JP4638176B2 - Copyright protection system, power residue calculation device, operation device, key management device, playback device, recording device, recording medium, power residue calculation method, calculation method, and program - Google Patents

Description

  The present invention relates to a system for recording and reproducing content to be copyrighted, such as a movie or music, on a large-capacity recording medium such as an optical disk, and in particular, normal content by an unauthorized device that does not protect copyright. The present invention relates to a technology for preventing reproduction.

  In recent years, with the development of multimedia-related technologies such as the improvement of video processing speed by computers, the increase in the capacity of recording media such as optical disks, and the speed of communication lines, digital content (hereinafter referred to as content) such as video and audio )) Is being actively distributed through large-capacity recording media, networks, broadcasts, etc. In such businesses, content copyright protection is very important.

In a system that protects copyright and distributes content, encryption technology is often used, the distribution device encrypts and distributes the content, and the playback device uses the decryption key distributed in advance, The encrypted content is decrypted.
In the system, in addition to encryption technology, in case the key is exposed to the outside due to analysis inside the playback device by an unauthorized person, etc., in order to make it impossible to decrypt the content to be provided thereafter with the once exposed key A key revocation technique is also used (see Patent Document 1).

The system described in Patent Document 1 manages each playback device using an N-layer structure (N is a natural number of 2 or more) called a tree structure, and the playback device corresponds to the device itself. A device that holds N device keys arranged at each node on the path from the end of the tree structure to the uppermost end, and is specified by information in the recording medium among the held device keys Using the key, the corresponding ciphertext is decrypted to obtain a media key, the encrypted content is decrypted, and the content is reproduced. The ciphertext is stored in the recording medium by the number of valid device keys.
JP 2002-281913 A

  However, in the conventional key revocation technique, the number of keys held by each device is proportional to the number of layers of a hierarchical structure called a tree structure (hereinafter referred to as height), and the height of the hierarchy of the tree structure is Since this is proportional to the logarithm of the total number of devices supported by the copyright protection system, the number of keys held by each device increases as the total number of devices belonging to the system increases, and the memory capacity required to hold the key increases. As a result, there is a problem that the manufacturing cost of the apparatus increases.

  Therefore, the present invention has been made in view of such a problem, and an object thereof is to provide a copyright protection system capable of suppressing the manufacturing cost regardless of the total number of devices belonging to the system.

In order to achieve the above object, the present invention provides a copyright protection system comprising a distribution system and a playback device, wherein the distribution system holds an operation value S that is an operation value S that is a natural number. And (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出手段と、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
Selection means for selecting the number of primes indicated by, and power-residue calculation over a finite field

（Ｎは素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記選出手段により選出された全素数の積）
を行う第１演算手段と、前記被演算値Ｓを用いてコンテンツの暗号化を行う暗号化手段と、前記選出した素数を示す指示情報と、暗号化された前記コンテンツとを配布する配布手段とを備え、前記再生装置は、１以上の素数を示す指示情報と、前記暗号化されたコンテンツを取得する取得手段と、前記Ｓ'を予め保持する結果保持手段と、有限体上のべき乗剰余演算

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
First computing means for performing encryption, encryption means for encrypting content using the operand value S, distribution means for distributing the instruction information indicating the selected prime number, and the encrypted content The reproduction apparatus includes instruction information indicating one or more prime numbers, an acquisition unit that acquires the encrypted content, a result holding unit that holds the S ′ in advance, and a power residue calculation on a finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記取得した指示情報により示された全素数の積）
を行う第２演算手段と、前記第２演算手段による演算結果を用いて、取得した前記暗号化コンテンツを復号する復号手段とを備える。

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers indicated by the acquired instruction information)
And second decryption means for decrypting the acquired encrypted content using a computation result obtained by the second computation means.

The copyright protection system of the present invention has the above-described configuration, so that one power residue calculation result by the distribution system is distributed to the playback device as a first key, and the playback device uses the first key. It is possible to provide a system that obtains the second key from the information and decrypts the information using the second key.
In addition, regarding the first key, the reproduction apparatus further calculates a power residue calculation for all the prime numbers excluding one prime number among a plurality of prime numbers used for the power residue calculation by the distribution system with respect to the first key. To obtain the second key, the playback device obtains the second key from the third key that is the power-residue calculation result that is not the power-residue calculation by the inverse element of the prime number of 1. It is difficult to obtain, and whether or not a second key that is a key for encryption and decryption can be generated from the first key depending on which prime number is selected as the prime number of 1 Will change.

The power-residue calculating apparatus of the present invention includes a holding unit that holds a calculation value S that is a natural number, a reading unit that reads the calculation value S, and (2 ^a -2) pieces (a is a natural number of 2 or more). From the different prime numbers of

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出手段と、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
Selection means for selecting the number of primes indicated by, and power-residue calculation over a finite field

（Ｎは素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記選出手段により選出された全素数の積）
を行う演算手段とを備える。
この構成によれば、選出手段が選出する素数により異なる、べき乗剰余演算結果を得ることができる。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
And an arithmetic means for performing.
According to this configuration, it is possible to obtain a power residue calculation result that varies depending on the prime number selected by the selection means.

  In particular, the power residue calculation apparatus is effective for a system that uses the power residue calculation result as a first key and generates a second key from the first key. An operation to be performed in the holding means by performing a power-residue operation on all the prime numbers excluding one prime number among the plurality of prime numbers used for the power-residue operation as a key of 1. A second key that is a number obtained by performing a power-residue operation on the inverse of the prime number of the 1 can be obtained, but from a power-residue operation result that is not a power-residue operation on the inverse of the prime number of the 1 Since obtaining the second key is difficult in terms of computational complexity, if the second key is used for encryption and decryption, depending on which one is selected as the prime number of 1, the power residue calculation result of 1 Control whether the second key can be generated Door can be.

Further, the power-residue calculating device may be configured such that the selecting means calculates the number of all the numbers from 1 to (a-1) from a branch connected to any node of the a-ary tree. A combination for selecting a branch is generated, and a prime number storage means for storing (2 ^a -2) corresponding prime numbers without overlapping any of all the generated combinations; Of these, branch acquisition means for acquiring branch specification information for specifying one branch, and the branch specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means. You may provide the prime number selection means which selects all the prime numbers corresponding to the combination to include.

According to this configuration, among the branches connected to one node of the a-ary tree, each prime number corresponding to all combinations including the one branch is selected, and a calculation result obtained by performing a power-residue operation with an inverse element of the selected prime number Can be obtained.
Further, the power-residue calculating device further includes a writing means for overwriting the operation value S held in the holding means with the operation result value S ′ calculated by the operation means as the operation value S. For each branch on the path from the root of the a-tree to one leaf, in order from the root to the leaf, the branch acquisition means, the prime number selection means, the calculation means, and the writing means, Acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Equation 1, and the calculation result value S ′ described above Repeating control means for controlling to repeat writing to the holding means may be provided.

According to this configuration, for each leaf, a unique calculation result corresponding to the route from the root to the leaf can be obtained.
The power-residue calculating unit further performs a reversible operation on the operation result value S ′ calculated by the operation unit to obtain a reversible operation result value, and a reversible operation result value calculated by the reversible operation unit. From the root for each branch on the path from the root of the a-ary tree to the leaf of one, and writing means for overwriting the operand value S held in the holding means as the operand value S. In order to the leaf, the branch acquisition means, the prime number selection means, the calculation means, the reversible calculation means, and the writing means, respectively, acquire branch designation information that designates the branch, and are designated Selection of all prime numbers corresponding to combinations including branches, power-residue operation based on Equation 1, reversible operation to operation result value S ′, and writing of the obtained reversible operation result value to the holding means Control to repeat A, and a return control unit.

According to this configuration, by performing a reversible operation on a constant, it is possible to obtain an operation result obtained by dividing the operation for each hierarchy in the a-ary tree.
In the power-residue calculating device, the reversible calculating means may add a constant to the calculation result value S ′ calculated by the calculating means to obtain a reversible calculation result value.
According to this configuration, by adding constants, it is possible to obtain a calculation result obtained by dividing the calculation for each hierarchy in the a-ary tree.

The power-residue calculating device of the present invention includes a holding unit that holds an operand value T that is a natural number, and a branches connected to any node of the a-tree (a is a natural number of 2 or more). For each of all the numbers from 1 to (a-1), combinations for selecting the number of branches are generated, and (2 ^a -2) corresponding combinations without overlapping any of the generated combinations The prime number storage means for storing the prime numbers of the first and all branches on the path from the root of the a-tree to any leaf are invalidated and stored in the prime number storage means (2 ^a -2 Effective prime number selection means for selecting a prime number corresponding to a combination including all the branches that are not invalidated from a number of the prime numbers connected to any one of the nodes;
Power-residue operation over a finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記有効素数選出手段により選出された素数である）
を行う演算手段とを備える。
この構成によれば、ａ分木のいずれかのノードに接続する有効な全枝に対応づけられた素数の逆元に係る演算結果を得ることができる。

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected by the effective prime number selection means)
And an arithmetic means for performing.
According to this configuration, it is possible to obtain a calculation result related to the inverse element of the prime number associated with all valid branches connected to any node of the a-ary tree.

The power-residue calculating device further specifies a storage means for storing the operand value S, which is a natural number, a reading means for reading the operand value S, and one of the a branches. A branch acquisition unit that acquires the branch designation information, and a prime number corresponding to a combination including a branch designated by the branch designation information from the (2 ^a -2) prime numbers stored in the prime number storage unit. Prime number selection means to select all and power-residue calculation on finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記選出手段により選出された全素数の積である）
を行う生成手段と、前記生成手段により演算された演算結果値Ｓ'を、前記保持手段に保持している前記被演算値Ｓに、前記被演算値Ｓとして上書きする第１書込手段と、ａ分木のルートから１のノードまでの経路上の各枝について、ルートから前記ノードへの順序で、前記枝取得手段、前記素数選出手段、前記生成手段、前記第１書込手段に対して、それぞれ、当該枝を指定する枝指定情報の取得と、指定された枝を含む組合せに対応する全ての素数の選択と、式３に基づくべき乗剰余演算と、演算された演算結果値Ｓ'の前記記憶手段への書込みとを繰り返すように制御する繰返制御手段と、前記繰返制御手段による繰り返し制御の終了後、前記演算結果値Ｓ'を、Ｔとして保持手段に書き込む第２書込手段と、
前記有効素数選出手段、前記演算手段に対して、それぞれ、無効化されていない枝全てを含む組合せに対応する素数の選出と、式２に基づくべき乗剰余演算とを行わせるよう制御する演算制御手段とを備えてもよい。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and Q is the product of all prime numbers selected by the selection means)
And a first writing unit for overwriting the operation value S ′ calculated by the generation unit over the operation value S held in the holding unit as the operation value S; For each branch on the path from the root of the a-tree to one node, in order from the root to the node, the branch acquisition means, the prime number selection means, the generation means, and the first writing means , Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 3, and calculation result value S ′ Repeat control means for controlling to repeat writing to the storage means, and second write means for writing the operation result value S ′ to the holding means as T after completion of the repeat control by the repeat control means. When,
Arithmetic control means for controlling the effective prime number selection means and the calculation means to perform selection of prime numbers corresponding to combinations including all branches that are not invalidated and exponentiation remainder calculation based on Expression 2. And may be provided.

According to this configuration, a unique calculation result can be obtained for each leaf corresponding to the route from the root of the a-tree to the leaf.
The arithmetic device according to the present invention provides the number of all the numbers from 1 to (a-1) from a branch connected to any node of a tree (a is a natural number of 2 or more). A combination for selecting a branch of the prime number, a prime number storage means for storing the corresponding (2 ^a -2) prime numbers without overlapping any one of the generated combinations, and a root of the a-ary tree All branches on the path to any leaf are invalidated, and invalid branch selection means for selecting (a-1) or less invalid branches among a branches connected to one node. The valid branch selecting means for selecting one branch that has not been invalidated from the a number of branches connected to the node, and the prime number stored in the prime number storage means that has not been invalidated. That of all combinations including a branch and at least one of said disabled branches Comprises instruction information indicating prime corresponding to Les to reproducing apparatus and an instruction information distribution unit for distributing.

According to this configuration, only the playback device corresponding to the valid branch can generate and distribute key revocation information for decrypting the content.
In addition, the arithmetic device may include a communication unit that distributes the instruction information through communication by the instruction information distribution unit.
According to this configuration, the key revocation information for decrypting the content only to the playback device corresponding to the valid branch can be distributed to the playback device via communication.

