JP4614744B2 - Management device, terminal device and copyright protection system - Google Patents

Description

  The present invention relates to a system that records or reproduces digitized data of a content such as a movie or music on a large-capacity recording medium such as an optical disc, and in particular, works by recording or reproducing content using an unauthorized device. The present invention relates to technology for preventing infringement.

In recent years, with the development of multimedia-related technologies and the emergence of large-capacity recording media, digital content (hereinafter referred to as “content”) consisting of moving images, audio, etc. is generated, stored in a large-capacity recording medium such as an optical disc, and distributed. Or systems that distribute via networks and broadcasts have emerged.
The distributed content is read out by a computer, a playback device, etc., and is subject to playback or copying.

In general, an encryption technique is used to protect the copyright of content, that is, to prevent unauthorized use such as unauthorized reproduction or unauthorized copying of content.
Specifically, the content is encrypted using a certain encryption key, recorded on a recording medium such as an optical disc, and distributed. On the other hand, only a terminal having a decryption key corresponding to the encryption key can decrypt the data read from the recording medium using the decryption key and reproduce the content. It is. In addition, as a method of encrypting the content and recording it on the recording medium, the content itself is encrypted and recorded with an encryption key corresponding to the decryption key held by the terminal, or the content is encrypted and recorded with a certain key. There is a method of recording a decryption key corresponding to the key by encrypting it with an encryption key corresponding to the decryption key held by the terminal.

  At this time, the decryption key held by the terminal needs to be strictly managed so as not to be exposed to the outside, but there is a risk that a certain key is exposed to the outside in the analysis inside the terminal by an unauthorized person. Once a key is exposed to an unauthorized person, it is conceivable to create a recording device, a playback device, or software that illegally uses the content, and distribute it via the Internet or the like. In such a case, the copyright holder wants to make sure that the key provided once cannot handle the content to be provided next. This is called a key revocation technique, and a key revocation technique using a hierarchical structure called a tree structure is disclosed in Patent Document 1 and Non-Patent Document 1 as a system for realizing key revocation.

Hereinafter, a conventional key revocation technique described in Non-Patent Document 1 will be described.
First, “Subset Difference” (hereinafter referred to as a difference set) is defined. The difference set is defined as a set made up of devices (leafs) when a set of smaller tree structures is removed from a set of large tree structures. The difference set is determined by defining two routes, a large tree structure root and a small tree structure root. A decryption key is assigned to each difference set.

Furthermore, content is encrypted with a content key, each device holds a decryption key, and data required when each device obtains a content key using its own decryption key is called key data. . Generally, key data is distributed together with content. When a recording medium is used for distributing content, the key data is recorded on the recording medium.
By covering a set of devices that are not invalidated with a differential set, the size of the key data can be reduced. FIG. 42 shows a conceptual diagram thereof. In FIG. 42, when the root of the large tree structure T1000 is Vi and the root of the small tree structure T1001 is Vj, the set that invalidates the devices allocated to the two leaves marked with X is a tree from the tree structure T1000. The difference set 1001 “Si, j” is obtained by removing the structure T1001. Further, the necessary key data is one encrypted content key encrypted using one encryption key Li, j corresponding to the difference set Si, j. That is, the difference set is a set of leaves belonging to the remaining part of the conceptual diagram T1002 that is a conceptual diagram showing the tree structure T1000, and the conceptual diagram T1003 that is a conceptual diagram showing the tree structure T1001.

  As another example, in the tree structure of 16 devices, the difference set when the device 3, the device 4, the device 13, and the device 15 are invalidated, and the encryption key Si for encrypting the content key. , J are shown in FIG. For example, the devices 9 to 12 belong to the difference set 2001 “S3, 7” obtained by removing the tree structure T2001 having the root V7 from the tree structure T2000 having the root V3. In FIG. 43, devices belonging to the same difference set Si, j hold a common decryption key. For example, the devices 1, 2, and 5 to 8 belonging to the difference set 2002 “S 2, 9” hold the common decryption keys L 2 and 9, and the devices 9 to 5 belonging to the difference set 2001 “S 3, 7” 12 holds common decryption keys L3 and L7. Furthermore, since the content keys are encrypted by L2, 9, L3, 7, L14, 28, L15, and 31, respectively, the device 3, device 4, device 13, and device 15 that do not hold any decryption key are The content key cannot be decrypted and the content cannot be handled.

  Here, each device needs to hold a decryption key corresponding to the positional relationship of the devices to be invalidated, and the basic concept is as follows. When a certain device holds a decryption key Li, j corresponding to the difference set Si, j, the device also holds a decryption key Li, k corresponding to the difference set Si, k. However, Vk is a subset of Vj. At this time, Li, k can be obtained from Li, j by calculation, but the reverse is performed by using a one-way function so that it cannot be obtained by calculation.

First, the encryption key assigned to each node of the tree structure (this encryption key corresponds to the decryption key held by each device) will be described using the example of the tree structure T3000 of the binary tree shown in FIG. To do. FIG. 44 shows a part of a tree structure T3000 that manages a total of eight devices.
Each node of the tree structure T3000 shown in FIG. 44 is given an identifier called a “label” of individual T bits. Then, a pseudo-random number generator G that generates a 3T-bit random number for the input data length T bits is prepared. When the label “A1” is input to the pseudorandom number generator G, among the 3T bits to be output, the first half T bit is the label of the lower left child of the label 3001 “A1”, and the middle T bit is the label 3001 “ The encryption key corresponding to the node of “A1” is used, the latter T bits are the lower right child labels of the label 3001 “A1”, and they are expressed as “A1L”, “A1M”, and “A1R”, respectively. In FIG. 44, labels “A1”, “A2”, “A3”, “A4” and the like are individually assigned to each node in advance, and in addition, new labels derived from higher-level labels are added. . For example, in the node 4001 in the third layer from the top, in addition to the label “A4” pre-assigned to the node, the label “A1LL” derived from the upper label “A1” and the same upper label “A2” The derived label “A2L” and a total of three labels are assigned. Furthermore, since the number of encryption keys assigned to each node is equal to the number of labels assigned to that node, a total of three encryption keys A1LMM, A2LM, and A4M are assigned to the node 4001. Become.

  Here, the relationship between the encryption key Li, j corresponding to the difference set Si, j and the encryption key assigned to each node is shown. When the node Vi and the node Vj are determined, the encryption key Li, j corresponding to the difference set Si, j corresponds to the label added to the node Vj among the labels derived from the labels assigned to the node Vi. It becomes an encryption key. In the example of FIG. 44, if the label of the node Vi is A1 and the label of the node Vj is A4, the encryption key Li, j is A1LLM.

Next, the decryption key assigned to each device will be described. Here, it is assumed that each device is assigned a plurality of labels assigned to the node, and each device generates a decryption key from the corresponding label and the pseudorandom number generator G in the device. Further, a secret key cryptography having the same encryption key and decryption key will be described as an example.
Specifically, paying attention to a node hanging from a node existing on a route leading to a route from a leaf to which each device is assigned, labels assigned and derived from nodes positioned higher than the node are Assigned to the device.

For example, the labels assigned to the device 1 shown in FIG. 44 are a total of six labels: A1LLR, A2LR, A4R, A1LR, A2R, and A1R. Note that the labels “A3”, “A5”, and “A7” are labels that are assigned in advance to the corresponding nodes, and thus are not assigned to the device 1.
The total number of labels assigned to each device, if the total number of devices is t _{stand, 0.5 (log 2 t) ^} 2 + 0.5log a ₂ t pieces. This is the number of labels to be assigned to each device, one to the second layer, two three-layer, ..., since it is log ₂ t pieces in the lowest layer, 1 + 2 + ... + log ₂ t = because the _{0.5 (log 2 t) ^ 2} + 0.5log 2 t. For example, when the total number of devices is 8, the number of labels assigned to each device is 6.

Next, an example in which the apparatus is actually invalidated will be described with reference to FIG.
In an initial state where none of the devices is revoked, the content key is encrypted using the keys “A1LM” and “A1RM” corresponding to the label 3002 “A1L” and the label 3003 “A2R”. All apparatuses hold the label 3002 “A1L” or the label 3003 “A1R”, and can generate the decryption key “A1LM” or “A1RM” therefrom. Therefore, the content key can be decrypted with the generated decryption key, and further, the content can be decrypted using the decrypted content key.

  If device 1 is hacked and all keys held by device 1 are revealed, label 3001 “A1” and label 3004 “A1LLL” are specified, and a large tree structure with label 3001 “A1” as the root From T3000, a small tree structure (leaf) T3001 with label 3004 “A1LLL” is removed. Then, the content key is encrypted using the encryption key “A1LLLM” corresponding to the label 3004 “A1LLLL”. Thus, since the pseudo-random number generator G is unidirectional, the device 1 cannot generate the decryption key “ALLLM” from the label held by itself, and therefore cannot decrypt the content key. Each device other than the device 1 holds the label 3004 “A1LLL” or can generate the label 3004 “A1LLL” from the held label by a pseudo-random number generator. That is, each device other than the device 1 can generate the decryption key “A1LLLM”. For example, since the device 2 holds the label 3004 “A1LLL”, the decryption key “A1LLLM” can be generated from the held label 3004 “A1LLLL”. Also, two leaves (not shown, for example, device 3 and device 4) hanging from the node corresponding to label 3006 “A5” hold label 3005 “A1LL”. That is, the device 3 and the device 4 can generate the decryption key “A1LLLM” from the label 3005 “A1LL” that is held. The leaf of the node corresponding to the label “A3”, that is, the grandchild node (not illustrated, for example, the devices 5 to 8) holds the label 3002 “A1L”. That is, the devices 5 to 8 can generate the decryption key “A1LLLM” from the label 3002 “A1L”.

As described above, the system disclosed in the non-patent document realizes key invalidation.
JP 2002-281913 A D. Naor, M. Naor, and J. Lotspiech, "Revocation and Tracing Schemes for Stateless Receivers", Proceedings of CRYPTO2001, LNCS2139, pp.41-62, 2001.

  However, in the conventional key revocation technique disclosed in Non-Patent Document 1, each subtree that routes each node including a leaf has an independent relationship. This is because labels are assigned in advance to the roots of the subtrees, and the assigned labels have an independent relationship. For this reason, labels assigned to the same subtree can be generated from the labels assigned to the subtree, but labels assigned to other subtrees cannot be generated. Therefore, in the conventional technology, when the number of devices to be managed increases, the number of subtrees to be managed increases. That is, labels that are not generated from other labels are assigned to the root of each subtree. When pre-assigning, there is a problem that the number increases.

  In order to solve the above-described conventional problems, the present invention reduces the number of unique information that is not generated from other unique information among a plurality of unique information that is a basis of a key assigned to a device to be managed. An object is to provide a device, a terminal device, a copyright protection system, a recording medium, an association method, an association program, and a program recording medium.

  In order to achieve the above object, according to the present invention, device identifiers for identifying a plurality of terminal devices are arranged in a tree-structured leaf, and each device identifier is a basis for a decryption key for decrypting encrypted data. A management device for assigning and managing specific information, a subset generation means for obtaining and generating a subset of device identifiers subordinate to each node in each layer excluding the leaf of the tree structure, and a leaf layer A subset including the subset of the lowest layer except for the first layer is searched from the immediately upper layer, and the first association means for associating and the subset including the subset of the association destination are the same layer and the immediately higher layer. A second associating means for searching and associating with one another; a first control means for controlling the second associating means to repeatedly process until reaching the highest layer; Second control means for controlling the first associating means, the second associating means, and the first control means to repeatedly process all of the subsets, and the associating source of the lowest layer The association source is associated with a subset that is linked across layers by association with a first assigning unit that associates unique information with a subset of the first identifier, and assigns the unique information to a device identifier included in the subset. And second assigning means for associating unique information derived from the unique information assigned to the subset and assigning the unique information to each device identifier included in the subset.

  According to the configuration shown in the means for solving the problem, the management device uses the first association unit, the second association unit, the first control unit, and the second control unit to set a subset of the lowest layer. To a subset of the top layer. In addition, the management apparatus can associate the unique information derived from the unique information associated with the subset of the lowest layer with the subset connected by the association using the second assigning unit. The conventional management apparatus had to prepare in advance each piece of unique information that is not related to each subset of the minimum number of elements in each layer. Different unique information may be prepared only for each subset of layers. In other words, the management apparatus can reduce the number of pieces of unique information that are not generated from other unique information in advance.

  Here, the first associating means searches for a subset that includes the subset of the lowest layer and includes the minimum number of elements, and uses the subset of the lowest layer as a parent node, Associating a set as a child node, the second associating means searches for a subset that includes the subset of the association destination and includes the minimum number of elements, and sets the subset of the association destination as a parent node And the first control means controls the second association means to repeatedly process until reaching the highest layer, and the subset of the lowest layer is obtained. A root subset tree may be generated.

According to this configuration, the management apparatus can generate a subset tree that routes a subset of the lowest layer. Thereby, the management apparatus can manage the association between the subsets in a tree structure.
Here, the first associating means excludes one or more subsets associated with each other from the subsets of the upper layers to the lowest layer, and uses the remaining one or more subsets, The second association means may be controlled to repeatedly process until reaching the highest layer, and a subset tree that routes a subset of the lowest layer may be generated.

According to this configuration, the management apparatus can generate each subset tree having each subset in the lowest layer as a root by using each subset generated by the subset generation unit only once.
Here, the second allocating unit generates the derived unique information from the unique information associated with the association source subset using a one-way function, and generates the generated unique information. , It may be associated with a subset connected by association.

According to this configuration, the management apparatus can generate unique information associated with a subset connected by association from unique information associated with a subset of the lowest layer, using a one-way function.
Here, the management apparatus further includes a subset in which an identifier of a terminal device to be distributed that distributes unique information first appears as an element in each path from the root of the subset tree to each of one or more leaves. One or more unique information acquisition means for acquiring one or more unique information associated with the previous subset, and one or more set identification information for identifying the acquired unique information and a subset corresponding to the unique information, if present The distribution unit may be provided with distribution means for distributing the set to the terminal device to be distributed.

  According to this configuration, the management device can distribute one or more sets including the unique information and the set identification information corresponding to the unique information to the terminal device to be distributed. As a result, the number of unique information distributed to the terminal device can be reduced as compared with the prior art. Conventionally, each layer associates subsets and acquires unique information to be distributed for each layer. According to the present invention, the unique information to be distributed exists in a higher layer than the associated subset. However, there is no need to distribute unique information associated with a subset connected by association. This is because the unique information allocated to the device identifier included in the subset existing in the upper layer and connected by the association can be derived from the unique information to be distributed. As a result, the management apparatus can reduce the number of unique information distributed to the distribution target terminal apparatus. That is, the management device can reduce the number of keys assigned to the terminal device.

  Here, the specific information acquisition means searches the subset in which the identifier of the terminal device to be distributed first appears as an element from each route from the root to the leaf of the subset tree, and detects the subset. When the detected subset is not acquired, a first acquisition unit that acquires the detected subset and the unique information associated with the subset acquired by the first acquisition unit are acquired. A second acquisition unit and a repetition control unit that controls the first and second acquisition units to repeatedly process until each route is performed may be provided.

According to this configuration, the management device can acquire one or more pieces of unique information to be distributed to the distribution target terminal device from the subset tree by the repetition control unit.
Here, the management device further includes a first storage unit having an area for storing each subset that is a component of the subset tree and the unique information associated with each of the subsets; , Second storage means having an area for storing a plurality of nodes constituting the subset tree, and child nodes of each node, the subset, and unique information associated with the subset First writing means for writing to the first storage means, second nodes for writing to the second storage means in association with the nodes constituting the subset tree and child nodes of the nodes. May be provided.

According to this configuration, the management apparatus can store the subset and the unique information associated with the subset in association with each other. Further, the management apparatus can store a plurality of nodes constituting the subset tree in association with child nodes of each node.
Here, the first storage means includes a first table that stores a plurality of sets, with the subset and unique information associated with the subset as one set, and the second table The storage means has a second table for storing a plurality of sets, with the node and child nodes corresponding to the node as one set, and the first writing means includes the subset, A set of unique information associated with the subset is written to the first table, and the second writing means stores a set of the node and a child node of the node in the second memory. You may write to the means.

According to this configuration, the management apparatus can store the subset and the unique information associated with the subset in association with each other using the first table. In addition, the management apparatus can store a plurality of nodes constituting the subset tree and child nodes of each node in association with each other using the second table.
Here, the second control means controls the first association means, the second association means, and the first control means to repeatedly process all the subsets of the lowest layer. A plurality of subset trees, and the first storage means stores each subset included in each subset tree and each unique information associated with each of the subsets. The management device is further stored in an invalidation identifier storage unit having an area for storing an invalid identifier indicating one or more invalid terminals among the plurality of terminal devices, and the invalidation identifier storage unit. And acquiring one or more subsets from the first storage means, and acquiring one or more encryption keys based on each unique information associated with each acquired subset. , Individually obtain each encryption key An encryption key generating means for encrypting a media key used for content use and generating the same number of encrypted media keys as the one or more encryption keys, the encrypted media key, and the encrypted media key Third writing means for writing one or more sets of reference identification information for identifying a subset used for acquiring the encryption key to a recording medium attached to the management apparatus may be provided.

According to this configuration, the management apparatus can generate one or more encrypted media keys, and write one or more sets of the generated encrypted media keys and reference identification information on the attached recording medium. .
Here, the management device may further include an invalidation identifier receiving unit that receives an invalid identifier and writes the received invalid identifier to the invalidation identifier storage unit.

According to this configuration, the management device can receive an invalid identifier and write the received invalid identifier to the invalidation identifier storage unit.
Here, the encryption key is the same common key as the decryption key, and the one-way function further generates each common key based on each unique information from each unique information, and the encryption key The generation unit includes a subset acquisition unit that acquires from the first storage unit a subset that most includes one or more valid identifiers excluding invalid identifiers stored in the invalidation identifier storage unit; A control unit that controls the subset acquisition unit to repeatedly process until the valid identifier belongs to any one or more of the subsets acquired by the subset acquisition unit, and the one-way function The common key acquisition unit for acquiring one or more common keys generated from the unique information associated with each of the subsets acquired by the subset acquisition unit, and the common key acquisition unit Using each acquired common key, It may comprise an encryption unit for generating as many encrypted media key Tsukagi.

According to this configuration, the management device generates a common key that is an encryption key from unique information corresponding to a subset of valid identifiers using a one-way function, and using the generated common key, An encrypted media key can be generated.
Here, the reference identification information is a subset used to obtain a common key for the encrypted media key, and the third writing unit is configured to share the encrypted media key and the encrypted media key. One or more sets composed of a subset used for key acquisition are written to the recording medium, and the distribution means uses the subset associated with the acquired unique information as the set identification information. One or more sets of the unique information and the set identification information may be distributed to the terminal device to be distributed, and the distribution unit may further distribute a data structure indicating each subset tree.

According to this configuration, the management apparatus sets the reference identification information as a subset used for acquiring the encryption key, and sets the identification information distributed to the terminal apparatus as a subset associated with the specific information to be distributed. Can do. Furthermore, the management device can distribute a data structure indicating each subset tree to the terminal device.
Here, the management apparatus further includes, for the subset, a generation path indicating a path from a root subset that is a root of a subset tree to which the subset belongs to the subset, and the route portion. Route information acquisition means for acquiring route information including a route identifier indicating a set, and the reference identification information is route information of a subset used to acquire an encryption key for the encryption media key, The third writing means writes one or more sets consisting of the encrypted media key and the path information of the subset used for obtaining the encryption key for the encrypted media key to the recording medium, The distribution means uses one or more sets of the acquired unique information and the set identification information as the set identification information, using the path information of a subset of the acquired specific information as the set identification information. It may be distributed to the target terminal.

According to this configuration, the management apparatus uses the reference identification information as the path information of the subset used for acquiring the encryption key, and the subset identification information to be distributed to the terminal apparatus is associated with the unique information to be distributed. Route information.
Furthermore, the present invention is a terminal device to which unique information that is a basis of a decryption key for decrypting encrypted data is assigned by a management device that manages each device identifier for identifying a plurality of terminal devices in a tree structure. Then, the management device obtains and generates a subset of the device identifiers subordinate to each node of the layer excluding the leaf of the tree structure, and includes the subset of the lowest layer excluding the leaf layer. Search for a subset from the uppermost layer, associate, and search for a subset including the associated subset in the same layer or immediately above the layer, associate, and link this association to the top layer , Control the second association means to repeatedly process, control to repeat these processes for all subsets of the lowest layer, The specific information is associated with the subset of the association source of the lowest layer, the specific information is assigned to the device identifier included in the subset, and the association is connected to the subset connected across the layers by the association. The unique information obtained in a derivative manner from the unique information assigned to the attachment subset is associated, and the unique information is assigned to each device identifier included in the subset. A unique information storage means for storing unique information including a device identifier of the terminal device among unique information associated with each subset of association sources distributed in advance from .

  According to this configuration, the terminal device can store unique information. The conventional management apparatus associates each subset for each layer, associates specific information with a subset of the minimum number of elements existing in the layer, and sets the minimum element for the subset connected by the association. The unique information derived from the unique information assigned to the subset of numbers is associated. For this reason, the conventional terminal device needs to store the unique information associated with the subset including the device identifier of the terminal device for each subset collection associated with each layer. According to the present invention, since the management device associates each layer, the unique information derived from the unique information associated with the subset including the terminal identifier of the terminal device, that is, the upper layer There is no need to store unique information associated with the subset. That is, the number of unique information stored in the terminal device is reduced.

Here, the unique information storage means further stores set identification information for identifying a subset associated with the stored unique information, and the terminal device further includes:
A determination unit that determines whether or not the set identification information indicates that the terminal device is a valid device, and a determination result by the determination unit is generated by the management device when the determination result is affirmative An encrypted medium in which a media key is encrypted with an encryption key based on specific unique information among each unique information associated with each subset, and associated with key related information related to the encryption key First acquisition means for acquiring a key, second acquisition means for acquiring a decryption key corresponding to the encryption key using the unique information stored in the unique information storage means, and the second acquisition Decrypting means for decrypting the encrypted media key obtained by the obtaining means using the decryption key obtained by the means and generating the media key may be provided.

According to this configuration, when the terminal device is an effective device, the terminal device acquires the encrypted media key and the decryption key, uses the acquired decryption key to decrypt the encrypted media key, and A key can be generated.
Here, the specific specific information is reference specific information associated with a subset including one or more identifiers of terminal devices valid at the time of generation of the encrypted media key, and the encryption key is a common key The key related information is reference identification information for identifying a subset associated with the reference specific information, and the encrypted media key is associated with the reference identification information, Is the set identification information when there is a path from the subset identified by the set identification information stored in the unique information storage means to the subset identified by the reference identification information. Determines that the terminal device is a valid device, and the first obtaining means encrypts the encrypted media key using an encryption key based on the reference specific information corresponding to the reference identification information. The second obtaining means obtains the decryption key, uses the obtained decryption key as the common key, and the decryption means decrypts the encrypted media key using the obtained common key. It is good.

