ＥｓとＤｓの双方を図２の構成例のように生成するように構成しても良い。
【００７３】
図５にアクセス制御情報生成部１０６の一構成例を示す。図５において、アクセス制御情報生成部１０６は、内部データバス５０１、データ変換部５０２、および情報生成部５０３を含んで構成されている。なお、この図において、図１〜図３に対応する箇所には対応する符号を付した。
【００７４】
この構成において、データバス１０５経由で入力された利用者の秘密情報および資源に関連する情報１０２は、内部データバス５０１経由でデータ変換部５０２に送られる。ここでは入力に対し、一方向変換Ｆ（）を施して、その結果を情報生成部５０３に送る。情報生成部５０３では、送られてきた一方向変換の結果と、データバス１０５および内部データバスを経由して送られてきた資源に関する情報とから、前述のように、アクセス制御情報１０６を生成する。例えば、利用者の秘密情報をｄｕとする。また、資源に関する情報として、Ｅｓ，Ｄｓに対応する法数ｎと、前述の資源の利用方法を記述する情報Ｌとを採用する。そしてこれら利用者の秘密情報ｄｕと資源に関する情報ｎ、Ｌとをビット連結したものを引数としてＦ（）を計算し、その計算結果を出力する。当該出力は内部データバス５０１経由で、情報生成部５０３に送られ、前述のＤｓをともに用いて、アクセス制御情報を生成する。生成されたアクセス制御情報は内部データバス５０１、およびデータバス１０５を経由して当該装置から出力される。この場合、アクセス制御情報δｕｓは以下のようになる。
【００７５】
【数３１】
δｕｓ＝Ｄｓ−Ｆ（ｎ，Ｌ，ｄｕ）
ここで、具体的に一方向変換Ｆ（）としては、一方向ハッシュ関数（例えば、ＭＤ５、ＳＨＡなど）、あるいは慣用鍵暗号（ＤＥＳ、ＩＤＥＡ）などを用いることができるが、その出力のビット数がＤｓのビット数と同程度となることが望ましい。
【００７６】
図６にアクセス制御情報生成装置（管理者用のトークン）１０８の利用者秘密情報生成部１０４の一構成例を示す。図６において、利用者秘密情報生成部１０４は、内部データバス６０１、共通情報記憶部６０２、およびデータ処理部６０３を含んで構成されている。なお、この図において、図１〜図３に対応する箇所には対応する符号を付した。
【００７７】
この構成において、共通情報記憶部６０３には、利用者用アクセス制御装置（利用者のトークン）を利用者に発行する際、発行者（具体例としては前述のセンタ）が、素数ｐ，ｑをあらかじめ生成しておいて、封じ込める。利用者の情報１０２として、Ｒａｂｉｎ暗号を用いた場合の公開情報Ｐｕ，Ｓｕを、
【００７８】
【数３２】
Ｐｕ＝ｄｕ＋ｒ
Ｓｕ＝ｄｕ・ｒ
と構成する。ただしｒは乱数、ｄｕは利用者の秘密情報とする。このＰｕ，Ｓｕを利用者の情報１０２として、データバス１０５および内部データバス６０１を経由して入力する。データ処理部６０３では、Ｐｕ、Ｓｕ，ｐ，ｑからＲａｂｉｎ暗号の手法により利用者の秘密情報ｄｕを取り出す。取り出されたｄｕは、内部データバスを経由して、データバスに出力される。
【００７９】
［変形例］
つぎに上述の実施例の変形例について説明する。
（共通情報の構成）
まず、トークン内に格納される共通情報ｐ，ｑについては、外部からのアクセスを禁じてもよい。あるいは、別の構成として、特別な条件、例えばセンタの認証を行ったのち、読み出し、書き込みが可能なように構成してもよい。
【００８０】
Φ（ｎ）は、共通情報に含め、トークン内にあらかじめ封じ込めておいてもよいし、必要に応じて共通情報のｐ，ｑを用いて、
【００８１】
【数３３】
Φ（ｎ）＝（ｐ−１）（ｑ−１）
のように計算するように構成しても良い。
【００８２】
前記実施例においては、Ｐｕ，Ｓｕを、トークンを発行するセンタが保持しておいて、リクエストに応じて送信することを前提にした構成であった。別の構成例として、利用者のトークン内で、以下のように生成してもよい。すなわち、利用者のトークンは、乱数ｅを新たに生成する。生成した乱数ｅと秘密鍵ｄｕとを用いて、Ｐｕ，Ｓｕを
【００８３】
【数３４】
Ｐｕ＝ｄｕ＋ｅ ｍｏｄ ｎ （２）
Ｓｕ＝ｄｕ・ｅ ｍｏｄ ｎ （３）
のように生成する。
【００８４】
また、さらに他の構成例としては、センタが、あらかじめ計算したＰｕ、Ｓｕを利用者のトークンのみに封じ込めて発行してもよい、
【００８５】
（アクセス制御処理の別構成例）