In the arithmetic device, the instruction information distribution unit may include a medium writing unit that writes the instruction information on a recording medium.
According to this configuration, it is possible to distribute the key revocation information for decrypting the content only to the playback device corresponding to the valid branch to the playback device via the recording medium.
The power-residue arithmetic unit according to the present invention includes one or more (a-1) from the holding means that holds the operand S ′ that is a natural number and a branch connected to any node of the a-ary tree. For each of the following numbers, a combination that selects the branch of the number is generated, and the corresponding (2 ^a -2) prime numbers are stored without overlapping any of the generated combinations. A prime number storage means, an acquisition means for acquiring one or more prime numbers among the prime numbers stored in the prime number storage means, and a power-residue operation on a finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記指定情報により指定された素数全ての積）
を行う演算手段とを備える。
この構成によれば、指定された１個以上の素数の積の逆元を用いたべき乗剰余演算結果を得ることができる。

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is the product of all the prime numbers specified by the specification information)
And an arithmetic means for performing.
According to this configuration, it is possible to obtain a power-residue calculation result using the inverse element of the product of one or more specified prime numbers.

  In particular, the power-residue computing device is effective for a system that uses the power-residue computation result as a first key and generates a second key from the first key. On the other hand, it is possible to obtain a second key by performing a modular exponentiation using a prime number excluding a designated prime number among predetermined prime numbers, and the first key held in advance is an inverse element of the first prime number. When the power-residue calculation is not performed, it is difficult to obtain the second key in terms of the amount of calculation, and the second key depends on the content of the first key and the specified prime number. It is possible to control whether or not a key can be generated.

Further, the power residue calculation device further includes:
Storage means for storing the operand value S that is a natural number; read means for reading the operand value S; and branch acquisition means for acquiring branch designation information that designates one of the a branches. Prime number selection means for selecting all prime numbers corresponding to combinations including the branch specified by the branch specification information from (2 ^a -2) prime numbers stored in the prime number storage means; Exponentiation operation

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記選出手段により選出された全素数の積）
を行う生成手段と、前記生成手段により演算された演算結果値Ｒを、前記保持手段に保持している前記被演算値Ｓに、前記被演算値Ｓとして上書きする第１書込手段と、ａ分木の１のリーフから１のノードまでの経路上の各枝について、前記リーフから前記ノードへの順序で、前記枝取得手段、前記素数選出手段、前記生成手段、前記第１書込手段に対して、それぞれ、当該枝を指定する枝指定情報の取得と、指定された枝を含む組合せに対応する全ての素数の選択と、式５に基づくべき乗剰余演算と、演算された演算結果値Ｒの前記記憶手段への書込みとを繰り返すように制御する繰返制御手段と、前記繰返制御手段による繰り返し制御の終了後、前記演算結果値Ｒを、Ｓ'として保持手段に書き込む第２書込手段と、前記取得手段、前記演算手段に対して、それぞれ、前記指定情報の取得と、式４に基づくべき乗剰余演算とを行わせるよう制御する演算制御手段とを備えてもよい。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
A first writing means for overwriting the calculated value S calculated by the generating means over the calculated value S held in the holding means as the calculated value S; a For each branch on the path from one leaf to one node of the branch tree, in the order from the leaf to the node, the branch acquisition means, the prime number selection means, the generation means, and the first writing means On the other hand, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue computation based on Expression 5, and computed computation result value R Repetitive control means for controlling to repeat the writing to the storage means, and after completion of the repetitive control by the repetitive control means, the second write for writing the operation result value R to the holding means as S ′ Means, said acquisition means, and said performance You may provide the calculation control means which controls a calculation means to perform acquisition of the said designation | designated information, and the power-residue calculation based on Formula 4, respectively.

According to this configuration, it is possible to realize a modular exponentiation operation device that performs a modular exponentiation operation according to the hierarchy of the a-ary tree.
The power-residue computing device of the present invention is a computing device that performs a computation on the computation result S ′ by the power-residue computing device, the holding means for holding the S ′, and (2 ^a −2) (a Is a natural number of 2 or more)

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出手段と、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
Selection means for selecting the number of primes indicated by, and power-residue calculation over a finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記選出手段により選出された全素数の積）
を行う演算手段とを備えることを特徴とする。
この構成によれば、元になる数に対し素数の逆元によるべき乗剰余演算によって生成された被演算数から、前記元になる数を生成することができる。
本発明の記録媒体は、前記演算装置により配布された前記指示情報を記録する。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and Q is the product of all prime numbers selected by the selection means)
And an arithmetic means for performing the above.
According to this configuration, the original number can be generated from the operands generated by the power-residue operation by the inverse element of the prime number with respect to the original number.
The recording medium of the present invention records the instruction information distributed by the arithmetic device.

According to this configuration, the playback device can be invalidated based on the recorded information.
A key management apparatus according to the present invention is a key management apparatus that manages a key used for decrypting content in a playback apparatus, and includes the power residue calculation apparatus.
According to this configuration, it is possible to realize a key management device including a power residue calculation device that generates a device key used for content decryption.

A key management apparatus according to the present invention is a key management apparatus that manages a key used for decrypting content in a playback apparatus, and includes the power-residue calculating apparatus.
According to this configuration, it is possible to realize a key management device including a power residue calculation device that generates a decryption key.
A key management apparatus according to the present invention is a key management apparatus that manages a key used for decrypting content in a playback apparatus, and includes the power residue calculation apparatus.

According to this configuration, it is possible to realize a key management device including a power residue calculation device that generates key revocation data.
The playback device according to the present invention is a playback device that decodes and plays back content, and includes the power residue calculation device.
According to this configuration, it is possible to configure a playback device that includes a power residue calculation device that generates a decryption key from a device key and decrypts content encrypted using the decryption key.

The recording apparatus of the present invention is a recording apparatus for recording content, and includes the power residue calculation apparatus.
According to this configuration, it is possible to realize a recording apparatus that includes a modular multiplication apparatus that should generate a decryption key from a device key and encrypts content using the decryption key.
The power-residue calculation method according to the present invention is a power-residue calculation method by a modular-residue calculation device that includes a holding unit that holds an operand value S that is a natural number, a reading unit, a selection unit, and a calculation unit. From the reading step of reading the operand value S by the reading means and the selecting means from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出ステップと、前記演算手段により、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
And a power-residue operation on a finite field by the selecting means for selecting the number of primes indicated by

（Ｎは素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記選出手段により選出された全素数の積）
を行う演算ステップとを含む。
この構成によれば、選出手段が選出する素数により異なる、べき乗剰余演算結果を得ることができる。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
And a calculation step.
According to this configuration, it is possible to obtain a power residue calculation result that varies depending on the prime number selected by the selection means.

In particular, the power residue calculation apparatus is effective for a system that uses the power residue calculation result as a first key and generates a second key from the first key. An operation to be performed in the holding means by performing a power-residue operation on all the prime numbers excluding one prime number among the plurality of prime numbers used for the power-residue operation as a key of 1. A second key that is a number obtained by performing a power-residue operation on the inverse of the prime number of the 1 can be obtained, but from a power-residue operation result that is not a power-residue operation on the inverse of the prime number of the 1 Since obtaining the second key is difficult in terms of computational complexity, if the second key is used for encryption and decryption, depending on which one is selected as the prime number of 1, the power residue calculation result of 1 Control whether the second key can be generated Door can be.
The power-residue calculation method according to the present invention includes a holding unit that holds an operand value T that is a natural number, and a branches that are connected to any node of a branch tree (a is a natural number of 2 or more). For each of all the numbers from 1 to (a-1), combinations for selecting the number of branches are generated, and (2 ^a -2) corresponding combinations without overlapping any of the generated combinations A modular exponentiation method by a modular exponentiation unit that should consist of a prime number storage means for storing the prime numbers of, an effective prime number selection means, and a calculation means,
All the branches on the route from the root of the a-tree to any one of the leaves are invalidated by the effective prime number selection means, and (2 ^a -2) number of the prime numbers stored in the prime number storage means From the a number of branches connected to any one of the nodes, an effective prime number selection step of selecting a prime number corresponding to a combination including all the branches that are not invalidated;
A power residue calculation on a finite field by the calculation means

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記有効素数選出手段により選出された素数である）
を行う演算ステップとを含む。
この構成によれば、ａ分木のいずれかのノードに接続する有効な全枝に対応づけられた素数の逆元に係る演算結果を得ることができる。

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected by the effective prime number selection means)
And a calculation step.
According to this configuration, it is possible to obtain a calculation result related to the inverse element of the prime number associated with all valid branches connected to any node of the a-ary tree.

The calculation method according to the present invention is such that, for each of all numbers from 1 to (a-1) from a branch connected to any node of a tree (a is a natural number of 2 or more), A combination that selects the branches of the generated number, a prime number storage unit that stores the corresponding (2 ^a -2) prime numbers without overlapping any of the generated combinations, an invalid branch selection unit, An arithmetic method by an arithmetic unit comprising valid branch selection means and instruction information distribution means, wherein all branches on the path from the root of the a-tree to any leaf are invalidated by the invalid branch selection means. The invalid branch selection step of selecting (a-1) or less invalid branches out of a branches connected to one node, and the valid branch selection means connects to the node. Select one branch that has not been invalidated from the a branches All combinations including the selected non-invalidated branch and the invalidated branch among the prime numbers stored by the prime number storage unit by the instruction information distributing unit. Including an instruction information distribution step of distributing instruction information indicating a prime number corresponding to each of the reproduction information to the playback device.

According to this configuration, only the playback device corresponding to the valid branch can generate and distribute key revocation information for decrypting the content.
The power-residue calculation method according to the present invention includes one or more (a-1) from a holding unit that holds the operand S ′ that is a natural number and a branches connected to any node of the a-ary tree. For each of the following numbers, a combination that selects the branch of the number is generated, and the corresponding (2 ^a -2) prime numbers are stored without overlapping any of the generated combinations. A modular exponentiation operation method using a modular exponentiation apparatus that is composed of a prime number storage means, an acquisition means, and a calculation means, wherein one or more of the prime numbers stored in the prime number storage means by the acquisition means An acquisition step of acquiring specification information for specifying a prime number of the power, and a power-residue calculation on a finite field by the calculation means

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記指定情報により指定された素数全ての積）
を行う演算ステップとを含む。
この構成によれば、指定された１個以上の素数の積の逆元を用いたべき乗剰余演算結果を得ることができる。
本発明のべき乗剰余演算方法は、請求項２に記載のべき乗剰余演算装置による演算結果Ｓ'に対し演算を行う、前記Ｓ'を保持する保持手段と、選出手段と、演算手段とから成るべき乗剰余演算装置によるべき乗剰余演算方法であって、前記選出手段により、（２^a−２）個（ａは２以上の自然数）の相異なる素数から、

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is the product of all the prime numbers specified by the specification information)
And a calculation step.
According to this configuration, it is possible to obtain a power-residue calculation result using the inverse element of the product of one or more specified prime numbers.
The power-residue calculation method of the present invention is a power to be formed of a holding means for holding the S ′, a selection means, and a calculation means for performing an operation on the calculation result S ′ by the power-residue calculating device according to claim 2. A power-residue calculation method by a remainder calculation device, wherein the selection means (2 ^a -2) (a is a natural number of 2 or more) different prime numbers,

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出ステップと、前記演算手段により、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
And a power-residue operation on a finite field by the selecting means for selecting the number of primes indicated by

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記選出手段により選出された全素数の積）
を行う演算ステップとを含む。
この構成によれば、元になる数に対し素数の逆元によるべき乗剰余演算によって生成された被演算数から、前記元になる数を生成することができる。
本発明のプログラムは、自然数である被演算値Ｓを保持している保持手段と、読出手段と、選出手段と、演算手段とから成るべき乗剰余演算装置に適用されるプログラムであって、前記読出手段により、被演算値Ｓを読み出す読出ステップと、
前記選出手段により、（２^a−２）個（ａは２以上の自然数）の相異なる素数から、

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and Q is the product of all prime numbers selected by the selection means)
And a calculation step.
According to this configuration, the original number can be generated from the operands generated by the power-residue operation by the inverse element of the prime number with respect to the original number.
A program according to the present invention is a program applied to a modular exponentiation operation device that includes a holding unit that holds an operand value S that is a natural number, a reading unit, a selection unit, and a calculation unit, A reading step for reading the operand value S by means;
By the selecting means, from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

（ｍは変数であり、１から（ａ−１）までの自然数をとる）
で示される個数の素数を選出する選出ステップと、前記演算手段により、有限体上のべき乗剰余演算

(M is a variable and takes a natural number from 1 to (a-1))
And a power-residue operation on a finite field by the selecting means for selecting the number of primes indicated by

（Ｎは素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記選出手段により選出された全素数の積）
を行う演算ステップとの各ステップをコンピュータに実行させる。
この構成によれば、選出手段が選出する素数により異なる、べき乗剰余演算結果を得ることができる。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
The computer is caused to execute each step including the calculation step.
According to this configuration, it is possible to obtain a power residue calculation result that varies depending on the prime number selected by the selection means.