According to this configuration, when the terminal device has a path from the subset indicated by the set identification information to the subset identified by the reference identification information, the set identification information is valid for the terminal device. It can be determined that the device is shown.
Here, the management apparatus searches for a subset that includes the lowest layer subset and includes the minimum number of elements, sets the lowest layer subset as a parent node, and uses the searched subset as a child. As a node, search for a subset that includes a subset of associations and the association destination, has a minimum number of elements, and is unassociated, and uses the subset of the association destination as a parent node, and the retrieved subset As a child node to generate a subset tree that routes the subset of the lowest layer, and the unique information storage means further includes data constituting the subset tree generated by the management device The structure is stored in advance, and the determination unit uses the subset tree configured by the data structure to store the specific information stored in the specific information storage unit. From subset attached response may be path to the subset identified by the reference identification information and determines whether there.

According to this configuration, the terminal device uses the data structure constituting the subset tree to determine whether there is a route from the subset indicated by the set identification information to the subset identified by the reference identification information. Can be determined.
Here, the management apparatus searches for a subset that includes the lowest layer subset and includes the minimum number of elements, sets the lowest layer subset as a parent node, and uses the searched subset as a child. As a node, search for a subset that includes a subset of associations and the association destination, has a minimum number of elements, and is unassociated, and uses the subset of the association destination as a parent node, and the retrieved subset As a child node to generate a subset tree that routes the subset of the lowest layer, and the reference identification information includes the permission set with respect to the reference subset associated with the reference specific information. A first generation path from the root of the tree to the reference subset, and the set identification information includes a subset tree associated with the subset associated with the unique information. A second generation route from the first generation route to the subset, and the determination means identifies the portion identified by the set identification information when the second generation route is included in the first generation route. It may be determined that there is a route from the set to the subset identified by the reference identification information.

According to this configuration, the terminal apparatus uses the first generation path included in the reference identification information and the second generation path included in each set identification information to store the set identification information stored in the terminal apparatus. It can be determined whether or not indicates that the device is an effective device.
Here, the management device gives unique information associated with the subset as input information for a one-way function, and generates a common key based on the unique information and unique information derived from the unique information. The generated unique information is associated with a subset associated with the subset associated with the unique information given as input information, and the generated unique information is assigned to each device identifier included in the associated subset. Assigning information, and using the same function as the one-way function, the second acquisition means uses a device key based on the unique information from the unique information stored in the unique information storage means, and Acquired by the device key acquisition unit until the device key acquisition unit that generates and acquires the unique information derived from the unique information and the device key based on the reference specific information The unique information is given as information of the next input to the function, based on the repeater for controlling to repeat the operation of the device key obtaining unit, and the reference unique information obtained by the device key obtaining unit Decryption key acquisition means for acquiring a device key as the common key may be provided.

According to this configuration, the terminal device uses the same function as the one-way function that the management device has, and uses the common key to store the device key corresponding to the reference unique information from the unique information stored in the unique information storage unit. Can be obtained as
Here, the terminal device further acquires a content acquisition unit for acquiring content, a content key acquisition unit for acquiring a content key, and the content key acquired by the content key acquisition unit by the decryption unit. A first encryption unit that generates an encrypted content key by encrypting using the media key, and the content acquired by the content acquisition unit using the content key acquired by the content key acquisition unit Second encryption means for generating encrypted content by encryption, writing means for writing the encrypted content key and the encrypted content to a recording medium may be provided.

  According to this configuration, the terminal device generates an encrypted content key by encrypting the content key using the acquired common key, and generates an encrypted content by encrypting the content using the content key. The encrypted content key and the encrypted content can be written to the recording medium. Thus, when the terminal device determines that the terminal device is a valid terminal, the terminal device can generate the encrypted content key and the encrypted content, and the copyright for the content is protected.

Here, the writing means may write the encrypted content key and the encrypted content to the recording medium of an apparatus existing on a network via a communication medium.
According to this configuration, the terminal device can write the generated encrypted content key and encrypted content to the recording medium via the communication medium.

  Here, the terminal device further includes an encrypted content key acquisition unit that acquires an encrypted content key in which a content key is encrypted with the media key, and an encryption in which the content is encrypted with the content key. Encrypted content acquisition means for acquiring content; and first decryption means for generating the content key by decrypting the encrypted content key acquired by the encrypted content key acquisition means using the media key; The encrypted content acquired by the encrypted content acquisition means is decrypted using the content key, and the second decryption means for generating the content and the content generated by the second decryption are Reproducing means for reproducing may be provided.

  According to this configuration, the terminal device decrypts the encrypted content key using the acquired common key, generates a content key, decrypts the encrypted content using the generated content key, and stores the content. Generate and play back the generated content. Accordingly, when the terminal device determines that the terminal device is an effective terminal, the terminal device can generate content from the encrypted content and reproduce the generated content, thereby protecting the copyright on the content.

Here, the encrypted content key and the encrypted content are recorded on a recording medium, the recording medium is attached to the terminal device, and the encrypted content key acquisition unit is An encrypted content key may be acquired, and the encrypted content acquisition unit may acquire the content from the recording medium.
According to this configuration, the terminal device can generate the content by acquiring the encrypted content key and the encrypted content from the recording medium attached to the terminal device.

Here, the encrypted content key acquisition unit may acquire the encrypted content key via a communication medium, and the encrypted content acquisition unit may acquire the content via a communication medium.
According to this configuration, the terminal device can acquire the encrypted content key and the encrypted content via the communication medium and generate the content.

  Further, the present invention provides a plurality of terminal devices and device identifiers for identifying the plurality of terminal devices arranged on a tree-structured leaf, and each device identifier has a decryption key base for decrypting encrypted data. A copyright protection system comprising a management device for assigning and managing unique information, wherein the management device obtains a subset of device identifiers subordinate to the nodes in each layer excluding the leaves of the tree structure. A subset generation means for generating, a subset including the subset of the lowest layer excluding the leaf layer, and a first association means for associating and associating the first subset with the association destination The second associating means for searching for a subset including the same layer from the same layer or the layer immediately above and associating with the second associating means, and the second associating means repeatedly processing up to the highest layer. The first control means for controlling the first and second association means, the second association means, and the first control means to repeatedly process all the subsets of the lowest layer. In association with the second control means, the first assigning means for associating the unique information with the subset of the association source of the lowest layer, and assigning the unique information to the device identifier included in the subset, The subset connected across the layers is associated with the unique information derived from the unique information assigned to the subset of the association source, and the unique information is assigned to each device identifier included in the subset. And a second allocating unit for allocating.

  According to this configuration, the copyright protection system management apparatus uses the first association unit, the second association unit, the first control unit, and the second control unit to convert the lowest layer to the highest layer. Up to a subset of. In addition, the management apparatus can associate the unique information derived from the unique information associated with the subset of the lowest layer with the subset connected by the association using the second assigning unit. The conventional management apparatus had to prepare in advance each piece of unique information that is not related to each subset of the minimum number of elements in each layer. Different unique information may be prepared only for each subset of layers. In other words, the management apparatus can reduce the number of pieces of unique information that are not generated from other unique information in advance.

  Here, the first associating means searches for a subset that includes the subset of the lowest layer and includes the minimum number of elements, and uses the subset of the lowest layer as a parent node, Associating a set as a child node, the second associating means searches for a subset that includes the subset of the association destination and includes the minimum number of elements, and sets the subset of the association destination as a parent node And the first control means controls the second association means to repeatedly process until reaching the highest layer, and the subset of the lowest layer is obtained. A root subset tree may be generated.

According to this configuration, the copyright protection system management apparatus can generate a subset tree that routes a subset of the lowest layer. Thereby, the management apparatus can manage the association between the subsets in a tree structure.
Here, the first associating means excludes one or more subsets associated with each other from the subsets of the upper layers to the lowest layer, and uses the remaining one or more subsets, The second association means may be controlled to repeatedly process until reaching the highest layer, and a subset tree that routes a subset of the lowest layer may be generated.

According to this configuration, the copyright protection system management device generates each subset tree rooted at each subset of the lowest layer using each subset generated by the subset generation unit only once. can do.
Here, the second allocating unit generates the derived unique information from the unique information associated with the association source subset using a one-way function, and generates the generated unique information. , It may be associated with a subset connected by association.

According to this configuration, the copyright protection system management device uses the one-way function to generate unique information associated with the subset connected by the association from the unique information associated with the subset of the lowest layer. be able to.
Here, the management apparatus further includes a subset in which an identifier of a terminal device to be distributed that distributes unique information first appears as an element in each path from the root of the subset tree to each of one or more leaves. One or more unique information acquisition means for acquiring one or more unique information associated with the previous subset, and one or more set identification information for identifying the acquired unique information and a subset corresponding to the unique information, if present The distribution unit may be provided with distribution means for distributing the set to the terminal device to be distributed.

  According to this configuration, the management apparatus of the copyright protection system can distribute one or more sets including the unique information and the set identification information corresponding to the unique information to the terminal device to be distributed. As a result, the number of unique information distributed to the terminal device can be reduced as compared with the prior art. Conventionally, each layer associates subsets and acquires unique information to be distributed for each layer. According to the present invention, the unique information to be distributed exists in a higher layer than the associated subset. However, there is no need to distribute unique information associated with a subset connected by association. This is because unique information associated with a subset existing in an upper layer and connected by association can be derived from unique information to be distributed. As a result, the management apparatus can reduce the number of unique information distributed to the distribution target terminal apparatus. That is, the management device can reduce the number of keys assigned to the terminal device.

  Here, the management device further includes a first storage unit having an area for storing each subset that is a component of the subset tree and the specific information associated with each of the subsets; , Second storage means having an area for storing a plurality of nodes constituting the subset tree, and child nodes of each node, the subset and unique information associated with the subset First writing means for writing to the first storage means, second nodes for writing to the second storage means in association with the nodes constituting the subset tree and child nodes of the nodes. May be provided.

According to this configuration, the copyright protection system management apparatus can store the subset and the unique information associated with the subset in association with each other. Further, the management apparatus can store a plurality of nodes constituting the subset tree in association with child nodes of each node.
Here, the second control means controls the first association means, the second association means, and the first control means to repeatedly process all the subsets of the lowest layer. A plurality of subset trees, and the first storage means stores each subset included in each subset tree and each unique information associated with each of the subsets. The management device is further stored in an invalidation identifier storage unit having an area for storing an invalid identifier indicating one or more invalid terminals among the plurality of terminal devices, and the invalidation identifier storage unit. And acquiring one or more subsets from the first storage means, and acquiring one or more encryption keys based on each unique information associated with each acquired subset. , Individually obtain each encryption key An encryption key generating means for encrypting a media key used for content use and generating the same number of encrypted media keys as the one or more encryption keys, the encrypted media key, and the encrypted media key Third writing means for writing one or more sets of reference identification information for identifying a subset used for acquiring the encryption key to a recording medium attached to the management apparatus may be provided.

According to this configuration, the management apparatus of the copyright protection system generates one or more encrypted media keys, and a recording medium in which one or more sets including the generated encrypted media keys and the reference identification information are mounted. Can be written on.
Here, the management device may further include an invalidation identifier receiving unit that receives an invalid identifier and writes the received invalid identifier to the invalidation identifier storage unit.

According to this configuration, the copyright protection system management apparatus can receive an invalid identifier and write the received invalid identifier to the invalidation identifier storage unit.
Here, the encryption key is the same common key as the decryption key, and the one-way function further generates each common key based on each unique information from each unique information, and the encryption key The generation unit includes a subset acquisition unit that acquires from the first storage unit a subset that most includes one or more valid identifiers excluding invalid identifiers stored in the invalidation identifier storage unit; A control unit that controls the subset acquisition unit to repeatedly process until the valid identifier belongs to any one or more of the subsets acquired by the subset acquisition unit, and the one-way function The common key acquisition unit for acquiring one or more common keys generated from the unique information associated with each of the subsets acquired by the subset acquisition unit, and the common key acquisition unit Using each acquired common key, It may comprise an encryption unit for generating as many encrypted media key Tsukagi.

According to this configuration, the copyright protection system management device generates a common key, which is an encryption key, from unique information corresponding to a subset of valid identifiers using a one-way function, and generates the generated common key. The key can be used to generate an encrypted media key.
Here, the terminal device stores one or more sets of unique information distributed in advance by the distribution means of the management device and set identification information for identifying a subset associated with the specific information. A unique information storage means, a judgment means for judging whether the set identification information indicates that the terminal device is a valid device, and a judgment result by the judgment means is affirmative , Using a first acquisition means for acquiring one encrypted media key from the recording medium and the unique information stored in the unique information storage means, to obtain a decryption key corresponding to the encryption key A second acquisition unit; and a decryption unit that generates the media key by decrypting the encrypted media key acquired by the acquisition unit using the decryption key acquired by the second acquisition unit. It is good.

  According to this configuration, the terminal device of the copyright protection system can store the unique information. The conventional management apparatus associates each subset for each layer, associates specific information with a subset of the minimum number of elements existing in the layer, and sets the minimum element for the subset connected by the association. The unique information derived from the unique information assigned to the subset of numbers is associated. For this reason, the conventional terminal device needs to store the unique information associated with the subset including the device identifier of the terminal device for each subset collection associated with each layer. According to the present invention, since the management device associates each layer, the unique information derived from the unique information associated with the subset including the terminal identifier of the terminal device, that is, the upper layer There is no need to store unique information associated with the subset. That is, the number of unique information stored in the terminal device is reduced.

In addition, when the terminal device is a valid device, the terminal device obtains an encrypted media key and a decryption key, and uses the obtained decryption key to decrypt the encrypted media key to generate a media key. can do.
Here, the encryption key is a common key, and the determination means is identified by the reference identification information from a subset identified by the set identification information stored in the unique information storage means. When there is a route to the subset, the set identification information determines that the terminal device is a valid device, and the first acquisition means encrypts corresponding to the reference identification information. Obtaining a media key, wherein the second obtaining means obtains the decryption key, uses the obtained decryption key as the common key, and uses the obtained common key to decrypt the encrypted media key. May be decrypted.

According to this configuration, when the terminal device of the copyright protection system has a path from the subset indicated by the set identification information to the subset identified by the reference identification information, the set identification information is It can be determined that the terminal device indicates a valid terminal device.
Here, the second acquisition means uses the same function as the one-way function, and from the unique information stored in the unique information storage means, a device key based on the unique information, and the unique information The unique information derived from the information is generated, and the device key acquisition unit to acquire and the device key acquisition unit acquires the unique information acquired by the device key acquisition unit until the device key is acquired based on the reference specific information. Given as information of the next input, a repeater that controls to repeat the operation of the device key acquisition unit, and a device key based on the reference specific information acquired by the device key acquisition unit is acquired as the common key And a decryption key acquisition means for performing the above.

According to this configuration, the terminal device of the copyright protection system can acquire the device key corresponding to the reference specific information as a common key using the same function as the one-way function of the management device.
In the present invention, each device identifier for identifying a plurality of terminal devices is arranged on a tree-structured leaf, and each device identifier is assigned and managed with unique information as a basis of a decryption key for decrypting encrypted data. A sub-unit generating means for generating a sub-set of device identifiers subordinate to each sub-node in each layer excluding the leaf of the tree structure, and a sub-set existing in the same layer Group generation means for grouping other subsets including a subset of the minimum number of elements into one group together with a subset of the minimum number of elements, and for all the subsets of the minimum number of elements existing in the same layer A first control unit that controls the group generation unit to repeatedly perform processing, and the group generation unit and the first control unit perform repeated processing for all layers. A second control unit that controls the second control unit, and a subset that includes all of the subsets of any of the lower layer groups between different layers after processing is performed for all layers by the second control unit. An integration unit that integrates a group of an upper layer into one group with the group of the lower layer, and for each subset of the minimum number of elements in each group remaining after the group integration in all layers The first assigning means for associating each unique information and assigning each associated unique information to one or more device identifiers included in each subset, and assigning each unique information by the first assigning means For each subset that is different from each subset with the minimum number of elements, derived from the unique information associated with the subset with the minimum number of elements in the group to which the subset belongs. In association with unique information, the one or more device identifier included in each subset, characterized in that it comprises a second assignment means for assigning unique information associated.

  According to this configuration, the management apparatus can associate from the subset of the lowest layer to the subset of the highest layer using the integration unit. In addition, the management apparatus can associate the unique information derived from the unique information associated with the subset of the lowest layer with the subset connected by the association using the second assigning unit. The conventional management apparatus had to prepare in advance each piece of unique information that is not related to each subset of the minimum number of elements in each layer. Different unique information may be prepared only for each subset of layers. In other words, the management apparatus can reduce the number of pieces of unique information that are not generated from other unique information in advance.

1. 1. First Embodiment 1.1 Configuration of Copyright Protection System 10 The configuration of a copyright protection system 10 as an embodiment according to the present invention is shown in FIG.
The copyright protection system 10 includes a key management device 100, a recording medium 200, recording devices 300a, 300b,..., 300c, and playback devices 400a, 400b,.

  The key management apparatus 100 is a recordable medium such as a DVD-RAM, and the key revocation data is recorded on the recording medium 200 on which no information is recorded yet, and the key revocation data is recorded. The recording medium 200 is generated in advance. In order to distinguish between the recording medium 200 in which no information is recorded and the recording medium 200 in which the key revocation data is recorded, hereinafter, the recording medium 200 in which no information is recorded is referred to as a recording medium. The recording medium 200 on which the key revocation data is recorded is described as a recording medium 200b. Here, the key revocation data includes an encrypted media key obtained by encrypting a media key stored in advance in the key management device 100, recording devices 300a, 300b,..., 300c, and playback devices 400a, 400b. ,..., 400c includes information consisting of a set of device identifiers of valid devices. The set of device identifiers possessed by valid devices is a subset of the set of device identifiers possessed by each device.

  The key management device 100 assigns one or more key information to each of the recording devices 300a, 300b,..., 300c and the playback devices 400a, 400b,. Key information is distributed to each device in advance. Here, the key information includes a label that is a basis for generating a device key for decrypting the encrypted media key, and a set of device identifiers of the device to which the label is assigned.

  The recording device 300a encrypts the digitized content to generate encrypted content, records the generated encrypted content on the recording medium 200b attached to the recording device 300a, and records the encrypted content. The recorded recording medium 200 is generated. Hereinafter, the recording medium 200 on which the encrypted content is recorded is described as a recording medium 200c. Here, the content includes video information and audio information.

The playback device 400a takes out the encrypted content from the recording medium 200c attached to the playback device 400a, and decrypts the extracted encrypted content to obtain the original content.
The recording devices 300b,..., 300c operate in the same manner as the recording device 300a, and the playback devices 400b,..., 400c operate in the same manner as the playback device 400a.

Further, hereinafter, the subset is described by listing all elements included in the subset. For example, a subset composed of device identifiers 1, 2, and 3 is represented as a subset “123”, and a subset composed of device identifiers 3 and 4 is represented as a subset “34”.
1.2 Key management device 100
As shown in FIG. 2, the key management device 100 includes a device information storage unit 101, an information storage unit 102, an information generation unit 103, a distribution unit 104, a revocation device specifying unit 105, a key revocation data generation unit 106, and a reception unit. 107 and an output unit 108.

  Specifically, the key management device 100 is a computer system including a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or the hard disk unit. The key management apparatus 100 achieves its functions by the microprocessor operating according to the computer program.

(1) Device information storage unit 101
The device information storage unit 101 is specifically composed of a hard disk unit. In the binary tree T100 shown as an example in FIG. 3, device identifiers for identifying each recording device and each playback device are shown. For management, a tree structure table T101 shown in FIG. 4 is stored as a data structure for expressing the tree structure T100.

  First, the tree structure T100 will be described. FIG. 3 shows, as an example, a tree structure T100 when the total number of recording devices and reproducing devices is eight. Each layer in the tree structure is called a layer, a node of layer 0 is called a root, and a node of the lowest layer (layer 3 in the example of FIG. 3) is called a leaf. Each device is assigned one-to-one with respect to the leaf of the tree structure. The information assigned to the leaf is a device identifier that identifies each device. In the tree structure T100, device identifiers 1 to 8 are assigned to eight leaves, respectively.

For example, the node T130 “E0” is the root of the tree structure T100, the node T131 “E7” is the leaf of the tree structure T100, and the device identifier “device 1” is assigned.
Next, the tree structure table T101 will be described. The tree structure table T101 stores in advance at least one set of a parent node, a corresponding child node, and a device identifier. The parent node name indicates a node included in the tree structure T100, and the child node name indicates a child node of the node indicated by the parent node name. However, when the node indicated by the parent node is a leaf, the symbol “-” is recorded. The device identifier is an identifier for identifying a device assigned to each leaf. When the node indicated by the parent node name is other than a leaf, the symbol “-” is recorded.

  For example, the set T170 shown in the tree structure table T101 includes a device identifier in which a parent node name T171 “E0”, a child node name T172 “E1”, and a symbol T173 “−” are recorded. The set T175 includes a parent node name T176 “E7”, a child node name in which a symbol “−” is recorded, and a device identifier T178 “device 1”. Accordingly, it can be seen that the node “E0” has “E1” as a child node, the node “E7” is a leaf, and the device identifier “device 1” is assigned.

As described above, the key management apparatus 100 can manage each apparatus identifier in the apparatus information storage unit 101, that is, manage each recording apparatus and each reproduction apparatus.
(2) Information storage unit 102
Specifically, the information storage unit 102 includes a hard disk unit, and includes a device key table D100 and an interrelation table D101 as shown in FIG. 5 and FIG. 6 as an example.

<Device key table D100>
The device key table D100 has at least one set of a subset made up of device identifiers of valid devices, a label name associated with the subset, and a device key generated from the label name. As will be described later, a device key table D100 is generated by the information generation unit 103 and written in the information storage unit 102. The device key table D100 indicates the result generated by the information generation unit 103 when the total number of recording devices and playback devices is eight.

In each item of the device key table D100, a subset is described in the upper section, a label name is displayed in the middle section, and a device key is described in the lower section. For example, in the item D200, the subset D201 “1” is described in the upper row, the label D202 “A1” in the middle row, and the device key D203 “K1” in the lower row.
<Interrelation table D101>
The correlation table D101 corresponds to the tree structures T201, T202, T203, T204, T205, T206, T207, and T208 of the subsets shown as examples in FIGS. 7 and 8, and represents the tree structure of each subset. The data structure for As will be described later, a data structure for representing the tree structure of each subset by the information generation unit 103 is generated as an interrelation table D101 and written in the information storage unit 102. The correlation table D101 indicates the result generated by the information generation unit 103 when the total number of recording devices and playback devices is eight.

Here, the tree structure of each subset will be described first.
The tree structures T201 and T205 of the subsets are routed to the subset “1” and the subset “5”, respectively, and are composed of six layers from layer 0 to layer 5. Each node of the subset tree structures T201 and T205 is a subset that includes a parent node for the node and has the smallest number of elements among the subsets recorded in the device key table D100.

For example, a node existing in layer 1 includes a subset “1” as a root, and becomes a subset “12” having the smallest number of elements. Also, layer 2 includes subset “12” that is a node of layer 1 and has subset “123” and subset “124” that are subsets having the smallest number of elements as nodes.
The tree structures T202, T204, T206, and T208 of the subsets are each composed of one layer of layer 0, rooting the subset “2”, the subset “4”, the subset “6”, and the subset “8”. That is, the child node is not associated from the root.

The tree structures T203 and T207 of the subset are each composed of six layers from layer 0 to layer 5 that route the subset “3” and the subset “7”, respectively. Each node in the tree structures T203 and T207 of the subset is a subset having the minimum number of elements, including the parent node for the node among the subsets recorded in the device key table D100.
Hereinafter, the correlation table D101 will be described.