コンテンツへのアクセスを行う際、トークンは、一般的に計算能力がそれほど高くないため、すべての計算をトークンで行わず、以下のようにトークン外で、例えば、利用者のもつプログラムで行う構成にしてもよい。
１）利用者のトークンは受け取ったＫ’’に対し、以下の計算を行う。
【００８６】
【数３５】
τ＝Ｋ’’^F(n,L,du) ｍｏｄ ｎ
利用者のトークンはτを出力する。
２）利用者のプログラムは、トークンから出力されたτに対し、以下の計算を行う。
【００８７】
【数３６】

３）利用者のプログラム（またはそれから呼び出される認証プログラム）は、以下の計算を行い、暗号鍵Ｋを取り出し、暗号化されたコンテンツの復号を行う。
【００８８】
【数３７】
Ｋ＝ｒ^-1τ’ ｍｏｄ ｎ
また、コンテンツの復号を行う際、アクセス制御部または装置内部でＫを用いてコンテンツを復号するように構成してもよい。
【００８９】
（集中管理型の構成例）
本発明では、従来例に対して、利用者の情報を一個所で集中的に管理する必要がないように構成されているが、従来と同様、利用者の情報を集中的に管理する構成もとることができる。例えば、利用者とコンテンツの情報を集中管理する一構成例は以下のようになる。
【００９０】
センタで利用者の情報を一括管理することを前提にする。各エンティティの役割は次の通りである。
【００９１】
▲１▼センタは、本発明に基づいた必要な情報を生成し、それらを必要に応じてトークンに封じ込める。さらに管理者および利用者毎に、必要に応じて固有の情報も封じ込め、それぞれに固有のトークンを発行する。さらにセンタは各利用者、および各管理者の名前、および発行したトークンとそれに封じ込めた固有の情報をデータベースに登録する。
【００９２】
▲２▼コンテンツの管理者は、管理対象とするコンテンツをセンタに登録する。センタは登録したコンテンツ毎に、Ｅｓ，Ｄｓおよび法数ｎを生成し、Ｅｓとｎを管理者に送付する。センタは生成したＥｓ，Ｄｓおよび法数ｎと対応するコンテンツをデータベースに登録する。
管理者は送付されたＥｓを用いて、コンテンツを施錠する。
【００９３】
▲３▼利用者は、コンテンツの利用要求をセンタに送る。センタはコンテンツのデータベースを検索し、Ｄｓを取り出す。さらに利用者のデータベースを検索して、利用者の秘密情報ｄｕを取りだす。センタは取り出されたＤｓと、ｄｕを用いて、アクセス制御情報δｕｓを
【００９４】
【数３８】
δｕｓ＝Ｄｓ−ｄｕ
のように生成し、δｕｓを利用者に送付する。利用者は、このδｕｓを用いてコンテンツにアクセスする。
【００９５】
【発明の効果】
以上説明したように、本発明によれば、管理者は、利用者からの要求に応じて、利用者ごとのアクセス制御情報を単独で生成して、アクセス制御を実現できる。また、生成されたアクセス制御情報は、利用者固有の情報を用いて生成するようにするので、正当な利用者以外の利用者では使用することが不可能になり、正当な利用者のみのアクセスが実現可能となっている。さらに、生成されたアクセス制御情報と資源とを利用者の環境に置けば、資源の利用ができるように構成されているので、資源の利用時に管理者の環境すなわちホストコンピュータあるいはサーバにアクセスする必要がなく、オフラインでの資源の利用が可能となる。
【図面の簡単な説明】
【図１】 本発明の実施例のアクセス制御情報生成装置の構成例を示すブロック図である。
【図２】 上述アクセス制御情報生成装置の他の構成例を示すブロック図である。
【図３】上述アクセス制御情報生成装置の他のもう１つの構成例を示すブロック図である。
【図４】 上述アクセス制御情報生成装置で用いる資源に関する情報を説明する図である。
【図５】 上述アクセス制御情報生成装置のアクセス制御情報生成部の構成例を示すブロック図である。
【図６】 上述アクセス制御情報生成装置の利用者秘密情報生成部の構成例を示すブロック図である。
【符号の説明】
１０１ 利用者の公開情報
１０２ 資源に関する情報
１０３ 情報入力部
１０４ 利用者秘密情報生成部
１０５ データバス
１０６ アクセス制御情報生成部
１０７ 情報出力部
１０８ アクセス制御情報生成装置
１０９ アクセス制御情報
１１０ 内部情報記憶部
２０１ 資源情報生成部
２０２ 生成された資源情報[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a technique for controlling user access.