In particular, the power residue calculation apparatus is effective for a system that uses the power residue calculation result as a first key and generates a second key from the first key. An operation to be performed in the holding means by performing a power-residue operation on all the prime numbers excluding one prime number among the plurality of prime numbers used for the power-residue operation as a key of 1. A second key that is a number obtained by performing a power-residue operation on the inverse of the prime number of the 1 can be obtained, but from a power-residue operation result that is not a power-residue operation on the inverse of the prime number of the 1 Since obtaining the second key is difficult in terms of computational complexity, if the second key is used for encryption and decryption, depending on which one is selected as the prime number of 1, the power residue calculation result of 1 Control whether the second key can be generated Door can be.
The program according to the present invention includes one or more (a or more) branching units connected to any node of the a-tree (a is a natural number of 2 or more) and holding means that holds an operand value T that is a natural number. a-1) For each of all the following numbers, a combination for selecting the branch of the number is generated, and the corresponding (2 ^a -2) prime numbers without overlapping any of the generated combinations A program applied to a modular exponentiation computing device to be composed of stored prime number storage means, effective prime number selection means, and calculation means, wherein any leaf from the root of the a-ary tree is selected by the effective prime number selection means. All branches on the route to the path are invalidated, and from (2 ^a -2) prime numbers stored in the prime number storage means, out of a branches connected to any one of the nodes, Pairs containing all uninvalid branches An effective prime selection step of selecting a prime number, by the computing means, modular exponentiation operation over a finite field

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｐは、前記有効素数選出手段により選出された素数である）
を行う演算ステップとの各ステップをコンピュータに実行させる。
この構成によれば、ａ分木のいずれかのノードに接続する有効な全枝に対応づけられた素数の逆元に係る演算結果を得ることができる。
本発明のプログラムは、ａ分木（ａは２以上の自然数）のいずれかのノードに接続するａ個の枝から、１以上（ａ−１）以下の全ての数のそれぞれについて、当該数の枝を選択する組合せが生成され、生成された全組合せのいずれかに重複することなく対応する（２^a−２）個の素数を記憶している素数記憶手段と、無効枝選出手段と、有効枝選出手段と、指示情報配布手段とから成る演算装置に適用されるプログラムであって、前記無効枝選出手段により、ａ分木のルートからいずれかのリーフへの経路上の全枝は無効化されており、１のノードに接続するａ個の枝のうち（ａ−１）個以下の無効化された枝を選出する無効枝選出ステップと、
前記有効枝選出手段により、前記ノードに接続するａ個の前記枝から、無効化されていない１の枝を選出する有効枝選出ステップと、前記指示情報配布手段により、前記素数記憶手段が記憶する素数のうち、選択した前記無効化されていない枝と、前記無効化された枝の少なくとも１つとを含む全組合せのそれぞれに対応する素数を示す指示情報を再生装置へと配布する指示情報配布ステップとの各ステップをコンピュータに実行させる。

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected by the effective prime number selection means)
The computer is caused to execute each step including the calculation step.
According to this configuration, it is possible to obtain a calculation result related to the inverse element of the prime number associated with all valid branches connected to any node of the a-ary tree.
The program of the present invention calculates the number of all the numbers from 1 to (a-1) from a branch connected to any node of a branch tree (a is a natural number of 2 or more). A combination for selecting a branch is generated, and a prime number storage unit storing invalid (2 ^a -2) prime numbers corresponding to any of the generated combinations, an invalid branch selection unit, and a valid A program applied to an arithmetic unit comprising branch selection means and instruction information distribution means, wherein all branches on the route from the root of the a-tree to any leaf are invalidated by the invalid branch selection means. An invalid branch selection step of selecting (a-1) or less invalid branches out of a branches connected to one node;
The effective branch selection means selects one branch that has not been invalidated from the a branches connected to the node, and the instruction information distribution means stores the prime number storage means. Distributing instruction information indicating a prime number corresponding to each of all combinations including the selected non-invalidated branch and at least one of the invalidated branches among the prime numbers to the playback device And let the computer execute each step.

According to this configuration, only the playback device corresponding to the valid branch can generate and distribute key revocation information for decrypting the content.
The program according to the present invention includes all of one or more and (a-1) or less from the holding means that holds the operand S ′ that is a natural number and a branch connected to any node of the a-ary tree. For each of the numbers, a combination that selects the branch of the number is generated, and a prime number storage that stores the corresponding (2 ^a -2) prime numbers without overlapping any of the generated combinations Means for calculating a modular exponentiation apparatus to be comprised of a means, an acquisition means, and an arithmetic means, wherein the acquisition means designates one or more prime numbers among the prime numbers stored in the prime number storage means An acquisition step of acquiring designation information to be performed, and a power residue calculation on a finite field by the calculation means

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記指定情報により指定された素数全ての積）
を行う演算ステップとの各ステップをコンピュータに実行させる。
この構成によれば、指定された１個以上の素数の積の逆元を用いたべき乗剰余演算結果を得ることができる。
本発明のプログラムは、前記べき乗剰余演算装置による演算結果Ｓ'に対し演算を行う、前記Ｓ'を保持する保持手段と、選出手段と、演算手段とから成るべき乗剰余演算装置に適用されるプログラムであって、前記選出手段により、（２^a−２）個（ａは２以上の自然数）の相異なる素数から、

(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is the product of all the prime numbers specified by the specification information)
The computer is caused to execute each step including the calculation step.
According to this configuration, it is possible to obtain a power-residue calculation result using the inverse element of the product of one or more specified prime numbers.
The program of the present invention is a program applied to a modular exponentiation apparatus to be composed of holding means for holding S ′, selection means, and arithmetic means for performing computation on the computation result S ′ by the modular exponentiation arithmetic apparatus. From the different prime numbers (2 ^a -2) (a is a natural number of 2 or more) by the selection means,

(M is a variable and takes a natural number from 1 to (a-1))
And a power-residue operation on a finite field by the selecting means for selecting the number of primes indicated by

（Ｎは、素数ｐ及び素数ｑの積であり、素数ｐ、素数ｑはそれぞれ所定値より大きく、Ｑは、前記選出手段により選出された全素数の積）
を行う演算ステップとの各ステップをコンピュータに実行させる。
この構成によれば、元になる数に対し素数の逆元によるべき乗剰余演算によって生成された被演算数から、前記元になる数を生成することができる。

(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and Q is the product of all prime numbers selected by the selection means)
The computer is caused to execute each step including the calculation step.
According to this configuration, the original number can be generated from the operands generated by the power-residue operation by the inverse element of the prime number with respect to the original number.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
The copyright protection system of the present invention prevents the content that should be protected from copyright from being played normally by an unauthorized playback device that has become unable to protect the copyright of the content because the key has been exposed. This is a system for protecting the copyright of the content.
First, an outline of the configuration of a copyright protection system according to an embodiment of the present invention will be described.

FIG. 1 is a diagram showing an outline of the configuration of the copyright protection system.
As shown in FIG. 1, the copyright protection system includes a key management device 100, a recording device 110, a recording medium 120, and playback devices 130, 130a,.
The key management device 100 is a server connected to a network that is operated by a company that sells and manages the playback devices 130, 130a,... 130b, etc., and generates a unique device key for each playback device. The generated device key is also transmitted to the recording device 110.

The company also manufactures a recording medium 120 for recording content,
The key management device 100 decrypts the content encrypted for copyright protection by a specific playback device that has become unable to protect the copyright, such as the device key being exposed among the playback devices. The key revocation data, which is data for preventing the above, is recorded on the recording medium 120. When encrypted content is recorded on the recording medium 120 in which the key revocation data is written, the specific playback device cannot decrypt the encrypted content.

The recording device 110 encrypts the content whose copyright is to be protected, and records it on the recording medium 120 in which various information such as the key revocation data is written by the key management device 100.
When the recording medium 120 is inserted, the playback devices 130, 130a, 130b,... Perform predetermined processing using the information recorded on the recording medium 120 and the device key that is held. As a result, when the key for decrypting the content is successfully decrypted, the content is decrypted using the acquired key and reproduced.

In the present embodiment, the recording device and the playback device are configured separately, but the recording function of the recording device and the playback function of the playback device are combined to form a recording / playback device capable of recording and playing back content. May be.
For encryption and decryption of information in the copyright protection system, four types of device key, encryption key (and the same decryption key as the encryption key), media key, and content key are used.

As described above, the device key is a unique key for each playback device and recording device, and is generated by the key management device 100 and distributed to each playback device and recording device.
As described above, the decryption key is the same as the encryption key, is a key for encrypting the media key and decrypting the encrypted media key, and is generated by the key management apparatus 100. A valid playback device and recording device that has not been revoked can generate a decryption key by performing predetermined processing using the key revocation data and the device key.

The media key is a key for encrypting and decrypting the content key, held by the key management apparatus 100, encrypted by the key management apparatus 100 using the decryption key, and recorded on the recording medium 120. .
The content key is a key used for encrypting and decrypting content, and is held by the recording device 110. The content key is encrypted by the recording device 110 using the media key and recorded on the recording medium 120.

Next, the overall operation of the copyright protection system will be described.
FIG. 2 is a flowchart showing the overall operation of the copyright protection system.
2 are processing by the key management apparatus 100, S108 to S111 are processing by the recording apparatus 110, and S112 to S117 are processing by the reproducing apparatus 130.

The key management apparatus 100 generates a prime number table (S101).
The prime number table shows prime numbers that the key management apparatus 100 uses for generating a device key.
The key management device 100 generates a device key corresponding to each playback device using the prime table (S102), and distributes it to the corresponding playback device and recording device (S103).

The key management device 100 generates a decryption key (S104), and further generates key revocation data (S105).
The key revocation data includes information for causing only a playback device that has not been revoked to generate a decryption key. Further, the number of decryption keys generated in S104 varies depending on the number of playback devices to be invalidated.

The key management apparatus 100 encrypts the media key with the same encryption key as each decryption key generated in S104 (S106), and writes the key revocation data including the encrypted media key to the recording medium 120 (S107). .
The recording device 110 generates a decryption key using the device key acquired from the key management device 100 and the key revocation data recorded on the recording medium 120 (S108).

The recording device 110 extracts the encrypted media key from the key revocation data, decrypts it with the decryption key generated in S108, and obtains the media key (S109).
The recording device 110 holds the content and the content key, encrypts the content using the content key, records the content on the recording medium 120 (S110), and uses the media key generated in S109. The data is encrypted and recorded on the recording medium 120 (S111).

The playback device 130 attempts to generate a decryption key using the key revocation data read from the recording medium 120 (S112). If the playback device 130 is not invalidated, the decryption key is successfully generated.
The playback device 130 determines whether or not the generation of the decryption key is successful (S113), and if the generation of the decryption key fails (S113 = No), the processing is terminated.
When the generation of the decryption key is successful (S113 = Yes), the encrypted media key recorded on the recording medium 120 is decrypted with the generated decryption key (S114).

Using the media key decrypted in S114, the encrypted content key recorded in the recording medium 120 is decrypted (S115).
The playback device 130 decrypts the encrypted content recorded on the recording medium 120 using the content key generated in S115 (S116), and plays back the content (S117).
Next, each device constituting the copyright protection system will be described in detail.
<Key management device 100>
The key management device 100 generates a unique device key for each playback device and recording device, distributes the generated device key to the playback device and recording device corresponding to the device key, and generates key revocation data Then, write to the recording medium.

The key management device 100 manages a playback device group and a recording device including the playback devices 130, 130a,..., 130b using a tree structure. In the present embodiment, it is assumed that there are a total of 27 playback devices and recording devices managed by the key management device 100, and that the tree structure is a triple tree.
First, the tree structure will be described.