  The interrelation table D101 includes a subset tree structure T201, T202, T203, T204, T205, T206, T207, and T208 that includes the same number of node information and route information corresponding to the node information. Has been. Here, the node information includes a parent node and a child node. Each parent node represents a subset corresponding to each node constituting the tree structure T201 to T208 of the subset, and a child node represents a subset associated with the parent node.

  Note that “-” described in the child node indicates that there is no subset associated with the parent node. Further, when two identical subsets are recorded in the parent node, it indicates that there are two child nodes for the subset. At this time, the child node for the subset recorded at the upper level indicates the left child node, and the child node for the subset recorded at the lower level indicates the right child node. When a subset is recorded only once at the parent node, this indicates that there is one child node for the subset, and that child node indicates the right child node.

The route information indicates whether the node recorded in the corresponding parent node is a route. When the node recorded in the parent node is a root, information indicating that it is a root (here, “root”) is recorded, and when it is not a root, nothing is recorded.
(3) Information generation unit 103
The information generation unit 103 is a one-way function, and stores in advance a pseudo-random number generator G150 that generates a random number of 3X bits for an input data length of X bits. The result when the value a1 is input to the pseudo-random number generator G150 is different from the result when the value a2 different from the value a1 is input.

  Here, the operation of the pseudorandom number generator G150 will be described with reference to FIG. When the pseudorandom number generator G150 receives an input value t having a data length of X bits, the initial value Iv and the AES function are used to generate t1 consisting of X bits, and further, the input value t, Using the AES function and the value obtained by adding the generated value t1 to the initial value Iv, t2 consisting of X bits is generated, and further, the input value t, the AES function, and the value t2 generated for the initial value Iv. Is used to generate t3 consisting of X bits, and the generated t1, t2 and t3 are combined to output a value t1 || t2 || t3 consisting of 3X bits. The symbol “||” means a bond. here. The value t1 is a label corresponding to the left child node when associating the child node of the node with respect to the input value t, and the value t3 is the right child node when associating the child node of the node with respect to the input value t. This is a corresponding label, and the value t2 is a device key assigned to the node for the input value t. Hereinafter, the value t1 is called a left label, the value t3 is called a right label, and the value t2 located in the middle is called a device key.

The information generating unit 103 has a working device key table that has the same framework as the device key table D100 and is not recorded as an initial state. That is, the working device key table is a table in which no device key table D100 is recorded.
The information generation unit 103 receives a generation instruction indicating that a device key is generated and stored in the device key table D100 from the reception unit 107.

  When the information generation unit 103 receives the generation instruction, the device information storage unit 101 sets a subset consisting of all devices managed by the binary tree, that is, device identifiers that indicate valid devices from the device identifier. Generate the above, associate the generated subsets, generate the correlation table D101, generate labels and device keys for each subset, and assign the generated labels and device keys A key table D100 is generated. The information generation unit 103 writes the generated device key table D100 and the correlation table D101 into the information storage unit 102.

<Generation of subset>
The information generation unit 103 acquires the height T of the tree structure managed by the device information storage unit 101, and sets an initial value 0 to the row counter n of the work device key table.
The information generation unit 103 repeats the following operations (a1) to (a6) from i = 0 to T-1.

(A1) The information generation unit 103 acquires the number N of nodes in which the layer i exists. Next, the information generation unit 103 acquires the height H of the subtree whose root is the node existing in the layer i.
(A2) The following operations (a3) to (a6) are repeated from j = 0 to H-1.
(A3) Add 1 to the row counter n and set the addition result to n.

(A4) The following operations (a5) and (a6) are repeated from k = 1 to N.
(A5) A subtree whose root is the k-th node from the left of layer i is acquired, and 2 ^ j terminal identifiers are removed from the leaves of the acquired subtree, and a subset including one or more terminal identifiers remaining One or more are generated. As a result, a subset of valid terminal identifiers excluding invalid terminal identifiers is generated. However, when a plurality of devices are excluded, that is, when a plurality of invalid device identifiers are excluded, only when there is an upper node having all invalid terminal identifiers in common and having only invalid terminal device identifiers. .

(A6) Write each created subset to the n-th unrecorded column of the working device key table in order from the left.
Through the above operation, the information generation unit 103 generates a device key table D100a in which only a subset is recorded from the work device key table. As described above, a subset generation unit that generates a subset is configured by the above operation.

Note that the device key table D100a shown in FIG. 10 is a result when a subset is generated using the tree structure T100 shown in FIG. A specific operation for generating the device key table D100a shown in FIG. 10 using the tree structure T100 shown in FIG. 3 will be described below.
<Specific Example of Generation of Device Key Table D100a>
The information generation unit 103 acquires the height T = 3 of the tree structure T100 and sets the initial value 0 to the row counter n.

The information generation unit 103 repeats the following operation from i = 0 to 2.
(When i = 0)
The information generation unit 103 acquires the number N = 1 of nodes in which the layer i = 0 exists by the operation (a). Next, the information generation unit 103 acquires the height H = 3 of the subtree whose root is the node existing in the layer i = 0.

The information generation unit 103 repeats the operations (a3) to (a6) for j = 0 to 2 in the operation (a2).
When j = 0, first, in the operation (a3), 1 is added to the row counter n (= 0), so that n = 1. Next, the operations (a5) and (a6) are performed k = 1 times by repeating the operation (a4).

  In the operation (a5), subsets “1234567”, “1234568”, which are subtrees with the first root from the left of layer 0, that is, the tree structure T100 excluding 2 ^ 0 (= 1) terminal identifiers, “1234578”, “1234678”, “1235678”, “1245678”, “1345678”, and “2345678” are generated, and in the operation (a6), each generated subset is the n = 1st row of the work device key table. Write to the unrecorded columns in order from the left.

When j = 1, in the operation (a3), 1 is added to the current value of the row counter n (= 1), and n = 2. Next, the operations (a5) and (a6) are performed k = 1 times by repeating the operation (a4).
In operation (a5), subsets “123456”, “123478”, “125678”, and “345678” excluding 2 ^ 1 (= 2) terminal identifiers are generated from the tree structure T100, and operation (a6) Then, the generated subsets are sequentially written from the left to the unrecorded column of the n = 2nd row of the working device key table.

When j = 2, in the operation (a3), 1 is added to the current value of the row counter n (= 2), and n = 3. Next, the operations (a5) and (a6) are performed k = 1 times by repeating the operation (a4).
In operation (a5), subsets “1234” and “5678” are generated by removing 2 ^ 2 (= 4) terminal identifiers from the tree structure T100. In operation (a6), the generated subsets are Write in order from the left to the unrecorded column in the n = 3th row of the working device key table.

(When i = 1)
The information generation unit 103 acquires the number N = 2 of nodes in which the layer i = 1 exists by the operation (a). Next, the information generation unit 103 acquires the height H = 2 of the subtree whose root is the node existing in the layer i = 1.
The information generation unit 103 repeats the operations (a3) to (a6) for j = 0 to 1 in the operation (a2).

When j = 0, in the operation (a3), 1 is added to the current value of the row counter n (= 3), so that n = 4. Next, in the operation (a4), the operations (a5) and (a6) are repeated for k = 1 to 2.
In the case of k = 1, in the operation (a5), subsets “123” and “124” obtained by removing 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the first from the left of layer 1 , “134” and “234” are generated, and in the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 4th row of the work device key table.

In the case of k = 2, in the operation (a5), subsets “567” and “568” obtained by subtracting 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the second from the left of layer 1 , “578” and “678” are generated, and in the operation (a6), the generated subsets are sequentially written in the n = 4th unrecorded column of the device key table D100 from the left.
When j = 1, in the operation (a3), 1 is added to the current value of the row counter n (= 4), and n = 5. Next, in the operation (a4), the operations (a5) and (a6) are repeated for k = 1 to 2.

In the case of k = 1, in the operation (a5), the subsets “12” and “34” obtained by subtracting 2 ^ 1 (= 2) terminal identifiers from the subtree rooted at the first from the left of layer 1 In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 5th row of the work device key table.
In the case of k = 2, in the operation (a5), the subsets “56” and “78” obtained by removing 2 ^ 1 (= 2) terminal identifiers from the subtree having the second root from the left of layer 1 as the root. In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 5th row of the device key table D100.

(When i = 2)
The information generation unit 103 acquires the number N = 4 of nodes in which the layer i = 2 exists by the operation (a). Next, the information generation unit 103 acquires the height H = 1 of the subtree whose root is the node existing in the layer i = 2.
In the operation (a2), the information generation unit 103 performs the operations (a3) to (a6) only between j = 0 and H−1, that is, only when j = 0.

When j = 0, in the operation (a3), 1 is added to the current value of the row counter n (= 5), so that n = 6. Next, in the operation (a4), the operations (a5) and (a6) are repeated for k = 1 to 4.
In the case of k = 1, in the operation (a5), the subsets “1” and “2” obtained by removing 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the first from the left of layer 1 In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 6th row of the work device key table.

In the case of k = 2, in the operation (a5), the subsets “3” and “4” obtained by subtracting 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the second from the left of layer 1 In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 6th row of the work device key table.
In the case of k = 3, in the operation (a5), the subsets “5” and “6” obtained by subtracting 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the third from the left of layer 1 In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 6th row of the work device key table.

In the case of k = 4, in the operation (a5), the subsets “7” and “8” obtained by removing 2 ^ 0 (= 1) terminal identifiers from the subtree rooted at the fourth layer 1 from the left. In the operation (a6), the generated subsets are sequentially written from the left to the unrecorded column of the n = 6th row of the work device key table.
(Generation result)
By performing the above operation, the information generation unit 103 generates a device key table D100a in which only a subset is recorded, as shown in FIG.

  Each subset recorded in the first row 501, the second row 502, and the third row 503 in the device key table D100a is generated from a subtree rooting the node T130 “E0” existing in the layer 0 of the tree structure T100. In the first line 501, eight subsets from which one terminal identifier is removed, that is, eight subsets consisting of seven valid terminal identifiers are recorded. In the second line 502, five valid terminal identifiers are recorded. Four subsets are recorded, and in the third row 503, two subsets consisting of four valid terminal identifiers are recorded.

Further, each subset recorded in the fourth row 504 and the fifth row 505 is generated from two subtrees that respectively route two nodes existing in the layer 1 of the tree structure T100, and in the fourth row 504, Eight subsets composed of three valid terminal identifiers are recorded, and in the fifth row 505, four subsets composed of two valid terminal identifiers are recorded.
The eight subsets recorded in the sixth row 506 are generated from four subtrees that route each of the four nodes existing in layer 2 of the tree structure T100.

<Generate device key>
The information generation unit 103 has a framework similar to that of the correlation table D101, and has a working correlation table that is not recorded as an initial state in advance. That is, the work correlation table is a table that is not recorded in the correlation table D101.

The information generation unit 103 acquires the height T of the tree structure managed by the device information storage unit 101.
The information generation unit 103 repeats the following operations (b1) to (b11) until h = 1 to 2 ^ T.
(B1) Generate a random number Ah consisting of X bits, and write the generated random number Ah into {(T ^ 2 + T) / 2} rows and h columns of the device key table D100a. Thereby, the information generation unit 103 can assign the random number Ah as a label for a subset of {(T ^ 2 + T) / 2} rows and h columns of the device key table D100a.

(B2) The assigned label, that is, the random number Ah is given as an input value to the pseudo random number generator G, and a 3X bit random number is generated and acquired as an output.
(B3) The acquired 3X bit random number is divided into X bits, and the X bit located second from the left is set as the device key “Km” corresponding to the assigned label {(T Write to {2 + T) / 2} rows and h columns. In addition, two left labels and right labels composed of X bits located at both ends are temporarily stored in association with a subset of the label used for input to the pseudorandom number generator G (that is, the random number Ah). Keep it. However, the subscript m of Km indicating the device key starts from the initial value 1 and increases by 1 every time a device key is assigned, and Km + 1 indicates that the device key is assigned next to Km.

(B4) The following operations (b5) to (b11) are repeated for i = {(T ^ 2 + T) / 2-1} to 1.
(B5) The number J of subsets to which device keys and labels are assigned is acquired in the i + 1th row of the device key table D100a.
(B6) The following operations (b7) to (b11) are repeated for j = 1 to J.

(B7) A subset Sj is included in order from the left in the i-th row of the device key table D100a with reference to the j-th subset Sj from the left to which the device key and label are assigned in the i + 1-th row of the device key table D100a. And a subset to which a device key has not yet been assigned is retrieved.
(B8) As a result of the search in operation (b7), if there is no subset that includes the subset Sj and no device key has been assigned yet, the subset Sj is the parent node, and the subset Sj that is the parent node Then, a set consisting of the symbol “-” indicating that there is no subset as a child node is written as node information in the unrecorded highest area in the working correlation table. That is, the subset Sj is written in the item of the parent node, and the symbol “-” is written in the item of the child node. Further, when the subset Sj is a route, information indicating that it is a route (“route”) is recorded in the route information, and when it is not a route, nothing is recorded in the route information. A method for determining whether or not the subset Sj is a root may be to determine whether or not the row in which the subset Sj is recorded, that is, whether the value of i + 1 is {(T ^ 2 + T) / 2}. . When the value of i + 1 is {(T ^ 2 + T) / 2}, the subset Sj exists in the lowest layer of the device key table D100a, and therefore there is no subset included in the subset Sj. . That is, there is no parent node having the subset Sj as a child node, and the subset Sj is a root node.

(B9) If there is one or more subsets including the subset Sj and not yet assigned a device key as a result of the search in the operation (b7), one or more subsets to which no device key has been assigned yet A maximum of two subsets are acquired sequentially from the left.
(B10) When there is one acquired subset, the right label is assigned as the label for the acquired subset in correspondence with the subset Sj and temporarily stored in the left label and the right label The assigned right label is written in the field in which the acquired subset is recorded in the device key table D100a. In the case where there are two acquired subsets (here, Tj and Uj), a label for the subset Tj located on the left side of the two subsets is associated with the subset Sj and temporarily Of the left label and right label stored in the left label and right label, assigned to the subset Sj as a label for the subset Uj located on the right side, and temporarily stored Assign the right label. The assigned left label is written in the column in which the acquired subset Tj is recorded in the device key table D100a, and the assigned right label is written in the column in which the acquired subset Uj is recorded.

  (B11) When there is one acquired subset, the label assigned to the acquired subset (that is, the temporarily stored right label) is given to the pseudo-random number generator G as an input value. , Generate and obtain a 3X bit random number as the output, divide the obtained 3X bit random number into X bits, and replace the X bit positioned second from the left with the device key “ "Km" is written in the field in which the acquired subset in the device key table D100a is recorded. Further, the information generation unit 103 uses the two left labels and the right label acquired in the operation (b11) as a subset of the labels used for input to the pseudorandom number generator G (that is, in the operation (b9)). It is temporarily stored in association with the acquired subset). Further, the subset Sj is set as a parent node, and the acquired subset is set as a child node in the uppermost unrecorded area in the work correlation table. Further, when the subset Sj is a route, information indicating that it is a route (“route”) is recorded in the route information, and when it is not a route, nothing is recorded in the route information.

  (B12) When there are two acquired subsets (here, the subsets acquired in order from the left are the subset Tj and the subset Uj, respectively), first, the pseudo-random number generator G A label assigned to the acquired subset Tj (that is, a temporarily stored left label) is given as an input value, and a 3X-bit random number is generated and acquired as an output thereof. Divide every X bits, and write the X bit located second from the left as the device key “Km” corresponding to the assigned label in the field in which the acquired subset Tj in the device key table D100a is recorded. . Further, the information generation unit 103 uses the left label as an input value, temporarily associates the acquired two left labels and right label with the subset Tj for the label used for input to the pseudorandom number generator G, and temporarily Remember. Further, the subset Sj is used as a parent node, and the acquired subset Tj is used as a child node of the subset Sj in the highest area that is not recorded in the work correlation table. Further, when the subset Sj is a route, information indicating that it is a route (“route”) is recorded in the route information, and when it is not a route, nothing is recorded in the route information. Next, the pseudorandom number generator G is given the label assigned to the acquired subset Uj (that is, the temporarily stored right label) as an input value, and generates a 3X bit random number as its output. The obtained 3X-bit random number is divided into X bits, and the X-bit located second from the left is obtained as the device key “Km + 1” corresponding to the assigned label in the device key table D100a. Write in the field where the subset Uj is recorded. Further, the information generation unit 103 temporarily associates the acquired two left labels and right label with the subset Uj for the label used for input to the pseudorandom number generator G, using the right label as an input value. Remember. Further, the subset Sj is set as a parent node, and the acquired subset Uj is set as a child node of the subset Sj in the highest area that is not recorded in the work correlation table. Further, when the subset Sj is a route, information indicating that it is a route (“route”) is recorded in the route information, and when it is not a route, nothing is recorded in the route information.

Through the above operation, the information generation unit 103 generates a device key table D100 in which labels and device keys are assigned to all subsets recorded in the device key table D100a as shown in FIG. Furthermore, the correlation table D101 can also be generated from the work correlation table.
A specific operation in which the information generation unit 103 generates labels and device keys and assigns the generated labels and device keys using the device key table D100a will be described below.

<Specific example of device key generation>
The information generation unit 103 acquires the height T = 3 of the tree structure T100.
The information generation unit 103 repeats the following operation from h = 1 to 2 ^ T.
(When h = 1)
The information generation unit 103 generates a random number A1 composed of X bits, assigns the generated random number A1 as a label for the subset “1” of 6 rows and 1 column, and assigns the assigned label to 6 in the device key table D100a. Write to row and column.

Next, the information generation unit 103 gives the assigned label, that is, the random number A1 as an input value to the pseudo random number generator G, and acquires a 3X bit random number as its output.
The information generation unit 103 divides the acquired 3X-bit random number for each X bit, and sets the X bit located second from the left as the device key “K1” corresponding to the assigned label, in the device key table D100a. Write to 6 rows and 1 column. In addition, two left labels (here, denoted as A1L) and right labels (here, denoted as A1R) consisting of X bits located at both ends were used for input to the pseudorandom number generator G. The label is temporarily stored in association with the subset “1”.

The information generation unit 103 repeats the operations (b5) to (b11) until i = 5 to 1.
In the case of i = 5, the number J of the subsets to which the device key is assigned in the sixth row of the device key table D100a is obtained, and the operations (b8) to (b11) are performed by repeating (b6) by performing j = Perform once. In operation (b8), the information generation unit 103 uses the first subset “1” from the left to which the device key is assigned in the sixth row of the device key table D100a as a reference, and the fifth row of the device key table D100a. Are searched in order from the left, including a subset “1” and a device key not yet assigned. In operation (b9), the subset “12” including the subset “1” and not yet assigned with the device key is acquired, and the right label “A1R” temporarily stored in operation (b10). Is assigned as a label for the acquired subset “12”, and the assigned right label is written in the field in the device key table D100a where the acquired subset “12” is recorded. In operation (b11), the information generation unit 103 gives the pseudorandom number generator G the label “A1R” assigned to the acquired subset “12” as an input value, and acquires a 3 × bit random number as its output. The obtained 3X bit random number is divided into X bits, and the X bit located second from the left is used as the device key “K2” corresponding to the assigned label, and the acquired part in the device key table D100a Write to the field where set “12” is recorded. Two left labels (A1RL) and right labels (A1RR) consisting of X bits located at both ends are temporarily stored in association with a subset “12” for the label used for input to the pseudo-random number generator G. Keep it. Further, the subset “1” is set as a parent node, and the acquired subset is set as a child node in the uppermost unrecorded area in the work correlation table. Furthermore, since the subset “1” is a route, information indicating that it is a route (“route”) is recorded.

  In the case of i = 4, the number J of subsets to which the device key is assigned in the fifth row of the device key table D100a is obtained, and the operations (b8) to (b11) are performed by repeating (b6), j = Perform once. In operation (b8), the information generation unit 103 sets the fourth row of the device key table D100a based on the first subset “12” from the left to which the device key is assigned in the fifth row of the device key table D100a. Are searched in order from the left, including a subset “12” and a device key not yet assigned. In operation (b9), the subsets “123” and “124” including the subset “1” and not yet assigned with the device key are acquired, and in operation (b10), the two subsets “123” are acquired. And the left label (A1RL) temporarily stored as the label for the subset “123” located on the left side of “124”, and temporarily assigned as the label for the subset “124” located on the right side. The stored right label (A1RR) is assigned. The assigned left label is written in the field in which the acquired subset “123” is recorded in the device key table D100a, and the assigned right label is written in the field in which the acquired subset “124” is recorded.

  In operation (b12), the information generation unit 103 first gives the pseudorandom number generator G the label (A1RL) assigned to the acquired subset “123” as an input value, and outputs a 3 × bit random number as its output. And the obtained 3X-bit random number is divided into X bits, and the X-bit located second from the left is obtained as the device key “K3” corresponding to the assigned label in the device key table D100a. Is written in the field in which the subset “123” is recorded. Two left labels (A1RLL) and right labels (A1RLL) consisting of X bits located at both ends are temporarily stored in association with a subset “123” for the label used for input to the pseudo-random number generator G. Keep it. Further, the subset “12” is set as a parent node, and the acquired subset “123” is set as a child node of the subset “12” in the uppermost unrecorded area in the work correlation table. Since the subset “12” is not a route, nothing is recorded in the route information. Next, a label (A1RR) assigned to the acquired subset “124” is given as an input value to the pseudo-random number generator G, and a 3X-bit random number is acquired as an output thereof. Dividing into bits, the X bit positioned second from the left is used as the device key “K4” corresponding to the assigned label to the column in which the acquired subset “124” in the device key table D100a is recorded. Write. Two left labels (A1RRL) and right labels (A1RRR) consisting of X bits located at both ends are temporarily stored in association with the subset “124” for the label used for input to the pseudorandom number generator G. Keep it. Further, the subset “12” is set as a parent node, and the acquired subset “124” is set as a child node to the uppermost unrecorded area in the work correlation table. Since the subset “12” is not a route, nothing is recorded in the route information.

For i = 3, 2 and 1, by performing the above-described operation, the data structure indicating the tree structure T100 that routes the subset “1” and the device keys “K1” to “K11” A label corresponding to the device key can be acquired.
Also, for each of h = 2, 3, 4, 5, 6, 7, and 8, the subsets “2”, “3”, “4”, “5” are performed by performing the above-described operation. , “6”, “7”, and “8” as a root, a data structure indicating a tree structure T202, T203, T204, T205, T206, T207, and T208, device keys “K12” to “K34”, and each device A label corresponding to the key can be obtained.

(Generation result)
By performing the above operation, the information generation unit 103 generates a device key table D100 and an interrelation table D101 as shown in FIGS.
In the first row of the device key table D100, a subset from which one terminal identifier is removed, that is, a subset including seven valid terminal identifiers, a label assigned to the subset, and a device key are recorded. The line contains a subset of five valid terminal identifiers, the labels and device keys assigned to those subsets, and the third line contains a subset of four valid terminal identifiers, those parts A label and a device key assigned to the set are recorded. In the following, the 4th, 5th and 6th lines are respectively a subset of three valid terminal identifiers, two valid terminal identifiers and one valid terminal identifier, and labels assigned to those subsets. And a device key are recorded.