[0002]
[Prior art]
As a technique for controlling user access to information, for example, there is a technique described in Japanese Patent Laid-Open No. 4-157555 (referred to as prior art document [1]). In this technique, an access control system is configured by a user and a host computer that holds access control information of the user, a terminal that is connected online to the host computer, and an ID card reader provided in the terminal. Actual access control is performed as follows. The user first inserts his / her ID card into the ID card reader. The user ID information stored in the ID card is read by an ID card reader. The terminal performs online connection with the host computer and sends the read user ID information to the host computer. The host computer retrieves the user access control information from the user ID. Only in the range corresponding to the access control information obtained as a result of the search, the user is permitted and controlled to access the information on the host computer.
[0003]
As a similar technique, there is “kerberos” shown in UNIX Magazine in April 1995, p96-103 (referred to as prior art document [2]). This system includes a kerberos server that authenticates a user, a ticket issuing server that issues access control information for information called a ticket or service, and a server that holds the service or information.
[0004]
Actual access control will be described by taking as an example a case where a user uses a service or information on a server A. The user first logs into the kerberos server. If the login is successful, user authentication information called an initial ticket is issued. Next, the user sends an access request to the server A to the ticket issuing server together with the initial ticket. The ticket issuing server verifies the sent ticket and issues a ticket which is access control information for the service or information on the server A only when it is valid. The user issues a request for access to the service or information to the server A together with the issued ticket. The server A verifies the ticket and permits the user to access the service or information on the server A only when it is valid.
[0005]
[Problems to be solved by the invention]
Since the conventional technology is configured as described above, it is necessary to centrally manage the user and the service or information provided to the user. That is, in the prior art document [1], the user ID and access control information are held on the host computer. In the prior art document [2], the user ID information must be managed by the kerberos server, and the service or information must be managed by the ticket issuing server. For this reason, if it is going to perform access control with respect to information or a service newly, it will cost very much. That is, in the prior art document [1], it is necessary to request the administrator of the host computer to newly register access control information for services or information newly in the access control information held on the host computer. Further, in the prior art document [2], the service or information must be additionally registered in the server registered in the ticket issuing server, and the added service or information must be registered in the ticket server.
[0006]
Furthermore, access control information can be issued only to users who have already been managed. As a result, when an access permission is to be given to a new user, it is necessary to register the user.
[0007]
Therefore, if the number of users and the number of services and information subject to access control increase, a large burden is placed on the host computer, the server, and its manager.
[0008]
[Means for Solving the Problems]
In the present invention, a service or information manager uniquely determines access control information for each user from information related to the service or information, information held or generated by the manager, and user information. The above-mentioned problems are solved by providing means that can be easily generated. That is, the service or information manager can realize access control by generating access control information for each user independently in response to a request from the user. In addition, according to the present invention, the generated access control information is generated using user-specific information, so that it is impossible for a user other than a valid user to use it. Only legitimate users can access. Furthermore, according to the present invention, since the resource can be used if the generated access control information and the resource are held in the user's environment, the environment of the administrator, that is, the host computer when the resource is used. Alternatively, it is not necessary to access the server, and resources can be used offline.
[0009]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiments according to the present invention will be described in detail below. First, the outline of the configuration of the embodiment will be described, and then the outline of the operation will be described. Thereafter, the details of the configuration and operation will be described with reference to the drawings.
[0010]
[Outline]
As a premise, a situation is considered in which an administrator who possesses some information, device, or resource (hereinafter collectively referred to as content) controls user access to it. In the embodiment according to the present invention, there are three entities: administrator, user and center. Assume that an administrator and a user have an access control device based on the present invention called a “token”. The token securely holds information unique to its owner and information necessary for access control. As the token, a portable storage medium is used, and is actually realized by a floppy disk, an IC card, an optical card, a magnetic card, or the like.
[0011]
The role of each entity is as follows.
(1) The center generates necessary information based on the present invention and encloses them in a token as necessary. Furthermore, for each administrator and user, unique information is contained as necessary, and a unique token is issued for each.
(2) The administrator owns the content and controls the user's access to it.
(3) The user uses the content using his / her token.
[0012]
The user secretly provides the user's own secret information secretly to the content administrator who wants to use (the content manager is also kept secret). The administrator uses the user's own secret information (maintained in a secret state with respect to the administrator) and the information given by the administrator for each individual content related to the content. Access control information for controlling access to the content of the user is generated and sent to the user. By using the sent access control information, the user can access the content and can use the content.
[0013]
[Background technology]
In the present invention, it is necessary to secretly share the user's own secret information secretly between the user and the administrator. In such a case, a public key encryption technique that is a publicly known technique can be used. Among the public key encryption techniques, the Rabin encryption and the RSA encryption will be briefly described.
[0014]
Rabin cipher
Assume that the sender wants to secretly send information M to the receiver. As preparation, the following information is generated.