FIG. 3 is a diagram showing a tree structure of a triple tree for managing 27 devices.
In FIG. 3, N _{0 to} N ₃₃₃ indicate nodes, and lines (hereinafter referred to as paths) connecting the nodes have numbers 1, 2, and 3 (hereinafter referred to as path numbers) in order from the left as shown in the figure. .).
Each node is assigned a node ID representing a path from the root node N ₀ to the node in the tree structure.

N _{abc in} FIG. 3 indicates a node having a node ID “abc”, and the path number a, b path, and c path from the root node N ₀ to N _abc It shows that it goes through in the order of.
The tree structure is divided into four logical layers from layer 0 to layer 3 with layer 0 as the highest layer. A node having a node ID digit number L belongs to the layer L.

For example, as shown in FIG. 3, N ₁ belongs to layer 1 and N ₁₁ belongs to layer 2. N ₀ is a special node serving as a root and belongs to layer 0.
The node groups N _{111 to} N ₃₃₃ belonging to layer 3 which is the lowest hierarchy of the tree structure have device IDs equivalent to the node IDs, and the playback device 130, playback device 130a,... Playback device 130b, recording device. A device corresponding to 110 is associated.

  The 27 devices corresponding to the layer 3 nodes are hereinafter referred to as devices 1 to 27 as shown in FIG. Device keys K1 to K27 are distributed to the devices 1 to 27. For example, the key management apparatus 100 distributes K2 as a device key to the apparatus 2 whose apparatus ID is “112”, and distributes K20 as a device key to the apparatus 20 whose apparatus ID is “312”.

Next, details of the configuration of the key management apparatus 100 will be described.
FIG. 4 is a block diagram showing the configuration of the key management apparatus 100.
As shown in FIG. 4, the key management device 100 includes a prime number assignment unit 201, a random number generation unit 202, a key information storage unit 203, a device key generation unit 204, a revocation device specification unit 205, a key revocation data generation unit 206, A computer system including a transmission unit 207, a writing unit 208, and hardware including a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, a keyboard, a network adapter, etc. A computer program is stored in the ROM or the hard disk, and the key management apparatus 100 realizes its function by the CPU operating according to the computer program.

The prime number assignment unit 201 holds in advance the prime numbers p and q for calculating n, which is the RSA encryption method, necessary for generating the device key, and causes the key information storage unit 203 to hold it.
The RSA cipher described above is a cipher that uses a public key that is a prime number and a decryption key that is an inverse element of the public key modulo a composite number n that is a product of the prime numbers p and q. Is not computationally difficult to calculate the inverse element of a certain prime number.

  Here p, q, n as an example, p = FFFFFFFF EA2DE66E D3B1B7E9 61B75DFC D9FAE2FF A07A2345 9B7956FB 1B9B16D7 E1B6D59B BDF45B85 3CBF08EA 3BC7A1BD 541CB3A8 80E02E43 87CA7DEF 50948E87, q = FFFFFFFF E275B7F4 98A3811D E906ACF7 BFEB5CD6 A445AF09 D7906DE1 97CC2CCD 87614718 8C7C084F CE9231CA B7CFA113 13C3DDCF F1B70A54 84494467 8FCEF193, n = a pq = FFFFFFFF CCA39E63 6ED9CF52 950C23A0 38AE0291 012B984A 964FFBBD 99E9DACB 91400431 0C5DD264 B1873126 44A725C5 D5BC73F4 97CFD100 89FD1342 656026BE 3FB583FE B134FF43 6957A1E1 D975B5BE DF1A9570 4C81A337 F06E5F9F 9388A7AC 5ABFD5CF 0356D91A 9861C69F E50509C2 323E5270 F2015FBD C08AA2C0 391CEE85. However, the above-mentioned p, q, and n are expressed in hexadecimal.

Details of the RSA encryption are disclosed in “Introduction to Cryptography”, Eiji Okamoto, Kyoritsu Publishing Co., Ltd., and a description thereof is omitted here.
Further, the prime number assignment unit 201 causes the key information storage unit 203 to hold m prime numbers necessary for generating a device key.
m depends on the tree structure. When the tree structure is a-ary tree, m = 2 ^a -2, for example, in the example of FIG. 3, the tree structure is a tri-tree, so m = 2 ³ − 2 = 6.

m is the same as the number of combinations of pass numbers that can be selected except when all pass numbers are selected for pass numbers “1”, “2”... “a”. That means
m = _a C ₁ + _a C ₂ +... + _a C _(a-1)
It is.
For example, in the case of a ternary tree, except for the case of selecting all the path numbers for three path numbers “1”, “2”, and “3”, the combinations of path numbers that can be selected are (1) “1” ”Only, (2)“ 2 ”only, (3)“ 3 ”only, (4)“ 1 ”and“ 2 ”selected, (5)“ 1 ”and“ 3 ”selected, (6) There are six combinations of selecting “2” and “3”.

The prime number assignment unit 201 holds m or more prime numbers in advance, and assigns different prime numbers to each of the m combinations. A prime number corresponding to each combination is referred to as a generated prime number, and is described as P _x hereinafter. _{X in} the description of Px is a concatenation of the selected path numbers, and x is referred to as a selected path number.
For example, the selection path number corresponding to the above “(1)“ select only 1 ”” is “1”, the corresponding prime number is P ₁ , and “(4)“ 1 ”and“ 2 ” The selection path number corresponding to “select and” is “12”, and the corresponding prime number is P ₁₂ .

Next, generation of a prime table performed by the prime assignment unit 201 will be described.
FIG. 5 is a prime number table generated and held by the prime number assignment unit 201. FIG. 5A corresponds to the case where the tree structure is a tri-tree, and FIG. This corresponds to the case of a branch tree. 5A and 5B, each row of the prime number table includes a set of a selected pass number and a generated prime number.
For example, in FIG. 5A, the fourth row of the prime number table corresponds to the combination of the pass numbers “1” and “2” in the above (4), the selected pass number is 12, and the generated prime number Indicates P ₁₂ .

FIG. 6 is a flowchart showing processing for the prime allocation unit 201 to generate a prime table for the a-ary tree, and corresponds to S101 in FIG.
The prime number assignment unit 201 initializes variables k and l used for the calculation (S201).
The initial value 1 is substituted for k, and the initial value k-1 is substituted for l.
The prime number assignment unit 201 sets the pass number storage areas P (0) to P (a−1) used for the calculation to P (x) = (x + 1) (where 0 ≦ x ≦ (k−1)). (S202).

For example, P (0) = 1, P (1) = 2... P (k−1) = k.
Further, the prime number assignment unit 201 initializes the write destination pointer in the prime number table to point to the first row of the prime number table (S203).
The number obtained by concatenating P (0) to P (k−1) is written in the “selected pass number” of the writing destination pointed to by the pointer (S204).

A prime number is generated and written in the “generated prime number” of the writing destination pointed to by the pointer (S205).
It is determined whether P (k−1) +1 is larger than a (S206).
When it determines with it being small or equal (S206 = No), P (k-1) is incremented (S207).
The pointer is updated to indicate the next area (S208).

When it is determined that it is large (S206 = Yes), it is determined whether or not l−1 is 0 or more (S209).
When it is determined that it is 0 or more (S209 = Yes), it is determined whether P (l−k) + k is greater than a (S210).
When it is determined that they are smaller or equal (S210 = No), l is decremented (S211).

After incrementing the numerical value held in P (l), the process shown by P (l + x) = P (l) + x (where 1 ≦ x ≦ (k−1−l)) is performed, and the process proceeds to S208 (S212). ).
When it is determined that l-1 is less than 0 (S209 = No) or when it is determined that it is small in S210 (S210 = Yes), it is determined whether (k + 1) is greater than (a-1) (S213). ).

If it is determined in S213 that (k + 1) is less than (a-1) (S213 = NO), the process ends.
If it is determined in S213 that the value is large (S213 = YES), k is incremented and (k-1) is substituted for l (S214).
P (0) = 1, P (1) = 2,... P (k-1) = k (S215).

As described above, through S201 to S215, the prime number assignment unit 201 generates and holds the prime number table shown in FIG.
The random number generation unit 202 generates a random number (random number S) necessary for generating a device key and stores the random number in the key information storage unit 203.
The key information storage unit 203 holds the prime number generated by the prime number assignment unit 201 and the random number generated by the random number generation unit 202.

Further, it is assumed that the key information storage unit 203 holds a media key unique to each recording medium including the recording medium 120 in advance.
The device key generation unit 204 generates a device key corresponding to each of the devices 1 to 27 based on information held by the key information storage unit 203.
FIG. 7 is a flowchart showing a process in which the device key generation unit 204 generates a device key based on the tree structure that is the above-described tri-tree, and corresponds to S102 in FIG.

In FIG. 7, “ID (J)” indicates the J-th pass number from the lower digit of the device ID of the device key issuance destination device. For example, in the case of the device 20 whose device ID is “312”, ID (1) = 2, ID (2) = 1, and ID (3) = 3.
In addition, the power calculation shown below assumes that mod n calculation under modulus n is performed even if there is no description.

The device key generation unit 204 initializes each variable used for the calculation (S401).
The random number S stored in the key information storage unit 203 is substituted for the variable X, 0 is substituted for the variable J, and the number of digits of the device ID is substituted for the variable L.
In the example of the tree structure of FIG. 3, L = 3.
It is determined whether or not the value of ID (J) is 1 (S402). If it is 1, the process proceeds to S404, and if it is not 1, the process proceeds to S403.

It is determined whether or not the value of ID (J) is 2 (S403). If it is 2, the process proceeds to S405. If it is not 2, the process proceeds to S406.
Note that both steps S402 and S403 are steps for selecting a modular multiplication that should be executed in each of cases 1, 2, and 3 in which ID (J) corresponds to a tri-tree. If there is an ID (J) of 1, 2,..., (A-1), a, it is necessary to select a modular exponentiation to be executed. Therefore, a determination equivalent to S402 (or S403) is made. (A-1) steps to be performed are required.

An exponentiation remainder operation is performed on the inverse element of the prime numbers P ₁ , P ₁₂ , and P ₁₃ for the variable X, and the result is assigned to the variable X (S404).
The prime numbers that use the inverse element in the power-residue calculation in S404 are all prime numbers corresponding to ID (J) = 1 and including the value “1” in the selected path number of the prime table.
In the ternary tree, P ₁ , P ₁₂ , and P ₁₃ including the value “1” in the corresponding selection path number among the prime numbers described in FIG. 5A are used in the calculation of S404.

In the quadtree, P ₁ , P ₁₂ , P ₁₃ , P ₁₄ , P ₁₂₃ , P ₁₂₄ , P ₁₃₄ including the value “1” in the selected path number in FIG. 5B are used. .
Further, the inverse element of the prime number P _x is described as 1 / P _x .
An exponentiation remainder operation is performed on the inverse element of the prime numbers P ₂ , P ₁₂ , and P ₂₃ for the variable X, and the result is substituted into the variable X (S405).

The prime numbers that use the inverse element in the power-residue calculation in S405 are all prime numbers corresponding to ID (J) = 2 and including the value “2” in the selected path number of the prime table.
An exponentiation remainder operation is performed on the inverse element of the prime numbers P ₃ , P ₁₃ , and P ₂₃ for the variable X, and the result is substituted into the variable X (S406).
The prime numbers using the inverse element in the power-residue calculation in S406 are all prime numbers corresponding to ID (J) = 3 and including the value “3” in the selected pass number of the prime table.

  Note that each step of S404, S405, and S406 is a modular multiplication process to be executed in each of cases 1, 2, and 3 in which ID (J) corresponds to a tri-tree, and in the case of an a-tree, A residue calculation step to be executed is required when ID (J) is 1, 2,..., (A-1), a. That is, a power residue calculation execution step equivalent to S404 (or S405, S406) is required, and a prime number using an inverse element in power residue calculation is ID (J) = h (h: 1 ≦ h ≦ a). ) Corresponding to all prime numbers including the value “h” in the selected pass number of the prime table.

It is determined whether the variable J is larger than the variable L-2 (S407). If larger, the process proceeds to S410, and if not larger, the process proceeds to S408.
1 is added to the variable X, and the result is substituted into the variable X (S408).
1 is added to the variable J, and the result is substituted into the variable J (S409).
The calculated value of the variable X is substituted for Ki, and the device key Ki is issued to the device i (S410).