Further, in the interrelation table D101, a tree structure T201 having the roots of the subsets “1”, “2”, “3”, “4”, “5”, “6”, “7”, and “8”, A data structure indicating T202, T203, T204, T205, T206, T207, and T208 is recorded.
Here, the state in which each subset is associated by the above operation is shown in the table of FIG. Each element of the table is a subset, and the arrows indicate the direction in which the two subsets are associated. The association of the subset means that a label corresponding to the child node can be generated from the label corresponding to the subset that is the parent node.

  For example, the subset 510 “1” is associated with the subset 511 “12” by the arrow 512. This is because two nodes are associated with a subset 510 “1” as a parent node and a subset 511 “12” as its child node. This is because the label “A1” of the subset 510 “1” This means that the label “A1R” of the set 511 “12” can be generated. Further, the subset 511 “12” is associated with the subset 513 “123” and the subset 514 “124” by arrows 515 and 516, that is, the subset 511 “12” is set as a parent node, and the subset 513 “123” ”And the subset 514“ 124 ”as their child nodes.

Here, by associating the subsets, it is understood that the labels are associated. This is because a label for a subset assigned to a child node is generated from a label assigned to a subset serving as a parent node by using the pseudo random number generator G150 that is a one-way function. Because.
(4) Distribution unit 104
The distribution unit 104 includes a key information storage area for temporarily storing a label to be distributed to the device and a subset corresponding to the label.

The distribution unit 104 receives a key information distribution instruction and a device identifier indicating a device to distribute from the reception unit 107.
When the distribution unit 104 receives the distribution instruction and the device identifier, the distribution unit 104 generates and acquires one or more pieces of key information including a label to be distributed to a device corresponding to the received device identifier and a subset corresponding to the label. A method for acquiring key information will be described later.

The distribution unit 104 reads the correlation table D101 stored in the information storage unit 102.
The distribution unit 104 distributes the acquired one or more pieces of key information and the read correlation table D101 to a device corresponding to the received device identifier.
Here, an example of the distribution method will be described below. The distribution unit 104 writes the received device identifier, the acquired one or more key information, and the read correlation table D101 in a distribution recording medium attached to the key management device 100. A company that manages the key management apparatus 100 distributes a recording medium in which the apparatus identifier, one or more pieces of key information, and the correlation table D101 are written to a manufacturer that manufactures the apparatus. Upon receipt of the recording medium, the manufacturer reads and reads one or more key information and the correlation table recorded on the recording medium during manufacture of the device corresponding to the device identifier recorded on the recording medium. One or more pieces of key information and the correlation table D101 are written into the device being manufactured. Thereby, one or more pieces of key information and the correlation table D101 can be distributed to the device corresponding to the device identifier.

<Acquisition of key information>
Here, the operation of acquiring key information will be described.
When the distribution unit 104 receives the distribution instruction and the device identifier of the device to distribute, the distribution unit 104 acquires the number Y of tree structures managed in the correlation table D101.
The distribution unit 104 repeats the following operations (c1) to (c6) from i = 1 to Y.

(C1) The distribution unit 104 acquires a data structure indicating the tree structure Vi managed i-th from the top in the correlation table D101.
(C2) The number P of nodes (that is, leaves) having no child nodes is acquired from the acquired data structure.
(C3) The distribution unit 104 repeats the following operations (c4) to (c6) from p = 1 to P.

(C4) The distribution unit 104 acquires the upper p-th node Wp (that is, Wp is a leaf) having no child node from the parent node item of the acquired data structure, and the root of the tree structure Vi. As a starting point, the first node (subset) in which the subset including the received device identifier appears is searched for the path to the leaf Wp.
(C5) When a node is detected by the search of the operation (c4), it is determined whether or not the detected node is already stored in the key information storage area.

  (C6) When determining that it has not been stored, the distribution unit 104 reads the detected node, that is, a label corresponding to the subset from the device key table D100, and includes key information including the read label and the detected subset. Is generated and acquired, and the acquired key information is stored in the key information storage area. When it is determined that the information has been stored, the key information is not generated and stored in the key information storage area.

Through the above operation, the distribution unit 104 stores all the key information including the label and the subset to be distributed to the device corresponding to the received device identifier in the key information storage area. The distribution unit 104 reads the correlation table D101 and distributes the read correlation table D101 and all the key information stored in the key information storage area to the distribution target devices.
The distribution unit 104 deletes all the key information stored in the key information storage area after distributing the correlation table D101 and all the key information to the apparatus having the received apparatus identifier. Here, the distribution means that, for example, writing of the received apparatus identifier, one or more key information stored in the key information storage area, and the correlation table D101 on the recording medium for distribution is completed. Say what you did.

<Specific example of key information acquisition>
A specific operation for acquiring key information when the device identifier 1 is given will be described below using the device key table D100 and the correlation table D101.
Upon receiving the distribution instruction and the device identifier “1”, the distribution unit 104 acquires the number 8 of tree structures managed in the correlation table D101.

The distribution unit 104 repeats the operations (c1) to (c6) for i = 1 to 8.
(When i = 1)
The distribution unit 104 acquires a data structure indicating the tree structure V1 managed first from the top in the interrelation table D101. Here, the data structure indicating the tree structure V1 is the data structure D300 shown from the first line to the fifteenth line of the correlation table D101.

The distribution unit 104 acquires the number 5 of nodes (that is, leaves) that do not have child nodes from the acquired data structure.
The distribution unit 104 repeats the operations (c4) to (c6) until p = 1 to 5.
In the case of p = 1, the distribution unit 104 becomes the top first node W1 (here, the subset D302 “124” in FIG. 6) that has no child nodes from the parent node item of the acquired data structure. And the first node (subset) in which the subset including the received device identifier appears is searched for the route to the leaf W1 starting from the root of the tree structure V1. The distribution unit 104 detects the node 1 (here, the subset D301 “1” in FIG. 6) by searching, and whether or not the detected subset D301 “1” has already been stored in the key information storage area. Judging.

The distribution unit 104 determines that it has not been stored, reads the label D202 “A1” corresponding to the detected subset D301 “1” from the device key table D100, reads the read label D202 “A1”, and the detected subset D301. Key information including “1” is generated and acquired, and the acquired key information is stored in the key information storage area.
In the case of p = 2, the distribution unit 104 selects the second highest node W2 (in this case, the subset D303 “1234567”) having no child nodes from the parent node item of the acquired data structure. The first node (subset) in which the subset including the received device identifier appears is searched for the route from the root of the tree structure V1 to the leaf W2, starting from the root of the tree structure V1. , Subset D301 “1”) is detected, but it is determined that it has been stored in the key information storage area, and generation of key information and storage in the key information storage area are not performed.

Similarly, for p = 3 to 5, the distribution unit 104 detects the node 1, but determines that it has been stored, and does not generate key information and store it in the key information storage area.
(When i = 2)
The distribution unit 104 acquires a data structure indicating the tree structure V2 that is secondly managed from the top in the correlation table D101. Here, the data structure indicating the tree structure V2 is a data structure D310 composed of the 16th line of the correlation table D101.

The distribution unit 104 acquires the number 1 of nodes (that is, leaves) that do not have child nodes from the acquired data structure D310.
The distribution unit 104 performs the operations (c4) to (c6) p = 1 time.
The distribution unit 104 acquires the top first node W1 (in this case, the subset D311 “2”) having no child node from the parent node item of the acquired data structure, and acquires the tree structure V2. The first node (subset) in which the subset including the received device identifier appears is searched for the route from the root to the leaf W1. The distribution unit 104 does not detect the node by the search.

(When i = 3)
The distribution unit 104 acquires a data structure indicating the tree structure V3 managed third from the top in the correlation table D101. Here, the data structure indicating the tree structure V3 is the data structure D320 including the 17th to 21st lines of the correlation table D101.
The distribution unit 104 acquires the number 2 of nodes (that is, leaves) that do not have child nodes from the acquired data structure.

The distribution unit 104 repeats the operations (c4) to (c6) until p = 1 to 2.
In the case of p = 1, the distribution unit 104 selects the top first node W1 (in this case, the subset D321 “134”) that has no child node from the parent node item of the acquired data structure. The first node (subset) in which the subset including the received device identifier appears is searched for the route from the root of the tree structure V3 to the leaf W1. The distribution unit 104 detects a node (here, the subset D321 “134”) by the search, and determines whether or not the detected subset D321 “134” has been stored in the key information storage area.

The distribution unit 104 determines that it has not been stored, reads the label D204 “A3RL” corresponding to the detected subset D321 “134” from the device key table D100, reads the read label D204 “A3RL”, and the detected subset D321. Key information including “134” is generated and acquired, and the acquired key information is stored in the key information storage area.
In the case of p = 2, the distribution unit 104 selects the upper second node W2 (in this case, the subset D322 “234”) that has no child node from the parent node item of the acquired data structure. The first node (subset) in which the subset including the received device identifier appears is searched for the route to the leaf W2 starting from the root of the tree structure V3. The distribution unit 104 does not detect the node by the search.

(When i = 4)
The distribution unit 104 acquires a data structure indicating the tree structure V4 managed fourth from the top in the correlation table D101. Here, the data structure indicating the tree structure V4 is a data structure D330 including the 22nd line of the correlation table D101.
The distribution unit 104 acquires the number 1 of nodes (that is, leaves) that do not have child nodes from the acquired data structure.

The distribution unit 104 performs the operations (c4) to (c6) p = 1 time.
The distribution unit 104 acquires the top first node W1 (in this case, the subset D331 “4”) that does not have a child node from the parent node item of the acquired data structure, and acquires the tree structure V4. The first node (subset) in which the subset including the received device identifier appears is searched for the route from the root to the leaf W1. The distribution unit 104 does not detect the node by the search.

Thereafter, the distribution unit 104 performs the above-described operations from i = 5 to 8, and includes key information including the subset “125678” and the label “A5RLRL”, and includes the subset “1345678” and the label “A5RLRRRL”. Key information is generated and stored in the key information storage area.
As described above, the distribution unit 104 stores all the key information including the label and the subset to be distributed to the device corresponding to the received device identifier in the key information storage area. The distribution unit 104 reads the correlation table D101 from the information storage unit 102, and distributes the read correlation table D101 and all the key information stored in the key information storage area to the device having the device identifier 1. To do.

The distribution unit 104 deletes all the key information stored in the key information storage area after distributing the interrelation table D101 and all the acquired key information to the apparatus having the apparatus identifier 1.
Also, the table D400 shown in FIG. 12 shows the key information distributed to each of the devices 8 from the device 1, that is, the total number of key information held by each device and the key information. In FIG. 12, the key information is described from the left in order from the smallest number of subset elements included in the key information. For example, although the number of labels held by the conventional device is uniformly held by each device, the number of key information held by the device 1 is four, which is two less than the conventional number. The numerical value in parentheses in the total item indicates a difference when the number of key information held by the device is compared with the number of labels held by the conventional device.

Further, each key information held by the device 1 includes a subset 520 “1” and a label 521 “A1”, a subset 522 “134” and a label 523 “A3RL”, a subset, as indicated by a key information item D401. 524 “125678” and label 525 “A5RLRL”, and subset 526 “1345678” and label 527 “A5RLRRRL”.
(5) Invalidation device specifying unit 105
It has a revoked device storage area for storing one or more device identifiers for identifying revoked devices. Note that nothing is stored in the invalidation device storage area in the initial state.

  When the invalidation device specifying unit 105 receives a registration instruction for registering a device to be invalidated from the reception unit 107, the invalidation device specifying unit 105 subsequently receives one or more device identifiers of the device to be invalidated. The invalidation device specifying unit 105 stores the received one or more device identifiers in the invalidation device storage area. At this time, the invalidation device specifying unit 105 stores the received one or more device identifiers following the device identifiers stored so far.

When the revocation apparatus specifying unit 105 receives a key revocation data generation instruction from the reception unit 107, the revocation apparatus specifying unit 105 outputs the received generation instruction to the key revocation data generation unit 106.
(6) Key revocation data generation unit 106
The key revocation data generation unit 106 has a media key storage area in which media keys are stored in advance.

The key revocation data generation unit 106 has a common key encryption algorithm (for example, DES).
When the key revocation data generation unit 106 receives a creation instruction from the revocation device specifying unit 105, the key revocation data generation unit 106 determines whether or not a device identifier is stored in the revocation device storage area of the revocation device specifying unit 105, that is, invalidated. It is determined whether the device identifier of the device to be activated (hereinafter referred to as an invalid device identifier) exists in the invalidated device storage area.

  If it is determined that an invalid device identifier is not stored, two subsets that can include the device identifiers of all devices by union and device keys corresponding to these subsets are stored in the information storage unit 102. Read from the stored device key table D100. For example, the key revocation data generation unit 106 determines from the device key table D100 shown in FIG. 5 that the set includes the subset “1234567” and the device key “K8”, the subset “8”, and the device key “K34”. Read a set of. In the following description, the two read subsets are referred to as a first subset and a second subset, and the corresponding device keys are referred to as a first device key and a second device key.

  The key revocation data generation unit 106 reads the media key from the media key storage area, encrypts the read media key with the common key encryption algorithm using the first device key, and generates the first encrypted media key. The generated first encrypted media key and the first subset are associated with each other and temporarily stored. Further, the key revocation data generation unit 106 encrypts the read media key with a common key encryption algorithm using the second device key, generates a second encrypted media key, and generates the generated second encrypted media. The key and the second subset are stored in association with each other.

  In the example shown above, the key revocation data generation unit 106 generates the first encrypted media key Enc (K8, media key) and the second encrypted media key Enc (K34, media key), It is temporarily stored in association with the set “1234567” and the subset “8”. Here, Enc (A, B) indicates that the encryption algorithm E is applied and the data B is encrypted using the key A.

  When determining that an invalid device identifier is stored, the key revocation data generation unit 106 removes the invalid device identifier from all the device identifiers managed in the tree structure T100. (Hereinafter, referred to as a valid device identifier), a subset of the most valid device identifiers and a device key corresponding to the subset are read from the device key table D100. The read subset and device key are temporarily stored. This operation is repeated until all valid device identifiers are selected as elements of the subset. Through this operation, the key revocation data generation unit 106 temporarily stores one or more sets including a subset and a device key corresponding to the subset in the order of reading.

  The key revocation data generation unit 106 reads the media key from the media key storage area, encrypts the read media key with a common key encryption algorithm using each device key temporarily stored, and one or more Encryption media keys are generated, and each of the generated encryption media keys is temporarily stored in association with a subset corresponding to the device key used for encryption. At this time, the number of encrypted media keys to be generated is the same as the number of read device keys.

  For example, when the device identifier “1” is stored in the revocation device storage area, the key revocation data generation unit 106 reads out the subset “2345678” and the device key “K28”, and reads out the device key Is used to generate an encrypted media key Enc (K28, media key), and the generated encrypted media key Enc (K28, media key) and the subset “2345678” are temporarily stored in association with each other. When device identifiers “1” and “5” are stored in the revocation device storage area, the key revocation data generation unit 106 includes a subset “234” and a device key “K16”. A set consisting of a set and a subset “678” and a device key “K33” is read out, and using the read device keys “K16” and “K33”, encrypted media keys Enc (K16, media key) and Enc ( K33, media key) and the generated encrypted media key Enc (K16, media key) is associated with the subset “234”, and the encrypted media key Enc (K33, media key) and the subset “678” are associated with each other. Are associated with each other and temporarily stored.

  When the generation of the encrypted media key is completed from all the read device keys, the key revocation data generating unit 106 sets a pair (hereinafter referred to as a key) of one or more encrypted media keys and a subset stored temporarily. (Referred to as revocation data), and the read one or more key revocation data is written to the recording medium 200a via the output unit. Next, the key revocation data generation unit 106 deletes each piece of information temporarily stored.

Accordingly, the key revocation data generation unit 106 can generate one or more key revocation data composed of a pair of the encrypted media key and a subset, and record the generated key revocation data on the recording medium 200a. .
(7) Reception unit 107
The receiving unit 107 receives a generation instruction by a user operation and outputs the received generation instruction to the information generation unit 103.

When accepting a distribution instruction by a user operation, the accepting unit 107 continuously accepts a device identifier indicating a device to be distributed. The accepting unit 107 outputs the accepted distribution instruction and device identifier to the distributing unit 104.
When the accepting unit 107 accepts a registration instruction by a user operation, it accepts one or more device identifiers of devices to be invalidated. The accepting unit 107 outputs the accepted registration instruction and one or more device identifiers to the invalidation device specifying unit 105.

When the reception unit 107 receives a key revocation data creation instruction by a user operation, the reception unit 107 outputs the received creation instruction to the revocation device specifying unit 105.
(8) Output unit 108
The output unit 108 receives information from the key revocation data generation unit 106, secures the key revocation data storage unit 201, which is an area for writing the received information, on the recording medium 200a, and secures the received information. Write to the key revocation data storage unit 201.

1.3 Recording medium 200
The recording medium 200 is a recordable medium such as a DVD-RAM, and no information is recorded as an initial state.
As shown in FIG. 13, the recording medium 200 is provided with a key revocation data storage unit 201 after the operation of the key revocation data generation unit 106 of the key management apparatus 100 is completed. By this operation, the encrypted content key storage unit 202 and the encrypted content storage unit 203 are secured.

(1) Key revocation data storage unit 201
The key revocation data storage unit 201 is an area secured for the first time from the recording medium 200a on which no information is recorded by the operation of the key revocation data generation unit 106 of the key management apparatus 100.
In the key revocation data storage unit 201, one or more sets of key revocation data, that is, a set composed of an encrypted media key and a subset associated with each encrypted media key are recorded.

As described above, the recording medium 200b in which one or more key revocation data is recorded is described as the recording medium 200b.
(2) Encrypted content key storage unit 202 and encrypted content storage unit 203
The encrypted content key storage unit 202 and the encrypted content storage unit 203 are areas secured from the state of the recording medium 200b by the operation of the recording device 300.

The encrypted content storage unit 203 records the encrypted content obtained by encrypting the content using a common key encryption algorithm (for example, DES) using the content key.
The encrypted content key storage unit 202 stores an encrypted content key obtained by encrypting a content key using a media key with a common key encryption algorithm (for example, DES).
1.4 Recording device 300
Since the recording apparatuses 300a, 300b,..., 300c have the same configuration, the recording apparatus 300 will be described here.

As shown in FIG. 14, the recording apparatus 300 includes a key information storage unit 301, a content storage unit 302, a content key storage unit 303, a decryption key generation unit 304, a decryption unit 305, a first encryption unit 306, and a second encryption. A unit 307, a reception unit 308, and an input / output unit 309 are configured.
Specifically, the recording apparatus 300 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. A computer program is stored in the RAM or the hard disk unit. The recording apparatus 300 achieves its functions by the microprocessor operating according to the computer program.

The recording device 300 stores a device identifier for identifying the recording device 300 in advance.
In the following description, it is assumed that the recording medium 200b is attached to the recording apparatus 300.
(1) Key information storage unit 301
The key information storage unit 301 stores in advance one or more pieces of key information distributed from the key management apparatus 100 and a correlation table D101.

For example, when the recording device 300 stores the device identifier 1 in advance, it stores four pieces of key information held by the device 1 shown in FIG. 12, and stores the device identifier 2 in advance. , Five pieces of key information held by the device 2 shown in FIG. 12 are stored.
(2) Content storage unit 302
The content storage unit 302 stores content including video information and audio information in advance.

(3) Content key storage unit 303
The content key storage unit 303 stores a content key for encrypting the content stored in the content storage unit 302.
(4) Decryption key generation unit 304
The decryption key generation unit 304 stores in advance a pseudo random number generator G151 that is the same as the pseudo random number generator G150 included in the information generation unit 103 of the key management apparatus 100. Since the pseudo random number generator G151 is the same as the pseudo random number generator G150, description thereof is omitted here.

  When receiving the recording instruction for recording the encrypted content in the recording medium 200b from the receiving unit 308, the decryption key generating unit 304 receives the recording medium from the recording medium 200b attached to the recording apparatus 300 via the input / output unit 309. One subset (hereinafter referred to as a reference subset) is read out from the subsets corresponding to each of one or more encrypted media keys recorded in 200b.

The decryption key generation unit 304 reads the correlation table D101 and one or more key information from the key information storage unit 301.
The decryption key generation unit 304 uses the correlation table D101 to search for a subset having a route from the subset included in each read key information to the reference subset.
When a subset having a path to the reference subset (hereinafter referred to as a detected subset) is detected from each subset included in each read key information based on the search result, the decryption key generation unit 304 A device key that is a decryption key of the encrypted media key is obtained by the following device key obtaining operation, and the obtained device key and the reference subset are output to the decryption unit 305. Here, when a subset that matches the reference subset is included in each subset included in the read key information, the decryption key generation unit 304 uses the matching subset as a detected subset. To detect.

  If the detected subset is not detected based on the search result, it is determined whether or not one or more unread reference subsets exist in the recording medium 200b. If it is determined that one or more unread reference subsets exist. One reference subset is read out of the output reference subsets, and the detected subset is searched. When it is determined that the unread reference subset does not exist in the recording medium 200b, the operation of recording the encrypted content is terminated.

<Acquisition of device key>
The decryption key generation unit 304 acquires a label composed of X bits from the key information including the detected subset.
The number Z of nodes existing in the path from the detection subset to the reference subset is acquired. The decryption key generation unit 304 uses the pseudo random number generator G151 Z times as follows.

  The decryption key generation unit 304 uses the obtained label as an input value to generate and acquire a random number composed of 3X bits using the pseudo random number generator G151. The decryption key generation unit 304 determines whether there is a next node (that is, a child node) for the subset corresponding to the label used as the input value in the path from the detection subset to the reference subset. . When it is determined that it exists, it is determined whether the next node is a left child node or a right child node. When determining that the node is a left child node, the obtained 3X-bit random number is divided into X bits to obtain a left label, and the obtained left label is used as a next input value to the pseudo-random number generator G151. If the right child node is determined, the right label is obtained by dividing the obtained 3X-bit random number for each X bit, and the obtained right label is assigned to the next pseudorandom number generator G151. As an input value. When it is determined that the next node does not exist, that is, when the subset corresponding to the label used as the input value is the reference subset, the right label and the left label are not acquired.

The decryption key generation unit 304 uses the pseudo random number generator G151 Z times to generate a random number consisting of 3X bits, which is the output value of the pseudo random number generator G151 when the label for the reference subset is an input value. And can be obtained.
The decryption key generation unit 304 divides the 3X-bit random number acquired for the Zth time every X bits, and acquires the X bit positioned second from the left as a device key used for decryption of the encrypted media key.

(Specific example of device key acquisition)
Here, as a specific example of acquiring the device key, a case where the recording apparatus 300 has the apparatus identifier 1, a case where the recording apparatus 300 has the apparatus identifier 2, and a case where the recording apparatus 300 has the apparatus identifier 3 will be described. At this time, as shown in FIG. 15, the recording medium 200b stores the subset “2345678” and the encrypted media key (K28, media key) in the key revocation data storage unit 201.