[0015]
[Expression 1]
Prime number: p, q where p≡q≡3 mod 4
Common modulus: n = p · q
n is public information. p and q are secret constants other than the sender and receiver. N, p, and q are shared by the sender and the receiver.
[0016]
The information sender calculates the information Pu and Su from the information M to be transmitted as follows. The sender generates a random number e,
[0017]
[Expression 2]
Pu = M + e mod n
Su = M · e mod n
The sender sends Pu and Su as ciphertext to the receiver.
[0018]
The receiver solves the following equation:
[0019]
[Equation 3]
X²+ Pu · X + Su≡0 mod n (1)
A third party who does not know p and q cannot solve Equation (1) in terms of computational complexity. Furthermore, since M and e are the solutions of equation (1), only the receiver who shares p and q with the sender can solve equation (1) and decrypt the ciphertext.
[0020]
Now, consider solving equation (1). As described above, since p and q are taken as p≡q≡3 mod 4, what knows p and q is
[0021]
[Expression 4]
x²≡4^-1(Su²-4Pu) mod n
Solution η₁, Η₂, Η_Three, Η_FourA = 4^-1(Su²-4 Pu)
[0022]
[Equation 5]
η₁≡a^{(p + 1) / 4}≡a^{(q + 1) / 4}
η₂≡a^{(p + 1) / 4}≡-a^{(q + 1) / 4}
η_Three≡-a^{(p + 1) / 4}≡a^{(q + 1) / 4}
η_Four≡-a^{(p + 1) / 4}≡-a^{(q + 1) / 4}
You can ask for it. Using this, the receiver who knows p and q can solve the equation (1) ξ₁, Ξ₂, Ξ_Three, Ξ_FourThe
[0023]
[Formula 6]
ξ₁≡2^-1Su + η₁  mod n
ξ₂≡2^-1Su + η₂  mod n
ξ_Three≡2^-1Su + η₂  mod n
ξ_Four≡2^-1Su + η_Four  mod n
You can ask for it.
[0024]
Further, the sender of the ciphertext teaches the receiver a part of M. The receiver contains a part of Mξ_iSelect (i = 1, 2, 3, 4) as the correct M. As a result, the recipient can decrypt the ciphertext.
[0025]
RSA encryption
Next, RSA encryption will be described. Assume that the sender wants to secretly send information M to the receiver. As advance preparation, the sender generates the following information.
[0026]
[Expression 7]
Prime numbers: p, q
Common modulus: n = p · q
n is public information. p and q are secret constants other than the sender. In addition, the sender
[0027]
[Equation 8]
e ・ d≡1 mod Φ (n)
E and d are generated, and e is a public key and d is a secret key. However, Φ (n) = (p−1) (q−1).
[0028]
The sender encrypts the message M with his / her private key d as follows, and creates a ciphertext C.
[0029]
[Equation 9]
C = M^d  mod n
The sender sends C to the receiver.
[0030]
The receiver uses the sender's public key e to decrypt the ciphertext C as follows to obtain a message M.
[0031]
[Expression 10]
M = C^e  mod n
[0032]
[Details of operation of the embodiment]
The access control operation according to the present invention will be described in detail by taking as an example the case where the resource manager MA controls the access of the user U to the resource S. First, the case of using the Rabin cipher will be described, and the case of using the RSA cipher will be described.
[0033]
When using Rabin cipher
(Preparation)
The center C generates prime numbers p and q and a common modulus number n according to the Rabin encryption method described above. Furthermore, a unique secret key du is generated for each user. The center C encloses the common information n, p, q generated as described above and the secret key du generated for the user U in the token Tu of the user U and issues it to the user U. Similarly, the center C encloses the common information n, p, q and the secret key dm of the manager MA in the token Tm of the manager MA and issues it to the manager MA.
[0034]
The manager MA of the content S sets constants Es and Ds corresponding to the content S in his token Tm.
[0035]
## EQU11 ##
Es · Ds≡1 mod Φ (n) (2)
To be generated. Where Φ (n) is Euler's number, in this case
[0036]
[Expression 12]
Φ (n) = (p−1) (q−1) (3)
It becomes.
[0037]
(Generation of access control information)
The center C uses the private key du of the user U and the newly generated random number ec to convert Pu and Su according to the Rabin encryption method.
[0038]
[Formula 13]
Pu = du + ec mod n (4)
Su = du · ec mod n (5)
Generate and publish like this.
[0039]
The content manager MA generates a random number em within the token Tm and sends it to the user U. User U inputs em to token Tu. User U's token Tu is inside
[0040]
[Expression 14]
v = em^du  mod n (6)
And v is output. User U sends v to manager MA. The manager MA inputs v to the token Tm. In the token Tm, the content manager MA follows the method of Rabin encryption from the Pu and Su of the user U.