The process shown in the flowchart of FIG. 7 is repeated as many times as the number of devices for which a device key is to be generated.
Here, according to the flowchart shown in FIG. 7, for example, when calculating a device key for the apparatus 20, first, in S406, S ^ {1 / (P ₃ P ₁₃ P ₂₃ )} is calculated, and then S408. 1 is added. Next, X ^ {1 / (P ₁ P ₁₂ P ₁₃ )} is calculated for the addition result X in S404, and 1 is added again in S408. Finally, X ^ {1 / (P ₂ P ₁₂ P ₂₃ )} is calculated for the addition result X in S405.
With the above processing, the device key K20 issued to the device 20 is
K20 = ((S ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 1 P 12 P 13)) + 1) ^ (1 / (P 2 P 12 P 23))
It becomes.

Similarly, the device key K2 issued to the device 2 is
K2 = ((S ^ (1 / (P 1 P 12 P 13)) + 1) ^ (1 / (P 1 P 12 P 13)) + 1) ^ (1 / (P 2 P 12 P 23))
It becomes.
The invalidation device specifying unit 205 holds invalid device identification information indicating a device to be invalidated, which is input by an operator using a keyboard (not shown) provided in the key management device 100 or the like.

In this embodiment, after the device keys K1 to K27 are distributed to the devices 1 to 27, the device keys K1 and K26 corresponding to the devices 1 and 26 are exposed. The key management apparatus 100 generates key revocation data so that the content cannot be decrypted even if K1 and K26 are used.
FIG. 8 is a diagram schematically showing the relationship between the node that outputs the encryption key and the value of the encryption key when the devices 1 and 26 are invalidated in the tree structure.

When the device n is invalidated, an encryption key is generated for a node on the path from the node corresponding to the device n in the tree structure to N ₀ .
For example, in FIG. 8, when the device 1 is revoked, an encryption key for the nodes (N ₁₁ , N ₁ , N ₀ ) on the path from the device 1 to N ₀ is generated, and the device 26 is revoked. In this case, an encryption key for the nodes (N ₃₃ , N ₃ , N ₀ ) on the path from the device 26 to N ₀ is generated.

In the present embodiment, the encryption key generated to invalidate the device 1 and the device 26 is duplicated between the node on the route from the device 1 to N ₀ and the node on the route from the device 26 to N ₀ . There are five of Ke 1 to Ke 5 corresponding to N ₀ , N ₁ , N ₂ , N ₁₁ , and N ₂₂ excluding the node. Hereinafter, N ₁₁ , N ₁ , N ₀ , N ₃₃ , and N ₃ are referred to as invalidation nodes, respectively.
As a result of the input by the operator or the like, the invalidation device specifying unit 205 holds values “111” that is the device ID of the device 1 and “332” that is the device ID of the device 26 as the invalid device identification information. .

FIG. 9 is an invalid table based on the invalidation device identification information and the tree structure held by the invalidation device specifying unit 205.
In the invalid table, each row of the invalid table includes a node ID, an invalid flag, and a selected pass number. In the column indicating the node ID, node IDs of all nodes except the lowest layer in the tree structure are registered. The invalid flag indicates whether or not the node indicated by the node ID is invalid. A value “1” is registered when the node is invalid, and a value “0” is registered when the node is valid. The selected path number indicates a combination of valid path numbers while connected to the node, and each digit of the selected path number indicates a valid path number.

The key revocation data generation unit 206 generates a header portion of key revocation data to be recorded on the recording medium 120 from the information stored in the key information storage unit 203 and the revocation table.
FIG. 10 is a flowchart showing processing for generating a header part of key revocation data in the key revocation data generation unit 206, and corresponds to S105 in FIG.
The key revocation data includes one or more key revocation entries, and the key revocation entry includes a node ID, a selected pass number, and an encrypted media key. The node ID excluding the activation media key and the selected pass number are collectively referred to as a header portion of the key revocation data.

The key revocation data header generation processing by the key revocation data generation unit 206 will be described with reference to FIG.
The key revocation data generation unit 206 has a storage area for storing key revocation data to be generated.
The key revocation data generation unit 206 first initializes a variable E used for calculation with 1 (S451).

A pointer used for the calculation is set in the first key revocation entry storage area (S452).
The contents of the Eth row of the invalid table (hereinafter referred to as entry E) are acquired (S453).
For example, in the invalid table of FIG. 9, the node ID of entry E when E = 1 is “0”, the invalid flag is “1”, and the selected path number is “2”.
It is determined whether or not the invalid flag of the entry E acquired in S453 is “1” indicating invalid (S454).

When it is not “1” indicating invalidity (S454 = No), the process proceeds to S457.
When it is “1” indicating invalidity (S454 = Yes), the node ID of the entry E is written as the node ID in the invalidation information entry storage area of the area pointed to by the pointer, and the entry E is selected as the selected path number. The pass number is written (S455).
The key revocation data generation unit 206 sets the pointer to point to the next revocation information entry storage area (S456).

It is determined whether E + 1 is larger than the number of rows in the invalid table (S457).
If larger (S457 = Yes), the process is terminated.
If it is smaller or equal (S457 = No), E is incremented (S458).
FIG. 11 shows the data structure of key revocation data recorded on the recording medium.
FIG. 11A shows key revocation data when there is a revoked device, and FIG. 11B shows key revocation data when there is no revoked device.

Each column in FIG. 11 is “node ID”, “selected path number”, and “encrypted media key”.
Through S451 to S458, the key revocation data generation unit 206 generates a header portion composed of “node ID”, “selected path number”, and “encrypted media key” from the key revocation data shown in FIG. Will be written.
The “encrypted media key” is a media key encrypted with an encryption key that is the same key as the decryption key, and will be described later.

Next, encryption key generation processing by the key revocation data generation unit 206 will be described.
“Encryption key” and “decryption key” indicate the same key, and are used for both encryption and decryption of information.
FIGS. 12 to 14 are flowcharts showing the operation when generating the encryption key, which is the same key as the decryption key, and corresponds to S104 in FIG.

Here, the description “NID (J)” in FIG. 13 indicates the Jth pass number from the lower digit of the node ID. For example, when the node ID is 31, NID (1) = 1 and NID (2) = 3. In addition, the description of “root” and “root node” in the figure indicates N ₀ .
In the tree structure, the key revocation data generation unit 206 determines all nodes existing on the path connecting the device to be revoked identified by the revocation device identifying unit 205 and N ₀ as invalidation nodes, and stores them. (S501).

The key revocation data generation unit 206 starts from N ₀ of the tree structure stored in the key information storage unit 203 as a starting point, and removes each leaf from the upper layer to the lower layer, and from the left node to the right node in the same layer. A node is selected as a processing node (S502).
In S502, when the processing node can be selected, it is determined that the search of all the nodes is not completed, and when there is no node to be selected, it is determined that the processing is completed (S503). If not completed, the process proceeds to S504, and if completed, the process proceeds to S507.

It is determined whether or not the processing node selected in S502 is an invalidation node and at least one of the child nodes is not an invalidation node (S504). If the node is an invalidation node and there is a child node that is not an invalidation node, the process proceeds to S506. If the node is not an invalidation node, or all the child nodes are invalidation nodes, the process proceeds to S505.
Here, the child node is a node one layer below that is connected to the target node by a path. For example, N ₃ child nodes belonging to layer 1 are N ₃₁ , N ₃₂ , N belonging to layer 2. ₃₃ .

Since there is no need to generate an encryption key for the processing node, the next processing node is selected in the same manner as in S502 (S505).
It is determined whether or not the processing node is not the root (N ₀ ) (S506). If it is a route, the process proceeds to S601. If it is not a route, the process proceeds to S702.
The media key is individually encrypted with all the issued encryption keys Kei, and key revocation data is generated (S507).

In the present embodiment, when the devices 1 and 26 are invalidated, the generated encryption keys Ke1 to Ke5 have values shown in FIG.
The key revocation data generation unit 206 initializes each variable used for calculation. The random number S stored in the key information storage unit 203 is substituted into the variable X, the variable J is initialized with 0, and the variable L is set to the number of digits of the node ID (S601). In the example of FIG. 3, L = 2.

It is determined whether or not the value of NID (J) is 1 for the processing node (S602). If it is 1, the process proceeds to S604, and if it is not 1, the process proceeds to S603.
It is determined whether or not the value of NID (J) is 2 for the processing node (S603). If it is 2, the process proceeds to S605. If it is not 2, the process proceeds to S606.
Note that both steps S602 and S603 are steps for selecting a remainder operation to be executed in each of cases 1, 2, and 3 in which NID (J) corresponds to a tri-tree. If there is NID (J) 1, 2,..., (A-1), and a, it is necessary to select a remainder operation to be executed. Therefore, a determination equivalent to S602 (or S603) is made. (A-1) steps to be performed are required.

For the variable X, the inverse elements (1 / P ₁ , 1 / P ₁₂ , 1 / P ₁₃ ) of the prime numbers P ₁ , P ₁₂ , and P ₁₃ are subjected to exponentiation and the result is substituted into the variable X ( S604).
For the variable X, the inverse elements (1 / P ₂ , 1 / P ₁₂ , 1 / P ₂₃ ) of the prime numbers P ₂ , P ₁₂ , and P ₂₃ are exponentiated and the result is substituted into the variable X ( S605).
For the variable X, the inverse elements (1 / P ₃ , 1 / P ₁₃ , 1 / P ₂₃ ) of the prime numbers P ₃ , P ₁₃ , and P ₂₃ are exponentiated and the result is substituted into the variable X ( S606).

  Note that each step of S604, S605, and S606 is a modular multiplication process to be executed in each of cases 1, 2, and 3 in which NID (J) corresponds to a tri-tree. A remainder calculation step to be executed is required when NID (J) is 1, 2,..., (A-1), a. That is, a power residue calculation execution step equivalent to S604 (or S605, S606) is required, and a prime number that uses an inverse element in power residue calculation is NID (J) = h (h: 1 ≦ h ≦ a ) Corresponding to all prime numbers including the value “h” in the selected pass number of the prime table.

It is determined whether the variable J is larger than the variable L-2 (S607). If it is larger, the process proceeds to S701 in FIG. 14, and if it is not larger, the process proceeds to S608.
1 is added to the variable X, and the result is substituted into the variable X (S608).
1 is added to the variable J, and the result is substituted into the variable J (S609).
1 is added to the variable X, and the result is substituted into the variable X (S701).

It is checked whether or not the child node related to the processing node is an invalidation node (S702).
If only the child node connected to the processing node with the pass number 1 is an invalidation node, the inverse element (1 / P ₂₃ ) of the prime number P ₂₃ is subjected to a power-residue operation on the variable X, and the result is obtained as the variable X (S703). When only the child node connected to the node by pass number 2 is an invalidation node, the inverse element (1 / P ₁₃ ) of the prime number P ₁₃ is subjected to a power-residue operation on the variable X, and the result is obtained as the variable X Assign to. When only the child node connected to the node by the pass number 3 is an invalidation node, the inverse element (1 / P ₁₂ ) of the prime number P ₁₂ is exponentiated with respect to the variable X, and the result is obtained as the variable X Assign to. When the child node connected to the node by the path numbers 1 and 2 is an invalid node, the inverse of the prime number P ₃ (1 / P ₃ ) is calculated with respect to the variable X, and the result is calculated. Assign to variable X. If the child node connected to the node by the path numbers 1 and 3 is an invalid node, the inverse of the prime number P ₂ (1 / P ₂ ) is calculated with respect to the variable X, and the result is calculated. Assign to variable X. If the child node connected to the node by the path numbers 2 and 3 is an invalid node, the inverse of the prime number P ₁ (1 / P ₁ ) is calculated for the variable X and the result is calculated. Assign to variable X.

The calculated value of the variable X is substituted for Kei, and the encryption key Kei is output (S704).
The key revocation data generation unit 206 generates the encryption keys Ke1 to Ke5 by executing the processes of S501 to S704 described above, and the media held by the key information storage unit 203 using each of Ke1 to Ke5. The key Km is encrypted.
If there is no device to be invalidated, the key management device 100 encrypts the media key using the random number S stored in the key information storage unit 203 as the only encryption key. The key revocation data as shown in FIG. 11B is recorded.

The key revocation data generation unit 206 writes the key revocation data 121 to the recording medium 120 via the writing unit 208.
The recording medium 120 is a portable recording medium such as a DVD (Digital Versatile Disc), a CD (Compact Disc), and a BD (Blu-ray Disc).

FIG. 15 is a diagram schematically showing data recorded on the recording medium 120.
The key revocation data unit 121 records the key revocation data shown in FIG.
The content key encrypted by the recording device 110 is written in the encrypted content key portion 122, and the content encrypted by the recording device 110 using the content key is written in the encrypted content portion 123. .