When the recording device 300 has the device identifier 1, there is no path from the subset included in each of the four stored key information to the reference subset “2345678”, so that a decryption key is generated. The unit 304 cannot generate a device key for decrypting the encrypted media key.
When the recording apparatus 300 has the apparatus identifier 2, the subset is obtained as a subset having a path from the subset included in each of the five stored key informations to the reference subset “2345678”. “2345678” is detected, and the detected subset “2345678” is set as a detected subset. The decryption key generation unit 304 acquires the label “A5RLRRR” from the key information including the detected subset. Further, the decryption key generation unit 304 acquires the number of nodes Z = 1 from the detection subset to the reference subset. The decryption key generation unit 304 uses the acquired label “A5RLRRRR” as an input value to generate and acquire a random number consisting of 3 × bits using the pseudorandom number generator G151 once Z = 1. The decryption key generation unit 304 divides the acquired 3X-bit random number for each X bit, and acquires the X bit positioned second from the left as the device key “K28” used for decryption of the encrypted media key.

  When the recording apparatus 300 has the apparatus identifier 3, the subset is obtained as a subset having a path from the subset included in each of the stored four key information to the reference subset “2345678”. “345678” is detected, and the detected subset “345678” is set as a detected subset. The decryption key generation unit 304 acquires the label “A5RLRR” from the key information including the detected subset. Further, the decryption key generation unit 304 acquires the number of nodes Z = 2 from the detection subset to the reference subset. The decryption key generation unit 304 acquires the device key “K28” by using the pseudo random number generator G151 Z = 2 times as follows.

  First, the decryption key generation unit 304 uses the obtained label “A5RLRR” as an input value to generate and acquire a random number “A5RLRRRL || K24 || A5RLRRR” composed of 3 × bits using the pseudo-random number generator G151. It is determined whether the subset “2345678”, which is a child node for the subset “345678” corresponding to the label used as the input value, is a left child node or a right child node. In this case, it is determined that the node is the right child node, and the acquired right label “A5RLRRR” is acquired as the next input value to the pseudo-random number generator G151. The decryption key generation unit 304 generates and acquires a random number “A5RLRRRL || K28 || A5RLRRRR” composed of 3 × bits using the acquired label “A5RLRRRR” as an input value and using the pseudorandom number generator G151. The decryption key generation unit 304 divides the acquired 3X-bit random number for each X bit, and acquires the X bit positioned second from the left as the device key “K28” used for decryption of the encrypted media key.

(5) Decoding unit 305
The decryption unit 305 has the same common key encryption algorithm as the common key encryption algorithm that generated the encrypted media key.
Upon receiving the device key and the reference subset from the decryption key generation unit 304, the decryption unit 305 obtains the encrypted media key corresponding to the received reference subset from the key revocation data storage unit 201 of the recording medium 200b. Reading is performed via the input / output unit 309.

The decryption unit 305 decrypts the read encrypted media key with a common key encryption algorithm using the received device key, generates a media key, and outputs the generated media key to the first encryption unit 306.
(6) First encryption unit 306
The first encryption unit 306 has a common key encryption algorithm (for example, DES).

When receiving the media key from the decryption unit 305, the first encryption unit 306 reads the content key from the content key storage unit 303.
The first encryption unit 306 encrypts the read content key with a common key encryption algorithm using the media key, generates an encrypted content key Enc (media key, content key), and generates the generated encrypted content key Is written to the encrypted content key storage unit 202 of the recording medium 200b via the input / output unit 309.

Further, the first encryption unit 306 outputs an encryption command for instructing the second encryption unit 307 to encrypt the content.
(7) Second encryption unit 307
The second encryption unit 307 has a common key encryption algorithm (for example, DES).
When receiving the encryption command from the first encryption unit 306, the second encryption unit 307 reads the content key from the content key storage unit 303 and the content from the content storage unit 302, respectively.

The second encryption unit 307 encrypts the read content with a common key encryption algorithm using the read content key, generates encrypted content Enc (content key, content), and generates the generated encrypted content as Data is written into the encrypted content storage unit 203 of the recording medium 200b via the input / output unit 309.
Note that the recording medium 200c is generated by the first encryption unit 306 and the second encryption unit 307 writing each information to the recording medium 200b.

(8) Reception unit 308
The accepting unit 308 accepts a recording instruction by a user operation, and outputs the accepted recording instruction to the decryption key generating unit 304.
(9) Input / output unit 309
The input / output unit 309 reads the reference subset from the key revocation data storage unit 201 of the recording medium 200b, and outputs the read reference subset to the decryption key generation unit 304.

The input / output unit 309 reads the encrypted media key corresponding to the reference subset from the key revocation data storage unit 201 of the recording medium 200b, and outputs the read encrypted media key to the decryption unit 305.
The input / output unit 309 receives the encrypted content key from the first encryption unit 306 and secures the encrypted content key storage unit 202 on the recording medium 200b in order to write the received encrypted content key. The received encrypted content key is written in the encrypted content key storage unit 202.

The input / output unit 309 receives the encrypted content from the second encryption unit 307 and secures the encrypted content storage unit 203 on the recording medium 200b to write the received encrypted content. The received encrypted content is written in the unit 203.
1.5 Playback device 400
Since the playback devices 400a, 400b,..., 400c have the same configuration, the playback device 400 will be described here.

As shown in FIG. 16, the playback device 400 includes a key information storage unit 401, a decryption key generation unit 402, a first decryption unit 403, a second decryption unit 404, a third decryption unit 405, a playback unit 406, a reception unit 407, and The reading unit 408 is configured.
Specifically, the playback device 400 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. A computer program is stored in the RAM or the hard disk unit. The playback apparatus 400 achieves its functions by the microprocessor operating according to the computer program.

The playback device 400 stores a device identifier for identifying the playback device 400 in advance.
In the following description, it is assumed that the recording medium 200c is attached to the playback device 400.
(1) Key information storage unit 401
The key information storage unit 401 stores in advance one or more pieces of key information distributed from the key management apparatus 100 and a correlation table D101.

For example, when the playback device 400 stores the device identifier 5 in advance, four pieces of key information held by the device 5 shown in FIG. 12 are stored, and when the device identifier 6 is stored in advance. The five key information held by the device 6 shown in FIG. 12 is stored.
(2) Decryption key generation unit 402
The decryption key generation unit 402 stores in advance a pseudo random number generator G152 that is the same as the pseudo random number generator G150 included in the information generation unit 103 of the key management apparatus 100. Since the pseudo random number generator G152 is the same as the pseudo random number generator G150, description thereof is omitted here.

When the decryption key generation unit 402 receives a playback instruction to play back content from the reception unit 308, the decryption key generation unit 402 is recorded on the recording medium 200 c from the recording medium 200 c mounted on the playback device 400 via the reading unit 408. One reference subset is read out from the subsets corresponding to the respective encrypted media keys.
The decryption key generation unit 402 reads the correlation table D101 and one or more key information from the key information storage unit 401.

Using the correlation table D101, the decryption key generation unit 304 searches for a detected subset having a route from the subset included in each read key information to the reference subset.
When a detection subset is detected from the subset included in each read key information based on the search result, the decryption key generation unit 402 obtains a device that is a decryption key of the encrypted media key by a device key acquisition operation. The key is acquired, and the acquired device key and reference subset are output to the first decryption unit 403.

  If the detected subset is not detected based on the search result, it is determined whether or not one or more unread reference subsets exist in the recording medium 200c. If it is determined that one or more unread reference subsets exist. One reference subset is read out of the output reference subsets, and the detected subset is searched. If it is determined that the unread reference subset does not exist in the recording medium 200c, the content reproduction operation is terminated.

The device key acquisition operation is the same as the acquisition operation shown by the decryption key generation unit 304 of the recording apparatus 300, and thus the description thereof is omitted.
<Specific example of device key acquisition>
Here, as a specific example of obtaining the device key, a case where the playback device 400 has the device identifier 1 and a case where the playback device 400 has the device identifier 7 will be described. At this time, as shown in FIG. 17, the recording medium 200c stores the subset “2345678” and the encrypted media key (K28, media key) in the key revocation data storage unit 201, and stores the encrypted content key. The unit 202 stores the encrypted content key Enc (media key, content key), and the encrypted content storage unit 203 stores the encrypted content Enc (content key, content).

When the playback device 400 has the device identifier 1, there is no path from the subset included in each of the four stored key information to the reference subset “2345678”, so that a decryption key is generated. The unit 304 cannot generate a device key for decrypting the encrypted media key.
When the playback device 400 has the device identifier 7, the detected subset “567” is detected from the subsets included in each of the five stored key information, and the key information including the detected subsets To obtain the label “A5RL”. The decryption key generation unit 402 acquires the device key “K28” using the pseudorandom number generator G152 and the acquired label “A5RL”.

(3) First decoding unit 403
The first decryption unit 403 has the same common key encryption algorithm as the common key encryption algorithm that generated the encrypted media key.
When the first decryption unit 403 receives the device key and the reference subset from the decryption key generation unit 402, the first decryption unit 403 receives the encrypted media key corresponding to the received reference subset from the key revocation data storage unit 201 of the recording medium 200c. Are read out via the reading unit 408.

The first decryption unit 403 decrypts the read encrypted media key with a common key encryption algorithm using the received device key, generates a media key, and outputs the generated media key to the second decryption unit 404. .
(4) Second decoding unit 404
The second decryption unit 404 has the same common key encryption algorithm as the common key encryption algorithm that generated the encrypted content key.

Upon receiving the media key from the first decryption unit 403, the second decryption unit 404 reads the encrypted content key from the encrypted content key storage unit 202 of the recording medium 200c via the reading unit 408.
The second decryption unit 404 decrypts the read encrypted content key with a common key encryption algorithm using the received media key, generates a content key, and outputs the generated content key to the third decryption unit 405 .

(5) Third decoding unit 405
The third decryption unit 405 has the same common key encryption algorithm as the common key encryption algorithm that generated the encrypted content.
Upon receiving the content key from the second decryption unit 404, the third decryption unit 405 reads the encrypted content from the encrypted content storage unit 203 of the recording medium 200c via the read unit 408.

The third decryption unit 405 decrypts the read encrypted content using a common key encryption algorithm using the received content key, generates content, and outputs the generated content to the playback unit 406.
(6) Playback unit 406
The playback unit 406 receives the content DCNT from the third decoding unit 405, generates video information and audio information from the received content, converts the generated video information and audio information into analog video signals and audio signals, The video signal and the audio signal are output to the monitor 420.

(7) Reception unit 407
The accepting unit 407 accepts a reproduction instruction by a user operation, and outputs the accepted reproduction instruction to the decryption key generation unit 402.
(8) Reading unit 408
The reading unit 408 reads the reference subset from the key revocation data storage unit 201 of the recording medium 200c, and outputs the read reference subset to the decryption key generation unit 402.

The reading unit 408 reads the encrypted media key corresponding to the reference subset from the key revocation data storage unit 201 of the recording medium 200 c and outputs the read encrypted media key to the first decryption unit 403.
The reading unit 408 reads the encrypted content key from the encrypted content key storage unit 202 of the recording medium 200 c and outputs the read encrypted content key to the second decryption unit 404.

The reading unit 408 reads the encrypted content from the encrypted content storage unit 203 of the recording medium 200c, and outputs the read encrypted content to the third decryption unit 405.
(9) Monitor 420
The monitor 420 includes a CRT and a speaker, receives analog video signals and audio signals from the reproduction unit 406, displays video based on the video signals, and outputs audio based on the audio signals.

1.6 Operations of Key Management Device 100 Here, operations when the key management device 100 receives a generation instruction, operations when distributing key information, and operations when generating key revocation data will be described. .
(1) Operation Overview of Generation Processing Here, an overview of operation when the key management apparatus 100 receives a generation instruction will be described with reference to the flowchart shown in FIG.

When the information generation unit 103 of the key management apparatus 100 receives a generation instruction from the reception unit 107 (step S5), the information generation unit 103 performs a subset generation process and generates a device key table D100a in which one or more subsets are recorded. (Step S10).
Next, the information generation unit 103 performs a device key generation process, and generates a device key table D100 and a correlation table D101 (step S15).

(2) Operation of Subset Generation Processing Here, the operation of the subset generation processing will be described with reference to the flowcharts shown in FIGS. 19 and 20.
The information generation unit 103 acquires the height T of the tree structure managed by the device information storage unit 101 (step S50), and sets an initial value 0 to the row counter n of the working device key table (step S55). ).

The information generation unit 103 repeats Steps S65 to S110 from i = 0 to T-1.
The information generation unit 103 acquires the number N of nodes in which the layer i exists (step S65). Next, the information generation unit 103 acquires the height H of the subtree whose root is the node existing in the layer i (step S70).

The information generation unit 103 repeats Steps S80 to S105 until j = 0 to H-1.
The information generation unit 103 adds 1 to the row counter n and sets the addition result to n (step S80).
Next, the information generation unit 103 repeats Steps S90 to S100 until k = 1 to N.

  The information generation unit 103 acquires a subtree rooted at the k-th node from the left of the layer i (step S90), removes 2 ^ j terminal identifiers from the leaves of the acquired subtree, and leaves the remaining terminals One or more subsets of identifiers are generated (step S95). However, when a plurality of devices are excluded, that is, when a plurality of invalid device identifiers are excluded, only when there is an upper node having all invalid terminal identifiers in common and having only invalid terminal device identifiers. .

The information generation unit 103 writes the generated subsets in order from the left in the unrecorded column of the nth row of the working device key table (step S100).
(3) Device Key Generation Processing Operation Here, device key generation processing operation will be described with reference to the flowcharts shown in FIGS.

The information generation unit 103 acquires the height T of the tree structure managed by the device information storage unit 101 (step S150).
The information generation unit 103 repeats Steps S160 to S345 until h = 1 to 2 ^ T.
The information generation unit 103 generates a random number Ah consisting of X bits (step S160), and writes the generated random number Ah into {(T ^ 2 + T) / 2} rows and h columns of the device key table D100a (step S165). .

The information generation unit 103 gives the assigned label, that is, the random number Ah as an input value to the pseudo-random number generator G, and acquires the device key “Km”, the left label, and the right label as the output (step S170).
The information generation unit 103 writes the acquired device key “Km” in the {(T ^ 2 + T) / 2} row and h column of the device key table D100a (step S175). The information generation unit 103 temporarily stores the left label and the right label in association with a subset of the label (that is, the random number Ah) used for input to the pseudorandom number generator G (step S180). . However, the subscript m of “Km” indicating a device key starts from an initial value 1 and increases by 1 every time a device key is assigned, and “Km + 1” is a device key assigned next to “Km”. Indicates that there is.

The information generation unit 103 repeats Steps S190 to S340 from i = {(T ^ 2 + T) / 2-1} to 1.
The information generation unit 103 acquires the number J of subsets to which the device key is assigned in the i + 1th row of the device key table D100a (step S190).
The information generation unit 103 repeats Steps S200 to S335 until j = 1 to J.

The information generation unit 103 sets the subset Sj in order from the left in the i-th row of the device key table D100a with reference to the j-th subset Sj from the left to which the device key is assigned in the i + 1-th row of the device key table D100a. A subset including the device key that has not yet been assigned is searched (step S200).
The information generation unit 103 determines whether or not there is a subset that includes the subset Sj and to which the device key has not yet been assigned by the search (step S205).

  When it is determined that the subset does not exist (“NO” in step S205), the subset Sj is a parent node, the subset Sj that is a parent node, and a symbol that indicates that the subset that is a child node does not exist The group consisting of “−” is written as node information in the highest area that is not recorded in the work interaction table (step S210). Further, it is determined whether or not the subset Sj is a route (step S215). When it is determined that the subset Sj is a route (“YES” in step S215), the route information includes information indicating that it is a route ( "Route") is recorded (step S220). If it is determined that the route is not the route (“NO” in step S215), step S220 is omitted.

If it is determined that one or more subsets exist (“YES” in step S205), a maximum of two subsets of one or more subsets to which a device key has not yet been assigned are acquired sequentially from the left (step S225). ).
The information generation unit 103 determines whether there is one acquired subset (step S230).

  When it is determined that the acquired subset is one (“YES” in step S230), the right label among the left label and the right label temporarily associated with the subset Sj is Allocation is performed as a label for the acquired subset, and the allocated right label is written in the field in which the acquired subset is recorded in the device key table D100a (step S235).

The information generation unit 103 gives the pseudorandom number generator G the label assigned to the acquired subset (that is, the temporarily stored right label) as an input value, and outputs the device key “Km”, The left label and the right label are acquired (step S240).
The information generation unit 103 writes the acquired device key “Km” in the field in which the acquired subset in the device key table D100a is recorded (step S245). Furthermore, the information generation unit 103 uses the two left labels and the right label acquired in step S240 as a subset of the labels used for input to the pseudorandom number generator G (that is, the subset acquired in step S225). Are temporarily stored in association with each other (step S250). The information generation unit 103 uses the subset Sj as a parent node and writes the acquired subset as a child node in the unrecorded highest area in the work correlation table (step S255). Further, it is determined whether or not the subset Sj is a route (step S260). When it is determined that the subset Sj is a route (“YES” in step S260), information indicating that it is a route (“YES” in step S260) "Route") is recorded (step S265). If it is determined that the route is not the route (“NO” in step S260), step S265 is omitted.

  When it is determined that there are two acquired subsets (here, Tj and Uj) (“NO” in step S230), as labels for the subset Tj located on the left of the two subsets The left label that is associated with the subset Sj and temporarily stored is assigned, and the assigned left label is written in the field of the acquired subset Tj in the device key table D100a (step S270).

The information generator 103 gives the pseudo-random number generator G the label assigned to the acquired subset Tj (that is, the left label corresponding to the subset Sj) as an input value, and outputs the device key “Km”, The left label and the right label are acquired (step S275).
The information generation unit 103 writes the acquired device key “Km” in the field in which the acquired subset in the device key table D100a is recorded (step S280). Furthermore, the information generation unit 103 temporarily stores the two left labels and the right label acquired in step S275 in association with the subset Tj for the label used for input to the pseudorandom number generator G. (Step S285). The information generation unit 103 writes the subset Sj as a parent node and the acquired subset Tj as a child node in the unrecorded uppermost area in the work correlation table (step S290). Further, it is determined whether or not the subset Sj is a route (step S295). If it is determined that the subset Sj is a route (“YES” in step S295), the route information includes information indicating that it is a route ( "Route") is recorded (step S300). If it is determined that the route is not the route (“NO” in step S295), step S300 is omitted.

Next, the information generation unit 103 assigns a right label temporarily associated with the subset Sj as a label for the subset Uj, and acquires the assigned right label in the device key table D100a. The set Uj is written in the recorded field (step S305).
The information generation unit 103 gives the pseudorandom number generator G the label assigned to the acquired subset Uj (that is, the right label corresponding to the subset Sj) as an input value, and outputs the device key “Km + 1”, The left label and the right label are acquired (step S310).

  The information generation unit 103 writes the acquired device key “Km + 1” in the field in which the acquired subset in the device key table D100a is recorded (step S315). Further, the information generation unit 103 temporarily stores the two left labels and the right label acquired in step S310 in association with the subset Uj for the label used for input to the pseudorandom number generator G. (Step S320). The information generation unit 103 writes the subset Sj as a parent node and the acquired subset Uj as a child node to the unrecorded highest area in the work correlation table (step S325). Further, it is determined whether or not the subset Sj is a route (step S330). If it is determined that the subset Sj is a route (“YES” in step S330), the route information includes information indicating that it is a route ( "Route") is recorded (step S335). When it is determined that the route is not the route (“NO” in step S330), step S335 is omitted.

The information generation unit 103 stores the generated device key table D100 and the correlation table D101 in the information storage unit 102 (step S360).
(4) Operation at the time of distributing key information Here, the operation of the key information acquisition process performed at the time of distributing key information will be described using the flowcharts shown in FIGS.

When the distribution unit 104 receives the key information distribution instruction and the device identifier indicating the device to be distributed from the reception unit 107 (step S400), the distribution unit 104 acquires the number Y of tree structures managed in the correlation table D101. (Step S405).
The distribution unit 104 repeats Steps S415 to S465 until i = 1 to Y.

The distribution unit 104 acquires a data structure indicating the tree structure Vi managed i-th from the top in the correlation table D101 (step S415).
The distribution unit 104 acquires the number P of nodes (that is, leaves) that do not have child nodes from the acquired data structure (step S420).
The distribution unit 104 repeats Steps S430 to S460 from p = 1 to P.

  The distribution unit 104 acquires the upper p-th node Wp (that is, Wp is a leaf) having no child node from the parent node item of the acquired data structure (step S430), and the tree structure Vi. The first node (subset) in which the subset including the received device identifier appears is searched for the route from the root to the leaf Wp (step S435).

The distribution unit 104 determines whether a subset has been detected by the search (step S440).
If it is determined that a subset has been detected (“YES” in step S440), it is determined whether the detected subset has been stored in the key information storage area (step S445).

  When determining that it has not been stored (“NO” in step S445), the distribution unit 104 reads the label corresponding to the detected subset from the device key table D100 (step S450), and reads the detected label and the detected portion. Key information including the set is generated and acquired (step S455), and the acquired key information is stored in the key information storage area (step S460). If it is determined that the data has been stored (“YES” in step S445), steps S450 to S460 are omitted.

The distribution unit 104 reads the correlation table D101 (step S475), and distributes the read correlation table D101 and all the key information stored in the key information storage area to the distribution target device (step S480). ).
The distribution unit 104 distributes the correlation table D101 and all the key information to the apparatus having the received apparatus identifier, and then deletes all the key information stored in the key information storage area (step S485). . Here, the distribution means, for example, that writing of the received device identifier and one or more key information stored in the key information storage area is completed on a distribution recording medium.

(5) Operation at the time of generating key revocation data Here, the operation of the key revocation data generation process performed at the time of generating the key revocation data will be described with reference to the flowchart shown in FIG.
When the key revocation data generation unit 106 receives a creation instruction from the reception unit 107 via the revocation device specifying unit 105 (step S500), the device identifier is stored in the revocation device storage area of the revocation device specifying unit 105. It is determined whether or not an invalid device identifier exists in the invalidated device storage area (step S505).

If it is determined that no invalid device identifier is stored (“NO” in step S505), the first and second subsets that can include the device identifiers of all devices by union are obtained from the device key table D100. Read (step S510).
The key revocation data generation unit 106 reads the first and second device keys corresponding to the read subsets from the device key table D100 (step S515).

  The key revocation data generation unit 106 reads the media key from the media key storage area (step S520), encrypts the read media key with the common key encryption algorithm using the first device key, and generates the first encrypted media. A key is generated, and the generated first encrypted media key and the first subset are associated with each other and temporarily stored. Further, the key revocation data generation unit 106 encrypts the read media key with a common key encryption algorithm using the second device key, generates a second encrypted media key, and generates the generated second encrypted media. The key and the second subset are associated with each other and temporarily stored (step S525).

The first subset and the first encrypted media key are written to the recording medium 200a via the output unit 108 (step S530).
The second subset and the second encrypted media key are written to the recording medium 200a via the output unit 108 (step S535).
If it is determined that an invalid device identifier is stored (“YES” in step S505), the key revocation data generation unit 106 selects an invalid device identifier from all device identifiers managed in the tree structure T100. Of the one or more valid device identifiers excluding, a subset of the most valid device identifiers is read from the device key table D100 (step S540).

A device key corresponding to the read subset is read from the device key table D100 (step S545), and the read subset and device key are temporarily stored (step S550). The key revocation data generation unit 106 determines whether only all valid device identifiers have been selected as elements of the subset (step S555).
If it is determined that it has not been selected (“NO” in step S555), step S54 and subsequent steps are executed again using one or more unselected valid device identifiers.