Solution ξ of equation (1)₁, Ξ₂, Ξ_Three, Ξ_FourAsk for. The token Tm is further inside,
[0041]
[Expression 15]
v≡em^{e '}  mod n
E ’= ξ_i(I = 1, 2, 3, 4) = du is obtained. The token Tm of the administrator MA stores the access control information δus therein.
[0042]
[Expression 16]
δus = D−F (n, du) (7)
Or using Ls that describes how to use the content S,
[0043]
[Expression 17]
δus = DF (n, Ls, du) (8)
And δus is sent to user U. Here, F () is a one-way function. In the following description, it is assumed that the access control information δus is calculated by the equation (8).
[0044]
(Content locking)
The administrator MA locks the content S to be accessed with the key Ks, and encrypts the Ks with Es as follows.
[0045]
[Expression 18]
K '= Ks^Es  mod n (9)
This is embedded in the encrypted data itself.
[0046]
(Access control)
It is assumed that the user accesses the content by using the token Tu and the user program P that is an assist for using the content.
User program P uses K '
[0047]
[Equation 19]
K ″ = r^EsK '(10)
And is sent to the token Tu together with the access control information δus.
[0048]
The token Tu of the user U performs the following calculation and takes out the key K.
1) The token U of the user U performs the following calculation on the received K ″.
[0049]
[Expression 20]
τ = K ″^{F (n, Ls, du)}  mod n (11)

User U's token outputs τ '.
2) The user program P performs the following calculation and extracts the encryption key K.
[0050]
[Expression 21]
Ks = r^-1τ ′ mod n (13)
3) With the extracted key Ks, the user program P decrypts the encrypted content and uses the content.
[0051]
Since δus is generated from secret information du that is different for each user and Ds that is different for each content, access control that is different for each user and content can be easily and reliably realized.
[0052]
When using RSA encryption
When the RSA encryption is used, the token issuance and the method of extracting the user's secret information are different from the case where the Rabin encryption is used.
[0053]
(Preparation)
At the time of issuing the token, the center follows the RSA public key encryption method, and the secret key dm of the manager MA and the public key em (corresponding to n)_mAnd generate. The center encloses dm in the token Tm of the manager MA and issues it to the manager MA. em is public information. Furthermore, a unique private key du is generated for each user, and this is enclosed in a user token and issued to the user.
[0054]
(Retrieve user confidential information)
The user token Tu is the public key em of the administrator MA and the user's private key du.
[0055]
[Expression 22]
C = du^em  mod n_m    (14)
Encrypt and send it to the administrator. The token of the administrator MA is the secret key dm, which is decrypted to obtain the user's secret key.
[0056]
[Expression 23]
du = C^dm  mod n_m    (15)
[0057]
Access control information generation, content locking, and access control procedures are the same as in the case of using the Rabin cipher, and description thereof will not be repeated.
[0058]
[Configuration of access control information generator]
Next, the configuration of the access control information generating apparatus according to the present invention will be described. In this embodiment, the access control information generation device is realized as a token of a content manager. FIG. 1 shows a basic configuration of an access control information generation apparatus 108 according to the present invention. In FIG. 1, an access control information generation device 108 receives public information 101 of a user and information 102 regarding resources and outputs access control information 109. The access control information generation apparatus 108 includes an information input unit 103, a user secret information generation unit 104, a data bus 105, an access control information generation unit 106, an information output unit 107, and an internal information storage unit 110.
[0059]
In this configuration, the user information 101 input from the information input unit 103 is sent to the user secret information generation unit 104 via the data bus 105. The user secret information generation unit 104 generates user secret information from the user information 101. For example, consider generating a user secret key du as user secret information. In this case, RSA (Rivest-Shamir-Adelman) encryption, which is a known technique, can be used. As user information, du is a public key Em (modulus n) of an administrator (hereinafter simply referred to as an administrator) who is the owner of the access control information generation apparatus 108._m) To enter the encrypted C. That is,
[0060]
[Expression 24]
C = du^Em  mod n_m
It becomes. C and n as user information_mIs input to the information input unit 103. Input C and n_mIs sent to the user secret information generation unit 104 via the data bus 105. The user secret information generation unit 104 uses the administrator's secret key opening key Dm stored in the internal information storage unit 110 to store C.
[0061]
[Expression 25]
du = C^Dm  mod n_m
As described above, decryption is performed to generate the user's secret information du. Here, Em and Dm are key pairs generated based on the RSA public key method,
[0062]
[Equation 26]
Em · Dm≡1 mod Φ (n_m)
It is. Where Φ (n_m) Is n_mThe Euler number.