The writing unit 208 records the encryption key generated by the key revocation data generation unit 206 on the recording medium 120.
<Recording device 110>
The recording device 110 encrypts the content to be protected by using the content key held in the device, records the content on the recording medium 120, and then obtains the device key obtained from the key management device 100 and the key invalidation. A media key is generated using the data, and the content key is encrypted with the media key and recorded on the recording medium 120.

FIG. 16 is a block diagram illustrating a configuration of the recording apparatus 110.
As illustrated in FIG. 16, the recording apparatus 110 includes a communication unit 1000, a device key storage unit 1001, a decryption key generation unit 1002, a decryption unit 1003, an encryption unit 1004, an encryption unit 1005, and an input / output Unit 1006 and a storage unit 1007, and a computer system including a CPU, a ROM, a RAM, a hard disk, a keyboard, a network adapter, etc. as hardware, and a computer program is stored in the ROM or the hard disk, The recording device 110 realizes its functions by the CPU operating according to the computer program.
Further, as described above, the recording device 110 is associated with a node belonging to layer 3 which is the lowest hierarchy of the tree structure, and a device ID is assigned in advance.

The communication unit 1000 includes a network adapter and its control unit, and communicates with the key management apparatus 100 via a network.
The device key storage unit 1001 includes a storage device such as a nonvolatile memory and its control unit, and stores the device key received by the communication unit 1000.
The decryption key generation unit 1002 reads the key revocation data 121 from the recording medium 120 via the input / output unit 1006, and uses the key revocation data 121 and the device key held by the device key storage unit 1001 to generate a decryption key. calculate.

Here, it is assumed that the decryption key generation unit 1002 holds in advance six prime numbers P ₁ , P ₂ , P ₃ , P ₁₂ , P ₁₃ , and P ₂₃ necessary for generating a device key.
Hereinafter, a process in which the decryption key generation unit 1002 calculates a decryption key will be described.
17 and 18 are flowcharts showing processing for generating a decryption key.
The decryption key generation unit 1002 reads out the first key revocation entry of the key revocation data recorded on the recording medium 120 via the input / output unit 1006 as a processing field (S1201).

The decryption key generation unit 1002 determines whether a processing field exists (S1202). That is, if all the fields of the key revocation data are read and there are no processing fields, all the fields are checked, and if there are processing fields, it is determined that all the fields are not checked.
If all the fields have been checked (S1202 = NO), this apparatus indicates that it has been invalidated, and the process ends.

If all the fields have not been checked (S1202 = YES), it is determined whether the node ID described in the processing field matches the number of digits of the node ID from the top of the device ID. (S1203). However, when the node ID described in the processing field is “0”, it is determined that they match.
When it is determined that they do not match (S1203 = NO), the decryption key generation unit 1002 reads the key revocation entry next to the key revocation entry read last time as a processing field (S1205).

When it is determined that they match (S1203 = YES), in the tree structure, the node indicating the corresponding device (belonging to layer 3) is the path described in the processing field from the node indicated by the node ID described in the processing field. It is determined whether or not the node arrives via a path indicated by a number (hereinafter referred to as a descendant node) (S1204).
If it is not a descendant node (S1204 = NO), the process proceeds to S1205.

If it is a descendant node (S1204 = YES), the decryption key generation unit 1002 receives the encrypted media key corresponding to the processing field of the key revocation data recorded in the recording medium 120 via the input / output unit 1006. It reads out as a process encryption media key (S1206).
The decryption key generation unit 1002 initializes each variable used for calculation. The device key Ki is substituted into the variable X, and the number of digits of the device ID is substituted into the variable J (S1301).

  The decryption key generation unit 1002 determines whether the path indicated by the ID (J) is directly connected to the node indicated by the node ID described in the processing field (S1302). In FIG. 18, “ID (J)” indicates the J-th pass number from the lower digit of the device ID. For example, in the case of the device 20 whose device ID is “312”, ID (1) = 2, ID (2) = 1, and ID (3) = 3.

If not connected (S1302 = NO), the product Px of the prime number corresponding to ID (J) is exponentiated with respect to the variable X, and the result is substituted into the variable X (S1303).
However, the prime Px corresponding to ID (J) is Px = P ₁ P ₁₂ P ₁₃ when ID (J) = 1, and Px = P ₂ P ₁₂ P when ID (J) = 2. ₂₃ , ID (J) = 3, Px = P ₃ P ₁₃ P ₂₃ .

Next, 1 is added to the variable X, and the result is substituted into the variable X, and 1 is subtracted from the variable J, and the result is substituted into the variable J (S1304).
If they are connected (S1302 = YES), a power residue operation is performed on the variable X by removing the prime Py indicated by the processing field from the product Px of the primes corresponding to ID (J), and the result Is substituted into the variable X (S1305).

The y in the aforementioned Py indicates the selected path number of the processing field. For example, if the selected path number is “12”, Py is P ₁₂ , and if ID (J) = 1, Px = P ₁ P ₁₂ Of P ₁₃ , P ₁ P ₁₃ excluding P ₁₂ that is Py is subjected to exponentiation and the result is substituted into variable X.
Here, the description of “Px / Py” in the figure means that P ₁ P ₁₃ is calculated without using P _{12 as} described above, and Px = P ₁ P ₁₂ P ₁₃ It does not mean that 1 / P ₁₂ that is the inverse element of P ₁₂ that is Py is multiplied.

The calculated value of the variable X is substituted for Kdi, and the decryption key Kdi is output (S1306).
The decryption key generation unit 1002 obtains the media key by decrypting the encrypted media key extracted in S1206 with the decryption key Kdi obtained in S1306 (S1307).
Through the above steps, each device that has not been revoked can obtain the decryption key from the device key held by itself, and can decrypt the media key using the obtained decryption key. On the other hand, since no decryption key can be obtained with the device key held by the revoked device, the media key cannot be decrypted.

The encryption unit 1004 encrypts the content key stored in the storage unit 1007 using the media key decrypted by the decryption unit 1003, and stores it in the encrypted content key storage unit 1012 via the input / output unit 1006. To do.
The encryption unit 1005 encrypts the content stored in the storage unit 1007 using the content key stored in the storage unit 1007, and writes the encrypted content in the encrypted content storage unit 1013 via the input / output unit 1006.

The input / output unit 1006 writes data to the recording medium 120 and reads data from the recording medium 120.
The storage unit 1007 stores in advance a content whose copyright is to be protected and a content key for encrypting the content.
<Reproducing apparatus 130>
The playback device 130 holds the device key distributed by the key management device 100, reads the key revocation data from the recording medium 120, acquires the media key using the device key and the key revocation data, The encrypted content key is read from the recording medium 120, the encrypted content key is decrypted with the media key, the encrypted content is read, decrypted with the content key, and the decrypted content is reproduced.

FIG. 19 is a block diagram showing the configuration of the playback device 130.
As illustrated in FIG. 19, the playback device 130 includes a communication unit 1100, a device key storage unit 1101, a decryption key generation unit 1102, a decryption unit 1103, a decryption unit 1104, a decryption unit 1105, and an input / output unit 1106. And a playback unit 1107. As a hardware, a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, a network adapter, a transport decoder, a front end, etc. A recording / playback device such as a recorder, and the ROM or the hard disk stores a computer program, and the playback device 130 realizes its function by the CPU operating according to the computer program. .

The communication unit 1100 includes a network adapter and its control unit, and communicates with the key management apparatus 100 via the network.
The device key storage unit 1101 includes a recording device such as a nonvolatile memory and its control unit, and stores the device key when the communication unit 1100 acquires a device key issued from the key management device 100.

The device key may be written in the ROM in advance.
The decryption key generation unit 1102 reads the key revocation data 121 from the recording medium 120 via the input / output unit 1106, and uses the key revocation data 121 and the device key held by the device key storage unit 1101 to generate a decryption key. calculate.
The decryption key generation unit 1102 holds six prime numbers P ₁ , P ₂ , P ₃ , P ₁₂ , P ₁₃ , and P ₂₃ necessary for generating a device key in advance, and the decryption key generation unit 1002 Similarly, the decryption key is calculated according to the flowcharts shown in FIGS.

17 and 18 described above, the decryption key generation unit 1102 performs decryption by replacing the input / output unit 1006 with the input / output unit 1106 and replacing the decryption key generation unit 1002 with the decryption key generation unit 1102. Explain the key generation process.
Here, for example, with respect to the tree structure shown in FIG. 3, in order for the device 1 to obtain the decryption key Kd4 from the device key K1, P ₁ P ₁₂ P ₁₃ is exponentiated with respect to the device key K1, and Furthermore it shall modular exponentiation operation the inverse element of _{P 23 (1 / P 23)} . However, Law n (n: n = p × q) relating to prime numbers p, q is a value of a secret only key management apparatus 100 to know, because each device does not know its value, from prime P _23, and vice versa obtaining the original 1 / P ₂₃ is calculated is quantitatively difficult.

Therefore, the revoked device 1 cannot obtain the decryption key Kd4 from the device key K1 held by itself.
For the same reason, the device 1 cannot obtain any of the decryption keys Kd1 to Kd3 and Kd5, and the device 26 cannot obtain any of the decryption keys Kd1 to Kd5. It is possible to prevent copyright infringement of content by an unauthorized device.

The decryption unit 1103 reads the encrypted media key from the recording medium 120 via the input / output unit 1106, decrypts the encrypted media key using the decryption key generated by the decryption key generation unit 1102, and obtains the media key. get.
The decrypting unit 1104 decrypts the encrypted content key read from the recording medium 120 using the media key decrypted by the decrypting unit 1103 to obtain a content key.

The decrypting unit 1105 reads the encrypted content from the recording medium 120, decrypts the encrypted content using the content key, and obtains the content.
The input / output unit 1106 inputs / outputs information to / from the recording medium 120.
The playback unit 1107 plays back the content obtained by the decryption unit 1105.
<Operation>
The overall operation of the copyright protection system when the key management apparatus 100 manages 27 devices using a tri-tree will be described.

In the key management apparatus 100, the prime number assignment unit 201 uses the tri-tree having the tree structure shown in FIG. 3, and therefore generates and holds the prime number table shown in FIG. 5A according to the flowchart shown in FIG. The 2 ³ −2 = 6 prime numbers P ₁ , P ₂ , P ₃ , P ₁₂ , P ₁₃ , and P ₂₃ generated in the generation process of the prime table are distributed to the recording device 110 and the playback device 130 in advance. . Here, it is assumed that the playback device 130 is the device 26 in the tree structure shown in FIG.

Next, the device key generation unit 204 uses P1 to P23 generated by the prime number allocation unit 201 and held in the key information storage unit 203, and the random number S generated by the random number generation unit 202, as shown in FIG. A device key for each playback device is generated according to the flowchart.
Here, the device key K26 for the device 26 is
K26 = ((S ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 2 P 12 P 23))
It is.

The generated device key K26 is distributed to the playback device 130, which is a device corresponding to K26, via the transmission unit 207.
In the playback device 130, the communication unit 1100 receives K26, and the device key storage unit 1101 holds K26.
Next, the operation until the content is played back by the playback device is performed when there is no disabled device, when the disabled device does not include the device 26, and when the disabled device includes the device 26. It will be described separately when it is included.
<When there is no disabled device>
In the key management device 100, when there is no revoked device, the key revocation data generation unit 206 generates the key revocation data shown in FIG. The inserting unit 208 records the invalidation data on the recording medium 120.

The recording medium 120 on which the key revocation data is recorded is transferred to the recording device 110.
Next, the recording device 110 uses the key revocation data recorded on the recording medium 120 and the device key for the device that has not been revoked, here K26, and uses the decryption key S according to the flowcharts of FIGS. Generate.
The recording device 110 uses the decryption key S to decrypt the encrypted media key recorded in the key revocation data to obtain a media key.

The recording device 110 encrypts the content stored in the storage unit 1007 using the content key stored in the storage unit 1007, records the content in the encrypted content unit 123 of the recording medium 120, and uses the media key. The content key is encrypted and recorded in the encrypted content key unit 122.
The recording medium 120 is distributed, such as sold, and is handed over to the owner of the playback device 130, and playback processing is performed by the playback device 130.