  When determining that it has been selected (“YES” in step S555), the key revocation data generation unit 106 reads the media key from the media key storage area (step S560), and temporarily stores the read media key. A part corresponding to the device key used for encryption, and generating one or more encrypted media keys by encrypting each device key using a common key encryption algorithm The information is temporarily stored in association with the set (step S565). At this time, the number of encrypted media keys to be generated is the same as the number of read device keys.

When the generation of the encrypted media key is completed from all of the read device keys, the key revocation data generation unit 106 reads and reads the temporarily stored pair of one or more encrypted media keys and a subset. The one or more sets are written to the recording medium 200a via the output unit 108 (step S570).
1.7 Operation of Recording Device 300 Here, the operation when the recording device 300 receives a recording instruction will be described.

(1) Recording Process Operation Here, the recording process performed by the decryption key generation unit 304, the decryption unit 305, the first encryption unit 306, and the second encryption unit 307 when the recording apparatus 300 receives a recording instruction. Will be described with reference to the flowchart shown in FIG.
When receiving the recording instruction from the receiving unit 308 (step S600), the decryption key generating unit 304 of the recording device 300 receives the recording medium 200b from the recording medium 200b attached to the recording device 300 via the input / output unit 309. One subset (hereinafter referred to as a reference subset) is read out from the subsets corresponding to each of the one or more encrypted media keys recorded (step S605).

The decryption key generation unit 304 reads the correlation table D101 and one or more key information from the key information storage unit 301 (step S610).
The decryption key generation unit 304 uses the correlation table D101 to search for a detected subset from the subset included in each read key information (step S615).
Based on the search result, it is determined whether or not a detected subset is detected from the subset included in each read key information (step S620).

  If it is determined not to be detected (“NO” in step S620), it is determined whether one or more unread reference subsets exist in the recording medium 200b (step S625). If it is determined that it exists (“YES” in step S625), one reference subset of the one or more unread reference subsets is read (step S630), and the process returns to step S615. When it is determined that the unread reference subset does not exist in the recording medium 200b (“NO” in step S625), the operation of recording the encrypted content is terminated.

If it is determined that a detected subset has been detected (“YES” in step S620), device key acquisition processing is performed to acquire a device key (step S635).
Next, the decryption unit 305 performs decryption processing using the device key acquired in the device key acquisition processing, decrypts the encrypted media key, and generates a media key (step S640).

The first encryption unit 306 performs the first encryption process using the media key generated by the decryption process, and generates an encrypted content key (step S645).
The second encryption unit 307 performs the second encryption process using the content key to generate encrypted content (step S650).
(2) Operation of Device Key Acquisition Process Here, the operation of the device key acquisition process performed in step S635 of the recording process shown in FIG. 29 will be described using the flowchart shown in FIG.

The decryption key generation unit 304 acquires a label composed of X bits from the key information including the detected subset (step S700).
The number Z of nodes existing in the path from the detected subset to the reference subset is acquired (step S705).
The decryption key generation unit 304 repeats steps S715 to S735 from z = 1 to Z.

The decryption key generation unit 304 generates and acquires a random number of 3X bits using the acquired label as an input value and the pseudo random number generator G151 (step S715).
The decryption key generation unit 304 determines whether there is a next node for the subset corresponding to the label used as the input value in the path from the detection subset to the reference subset (step S720).

  If it is determined that it exists (“YES” in step S720), it is determined whether the next node is a left child node or a right child node (step S725). When determining that the node is the left child node (“YES” in step S725), the left label is acquired by dividing the acquired 3X-bit random number into X bits (step S730), and the acquired left The label is set as the next input value to the pseudorandom number generator G151, and the process returns to step S715. When determining that the node is the right child node (“NO” in step S725), the right label is acquired by dividing the acquired 3X-bit random number into X bits (step S735), and the acquired right The label is set as the next input value to the pseudorandom number generator G151, and the process returns to step S715.

If it is determined that there is no next node (“NO” in step S720), steps S725 to S735 are omitted.
The decryption key generation unit 304 divides the 3X-bit random number acquired for the Zth time every X bits, and acquires the X bit positioned second from the left as a device key used for decryption of the encrypted media key (Step S1). S745).

The decryption key generation unit 304 outputs the acquired device key and the reference subset to the decryption unit 305 (step S750).
(3) Operation of Decoding Process Here, the operation of the decoding process performed in step S640 of the recording process shown in FIG. 29 will be described using the flowchart shown in FIG.

When the decryption unit 305 receives the device key and the reference subset from the decryption key generation unit 304 (step S800), the decryption unit 305 encrypts corresponding to the received reference subset from the key revocation data storage unit 201 of the recording medium 200b. The media key is read out via the input / output unit 309 (step S805).
The decryption unit 305 decrypts the read encrypted media key with the common key encryption algorithm using the received device key to generate a media key (step S810), and the generated media key is the first encryption unit 306. (Step S815).

(4) Operation of First Encryption Process Here, the operation of the first encryption process performed in step S645 of the recording process shown in FIG. 29 will be described using the flowchart shown in FIG.
When receiving the media key from the decryption unit 305 (step S830), the first encryption unit 306 reads the content key from the content key storage unit 303 (step S835).

The first encryption unit 306 encrypts the read content key with a common key encryption algorithm using the media key to generate an encrypted content key (step S840), and inputs and outputs the generated encrypted content key. The encrypted content key storage unit 202 of the recording medium 200b is written via the unit 309 (step S845).
Further, the first encryption unit 306 outputs an encryption command for instructing the second encryption unit 307 to encrypt the content (step S850).

(5) Operation of Second Encryption Process Here, the operation of the second encryption process performed in step S650 of the recording process shown in FIG. 29 will be described using the flowchart shown in FIG.
When receiving the encryption command from the first encryption unit 306 (step S870), the second encryption unit 307 reads the content key from the content key storage unit 303 and the content from the content storage unit 302 (step S875). ).

The second encryption unit 307 encrypts the read content with the common key encryption algorithm using the read content key to generate the encrypted content (step S880), and the generated encrypted content is input to the input / output unit. The data is written into the encrypted content storage unit 203 of the recording medium 200b via 309 (step S885).
1.8 Operation of Playback Device 400 Here, the operation when the playback device 400 receives a playback instruction will be described.

(1) Operation of Reproduction Processing Here, when the reproduction apparatus 400 receives a reproduction instruction, the decryption key generation unit 402, the first decryption unit 403, the second decryption unit 404, the third decryption unit 405, and the reproduction unit 406 The operation of the reproduction process performed in this manner will be described using the flowchart shown in FIG.
When receiving the reproduction instruction from the receiving unit 407 (step S900), the decryption key generating unit 402 of the reproducing device 400 records the recording medium 200c from the recording medium 200c attached to the reproducing device 400 via the reading unit 408. Among the subsets corresponding to each of the one or more encrypted media keys, one subset (hereinafter referred to as a reference subset) is read (step S905).

The decryption key generation unit 402 reads the correlation table D101 and one or more key information from the key information storage unit 401 (step S910).
The decryption key generation unit 402 uses the correlation table D101 to search for a detected subset from the subset included in each read key information (step S915).
Based on the search result, it is determined whether or not a detected subset is detected from the subset included in each read key information (step S920).

  If it is determined not to be detected (“NO” in step S920), it is determined whether one or more unread reference subsets exist in the recording medium 200c (step S925). If it is determined that it exists (“YES” in step S925), one reference subset of the one or more unread reference subsets is read (step S930), and the process returns to step S915. When it is determined that the unread reference subset does not exist in the recording medium 200c (“NO” in step S925), the content reproduction operation is terminated.

If it is determined that a detected subset has been detected (“YES” in step S920), a device key acquisition process is performed to acquire a device key (step S935).
Next, the first decryption unit 403 performs decryption processing using the device key acquired in the device key acquisition processing, decrypts the encrypted media key, and generates a media key (step S940).

The second decryption unit 404 performs a second decryption process using the media key generated in the first decryption process, decrypts the encrypted content key, and generates a content key (step S945).
The third decryption unit 405 performs a second encryption process using the content key generated in the second decryption process, and decrypts the encrypted content to generate a content (step S950).

The playback unit 406 plays back the content generated by the third decryption process (step S955).
(2) Operation of Device Key Acquisition Process Here, the operation of the device key acquisition process performed in step S935 of the reproduction process shown in FIG. 34 will be described using the flowchart shown in FIG.

The decryption key generation unit 402 acquires a label composed of X bits from the key information including the detected subset (step S1000).
The decryption key generation unit 402 acquires the number Z of nodes existing in the path from the detection subset to the reference subset (step S1005).
The decryption key generation unit 402 repeats steps S1015 to S1035 from z = 1 to Z.

The decryption key generation unit 402 uses the acquired label as an input value to generate and acquire a random number composed of 3X bits using the pseudo-random number generator G151 (step S1015).
The decryption key generation unit 402 determines whether there is a next node for the subset corresponding to the label used as the input value in the path from the detection subset to the reference subset (step S1020).

  If it is determined that it exists (“YES” in step S1020), it is determined whether the next node is a left child node or a right child node (step S1025). When determining that the node is the left child node (“YES” in step S1025), the left label is acquired by dividing the acquired 3X-bit random number into X bits (step S1030), and the acquired left The label is set as the next input value to the pseudorandom number generator G151, and the process returns to step S1015. When determining that the node is the right child node (“NO” in step S1025), the right label is acquired by dividing the acquired 3X-bit random number into X bits (step S1035), and the acquired right The label is set as the next input value to the pseudorandom number generator G151, and the process returns to step S1015.

If it is determined that there is no next node (“NO” in step S1020), steps S1025 to S1035 are omitted.
The decryption key generation unit 402 divides the 3X-bit random number acquired for the Zth time every X bits, and acquires the X bit located second from the left as a device key used for decryption of the encrypted media key (step S1045).

The decryption key generation unit 402 outputs the acquired device key and the reference subset to the first decryption unit 403 (step S1050).
(3) Operation of First Decoding Process Here, the operation of the decoding process performed in step S940 of the reproduction process shown in FIG. 34 will be described using the flowchart shown in FIG.

When the first decryption unit 403 receives the device key and the reference subset from the decryption key generation unit 402 (step S1100), the first decryption unit 403 corresponds to the received reference subset from the key revocation data storage unit 201 of the recording medium 200c. The encrypted media key is read out via the reading unit 408 (step S1105).
The first decryption unit 403 decrypts the read encrypted media key using a common key encryption algorithm using the received device key, generates a media key (step S1110), and generates the generated media key as a second decryption unit. It outputs to 404 (step S1115).

(4) Operation of Second Decoding Process Here, the operation of the second decoding process performed in step S945 of the reproduction process shown in FIG. 34 will be described using the flowchart shown in FIG.
When the second decryption unit 404 receives the media key from the first decryption unit 403 (step S1130),
The encrypted content key is read from the encrypted content key storage unit 202 of the recording medium 200c via the reading unit 408 (step S1135).

The second decryption unit 404 decrypts the read encrypted content key with a common key encryption algorithm using the received media key, generates a content key (step S1140), and generates the generated content key as a third decryption unit. It outputs to 405 (step S1145).
(4) Operation of Third Decoding Process Here, the operation of the third decoding process performed in step S950 of the reproduction process shown in FIG. 34 will be described with reference to the flowchart shown in FIG.

Upon receiving the content key from the second decryption unit 404 (step S1070), the third decryption unit 405 reads the encrypted content from the encrypted content storage unit 203 of the recording medium 200c via the reading unit 408 (step S1075). .
The third decryption unit 405 decrypts the read encrypted content using a common key encryption algorithm using the received content key, generates content (step S1080), and outputs the generated content to the playback unit 406 ( Step S1085).

1.9 Other Modifications Although the present invention has been described based on the above-described embodiment, it is needless to say that the present invention is not limited to the above-described embodiment. The following cases are also included in the present invention.
(1) In the present invention, the recording medium 200 is a recordable medium such as a DVD-RAM. However, the present invention is not limited to this structure. For example, the recording medium may be a pre-recorded medium such as DVD-Video, and each playback device may have a device key and play content recorded on the recording medium. In this case, the recording device does not need to hold key information for generating a device key, and receives a media key directly from the key management device, and encrypts and writes content based on the media key. May be.

  (2) In the present invention, as a mechanism for encrypting content, the content key is encrypted with the media key and the content is encrypted with the content key. However, the present invention is not limited to this configuration. . For example, the content may be directly encrypted with the media key to reduce the key hierarchy by one. Conversely, the disc key is introduced, the disc key is encrypted with the media key, the content key is encrypted with the disc key, The content may be encrypted with the content key to increase the key hierarchy by one. Alternatively, the key may be modulated by adding different information separately in the middle of the key hierarchy.

  (3) In the present invention, the key revocation data and the encrypted content are recorded on the same recording medium 200. However, the present invention is not limited to this structure. For example, the recording medium for recording the key revocation data and the recording medium for recording the encrypted content may be distributed and distributed. In that case, the recording device 300 or the playback device 400 first calculates the media key by inserting the recording medium in which the key revocation data is recorded, and then inserts another recording medium to record the content. Or it becomes the structure which reproduces | regenerates.

  (4) In the present invention, the key revocation data is recorded on the recording medium 200 and distributed, but the present invention is not limited to that structure. For example, the key revocation data is distributed using a communication medium such as the Internet, the recording device 300 and the playback device 400 store the distributed key revocation data, and each device decrypts the encrypted media key. In this case, the decryption may be performed using the stored key revocation data.

Alternatively, each time the device decrypts the encrypted media key, the device may receive the key revocation data using the communication medium.
In the present invention, the recording apparatus 300 writes the generated encrypted content key and encrypted content to the attached recording medium 200, but the present invention is not limited to this. For example, the recording apparatus 300 may record the generated encrypted content key and encrypted content on a recording medium included in a server on the network via a communication medium.

(5) In the present invention, the key revocation data and the encrypted content are recorded and distributed on the recording medium 200, but the present invention is not limited to this structure. For example, it may be configured to distribute using communication media such as broadcasting or the Internet.
(6) In the present invention, the tree structure for the key management device 100 to manage each device is configured as a binary tree, but the present invention is not limited to that configuration. The tree structure for managing each device may be an n-ary tree (n is an integer). For example, the tree structure may be a triple tree or a quadtree.

Further, although the key management apparatus 100 is configured as a binary tree for managing keys, that is, managing the mutual relationship between subsets, the present invention is not limited to this configuration. Similarly to the above, the tree structure for managing the mutual relationship between the subsets may be an n-ary tree (n is an integer).
(7) In the above embodiment, the key management apparatus 100 associates subsets using the pseudo-random number generator G that outputs two different values for two different input values. It is not limited to.

The key management apparatus 100 may associate subsets using two pseudo-random number generators G_1 that output the same value for two different input values.
For example, in the above embodiment, the subset “1” is associated with the subset “12”. However, by using the pseudo-random number generator G_1, the subset “12” Association with each of the subsets “2” is possible. As a result, the device having the device identifier “2” does not need to hold key information including the subset “12”, and the number of pieces of key information to be held can be reduced.

  (8) In the above embodiment, when an invalid device identifier is not stored in the invalidation device storage area of the invalidation device specifying unit 105, the key revocation data generation unit 106 uses the union to identify the device identifiers of all devices. Are read out from the device key table D100 and two encrypted media keys are generated, but the present invention is not limited to this. One encrypted media key may be generated as follows.

The key management apparatus 100 generates a label “A0” that is common to all apparatuses, generates a device key “K0” from the generated label “A0”, labels “A0”, a device key “K0”, and all apparatuses A set including the set S0 including identifiers is stored in the information storage unit 102, and the key management apparatus 100 distributes the set S0 and the label “A0” to all apparatuses in advance.
When no invalid device identifier is stored in the invalidation device storage area, the key management device 100 reads the set S0 and the device key “K0” from the information storage unit 102, and uses the read device key “K0”. Then, an encrypted media key Enc (K0, media key) is generated. The key management device 100 writes the generated encrypted media key Enc (K0, media key) and the set S0 into the key revocation data storage unit 201 of the recording medium 200a.

Accordingly, all the recording devices and all the reproducing devices can generate the device key “K0” using the label “A0” corresponding to the set S0, and the encrypted media key Enc (K0, media key). Can be decrypted to generate a media key.
(9) In the above embodiment, the key revocation data generation unit 106 includes a case where an invalid device identifier is not stored in the revocation device storage area of the revocation device specifying unit 105 and a case where it is stored. Although the operations are distinguished, the present invention is not limited to this. The key revocation data generation unit 106 may perform the operation when the invalid device identifier shown in the above embodiment is stored without determining whether or not the invalid device identifier is stored. .

  At this time, in the key revocation data generation process shown in FIG. 28, step S540 is performed after step S500 is executed. If an invalid device identifier is not stored in the revoked device storage area, the key revocation data generating unit 106 can read out one or more subsets by repeating steps S540 to S555, The device identifier corresponding to each device is included in any of the read subsets.

(10) In the above embodiment, the pseudo-random number generator G generates a random number from X bits to 3X bits, but is not limited to this. The pseudo random number generator G may generate a random number consisting of X bits to 2X bits.
An operation of the key management apparatus 100 in this case will be described.
When the key management device 100 generates a random number Ah consisting of X bits, it records the generated random number Ah as a device key in (T ^ 2 + T) / 2} rows and h columns. As a result, the random number Ah can be assigned as a device key to the subset recorded in (T ^ 2 + T) / 2} rows and h columns.

The key management device 100 uses the random number Ah and the pseudo-random number generator G to generate a random number consisting of 2X bits. Here, of the generated 2X bits, the left X bit is a device key corresponding to the left child node when associating the child node of the subset corresponding to the random number Ah, and the right X bit is the right child The device key corresponding to the node.
When the key management apparatus 100 detects one subset or two subsets that are child nodes for the subset S, each of the detected subsets is detected by the same method as the label allocation method described in the embodiment. To the device key generated by the pseudo-random number generator G. Thereby, the key management apparatus 100 can generate a device key table including a subset and a device key, and an interrelation table. The generation of the correlation table is the same as that in the embodiment, and the description thereof is omitted.

At this time, the key information distributed to each device by the key management device 100 includes a subset and a device key corresponding to the subset.
When the recording device 300 acquires the decryption key of the encrypted media key using the key information, if the number of nodes on the path from the detection subset to the reference subset is Z (Z is 2 or more), the recording apparatus 300 By using the random number generator G Z-1 times, the decryption key can be obtained. Of the two device keys acquired by using the pseudo-random number generator G Z-1 times, the recording device 300 is a left child node or a right child node with respect to its parent node. It is judged whether it is. When it is determined that it is a left child node, a device key consisting of left X bits of 2X bits is obtained as a decryption key. When it is determined that it is a right child node, a device consisting of right X bits Get the key as a decryption key. Note that the determination of which device key to use for the next input out of the two device keys generated by the pseudorandom number generator G is the same as in the above embodiment, and thus the description thereof is omitted. When Z = 1, that is, when the detected subset and the reference subset are the same, the device key corresponding to the detected subset is used as the decryption key of the encrypted media key.

The playback device 400 also acquires the decryption key of the encrypted media key by the same operation as described above.
(11) In the above embodiment, each column of the device key table D100 records a subset, a label corresponding to the subset, and a device key corresponding to the label. However, the present invention is not limited to this. In each column of the device key table D100, a subset and a label corresponding to the subset may be recorded.

At this time, when generating key revocation data, the key management apparatus 100 generates a device key using a label corresponding to the acquired subset, and uses the generated device key to generate an encrypted media key. Generate. The generated encrypted media key and the acquired subset are recorded on the recording medium 200a as key invalidation data.
(12) In the above embodiment, the key information is composed of a label and a subset corresponding to the label. However, the present invention is not limited to this. The route information shown below may be used instead of the subset.

The route information includes a route number and a generation route.
The root number indicates the highest rank in the correlation table D101 of the subset that is the root of the tree structure to which the subset corresponding to the label to be distributed belongs. In other words, it is a number indicating the number of the root subset from the left in the lowest row of the device key table D100. For example, when the subset “1” is routed, the route number is “1”, and when the subset “3” is routed, the route number is “3”.

  The generation path is a path in which a label to be distributed is generated from labels assigned to a subset for the route, and is indicated by 0, 1, 2, and a combination of 1 and 2. “0” indicates the label itself, that is, the label assigned to the root node. “1” indicates that the parent node has moved to the right, that is, the right label among the right and left labels generated by the parent node has been assigned to the child node, and “2” indicates that the child node has left That is, the left label among the right and left labels generated at the parent node is assigned to the child node. For example, the generation path of the label “A1” illustrated in FIG. 5 is “0”, the generation path of the label “A1RL” is “12”, and the generation path of the label “A5RLRR” is “1211”.

Hereinafter, the route information is expressed as “route number−generated route”.
Upon receiving the distribution instruction and the device identifier, the distribution unit 104 of the key management device 100 generates one or more key information including a label to be distributed to the device corresponding to the received device identifier and path information corresponding to the label. get. The distribution unit 104 distributes the acquired one or more pieces of key information to the device corresponding to the received device identifier.

Here, the operation for acquiring the route information will be described with reference to FIGS.
First, the operation in step S445 is changed to an operation for determining whether or not the path information corresponding to the detected subset has been stored in the key information storage area. At this time, if the distribution unit 104 determines in step S450 that the route information corresponding to the detected subset has not been stored, it executes step S450.

Next, step S455 is changed as follows.
(Changes) The distribution unit 104 determines whether or not the detected node, that is, the root of the tree structure Vi. If it is determined that the route is a route, the generation route is set to “0”. If it is determined that the route is not the root, the generation route from the root to the detected node is acquired. Furthermore, the distribution unit 104 acquires a route number for the route of the tree structure Vi. In this case, i is the root number. The distribution unit 104 generates route information including the acquired route number and the generated route, and generates and acquires key information including the generated route information and the read label.

Next, step S475 is omitted, and the operation of step S480 is changed so that all key information is distributed to the device corresponding to the received terminal device identifier. Here, the distribution means, for example, that writing of the received device identifier and one or more key information stored in the key information storage area is completed on a distribution recording medium.
Further, when generating key revocation data, the key management device 100 first acquires one or more subsets based on the storage contents of the revocation device storage area, as in the above embodiment. A label and a device key corresponding to each acquired subset are acquired. The key management apparatus 100 generates an encrypted media key using each acquired device key. Furthermore, the key management apparatus 100 acquires path information using each tree structure to which each acquired subset belongs. In the acquisition method, first, a subset of the route to which the subset belongs is acquired, and a route number is acquired using the acquired subset of the route and the correlation table D101. Furthermore, a generation route is acquired from a route from the route to a subset of the acquired label, and route information is generated from the acquired route number and the generation route. The generation path is acquired in the same manner as described above. The key management apparatus 100 associates each generated path information with each encrypted media key to generate key invalidation data, and writes the generated key invalidation data to the recording medium 200a. For example, when the devices 4 and 5 are revoked, the key management device 100 acquires the subset “123” and the subset “678”, and further, the device key “K3” corresponding to each subset. ”,“ K33 ”, and route information“ 1-12 ”and“ 7-11 ”for the labels corresponding to each subset.