[0063]
The generated user secret information is sent to the access control information control unit 106 via the data bus 105. Further, information 102 related to resources input from the information input unit 103 is also sent to the access control information control unit 106 via the data bus 105. The access control information control unit 106 generates access control information 109 from the user's secret information and information 102 related to resources. Specifically, the access control information δus is obtained by using the above-mentioned du and Ds as information on the resource.
[0064]
[Expression 27]
δus = Ds−du
Calculate as follows. Here, Ds uses a certain modulus n,
[0065]
[Expression 28]
Es · Ds≡1Φ (n)
And Es is used to lock the content.
[0066]
FIG. 2 shows another configuration example of the access information generating apparatus 108 according to the present invention. In FIG. 2, portions corresponding to those in FIG. A resource information generation unit 201 is provided, and the resource information 202 is generated in the access control information generation apparatus 108.
[0067]
In this configuration, the operation for generating the secret information of the user is the same as in the case of FIG. The resource information generation unit 201 generates resource information 202. Specifically, first, the modulus n is generated. Then generate Es and continue
[0068]
[Expression 29]
Es · Ds≡1 mod n
Is generated using, for example, the Euclidean algorithm. The generated Ds is sent to the access control information generation unit 106 via the data bus. The access control information generation unit 106 generates and outputs the access control information 109 as described above. Further, Es is output as the generated resource information 202. The administrator locks the content using the output Es.
[0069]
FIG. 3 shows another configuration example of the access control information generation apparatus 108 according to the present invention. In this configuration example, the user's public information 101 and resource-related information 102 are received, and access control information 109 and resource information 202 are generated. Also in FIG. 3, portions corresponding to FIG. 1 or FIG.
[0070]
In this configuration, the operation for generating the secret information of the user is the same as in the case of FIG. 1 and FIG. As information 102 regarding resources, Ds and modulus n are input. The input Ds is sent to the resource information generation unit 201 via the data bus 105. The resource information generation unit 201 generates Es corresponding to Ds as resource information 202. In particular,
[0071]
[30]
Es · Ds≡1 mod n
Is generated using, for example, the Euclidean algorithm. The input Ds is sent to the access control information generation unit 106 via the data bus 105. The access control information generation unit 106 generates and outputs the access control information 109 as described above. Further, the generated Es is output as generated resource information 202.
[0072]
FIG. 4 shows a configuration example of information about resources. In FIG. 4, reference numeral 102 denotes information about resources, 401 denotes first resource information, and 402 denotes second resource information. The first resource information corresponds to either Es or Ds described above. For example, it is Ds in the configuration of FIG. 1, and Es in the configuration of FIG. The second resource information is information describing how to use the resource. Specifically, an expiration date, a usage fee, an effective usage count, and the like are listed. Further, in FIG. 3, only the second resource information may be input as information about resources, and both Es and Ds may be generated as in the configuration example of FIG.
[0073]
FIG. 5 shows a configuration example of the access control information generation unit 106. In FIG. 5, the access control information generation unit 106 includes an internal data bus 501, a data conversion unit 502, and an information generation unit 503. In addition, in this figure, the code | symbol corresponding was attached | subjected to the location corresponding to FIGS. 1-3.
[0074]
In this configuration, the user's confidential information and information 102 related to resources input via the data bus 105 are sent to the data conversion unit 502 via the internal data bus 501. Here, one-way conversion F () is performed on the input, and the result is sent to the information generation unit 503. The information generation unit 503 generates the access control information 106 as described above from the sent one-way conversion result and the information about the resource sent via the data bus 105 and the internal data bus. . For example, it is assumed that the user's confidential information is du. Further, as information on resources, a modulus n corresponding to Es and Ds and the information L describing the above-described resource utilization method are adopted. Then, F () is calculated using as an argument the bit concatenation of the user's secret information du and the resource information n and L, and the calculation result is output. The output is sent to the information generation unit 503 via the internal data bus 501, and the access control information is generated by using the aforementioned Ds together. The generated access control information is output from the device via the internal data bus 501 and the data bus 105. In this case, the access control information δus is as follows.
[0075]
[31]
δus = Ds−F (n, L, du)
Here, specifically, as the one-way conversion F (), a one-way hash function (for example, MD5, SHA, etc.) or conventional key cryptography (DES, IDEA) can be used. It is desirable that is equal to the number of bits of Ds.
[0076]
FIG. 6 shows a configuration example of the user secret information generation unit 104 of the access control information generation apparatus (administrator token) 108. In FIG. 6, the user secret information generation unit 104 includes an internal data bus 601, a common information storage unit 602, and a data processing unit 603. In addition, in this figure, the code | symbol corresponding was attached | subjected to the location corresponding to FIGS. 1-3.