In the playback device 130, the decryption key generation unit 1102 uses the key revocation data 121 to generate the decryption key S from the device key K26 according to the flowcharts shown in FIGS.
The decryption unit 1103 decrypts the encrypted media key recorded in the key revocation data using the decryption key S, and acquires the media key. The decrypting unit 1104 decrypts the encrypted content key recorded on the recording medium 120 using the media key to generate a content key. The decrypting unit 1105 decrypts the encrypted content recorded on the recording medium 120 using the content key to generate content. The playback unit 1107 plays back the content.
<When Playback Device 130 is a Device 27 Not Invalidated>
In the key management apparatus 100, when the revoked devices are the devices 1 and 26, the key revocation data generation unit 206 generates the key revocation data shown in FIG. 11A according to the flowchart of FIG. To be recorded on the recording medium 120.

The recording medium 120 on which the key revocation data is recorded is transferred to the recording device 110.
Next, the recording device 110 uses the key revocation data recorded on the recording medium 120 and the device key for the device that has not been revoked, here K26, and uses the decryption key Ke5 according to the flowcharts of FIGS. Generate.
The recording device 110 uses the decryption key Ke5 to decrypt the encrypted media key recorded in the key revocation data to obtain a media key.

The recording device 110 encrypts the content stored in the storage unit 1007 using the content key stored in the storage unit 1007, records the content in the encrypted content unit 123 of the recording medium 120, and uses the media key. The content key is encrypted and recorded in the encrypted content key unit 122.
The recording medium 120 is distributed for sale, etc., and is handed over to the owner of the playback device 130 to be played back by the playback device 130.

Here, it is assumed that the playback device 130 is the device 27 that is not disabled.
In the playback device 130, the decryption key generation unit 1102 uses the key revocation data 121 to generate the decryption key Ke5 from the device key K27 according to the flowcharts shown in FIGS.
K27 is
K27 = ((S ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 3 P 13 P 23))
It is.

  According to the tree structure of FIG. 3, the device ID of the device 27 is “333”, and if the first to fourth lines of the key revocation data are processing fields in step S1203 of FIG. 17, the determination is No. In step S1205, when the entry in the fifth line of the key revocation data is a processing field, the node ID “33” matches the upper two digits “33” of the device ID “333”. Thus, the determination is yes, and the process proceeds to S1204.

In S1204, the selected path number in the fifth line of the key revocation data is “13”, and the device 27 is connected to N33 through the path with path number 3 in the tree structure. , The process proceeds to S1206.
In S1206, the decryption key generation unit 1102 extracts E (Ke5, Km), which is the corresponding encrypted media key.

In S1301, K27 is substituted for X, and 3 is substituted for J.
In S1302, since the path “3” indicated by the ID (3) corresponds to “3” of “13” which is the selected path number, it is determined as Yes.
In S1305, among the P _3, P _13, P _23, except for the P ₁₃ shown by 13 is a selection path number, the respective inverse of P _3, P _23, to K27, to modular exponentiation.

_{(K27) ^ (P 3 P} 23) = ((S ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P 3 P 13 P 23)) + 1) ^ (1 / (P ₁₃ )) = Ke5
Thus, the decryption key generation unit 1102 has been able to generate Ke5.
Next, the decryption unit 1103 decrypts the encrypted media key recorded in the key revocation data using the decryption key Ke5, and obtains the media key.

The decrypting unit 1104 decrypts the encrypted content key recorded on the recording medium 120 using the media key to generate a content key.
The decrypting unit 1105 decrypts the encrypted content recorded on the recording medium 120 using the content key to generate content.
The playback unit 1107 plays back the content.
<When the playback device 130 is the disabled device 26>
In the key management apparatus 100, when the revoked devices are the devices 1 and 26, the key revocation data generation unit 206 generates the key revocation data shown in FIG. 11A according to the flowchart of FIG. To be recorded on the recording medium 120.

The recording medium 120 on which the key revocation data is recorded is transferred to the recording device 110.
Next, the recording device 110 uses the key revocation data recorded on the recording medium 120 and the device key for the device that has not been revoked, here K27 that is not K26, and uses the decryption key according to the flowcharts of FIGS. Ke5 is generated.
The recording device 110 uses the decryption key Ke5 to decrypt the encrypted media key recorded in the key revocation data to obtain a media key.

The recording device 110 encrypts the content stored in the storage unit 1007 using the content key stored in the storage unit 1007, records the content in the encrypted content unit 123 of the recording medium 120, and uses the media key. The content key is encrypted and recorded in the encrypted content key unit 122.
The recording medium 120 is distributed for sale, etc., and is handed over to the owner of the playback device 130 to be played back by the playback device 130.

Here, it is assumed that the playback device 130 is the device 26 that is a disabled device.
In the playback device 130, the decryption key generation unit 1102 uses the key revocation data 121 and tries to generate the decryption key Ke5 from the device key K26 according to the flowcharts shown in FIGS.
However, according to the tree structure of FIG. 3, the device ID of the device 26 is “332”, and if the first to fourth lines of the key revocation data are processing fields in step S1203 of FIG. No, and the processing proceeds to S1205. However, when the entry in the fifth line of the key revocation data is a processing field, the node ID “33” is changed to “33” which is the upper two digits of the device ID “332”. Since they match, the determination is yes, and the process proceeds to S1204.

In S1204, the selection path number in the fifth line of the key revocation data is “13”, and the device 26 is connected to N33 through the path with path number 2 in the tree structure. , It is determined not to be included in the offspring, and the process proceeds to S1205.
The decryption key generation unit 1102 determines that there is no field to be read in S1205, and that all the fields have been checked in S1202 (S1202 = Yes), and ends the process. Therefore, Ke1 as well as Ke5 other than Ke5 are determined. None of the decryption keys for Ke4 can be generated.

In addition, when trying to generate Ke5 in an unfair manner, it is necessary to calculate the inverse element of P ₁₃ by calculation, but only knows the law n and does not know p and q for generating n. it is computationally difficult to calculate the inverse of P _13.
Moreover, it is difficult to generate any of Ke1 to Ke4 for the same reason as when attempting to generate Ke5.

Therefore, it is difficult to generate a media key, a content key, and the like, and the content cannot be reproduced in the device 26.
<Other variations>
(1) In the present invention, the recording medium is a recordable medium such as a DVD-RAM. However, the present invention is not limited to this structure. For example, the recording medium may be a pre-recorded medium such as DVD-Video, and each playback device may have a device key and play content recorded on the recording medium. Further, in this case, the writing device to the recording medium does not need to hold the device key, and the configuration may be such that the media key is directly received from the key management device, and the content is encrypted and written based on the media key.

  (2) In the present invention, as a mechanism for encrypting content, the content key is encrypted with the media key and the content is encrypted with the content key. However, the present invention is not limited to this configuration. . For example, the content may be directly encrypted with the media key to reduce the key hierarchy by one. Conversely, the disc key is introduced, the disc key is encrypted with the media key, the content key is encrypted with the disc key, The content may be encrypted with the content key to increase the key hierarchy by one. Alternatively, the key may be modulated by adding different information separately in the middle of the key hierarchy.

  (3) In the present invention, the key revocation data and the encrypted content are recorded on the same recording medium. However, the present invention is not limited to this structure. For example, the recording medium for recording the key revocation data and the recording medium for recording the encrypted content may be distributed and distributed. In that case, the recording device or the playback device first inserts the recording medium in which the key revocation data is recorded to calculate the media key, and then inserts another recording medium to record or play back the content. It becomes the composition which performs.

(4) In the present invention, the key invalidation data and the encrypted content are recorded and distributed on the recording medium, but the present invention is not limited to the configuration. For example, it may be configured to distribute using communication media such as broadcasting or the Internet.
(5) In the present invention, the key management device is configured as a ternary tree for managing a key or each device, but the present invention is not limited to this configuration. For example, the tree structure may be a binary tree or a quadtree. In the case of a binary tree, there are two prime numbers used for device key generation and the like, and in the case of a quadtree, there are 14 prime numbers.

  (6) In the present invention, in the device key generation step in the key management apparatus, 1 is added after performing power-residue calculation for each layer. However, the present invention is not limited to this configuration. . For example, the value to be added may be 2, and the operation and the value to be calculated are not limited as long as the operation is a reversible operation such as subtraction, multiplication, division, and XOR operation.

  (7) In the present invention, when the recording device encrypts the media key, the media key is directly encrypted with the encryption key calculated from the device key. However, the present invention is not limited to this configuration. Absent. For example, the configuration may be such that an encryption key is input to a compression function such as SHA-1 and each media key is encrypted with its output value or a part thereof. In this case, similarly in the reproduction apparatus, the calculated decryption key is input to the compression function, and the media key is decrypted with the output value or a part thereof. Alternatively, the block key having a shorter size than the encryption key may be encrypted with the calculated encryption key, and each media key may be encrypted with the block key. In this case, the playback device first decrypts the block key with the calculated decryption key and then decrypts the media key.

(8) In the present invention, a common prime number is used in each layer and each node, but the present invention is not limited to the configuration. For example, the configuration may be such that the set of prime numbers used for each layer is changed, or the set of prime numbers used for each node is changed.
(9) In the embodiment of the present invention, an example of a tree structure of a triple tree has been described in which six prime numbers are used. In the present invention, the six prime numbers are not particularly limited, and for the purpose of reducing the amount of calculation, it is possible to select six small prime numbers. Specifically, the six prime numbers may be three, 5, 5, 11, 11, 13, 17 in ascending order.

(10) In the present invention, a form in which prime numbers are generated and held in advance has been shown, but the present invention is not limited to this configuration. For example, the configuration may be such that only the rules for generating prime numbers are determined in advance, and the calculation is executed after generating the prime numbers each time.
(11) Specifically, each device is a computer system including a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or the hard disk unit. Each device achieves its function by the microprocessor operating according to the computer program.

(12) The present invention may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.
The present invention also provides a computer-readable recording medium such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc). ), Recorded in a semiconductor memory or the like. Further, the present invention may be the computer program or the digital signal recorded on these recording media.

In the present invention, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network represented by the Internet, or the like.
The present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program.

In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, and is executed by another independent computer system. It is good.
(13) The above embodiment and the above modifications may be combined.

  The copyright protection system of the present invention is used as a basic technology of a system comprising a distribution system that encrypts and distributes content that requires copyright protection, and a playback device that decrypts and plays back the encrypted content. The distribution system and the playback device are produced by a manufacturer such as a digital home appliance that plays back digital content.

It is a figure which shows the outline of a structure of the copyright protection system of this invention. It is a flowchart which shows the operation | movement of the copyright protection system whole of this invention. It is a figure which shows the tree structure which is a triple tree for managing 27 apparatuses. It is a block diagram which shows the structure of the key management apparatus of this invention. It is a figure which shows the prime table which a prime number allocation part produces | generates and hold | maintains. It is a flowchart which shows the process for a prime number allocation part to produce | generate a prime table about a branch tree. It is a flowchart which shows the process which a device key production | generation part produces | generates a device key based on the tree structure which is a triple tree. In a tree structure, it is a figure which shows typically the relationship between the node which outputs the encryption key in the case of invalidating an apparatus, and the value of an encryption key. It is a figure which shows the invalid table based on the invalidation apparatus identification information and tree structure which an invalidation apparatus specific | specification part hold | maintains. It is a flowchart which shows the process for producing | generating the header part of key revocation data in a key revocation data production | generation part. It is a figure which shows the data structure of the key revocation data recorded on a recording medium. It is a flowchart which shows the operation | movement at the time of producing | generating an encryption key. It is a flowchart which shows the operation | movement at the time of producing | generating an encryption key. It is a flowchart which shows the operation | movement at the time of producing | generating an encryption key. It is a figure which shows typically the data recorded on a recording medium. 1 is a block diagram illustrating a configuration of a recording apparatus of the present invention. It is a flowchart showing the process which produces | generates a decryption key. It is a flowchart showing the process which produces | generates a decryption key. It is a block diagram which shows the structure of a reproducing | regenerating apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Key management apparatus 110 Recording apparatus 120 Recording medium 121 Key invalidation data part 122 Encrypted content key part 123 Encrypted content part 130 Playback apparatus

Claims (20)