  FIG. 39 shows key revocation data stored in the recording medium 200b when the device 4 and the device 5 are revoked. As described above, the key revocation data includes the encrypted media key and the path information of the label corresponding to the device key used for encrypting the media key. When the devices 4 and 5 are revoked, the recording medium 200b stores two pieces of key revocation data as described above.

Further, FIG. 40 shows key information held by each device. The upper part of the key information shows path information, and the lower part shows a label.
Here, the decryption of the encrypted media key performed by the recording apparatus 300 will be described with reference to FIGS. 29, 30, and 31 only. Note that the first and second encryption processes are the same as those in the above embodiment, and a description thereof will be omitted.

<Changes in recording process>
First, in step S605, the path information corresponding to each of one or more encrypted media keys recorded on the recording medium 200b from the recording medium 200b mounted on the recording apparatus 300 via the input / output unit 309 is used. Of these, the operation is changed to an operation for reading one piece of route information (hereinafter referred to as reference route information).

Next, the operation in step S610 is changed to an operation for reading one or more pieces of key information.
Next, step S615 is changed as follows.
(Changes) The decryption key generation unit 304 has a route number that matches the route number of the reference route information (hereinafter referred to as the reference route number) from one or more of the read key information, and is generated from “0”. Search is made for route information (hereinafter referred to as detected route information) having a generated route that matches the left front with respect to a generated route (hereinafter referred to as a reference generated route) having a route or included in the reference route information. Here, the left front coincidence will be described. First, the number of numbers written in the generation path is set as the length of the generation path. For example, the generation route “2” has a length of 1, and the back-fabrication route “12121” has a length of 5. The left front coincidence means that when the reference generation path is p1 and the generation path is p2, p1 = p2 or p1 = p2 || p3. Here, the length of p3 is 1 or more. For example, the generation paths “1” and “121” are in front of the generation paths “12” and “1211”, respectively. The search method will be described later using a specific example.

Next, the operation in step S620 is changed to an operation for determining whether or not the detected route information is detected. The operation in step S625 is changed to an operation for determining whether or not unread reference path information exists. Further, the operation in step S630 is changed to an operation for reading the reference path information.
Here, the search method will be described using a specific example. Note that it is assumed that the recording medium 200b loaded in the recording apparatus 300 stores two pieces of key revocation data shown in FIG. When the recording device 300 has the device identifier 2, the decryption key generation unit 304 determines whether or not the reference route number “1” exists in the route information included in each read key information. . Here, it is determined that it exists and the route information “1-1” is acquired. Next, it is determined whether or not the generation route is “0”. Here, it is determined that it is not “0”. Next, the decryption key generation unit 304 determines whether or not the generated route “1” of the acquired route information “1-1” matches the front left with respect to the reference generated route. Here, it is determined that they match, and the route information “1-0” is detected as the detected route information.

  When the recording device 300 has the device identifier 7, the decryption key generation unit 304 does not hold the route information having the reference route number “1”. The reference route information “7-11” is read out. The decryption key generation unit 304 determines whether or not the reference route number “7” exists in the route information included in each read key information. Here, it is determined that it exists, and the route information “7-0” is acquired. Next, it is determined whether or not the generation route is “0”. Here, it is determined to be “0”, and the route information “7-0” is detected as the detected route information.

<Changes in device key acquisition processing>
First, the operation in step S700 is changed to an operation for acquiring a label corresponding to the detected path information.
Next, the operation in step S705 is changed to an operation for obtaining a difference Z between the length of the reference generation path and the length of the detection generation path.

The control is repeated so that the repeated control from step S710 to step S740 is performed from z = 1 to Z + 1.
The determination operation in step S720 is changed to an operation for determining whether or not a number exists in the “detection generation path length + z” -th in the reference generation path.
The determination operation in step S725 is changed to an operation for determining whether or not the number existing in the “detection generation path length + z” -th number is two.

The operation in step S745 is changed to an operation for acquiring a device key from the random number acquired for the Z + 1th time.
The operation in step S750 is changed to an operation for outputting the device key and the reference path information to the decryption unit 305.
<Decoding process changes>
The operation in step S800 is changed to an operation for receiving a device key and reference path information.

The operation in step S805 is changed to an operation for obtaining an encrypted media key corresponding to the reference path information.
By changing the above points, the recording apparatus 300 can generate the media key by decrypting the encrypted media key using the key information including the label and the path information.
Note that the decryption of the encrypted media key performed by the playback device 400 may be performed in the same manner as the above changes for the processes shown in FIGS. 34, 35, and 36. Omitted.

  (13) In the above (12), the key management device 100 generates the path information when distributing the key information and generating the key revocation data. However, the present invention is not limited to this. At the time of generating the device key, the path information may be generated, and the set including the generated path information, subset, label, and device key may be recorded in the device key table D100. Thereby, at the time of distribution of key information and generation of key revocation data, it is only necessary to read out path information from the device key table D100.

(14) In the above embodiment, the association between one subset generated at layer 0 and one subset generated at layer 1, and one subset and layer generated at layer 1 Although the association with one subset generated in 2 is performed, the present invention is not limited to this.
For example, only one subset generated at layer 0 may be associated with one subset generated at layer 1.

In this case, the labels to be distributed to the device 1 include a subset “1”, a subset “12”, a subset “123”, a subset “125678”, and a subset “1345678”, and corresponding labels. There are five pieces of key information, and the number of pieces of key information to be distributed is smaller than before.
Alternatively, only the association between one subset generated at layer 1 and one subset generated at layer 2 may be performed.

In this case as well, it can be seen that the number of key information distributed to the device 1 is smaller than the conventional number.
(15) In the present invention, the association of the plurality of generated subsets may be the method shown in the above embodiment.
Alternatively, one or more subsets generated between the layers may be associated with each other, and the subsets may be associated with each other after the association of the subsets with each layer.

  For example, after generating the device key table D100a shown in FIG. 10, the key management apparatus 100 firstly sets each subset generated from the tree structure rooting the layer 0 node, that is, the first row 501 in the device key table D100a. Using each subset recorded in the second row 502 and the third row 503, the root is a subset consisting of the minimum number of elements, the child node is its parent node, and the minimum number of elements is used. Two tree structures are generated as a subset. That is, a tree structure that routes the subset “1234” and a tree structure that routes the subset “5678” are generated.

  Next, the key management apparatus 100 uses each subset generated from the tree structure rooting the layer 1 node, that is, each subset recorded in the fourth row 504 and the fifth row 505 in the device key table D100a. Then, four tree structures are generated as a subset including the minimum number of elements as a root and including a parent node as a child node and including a minimum number of elements.

  Further, the key management apparatus 100 uses each subset generated from the tree structure that routes the layer 2 node, that is, each subset recorded in the sixth row 506 in the device key table D100a, as a minimum. Eight tree structures including a parent node as a child node and a subset consisting of the minimum number of elements are generated as child nodes. The eight tree structures generated here are tree structures consisting only of roots.

  Next, using the generated tree structures, association between the tree structures is performed as follows. First, a tree structure that routes the subset “1” and a tree structure that includes the subset “1” and roots the subset having the minimum number of elements, here, the tree structure that routes the subset “12” Associate with. Furthermore, a tree structure that routes the subset “12” and one leaf of the tree structure, here, a tree structure that includes the subset “123” and roots the subset consisting of the minimum number of elements, here And the tree structure rooting the subset “1234”. By repeating this operation as many times as the number of each subset consisting of one element, the correlation similar to the correlation of each subset shown in FIG. 11 is made. The subset tree structure once associated is not used for other associations.

(16) In the above embodiment, a label for each node of the tree structure is assigned during the construction of the subset tree structure, that is, during the generation of the interrelation table. The labels assigned to the nodes may be assigned after the construction of the subset tree structure is completed, that is, after the creation of the correlation table is completed.
(17) The present invention may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.

  The present invention also provides a computer-readable recording medium such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc). ), Recorded in a semiconductor memory or the like. Further, the present invention may be the computer program or the digital signal recorded on these recording media.

In the present invention, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network represented by the Internet, or the like.
The present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program.

In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, and is executed by another independent computer system. It is good.
(18) The above embodiment and the above modifications may be combined.
1.10 Summary The key management device arbitrarily selects some from a plurality of terminal devices, generates a plurality of permission sets, and one key is assigned to each permission set. Data is encrypted by the key assigned to the permission set, and the terminal device including the permission set can use the encrypted data. The first permission set is associated with another second permission set. By association, a key of the second permission set is generated from the key of the first permission set. The key management device divides the plurality of terminal devices into a plurality of groups. For one group, a plurality of permission sets are generated by arbitrarily selecting some of the plurality of terminal devices included in the group. One key is assigned to each permission set, and data is encrypted by the key assigned to the permission set, and the terminal device including the permission set can use the encrypted data. The third permission set is associated with another fourth permission set. By association, a key of the fourth permission set is generated from the key of the third permission set. The key management device associates the first permission set with the fourth permission set.

  Here, the relationship of each subset in Non-Patent Document 1 will be described. The relationship between each subset in Non-Patent Document 1 is the same as that of the present invention for a plurality of subsets generated from a subtree rooting a node in which a layer i (i is 0 or more) exists. For example, subsets “12”, “123”, “124”, “34”, “134”, and “234” are generated from the subtree that routes E1 shown in FIG. 11, the subset “12” is associated with the subsets “123” and “124”, and the subset “34” is associated with the subsets “134” and “234”. However, the subsets are not related across the two subtrees. Therefore, each subtree has an independent relationship.

  In other words, the relationship between the subsets in Non-Patent Document 1 is associating the subset “1” with the subset “12” and associating the subset “123” with the subset “1234” from the relationship shown in FIG. , The association between the subset “3” and the subset “34”, the association between the subset “5” and the subset “56”, the association between the subset “567” and the subset “5678”, and the subset “ 7 ”and the subset“ 78 ”are not associated with each other. Thus, in the prior art, for example, the device 1 is labeled with the subset “1”, the label with the subset “12”, the label with the subset “134”, the label with the subset “1234”, and the subset “125678”. It is necessary to distribute a total of six labels, that is, a label of “1” and a subset “1345678”.

  However, according to the present invention, the largest element among a plurality of subsets generated from the subtree rooting the child node among the two subtrees rooting each of the two nodes having the parent-child relationship between the two roots. The association between the subset F1 having a number and the subset F2 including the subset F1 and including the minimum number of elements among the plurality of subsets generated from the portion having the parent node as a root is performed. ing. Therefore, the subsets are related across the two subtrees, and the subtrees are related. As a result, the number of labels to be distributed can be reduced.

  For example, by associating the subset “1” and the subset “12”, as shown in FIG. 41, a subtree T501 having a node T510 “E3” as a root in the tree structure T100 and a node T511 “E1” are connected. Each label corresponding to each of the subset “12”, the subset “123”, and the subset “124” associated with the root subtree T502 and generated in the subtree T502 is stored in the subtree T501. Is generated from the label corresponding to the subset “1” generated by using the pseudo-random number generator G150. Further, by associating the subset “123” with the subset “1234”, as shown in FIG. 41, the subtree T502 having the node T511 “E1” as the root and the portion having the node T512 “E0” as the root The subset “1234”, the subset “123456”, the subset “124123478”, the subset “1234567”, the subset “1234568”, the subset “1234578” that are associated with the tree T503 and generated in the subtree T503 are generated. ”And the subset“ 1234678 ”correspond to the label corresponding to the subset“ 123 ”generated in the subtree T502, that is, the subset“ 1 ”generated in the subtree T501. From the label to be generated, the pseudo random number generator G150 is used. Therefore, the key management device 100 does not need to distribute the label of the subset “12” and the label of the subset “1234” to the device 1, but the label of the subset “1” and the subset “134”. In other words, a total of four labels, that is, the label of the subset “125678” and the label of the subset “1345678” may be distributed.

  Furthermore, in the technique in Non-Patent Document 1, it is necessary to assign a different label to each node of a tree structure that manages each device, that is, each root of a partial tree. In the present invention, as described above, Since the association between the subtrees is performed, it is not necessary to assign a different label to each root of the subtree. That is, the number of different labels can be reduced as compared with the conventional case.

Further, the key management device 100 generates key revocation data, so that a key necessary for content recording or reproduction cannot be calculated with a label possessed by an unauthorized device, and one or more regular devices other than the unauthorized device can be calculated. Then, a key required for content recording or reproduction can be calculated using a label of each device.
In the conventional key revocation technique disclosed in Non-Patent Document 1, there is a problem that when the number of devices increases, the number of labels incorporated in each device becomes enormous. For example, when considering a system having about 1 billion devices (a binary tree with a height of 30), the number of labels held by each device is 465. However, according to the present invention, the number of keys built into each device can be reduced. Specifically, if the height of the tree structure is T and the total number of devices belonging to the system is Q, T-1 keys are reduced in Q / 2 devices, and Q / 4 devices T−2 keys are reduced, and T−k keys are reduced in Q / (2 ＾ k) devices. However, k is an integer of 1 or more and T-1 or less.

  The key revocation system according to the present invention has an effect that the number of labels, that is, keys, held by each device can be reduced by giving a correlation to the labels held by each device, that is, keys. However, in the same system, when a stationary machine, a portable terminal, etc. are mixed, it is possible to allocate a small number of keys to a portable terminal with a small storage capacity. Useful.

  The present invention relates to a key management device that generates and distributes invalidation information for invalidating a specific device, a recording medium that records the invalidation information, and reads and processes the invalidation information from the recording medium A copyright protection system comprising a terminal device, wherein the key management device generates a subset of a terminal device belonging to the copyright protection system, and assigns a key to the subset A key generation unit that generates a key of another subset including the subset from the assigned key, and an invalidation information generation unit that generates invalidation information based on the key assigned to the subset. It is characterized by providing.

Further, the present invention is the copyright protection system, wherein the key generation unit of the key management device uses a one-way function to obtain a key of another subset from the keys assigned to the subset. It is characterized by generating.
Further, the present invention is the copyright protection system, wherein the key generation unit of the key management device generates keys of a plurality of other subsets from the keys assigned to the subsets. To do.

Also, the present invention is the copyright protection system, wherein the key management device includes a storage unit that stores a correspondence relationship between the subset and the assigned key, and a mutual relationship between the generated keys. And
Further, the present invention is the copyright protection system, wherein the storage unit of the key management device uses a table to indicate the correspondence between the subset and the assigned key, and the mutual relationship between the generated keys. It manages and memorize | stores the said table.

  Further, the present invention is the copyright protection system, wherein the key management device includes a key distribution unit that distributes a key assigned to the subset to the terminal device, and the key distribution unit includes a key The smallest subset is selected from the subset including the terminal device that distributes the key, the key assigned to the selected subset is distributed, and the key generated from the distributed key is further assigned. A minimum subset including the terminal device is selected from the subsets excluding the subset, and a key assigned to the selected subset is distributed.

  Further, the present invention is the copyright protection system, wherein the revocation information generation unit of the key management device selects the largest subset including only valid terminal devices, and sets the selected subset to the selected subset. For terminal devices not included, the largest subset including only those terminal devices is further selected, and the selection is repeated until all valid terminal devices are included in any subset. It is characterized by that.

The present invention is the copyright protection system, wherein the terminal device includes a storage unit that stores a key for processing the invalidation information, and the storage unit is assigned to a subset including the storage unit. The stored key is stored.
Further, the present invention is the copyright protection system, wherein the storage unit of the terminal device also stores information indicating a correspondence relationship between a key and a subset.

Further, the present invention is the copyright protection system, wherein the storage unit of the terminal device generates the key that can be generated when a key of another subset can be generated from a key assigned to a certain subset. Is not stored.
Further, the present invention is the copyright protection system, wherein the terminal device includes a key generation unit that generates a key assigned to another subset from a key stored in the storage unit, and the key generation The section is characterized in that a key assigned to another subset is generated from the correspondence between the subset and the key and the mutual relationship between the generated keys.

Also, the present invention is the copyright protection system, wherein the terminal device includes a recording unit that records encrypted content on the recording medium.
In addition, the present invention is the copyright protection system, wherein the terminal device includes a playback unit that reads, decrypts, and plays back the encrypted content from the recording medium.

Further, the present invention is the copyright protection system, wherein the invalidation information generated by the key management device is provided with information indicating which subset of keys is generated based on the subset of keys. To do.
The present invention is the copyright protection system, wherein a communication medium is used instead of the recording medium.

  The present invention is also a key management device that generates and distributes revocation information for revoking a specific device, the key management device including a subset of terminal devices belonging to the copyright protection system. A subset generating unit to generate, an assigning unit for assigning a key to the subset, a key generating unit for generating keys of another subset including the subset from the assigned key, and the subset A revocation information generation unit that generates revocation information based on the assigned key is provided.

Further, the present invention is the key management apparatus, wherein the key generation unit generates a key of another subset using a one-way function from keys assigned to the subset. And
Further, the present invention is the key management apparatus, wherein the key generation unit generates keys of a plurality of other subsets from keys assigned to the subsets.
In addition, the present invention is the key management device, characterized in that the key management device includes a storage unit that stores a correspondence relationship between the subset and the assigned keys and a mutual relationship between the generated keys.

Further, the present invention is the key management apparatus, wherein the storage unit manages a correspondence relationship between the subset and the assigned keys and a mutual relationship between the generated keys using a table, and the table Is stored.
Further, the present invention is the key management device comprising a key distribution unit that distributes the keys assigned to the subset to the terminal device, and the key distribution unit includes a terminal device that distributes the key Among the subsets to be selected, distribute a key assigned to the selected subset, and further exclude a subset to which a key generated from the distributed key is assigned Then, a minimum subset including the terminal device is selected, and a key assigned to the selected subset is distributed.

  Further, the present invention is the key management device, wherein the revocation information generation unit selects a maximum subset including only valid terminal devices, and the terminal devices not included in the selected subset Is further characterized by selecting the largest subset including only those terminal devices and repeating the selection until all valid terminal devices are included in any subset. .

Further, the present invention is a terminal device that reads and processes invalidation information from a recording medium, and the terminal device includes a storage unit that stores a key for processing the invalidation information, and the storage unit includes: It is characterized by storing a key assigned to a subset including itself.
Further, the present invention is the terminal device, wherein the storage unit also stores information indicating a correspondence relationship between a key and a subset.

Further, the present invention is the terminal device, wherein the storage unit does not store a key that can be generated when a key of another subset can be generated from a key assigned to a certain subset. Features.
The present invention is the terminal device, wherein the terminal device includes a key generation unit that generates a key assigned to another subset from the key stored in the storage unit, and the key generation unit includes: The key assigned to the other subset is generated from the correspondence between the subset and the key, and the mutual relationship between the generated keys.

In addition, the present invention is the terminal device, wherein the terminal device includes a recording unit that records encrypted content on the recording medium.
In addition, the present invention is the terminal device, wherein the terminal device includes a playback unit that reads, decrypts, and plays back the encrypted content from the recording medium.
The present invention is also a recording medium for recording invalidation information for invalidating a specific device, wherein the key management device generates a subset of terminal devices belonging to the copyright protection system. An allocation unit that allocates a key to the subset, a key generation unit that generates a key of another subset including the subset from the allocated key, and a key allocated to the subset An invalidation information generation unit for generating invalidation information is provided, and the invalidation information generated by the key management device is recorded.

  Further, the present invention is the recording medium, wherein the revocation information generated by the key management device is provided with information indicating which subset of keys is generated, and the The key revocation information is recorded together with the information.

  Each apparatus and recording medium constituting the invention can be manufactured and sold in the electric appliance manufacturing industry in a management manner, continuously and repeatedly. In addition, each device and recording medium constituting the present invention can be used for management, continuously and repeatedly in the content distribution industry for producing and distributing content.

1 is a block diagram showing an outline of the entire copyright protection system 10. FIG. 2 is a block diagram showing a configuration of a key management device 100. FIG. It is a conceptual diagram which shows the tree structure T100. It is an example which shows an example of the data structure of tree structure table T101. An example of the data structure of device key table D100 is shown. An example of the data structure of the correlation table D101 is shown. It is a conceptual diagram which shows tree structure T201, T202, T203, and T204. It is a conceptual diagram which shows tree structure T205, T206, T207, and T208. It is a figure which shows the structure of pseudorandom number generator G150. An example of the data structure of device key table D100a is shown. It is a table which shows the mutual relation of each subset. It is a table which shows the total number of key information distributed to each apparatus, and key information. 3 is a block diagram showing a configuration of a recording medium 200. FIG. 3 is a block diagram showing a configuration of a recording apparatus 300. FIG. It is a figure which shows the recording medium 200b on which only the key revocation data was recorded. 3 is a block diagram showing a configuration of a playback device 400. FIG. It is a figure which shows the recording medium 200c with which key revocation data, the encryption content key, and the encryption content were recorded. It is a flowchart which shows the operation | movement outline | summary of a production | generation process. It is a flowchart which shows the production | generation process of a subset. Continued to FIG. It is a flowchart which shows the production | generation process of a subset. It continues from FIG. It is a flowchart which shows the production | generation process of a device key. Continuing to FIG. It is a flowchart which shows the production | generation process of a device key. It continues from FIG. 21 and continues to FIG. It is a flowchart which shows the production | generation process of a device key. Continuing from FIG. 22, continuing to FIG. It is a flowchart which shows the production | generation process of a device key. It continues from FIG. 23 and continues to FIG. It is a flowchart which shows the production | generation process of a device key. It continues from FIG. It is a flowchart which shows the acquisition process of key information. Continued to FIG. It is a flowchart which shows the acquisition process of key information. Continuing from FIG. It is a flowchart which shows the production | generation process of key revocation data. It is a flowchart which shows a recording process. It is a flowchart which shows a device key acquisition process. It is a flowchart which shows a decoding process. It is a flowchart which shows a 1st encryption process. It is a flowchart which shows a 2nd encryption process. It is a flowchart which shows reproduction | regeneration processing. It is a flowchart which shows a device key acquisition process. It is a flowchart which shows a 1st decoding process. It is a flowchart which shows a 2nd decoding process. It is a flowchart which shows a 3rd decoding process. It is a figure which shows the recording medium 200b on which only the key revocation data was recorded. It is a table which shows the total number of key information distributed to each apparatus, and key information. In tree structure T100, it is a figure which shows the correlation of each subtree which routes each of the node E0, the node E1, and the node E3. It is a figure which shows the concept of the difference set in a prior art. It is an example which shows a difference set in a prior art. It is an example which shows allocation of the label in a prior art.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Copyright protection system 100 Key management apparatus 101 Device information storage part 102 Information storage part 103 Information generation part 104 Distribution part 105 Invalidation apparatus specific part 106 Key invalidation data generation part 107 Reception part 108 Output part 200 Recording medium 201 Key invalidity Encrypted data storage unit 202 encrypted content key storage unit 203 encrypted content storage unit 300 recording device 301 key information storage unit 302 content storage unit 303 content key storage unit 304 decryption key generation unit 305 decryption unit 306 first encryption unit 307 2 encryption unit 308 reception unit 309 input / output unit 400 playback device 401 key information storage unit 402 decryption key generation unit 403 first decryption unit 404 second decryption unit 405 third decryption unit 406 playback unit 407 reception unit 408 read unit 420 monitor

Claims (42)