[0077]
In this configuration, when the user access control device (user token) is issued to the user, the issuer (specifically, the center described above) stores the prime numbers p and q in the common information storage unit 603. Generate in advance and contain. As the user information 102, public information Pu and Su when the Rabin encryption is used,
[0078]
[Expression 32]
Pu = du + r
Su = du · r
And configure. However, r is a random number and du is a user's secret information. These Pu and Su are input as user information 102 via the data bus 105 and the internal data bus 601. In the data processing unit 603, the secret information du of the user is extracted from Pu, Su, p, q by the Rabin encryption method. The extracted du is output to the data bus via the internal data bus.
[0079]
[Modification]
Next, a modification of the above embodiment will be described.
(Composition of common information)
First, the common information p and q stored in the token may be prohibited from external access. Alternatively, as another configuration, a special condition, for example, authentication of the center may be performed, and then read / write may be performed.
[0080]
Φ (n) may be included in the common information and enclosed in the token in advance, or using the common information p and q as necessary.
[0081]
[Expression 33]
Φ (n) = (p−1) (q−1)
You may comprise so that it may calculate as follows.
[0082]
In the above-described embodiment, Pu and Su are held by the center that issues the token and are configured to be transmitted in response to the request. As another configuration example, it may be generated in the user token as follows. That is, the user's token newly generates a random number e. Using the generated random number e and the secret key du, Pu and Su are
[0083]
[Expression 34]
Pu = du + e mod n (2)
Su = du · e mod n (3)
Generate as follows.
[0084]
As yet another configuration example, the center may issue Pu and Su calculated in advance only in the token of the user.
[0085]
(Another configuration example of access control processing)
When accessing content, tokens generally do not have very high computing power, so all calculations are not performed with tokens, but are configured outside the token, for example, with a user's program as follows. May be.
1) The user token performs the following calculation on the received K ″.
[0086]
[Expression 35]
τ = K ″^{F (n, L, du)}  mod n
The user token outputs τ.
2) The user program performs the following calculation on τ output from the token.
[0087]
[Expression 36]

3) The user program (or the authentication program called from it) performs the following calculation, extracts the encryption key K, and decrypts the encrypted content.
[0088]
[Expression 37]
K = r^-1τ ′ mod n
Further, when content is decrypted, the content may be decrypted using K in the access control unit or the apparatus.
[0089]
(Centralized configuration example)
In the present invention, it is configured so that it is not necessary to centrally manage user information in one place compared to the conventional example, but a configuration for centrally managing user information as in the past is also possible. Can take. For example, one configuration example for centrally managing user and content information is as follows.
[0090]
It is assumed that user information is centrally managed at the center. The role of each entity is as follows.
[0091]
(1) The center generates necessary information based on the present invention and encloses them in a token as necessary. Furthermore, for each administrator and user, unique information is contained as necessary, and a unique token is issued for each. Furthermore, the center registers the name of each user and each administrator, the issued token and unique information contained therein in the database.
[0092]
(2) The content manager registers the content to be managed in the center. The center generates Es, Ds, and a modulus n for each registered content, and sends Es and n to the administrator. The center registers contents corresponding to the generated Es, Ds, and modulus n in the database.
The administrator locks the content using the sent Es.
[0093]
(3) The user sends a content use request to the center. The center searches the content database and retrieves Ds. Further, the user database is searched to extract the user secret information du. The center uses the extracted Ds and du to obtain access control information δus.
[0094]
[Formula 38]
δus = Ds−du
And send δus to the user. The user accesses the content using this δus.
[0095]
【The invention's effect】
As described above, according to the present invention, an administrator can realize access control by generating access control information for each user independently in response to a request from the user. In addition, since the generated access control information is generated using user-specific information, it cannot be used by users other than legitimate users, and access only by legitimate users. Is feasible. Furthermore, since the generated access control information and resources are placed in the user's environment, the resources can be used, so it is necessary to access the administrator's environment, that is, the host computer or server when using the resources. This makes it possible to use resources offline.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration example of an access control information generation device according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating another configuration example of the access control information generation apparatus.
FIG. 3 is a block diagram showing another configuration example of the access control information generating apparatus.
FIG. 4 is a diagram for explaining information about resources used in the access control information generation apparatus.
FIG. 5 is a block diagram illustrating a configuration example of an access control information generation unit of the access control information generation apparatus.
FIG. 6 is a block diagram illustrating a configuration example of a user secret information generation unit of the access control information generation apparatus.