A management device that arranges each device identifier for identifying a plurality of terminal devices on a leaf of a tree structure, assigns unique information as a basis of a decryption key for decrypting encrypted data to each device identifier, and manages the device identifier ,
Subset generation means for determining and generating a subset of device identifiers subordinate to the nodes in each layer excluding the leaf of the tree structure;
A first associating means for searching and relating a subset including the subset of the lowest layer excluding the leaf layer from the uppermost layer;
A second associating means for searching and associating a subset including the subset of the association destination from either the same layer or the layer immediately above;
First control means for controlling the second association means to repeatedly process until reaching the highest layer;
Second control means for controlling the first associating means, the second associating means, and the first control means to repeatedly process all the subsets of the lowest layer;
First assigning means for associating unique information with a subset of association sources of the lowest layer and assigning the unique information to a device identifier included in the subset;
By associating, the specific information derived from the specific information assigned to the subset of the association source is associated with the subset connected across the layers, and the specific information is included in each subset. And a second assigning means for assigning the device identifier. The first associating means searches for a subset that includes the subset of the lowest layer and includes the minimum number of elements, sets the subset of the lowest layer as a parent node, and uses the searched subset as a child. As a node,
The second associating means searches for a subset that includes the subset of the association destination and includes the minimum number of elements, sets the association destination subset as a parent node, and uses the retrieved subset as a child. As a node,
The first control means generates the subset tree that routes the subset of the lowest layer by controlling the second association means to repeatedly process until reaching the highest layer. The management apparatus according to claim 1. The first associating means excludes one or more subsets associated with each other from the subsets of the upper layers with respect to the lowest layer, and uses the remaining one or more subsets as the highest layer. 3. The management apparatus according to claim 2, wherein the second associating unit performs control so as to repeatedly process until a subset tree that routes the subset of the lowest layer is generated. The second allocating means includes
The derived specific information is generated from the unique information associated with the association source subset using a one-way function, and the generated unique information is associated with the subset connected by the association. The management apparatus according to claim 3. The management device further includes:
Corresponds to the previous subset when there is a subset where the identifier of the distribution target terminal device that distributes unique information first appears as an element in each route from the root of the subset tree to each of one or more leaves Unique information acquisition means for acquiring one or more attached unique information;
5. Distribution means for distributing one or more sets of acquired unique information and set identification information for identifying a subset corresponding to the unique information to the terminal device to be distributed. The management apparatus as described in. The unique information acquisition means includes
When a subset in which the identifier of the terminal device to be distributed first appears as an element is searched from each route from the root of the subset tree to the leaf, and the subset is detected, the detected subset is not acquired. A first acquisition unit for acquiring the detected subset in a case;
A second acquisition unit that acquires the specific information associated with the subset acquired by the first acquisition unit;
The management apparatus according to claim 5, further comprising: a repeat control unit that controls the first and second acquisition units to repeatedly process until each route is performed. The management device further includes:
First storage means having an area for storing each subset that is a component of the subset tree and the unique information associated with each of the subsets;
A second storage means having an area for storing a plurality of nodes constituting the subset tree and child nodes of each node;
A first writing means for associating the subset and unique information associated with the subset and writing the first information to the first storage means;
6. The management apparatus according to claim 5, further comprising: a second writing unit that associates the node constituting the subset tree with a child node of the node and writes the node to the second storage unit. . The first storage means has a first table that stores a plurality of sets, with the subset and unique information associated with the subset as one set.
The second storage means has a second table for storing a plurality of sets, with the node and the child node corresponding to the node as one set.
The first writing means writes a set of the subset and unique information associated with the subset into the first table;
The management apparatus according to claim 7, wherein the second writing unit writes a set of the node and a child node of the node into the second storage unit. The second control means controls the first association means, the second association means, and the first control means to repeatedly process all the subsets of the lowest layer, and Generate a subset tree of
The first storage means stores each subset included in each subset tree and each unique information associated with each subset.
The management device further includes:
An invalidation identifier storage unit having an area for storing an invalid identifier indicating one or more invalid terminals among the plurality of terminal devices;
Based on the contents stored in the invalidation identifier storage means, obtain one or more subsets from the first storage means, and based on each unique information associated with each of the obtained subsets Acquire one or more encryption keys, use each acquired encryption key individually, encrypt the media key used for content use, and generate the same number of encrypted media keys as the one or more encryption keys Encryption key generation means for
Write one or more sets of the encrypted media key and reference identification information for identifying a subset used to acquire the encryption key for the encrypted media key to a recording medium attached to the management device The management apparatus according to claim 7, further comprising a third writing unit. The management device further includes:
The management apparatus according to claim 9, further comprising an invalidation identifier receiving unit that receives an invalid identifier and writes the received invalid identifier to the invalidation identifier storage unit. The encryption key is the same common key as the decryption key,
The one-way function further generates each common key based on each unique information from each unique information,
The encryption key generation means includes
A subset acquisition unit for acquiring from the first storage means a subset including the largest number of one or more valid identifiers excluding invalid identifiers stored in the invalidation identifier storage means;
A control unit that controls the subset acquisition unit to repeatedly process until all valid identifiers belong to any one or more subsets acquired by the subset acquisition unit;
Using the one-way function, a common key acquisition unit that acquires one or more common keys generated from each unique information associated with each subset acquired by the subset acquisition unit;
The management apparatus according to claim 9, further comprising: an encryption unit that generates the same number of encrypted media keys as the number of common keys using each common key acquired by the common key acquisition unit. The reference identification information is a subset used to obtain a common key for the encrypted media key,
The third writing means writes one or more sets consisting of the encrypted media key and a subset used to obtain a common key for the encrypted media key to the recording medium;
The distribution means uses the subset associated with the acquired unique information as the set identification information, and sends one or more sets of the acquired specific information and the set identification information to the terminal device to be distributed. Distribute,
The management device according to claim 9, wherein the distribution unit further distributes a data structure indicating each subset tree. The management device further includes:
Path information including a generation path indicating a route from a root subset which is a root of a subset tree to which the subset belongs to the subset to the subset, and a route identifier indicating the root subset. Route information acquisition means for acquiring
The reference identification information is a path information of a subset used for obtaining an encryption key for the encrypted media key,
The third writing means writes one or more sets consisting of the encrypted media key and path information of a subset used to obtain an encryption key for the encrypted media key to the recording medium;
The distribution means distributes one or more sets of the acquired unique information and the set identification information to the terminal device to be distributed using the route information of a subset with respect to the acquired specific information as the set identification information. The management apparatus according to claim 9, wherein: A terminal device to which unique information that is a basis of a decryption key for decrypting encrypted data is assigned by a management device that manages each device identifier that identifies a plurality of terminal devices in a tree structure,
The management device
At each layer node excluding the leaf of the tree structure, a subset of device identifiers subordinate to the node is obtained and generated, and a subset including the subset of the lowest layer excluding the leaf layer is used as the uppermost layer. The second associating means searches the subset including the subset of the association destination in the same layer and the layer immediately above, and associates the association to the highest layer. Are controlled so that the processing is repeated for all the subsets of the lowest layer, and the unique information is associated with the subset of the association source of the lowest layer. The unique information is assigned to the device identifier included in the subset, and the association is linked to the subset connected across the layers. In association with consequentially specific information obtained from the unique information assigned to the minute set, the unique information, and allocated to each device identifier included in the subset,
The terminal device
A unique information storage means for storing unique information including the device identifier of the terminal device among the unique information distributed in advance from the management device and associated with each subset of the association source. Characteristic terminal device. The unique information storage means further stores set identification information for identifying a subset associated with the stored unique information,
The terminal device further includes:
Determining means for determining whether or not the set identification information indicates that the terminal device is a valid device;
When the determination result by the determination unit is affirmative, the media key is encrypted by an encryption key based on specific specific information among the specific information associated with each subset generated by the management device. First acquisition means for acquiring an encrypted media key associated with key related information related to the encryption key,
Second acquisition means for acquiring a decryption key corresponding to the encryption key using the unique information stored in the unique information storage means;
The decryption means for decrypting the encrypted media key acquired by the acquisition means using the decryption key acquired by the second acquisition means, and generating the media key. Item 15. The terminal device according to Item 14. The specific specific information is reference specific information associated with a subset including one or more identifiers of terminal devices valid at the time of generation of the encrypted media key,
The encryption key is a common key;
The key related information is reference identification information for identifying a subset associated with the reference specific information,
The encrypted media key is associated with the reference identification information,
The determination means, when there is a route from the subset identified by the set identification information stored in the unique information storage means to the subset identified by the reference identification information, The set identification information is determined to indicate that the terminal device is a valid device,
The first acquisition means acquires the encrypted media key encrypted with an encryption key based on the reference specific information corresponding to the reference identification information;
The second acquisition means acquires the decryption key, uses the acquired decryption key as the common key,
The terminal device according to claim 15, wherein the decryption unit decrypts the encrypted media key using the acquired common key. The management device includes a subset of the lowest layer and searches for a subset consisting of the minimum number of elements, the subset of the lowest layer as a parent node, and the searched subset as a child node, Search for a subset that is completely related and includes a subset of the association destination, is composed of a minimum number of elements, and is unassociated, sets the association destination subset as a parent node, and uses the retrieved subset as a child node And generate a subset tree rooting the subset of the lowest layer in association with
The unique information storage means further stores in advance a data structure constituting the subset tree generated by the management device,
The determination means uses the subset tree configured by the data structure, and identifies the reference identification information from a subset associated with the unique information stored in the unique information storage means. The terminal device according to claim 16, wherein it is determined whether or not there is a route to reach the subset to be performed. The management device includes a subset of the lowest layer and searches for a subset consisting of the minimum number of elements, the subset of the lowest layer as a parent node, and the searched subset as a child node, Search for a subset that is completely related and includes a subset of the association destination, is composed of a minimum number of elements, and is unassociated, sets the association destination subset as a parent node, and uses the retrieved subset as a child node And generate a subset tree rooting the subset of the lowest layer in association with
The reference identification information includes a first generation path from the root of the permitted set tree to the reference subset with respect to the reference subset associated with the reference specific information,
The set identification information includes a second generation path from the root of the subset tree to the subset with respect to the subset associated with the unique information,
When the second generation path is included in the first generation path, the determination unit includes a path from a subset identified by the set identification information to a subset identified by the reference identification information. It is judged that it exists. The terminal device of Claim 16 characterized by the above-mentioned. The management device gives unique information associated with the subset as input information for a one-way function, generates a common key based on the unique information, and unique information derived from the unique information The unique information is associated with a subset associated with the subset associated with the unique information given as input information, and the generated unique information is assigned to each device identifier included in the associated subset. ,
The second acquisition means includes
Using the same function as the one-way function, a device key based on the unique information and unique information derived from the unique information are generated from the unique information stored in the unique information storage unit. A device key acquisition unit to acquire,
Control to repeat the operation of the device key acquisition unit by giving the specific information acquired by the device key acquisition unit as information of the next input to the function until a device key based on the reference specific information is acquired A repeating part to perform,
The terminal apparatus according to claim 16, further comprising: a decryption key acquisition unit that acquires, as the common key, a device key based on the reference specific information acquired by the device key acquisition unit. The terminal device further includes:
Content acquisition means for acquiring content;
Content key acquisition means for acquiring a content key;
A first encryption unit that encrypts the content key acquired by the content key acquisition unit using a media key acquired by the decryption unit to generate an encrypted content key;
A second encryption unit configured to encrypt the content acquired by the content acquisition unit using the content key acquired by the content key acquisition unit to generate an encrypted content;
The terminal device according to claim 19, further comprising: a writing unit that writes the encrypted content key and the encrypted content to a recording medium. The writing means includes
The terminal device according to claim 20, wherein the encrypted content key and the encrypted content are written to the recording medium of a device existing on a network via a communication medium. The terminal device further includes:
Encrypted content key acquisition means for acquiring an encrypted content key obtained by encrypting a content key with the media key;
Encrypted content acquisition means for acquiring encrypted content in which content is encrypted with the content key;
First decryption means for decrypting the encrypted content key acquired by the encrypted content key acquisition means using the media key and generating the content key;
Second decryption means for decrypting the encrypted content acquired by the encrypted content acquisition means using the content key and generating the content;
The terminal device according to claim 19, further comprising: a reproducing unit that reproduces the content generated by the second decoding. The encrypted content key and the encrypted content are recorded on a recording medium, and the recording medium is attached to the terminal device,
The encrypted content key acquisition means acquires the encrypted content key from the recording medium,
The terminal device according to claim 22, wherein the encrypted content acquisition unit acquires the content from the recording medium. The encrypted content key acquisition means acquires the encrypted content key via a communication medium,
The terminal device according to claim 22, wherein the encrypted content acquisition unit acquires the content via a communication medium. A plurality of terminal devices and each device identifier for identifying the plurality of terminal devices are arranged in a tree-structured leaf, and each device identifier is assigned unique information as a basis for a decryption key for decrypting encrypted data A copyright protection system comprising a management device for management,
The management device
Subset generation means for determining and generating a subset of device identifiers subordinate to the nodes in each layer excluding the leaf of the tree structure;
A first associating means for searching and relating a subset including the subset of the lowest layer excluding the leaf layer from the uppermost layer;
A second associating means for searching and associating a subset including the subset of the association destination from either the same layer or the layer immediately above;
First control means for controlling the second association means to repeatedly process until reaching the highest layer;
Second control means for controlling the first associating means, the second associating means, and the first control means to repeatedly process all the subsets of the lowest layer;
First assigning means for associating unique information with a subset of association sources of the lowest layer and assigning the unique information to a device identifier included in the subset;
By associating, the specific information derived from the specific information assigned to the subset of the association source is associated with the subset connected across the layers, and the specific information is included in each subset. A copyright protection system comprising: a second assigning means for assigning to a device identifier. The first associating means searches for a subset that includes the subset of the lowest layer and includes the minimum number of elements, sets the subset of the lowest layer as a parent node, and uses the searched subset as a child. As a node,
The second associating means searches for a subset that includes the subset of the association destination and includes the minimum number of elements, sets the association destination subset as a parent node, and uses the retrieved subset as a child. As a node,
The first control means generates the subset tree that routes the subset of the lowest layer by controlling the second association means to repeatedly process until reaching the highest layer. The copyright protection system according to claim 25. The first associating means excludes one or more subsets associated with each other from the subsets of the upper layers with respect to the lowest layer, and uses the remaining one or more subsets as the highest layer. 27. The copyright protection system according to claim 26, wherein the second associating unit performs control so as to repeatedly perform processing until a subset tree that routes the subset of the lowest layer is generated. . The second allocating means includes
The derived unique information is generated from the unique information associated with the subset of the association source using a one-way function, and the generated unique information is associated with the subset connected by the association. The copyright protection system according to claim 27. The management device further includes:
Corresponds to the previous subset when there is a subset where the identifier of the distribution target terminal device that distributes unique information first appears as an element in each route from the root of the subset tree to each of one or more leaves Unique information acquisition means for acquiring one or more attached unique information;
29. A distribution means for distributing one or more sets of acquired unique information and set identification information for identifying a subset corresponding to the unique information to the terminal device to be distributed. Copyright protection system described in. The management device further includes:
First storage means having an area for storing each subset that is a component of the subset tree and the unique information associated with each of the subsets;
A second storage means having an area for storing a plurality of nodes constituting the subset tree and child nodes of each node;
A first writing means for associating the subset with the unique information associated with the subset, and writing the first information into the first storage means;
30. The copyright according to claim 29, further comprising: second writing means for associating the node constituting the subset tree with a child node of the node and writing to the second storage means. Protection system. The second control means controls the first association means, the second association means, and the first control means to repeatedly process all the subsets of the lowest layer, and Generate a subset tree of
The first storage means stores each subset included in each subset tree and each unique information associated with each subset.
The management device further includes:
An invalidation identifier storage unit having an area for storing an invalid identifier indicating one or more invalid terminals among the plurality of terminal devices;
Based on the contents stored in the invalidation identifier storage means, obtain one or more subsets from the first storage means, and based on each unique information associated with each of the obtained subsets Acquire one or more encryption keys, use each acquired encryption key individually, encrypt the media key used for content use, and generate the same number of encrypted media keys as the one or more encryption keys Encryption key generation means for
Write one or more sets of the encrypted media key and reference identification information for identifying a subset used to acquire the encryption key for the encrypted media key to a recording medium attached to the management device The copyright protection system according to claim 30, further comprising third writing means. The management device further includes:
32. The copyright protection system according to claim 31, further comprising: an invalidation identifier receiving unit that receives an invalid identifier and writes the received invalid identifier to the invalidation identifier storage unit. The encryption key is the same common key as the decryption key,
The one-way function further generates each common key based on each unique information from each unique information,
The encryption key generation means includes
A subset acquisition unit for acquiring from the first storage means a subset including the largest number of one or more valid identifiers excluding invalid identifiers stored in the invalidation identifier storage means;
A control unit that controls the subset acquisition unit to repeatedly process until all valid identifiers belong to any one or more subsets acquired by the subset acquisition unit;
Using the one-way function, a common key acquisition unit that acquires one or more common keys generated from each unique information associated with each of the subsets acquired by the subset acquisition unit;
32. The copyright protection according to claim 31, further comprising: an encryption unit that generates the same number of encrypted media keys as the number of common keys using each common key acquired by the common key acquisition unit. system. The terminal device
Unique information storage means for storing one or more sets of unique information distributed in advance by the distribution means of the management device and set identification information for identifying a subset associated with the unique information; ,
Determining means for determining whether or not the set identification information indicates that the terminal device is a valid device;
First determination means for acquiring one encrypted media key from the recording medium when the determination result by the determination means is affirmative;
Second acquisition means for acquiring a decryption key corresponding to the encryption key using the unique information stored in the unique information storage means;
The decryption means for decrypting the encrypted media key acquired by the acquisition means using the decryption key acquired by the second acquisition means, and generating the media key. Item 34. The copyright protection system according to Item 33. The encryption key is a common key;
The determination means, when there is a route from the subset identified by the set identification information stored in the unique information storage means to the subset identified by the reference identification information, The set identification information is determined to indicate that the terminal device is a valid device,
The first acquisition means acquires an encrypted media key corresponding to the reference identification information,
The second acquisition means acquires the decryption key, uses the acquired decryption key as the common key,
The copyright protection system according to claim 34, wherein the decryption means decrypts the encrypted media key using the acquired common key. The second acquisition means includes
Using the same function as the one-way function, a device key based on the unique information and unique information derived from the unique information are generated from the unique information stored in the unique information storage unit. A device key acquisition unit to acquire,
Control to repeat the operation of the device key acquisition unit by giving the specific information acquired by the device key acquisition unit as information of the next input to the function until a device key based on the reference specific information is acquired A repeating part to perform,
36. The copyright protection system according to claim 35, further comprising: a decryption key acquisition unit that acquires, as the common key, a device key based on the reference specific information acquired by the device key acquisition unit. A recording medium,
The media key is encrypted using an encryption key generated based on unique information corresponding to a decryption key generated by an effective terminal device and corresponding to a set of one or more effective terminal devices. A recording medium comprising encryption key storage means for storing an encryption media key. The encryption key storage means further includes:
38. The recording medium according to claim 37, wherein set identification information for identifying a set corresponding to the unique information used for generating the encryption key is stored. A management device that arranges each device identifier for identifying a plurality of terminal devices on a leaf of a tree structure, assigns unique information as a basis of a decryption key for decrypting encrypted data to each device identifier, and manages the device identifier ,
Subset generation means for determining and generating a subset of device identifiers subordinate to the nodes in each layer excluding the leaf of the tree structure;
Group generating means for combining other subsets including the subset with the minimum number of elements among the subsets existing in the same layer together with the subset with the minimum number of elements;
First control means for controlling the group generation means to repeatedly process all subsets of the minimum number of elements existing in the same layer;
Second control means for controlling the group generation means and the first control means to repeatedly process for all layers;
After performing processing on all layers by the second control means, a group of an upper layer having a subset including all subsets of any of the groups of the lower layers between different layers An integration means for integrating a group of layers and a group of one;
After group integration in all layers, each unique information is associated with each subset of the minimum number of elements in each remaining group, and is associated with one or more device identifiers included in each subset First assigning means for assigning each unique information,
Each subset different from the subset of the minimum number of elements to which each unique information is assigned by the first assigning means is associated with the subset of the minimum number of elements existing in the group to which the subset belongs. And a second allocating unit that associates unique information derived from the unique information and assigns the associated unique information to one or more device identifiers included in each subset. . Each device identifier that identifies a plurality of terminal devices is arranged on a tree-structured leaf, and is used for a management device that assigns and manages unique information as a basis for a decryption key for decrypting encrypted data to each device identifier. An association method,
A subset generation step of obtaining and generating a subset of device identifiers existing under the nodes of each layer excluding the leaf of the tree structure;
A first associating step for searching and associating a subset including the lowest layer subset excluding the leaf layer from the uppermost layer;
A second associating step of searching for and associating a subset including the subset of the association destination from either the same layer or the layer immediately above;
A first control step for controlling the second association means to repeatedly process until reaching the highest layer;
A second control step for controlling the first association means, the second association means, and the first control means to repeatedly process the entire subset of the lowest layer;
A first allocating step of associating specific information with a subset of the association source of the lowest layer and assigning the specific information to a device identifier included in the subset;
By associating, the specific information derived from the specific information assigned to the subset of the association source is associated with the subset connected across the layers, and the specific information is included in each subset. A second assigning step for assigning to the device identifier. A management device that distributes each device identifier for identifying a plurality of terminal devices to a leaf of a tree structure, assigns unique information as a basis of a decryption key for decrypting encrypted data to each device identifier, and manages the device
A subset generation step of obtaining and generating a subset of device identifiers existing under the nodes of each layer excluding the leaf of the tree structure;
A first associating step for searching and associating a subset including the lowest layer subset excluding the leaf layer from the uppermost layer;
A second associating step of searching for and associating a subset including the subset of the association destination from either the same layer or the layer immediately above;
A first control step for controlling the second association means to repeatedly process until reaching the highest layer;
A second control step for controlling the first association means, the second association means, and the first control means to repeatedly process the entire subset of the lowest layer;
A first allocating step of associating specific information with a subset of the association source of the lowest layer and assigning the specific information to a device identifier included in the subset;
By associating, the specific information derived from the specific information assigned to the subset of the association source is associated with the subset connected across the layers, and the specific information is included in each subset. An association program for executing the second assignment step assigned to the device identifier. A management device that distributes each device identifier for identifying a plurality of terminal devices to a leaf of a tree structure, assigns unique information as a basis of a decryption key for decrypting encrypted data to each device identifier, and manages the device
A subset generation step of obtaining and generating a subset of device identifiers existing under the nodes of each layer excluding the leaf of the tree structure;
A first associating step for searching and associating a subset including the lowest layer subset excluding the leaf layer from the uppermost layer;
A second associating step of searching for and associating a subset including the subset of the association destination from either the same layer or the layer immediately above;
A first control step for controlling the second association means to repeatedly process until reaching the highest layer;
A second control step for controlling the first association means, the second association means, and the first control means to repeatedly process the entire subset of the lowest layer;
A first allocating step of associating specific information with a subset of the association source of the lowest layer and assigning the specific information to a device identifier included in the subset;
By associating, the specific information derived from the specific information assigned to the subset of the association source is associated with the subset connected across the layers, and the specific information is included in each subset. A computer-readable program recording medium recording an associated program for executing the second assignment step assigned to the device identifier.

Images