[Explanation of symbols]
101 Public information of users
102 Information about resources
103 Information input section
104 User secret information generator
105 Data bus
106 Access control information generation unit
107 Information output section
108 Access control information generator
109 Access control information
110 Internal information storage unit
201 Resource information generation unit
202 Resource information generated

Claims (5)

Resource management's side of the device, and securely store the private key of the resource manager,
The input means of the resource manager side device inputs resource-specific information that is uniquely assigned to the resource,
The input means encrypts the user's private key with the public key corresponding to the resource manager's private key to the access control information generating apparatus protected by the protective means for preventing internal information from leaking outside. Enter encrypted encryption information,
The user secret key generating means of the resource manager side device restores the user secret key by decrypting the encrypted information with the resource manager secret key in the access control information generating device. ,
The access control information generation means of the resource manager side device executes a first calculation on the resource-specific information and the restored user private key in the access control information generation device. An access control information generation method for generating the access control information,
The access control information is
An access control system,
The resource is accessed from a user device, the resource is encrypted with an encryption key for resource encryption, the access control information is supplied from the resource manager device to the user device, and the user device is When accessing the resource to the resource manager device, a second operation is executed on the access control information and the user's private key, and the operation result of the second operation is decrypted. The encrypted resource is decrypted using the key, and the first calculation and the second calculation are performed in such a manner that the access control information, the resource-specific information, and the user's secret key are all authentic. In this case, the second calculation result is selected to be a genuine decryption key for decrypting the encryption result of the resource.
An access control information generation method used in the access control system . 2. The access control information generation method according to claim 1, wherein the input means includes at least one of an expiration date, a usage fee, and an effective usage count of the resource in addition to unique information uniquely assigned to the resource. The information describing the method is input, and the access control information generating means is a unidirectional function having as arguments the resource-specific information D , the user's private key du, and the information Ls describing the method of use . An access control information generation method, wherein the access control information is generated from a value F using the first calculation as DF . In instrumentation Okimoto the body, to securely store the private key of the administrator of the resource,
And means for inputting encrypted information obtained by encrypting the user's private key with a public key corresponding to the resource manager's private key;
Means for inputting resource-specific information uniquely assigned to the resource;
Decryption means for decrypting the encrypted information with the resource manager's secret key to generate the user's secret key;
Means for generating access control information by performing a first operation on the user's secret information generated by the decryption means and the resource-specific information;
Means for outputting the generated access control information ;
An access control information generating device comprising information held or generated in the device main body and a protection means for preventing the progress of processing performed in the device main body from leaking outside,
The access control information is
An access control system,
The resource is accessed from a user device, the resource is encrypted with an encryption key for resource encryption, the access control information is supplied from the resource manager device to the user device, and the user device is When a request is made to access the resource to the resource manager device, a second operation is performed on the access control information and the user's private key, and an operation result of the second operation using as a decryption key to decrypt the encrypted resource, further, the first operational contact and the second operation, the access control information, said resource-specific information and the private key of the user When all are authentic, the second operation result is selected to be an authentic decryption key for decrypting the encrypted result of the resource.
An access control information generating apparatus used in the access control system . 4. The access control information generating device according to claim 3, wherein information describing a resource usage method including at least one of an expiration date, a usage fee, and an effective usage count in addition to the unique information uniquely assigned to the resource. input to the above access control information generating means, the first from the and resource-specific information D, the value F of the one-way function to the private key du and the usage parameters describing information Ls of the user An access control information generating apparatus, wherein the access control information is generated with 1 operation as DF . In instrumentation Okimoto the body, to securely store the private key of the administrator of the resource,
And means for inputting encrypted information obtained by encrypting the user's private key with a public key corresponding to the resource manager's private key;
Means for generating a unique public / private key pair uniquely assigned to the resource;
Means for outputting one key of the generated public / private key pair;
Decryption means for decrypting the encrypted information with the resource manager's secret key to generate the user's secret key;
Means for generating access control information by executing a first operation on the secret information of the user generated by the decryption means and the other key of the unique public / private key pair assigned to the resource When,
Means for outputting the generated access control information ;
The information held or generated in the apparatus main body and the progress of processing performed in the apparatus main body have a protection means for preventing leakage to the outside,
And means for inputting information Ls describing a method of using the resource including at least one of an expiration date, a usage fee, and an effective usage count;
Means for performing one-way conversion between the user's confidential information and the information Ls describing how to use the resource;
The means for generating the access control information uses the result F of the unidirectional conversion and the other key D of the unique public / private key pair assigned to the resource as the first calculation as DF. An access control information generating device for generating access control information;
The access control information is
An access control system,
The resource is accessed from a user device, the resource is encrypted with an encryption key for resource encryption, the access control information is supplied from the resource manager device to the user device, and the user device is When accessing the resource to the resource manager device, the access control information, the user's private key, and the resource information describing the resource usage method are assigned to the resource. A second operation using one key of the public key / private key pair of the first and the second operation is performed using the operation result of the second operation as a decryption key, and the encrypted resource is decrypted. In the first operation and the second operation, when the access control information, the resource-specific information, and the user's secret key are all authentic, the second operation result decrypts the resource encryption result. Authentic decryption key Is selected so,
An access control information generating apparatus used in the access control system .

Images