Holding means for holding the operand value S, which is a natural number;
Reading means for reading the operand value S;
From (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection means for selecting the number of primes indicated by
Power-residue operation on a finite field S ′ = S ^{1 / P} mod N (Formula 1)
(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected by the selection means)
Calculating means for performing performs reversible operation on the operation result value S 'calculated by said calculating means, and the reversible arithmetic means for obtaining a reversible operation result value,
Writing means for overwriting the operand value S held in the holding means with the operand value S calculated by the lossless operator as the operand value S;
The power remainder is controlled to repeat selection by the selection means, power residue calculation by the calculation means, reversible calculation by the reversible calculation means, and overwriting of the reversible calculation result value by the writing means to the holding means. Arithmetic unit. The selection means is:
Combinations for selecting the number of branches are generated for each of all the numbers from 1 to (a-1) from a branches connected to any node of the a branch tree, and all the generated combinations Prime number storage means for storing (2 ^a -2) prime numbers corresponding to any one of
branch acquisition means for acquiring branch designation information for designating one of the a branches;
A prime number selecting means for selecting all prime numbers corresponding to combinations including a branch designated by the branch designation information from the (2 ^a -2) prime numbers stored in the prime number storage means. The power-residue calculating device according to claim 1 . The power-residue computing device is :
For each branch on the path from the root of the a-tree to one leaf, in the order from the root to the leaf, the branch acquisition means, the prime number selection means, the calculation means, the reversible calculation means, and the writing means On the other hand, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Equation 1, and calculation result value S ′ The exponentiation remainder calculation apparatus according to claim 2 , further comprising: a repetitive control unit that performs control so as to repeat reversible calculation and rewriting of the reversible calculation result value to the holding unit. The exponentiation remainder calculation apparatus according to claim 1 , wherein the reversible calculation means obtains a reversible calculation result value by adding a constant to the calculation result value S 'calculated by the calculation means. For each of all numbers of 1 to (a-1) or less from a branches connected to any node of a branch tree (a is a natural number of 2 or more), there is a combination for selecting the number of branches. Prime number storage means for storing (2 ^a -2) prime numbers corresponding to each of the generated combinations without overlapping any of the generated combinations;
All branches on the route from the root of the a-tree to any leaf are invalidated, and any one of the nodes from the (2 ^a -2) prime numbers stored in the prime number storage means. Effective prime number selection means for selecting a prime number corresponding to a combination including all branches that are not invalidated among a branches connected to
Holding means for holding the operand value T;
Power residue calculation on a finite field T ^{1 / P} mod N (Formula 2)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected by the effective prime number selection means) ;
Storage means for storing an operand value S that is a natural number;
Reading means for reading the operand value S;
branch acquisition means for acquiring branch designation information for designating one of the a branches;
A prime number selection means for selecting all prime numbers corresponding to combinations including branches specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means ;
Power-residue operation over a finite field
S ′ = S ^{1 / Q} mod N (Formula 3)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all prime numbers selected by the prime number selection means)
Generating means for performing
First writing means for performing a reversible operation on the operation result value S ′ calculated by the generating means and overwriting the operation value S stored in the storage means as the operation value S;
For each branch on the path from the root of the a-tree to one node, in order from the root to the node, the branch acquisition means, the prime number selection means, the generation means, and the first writing means Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 3, and calculation result value S ′ Repetitive control means for controlling to repeat reversible calculation and rewriting of the reversible calculation result,
The result value S ′ obtained by the repetitive control by the repetitive control means is invalidated for the second writing means for writing to the holding means as T, the effective prime number selecting means, and the calculating means, respectively. A power-residue calculating apparatus comprising: arithmetic control means for controlling to select a prime number corresponding to a combination including all the branches that are not included and to perform a power-residue calculation based on Equation 2 . Combinations for selecting the number of branches are generated for each of all the numbers from 1 to (a-1) from a branches connected to any node of the a branch tree, and all the generated combinations Prime number storage means for storing (2 ^a -2) prime numbers corresponding to any one of
Obtaining means for obtaining designation information for designating one or more prime numbers among the prime numbers stored in the prime number storage means;
Holding means for holding the operand value S ′;
Power-residue operation on a finite field (S ′) ^Q mod N (Formula 4)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers designated by the designation information) ;
Storage means for storing an operand value S that is a natural number;
Reading means for reading the operand value S;
branch acquisition means for acquiring branch designation information for designating one of the a branches;
Prime number selection means for selecting all prime numbers corresponding to combinations including branches specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means ;
Power-residue operation over a finite field
R = S ^P mod N (Equation 5)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a product of all prime numbers selected by the prime number selection means);
First writing means for performing a reversible operation on the operation result value R calculated by the generating means and overwriting the operation value S stored in the storage means as the operation value S;
For each branch on the path from one leaf to one node of the a-branch tree, the branch acquisition unit, the prime number selection unit, the generation unit, and the first writing unit in the order from the leaf to the node Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 5, and calculated calculation result value Repetitive control means for controlling to repeat reversible computation on R and rewriting of reversible computation results;
A second writing means for writing the result value R obtained by repetitive control by the repetitive control means to the holding means as S ′;
Calculation control means for controlling the acquisition means and the calculation means to perform the acquisition of the specified information and the power-residue calculation based on Expression 4;
A modular exponentiation apparatus that should be characterized by comprising: A power residue calculation device that is to perform an operation on a calculation result S ′ by the power residue calculation device according to claim 1 ,
Holding means for holding S ′;
From (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection means for selecting the number of primes indicated by
Power-residue operation on a finite field (S ') ^Q mod N
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers selected by the selection means) ;
Reversible calculation means for performing a reversible calculation on the calculation result value calculated by the calculation means to obtain a reversible calculation result value;
Writing means for overwriting the operand value S ′ held in the holding means as the operand value S ′ with the lossless calculation result value calculated by the lossless operator;
The power remainder is controlled to repeat selection by the selection means, power residue calculation by the calculation means, reversible calculation by the reversible calculation means, and overwriting of the reversible calculation result value by the writing means to the holding means. Arithmetic unit. A key management device that manages keys used for decrypting content in a playback device,
Including a modular exponentiation unit,
The power-residue computing device is:
Holding means for holding the operand value S, which is a natural number;
Reading means for reading the operand value S;
From (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection means for selecting the number of primes indicated by
Power-residue operation over a finite field
S ′ = S ^{1 / P} mod N (Formula 1)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a product of all the prime numbers selected by the selection means);
Reversible calculation means for performing a reversible calculation on the calculation result value S ′ calculated by the calculation means to obtain a reversible calculation result value;
Writing means for overwriting the operand value S held in the holding means with the operand value S calculated by the lossless operator as the operand value S;
Control is performed to repeat selection by the selection means, exponentiation remainder calculation by the calculation means, reversible calculation by the reversible calculation means, and overwriting of the reversible calculation result value by the writing means to the holding means, and the obtained S ′ A key management apparatus that manages a device key used for decrypting the content . A key management device that manages keys used for decrypting content in a playback device,
Including a modular exponentiation unit,
The power-residue computing device is:
For each of all numbers of 1 to (a-1) or less from a branches connected to any node of a branch tree (a is a natural number of 2 or more), there is a combination for selecting the number of branches. Prime number storage means for storing (2 ^a -2) prime numbers corresponding to each of the generated combinations without overlapping any of the generated combinations ;
All branches on the route from the root of the a-tree to any leaf are invalidated, and any one of the nodes from the (2 ^a -2) prime numbers stored in the prime number storage means. Effective prime number selection means for selecting a prime number corresponding to a combination including all branches that are not invalidated among a branches connected to
Holding means for holding the operand value T;
Power-residue operation over a finite field
T ^{1 / P} mod N (Formula 2)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected by the effective prime number selection means);
Storage means for storing an operand value S that is a natural number;
Reading means for reading the operand value S;
branch acquisition means for acquiring branch designation information for designating one of the a branches;
A prime number selection means for selecting all prime numbers corresponding to combinations including branches specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means ;
Power-residue operation over a finite field
S ′ = S ^{1 / Q} mod N (Formula 3)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all prime numbers selected by the prime number selection means)
Generating means for performing
First writing means for performing a reversible operation on the operation result value S ′ calculated by the generating means and overwriting the operation value S held in the holding means as the operation value S;
For each branch on the path from the root of the a-tree to one node, in order from the root to the node, the branch acquisition means, the prime number selection means, the generation means, and the first writing means Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 3, and calculation result value S ′ Repetitive control means for controlling the reversible calculation and the output of the reversible calculation result as S to repeat;
The result value S ′ obtained by the repetitive control by the repetitive control means is invalidated to the second writing means for writing to the holding means as T, the valid prime number selecting means, and the calculating means, respectively. Calculation control means for controlling the selection of prime numbers corresponding to combinations including all branches that are not included and the power-residue calculation based on Equation 2;
A key management apparatus characterized in that a calculation result value by the calculation means is used as a key used for decrypting the content . A playback device for decrypting and playing back encrypted content,
Including a modular exponentiation unit,
The power-residue computing device is:
Combinations for selecting the number of branches are generated for each of all the numbers from 1 to (a-1) from a branches connected to any node of the a branch tree, and all the generated combinations Prime number storage means for storing (2 ^a -2) prime numbers corresponding to any one of
Obtaining means for obtaining designation information for designating one or more prime numbers among the prime numbers stored in the prime number storage means;
Holding means for holding the operand value S ′;
Power-residue operation over a finite field
(S ′) ^Q mod N (Formula 4)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers designated by the designation information);
Storage means for storing an operand value S that is a natural number;
Reading means for reading the operand value S;
branch acquisition means for acquiring branch designation information for designating one of the a branches;
Prime number selection means for selecting all prime numbers corresponding to combinations including branches specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means ;
Power-residue operation over a finite field
R = S ^P mod N (Equation 5)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a product of all prime numbers selected by the prime number selection means);
First writing means for performing a reversible operation on the operation result value R calculated by the generating means and overwriting the operation value S stored in the storage means as the operation value S;
For each branch on the path from one leaf to one node of the a-branch tree, the branch acquisition unit, the prime number selection unit, the generation unit, and the first writing unit in the order from the leaf to the node Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 5, and calculated calculation result value Repetitive control means for controlling repetitive writing of R to the storage means;
A second writing means for writing the calculation result value R into the holding means as S ′ after the repetition control by the repetition control means;
Computation control means for controlling the obtaining means and the computing means to perform the acquisition of the specified information and the power-residue computation based on Equation 4, respectively,
A playback apparatus , wherein the encrypted content is decrypted and played back using a computation result value obtained by the computing means as a decryption key . A recording device for encrypting and recording content,
Including a modular exponentiation unit,
The power-residue computing device is:
Combinations for selecting the number of branches are generated for each of all the numbers from 1 to (a-1) from a branches connected to any node of the a branch tree, and all the generated combinations Prime number storage means for storing (2 ^a -2) prime numbers corresponding to any one of
Obtaining means for obtaining designation information for designating one or more prime numbers among the prime numbers stored in the prime number storage means;
Holding means for holding the operand value S ′;
Power-residue operation over a finite field
(S ′) ^Q mod N (Formula 4)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers designated by the designation information);
Storage means for storing an operand value S that is a natural number;
Reading means for reading the operand value S;
branch acquisition means for acquiring branch designation information for designating one of the a branches;
Prime number selection means for selecting all prime numbers corresponding to combinations including branches specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means ;
Power-residue operation over a finite field
R = S ^P mod N (Equation 5)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a product of all prime numbers selected by the prime number selection means);
First writing means for performing a reversible operation on the operation result value R calculated by the generating means and overwriting the operation value S stored in the storage means as the operation value S;
For each branch on the path from one leaf to one node of the a-branch tree, the branch acquisition unit, the prime number selection unit, the generation unit, and the first writing unit in the order from the leaf to the node Respectively, acquisition of branch designation information for designating the branch, selection of all prime numbers corresponding to the combination including the designated branch, power-residue calculation based on Expression 5, and calculated calculation result value Repetitive control means for controlling repetitive writing of R to the storage means;
A second writing means for writing the calculation result value R into the holding means as S ′ after the repetition control by the repetition control means;
Computation control means for controlling the obtaining means and the computing means to perform the acquisition of the specified information and the power-residue computation based on Equation 4, respectively,
A recording apparatus , wherein the content is encrypted and stored based on a calculation result value by the calculation means . A recording device for encrypting and recording content,
Including a modular exponentiation unit,
The power-residue computing device is:
Holding means for holding the operand S ′ which is a natural number;
From (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection means for selecting the number of primes indicated by
Power-residue operation over a finite field
(S ') ^Q mod N
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all the prime numbers selected by the selection means);
Reversible calculation means for performing a reversible calculation on the calculation result value calculated by the calculation means to obtain a reversible calculation result value;
Writing means for overwriting the operand value S ′ held in the holding means as the operand value S ′ with the lossless calculation result value calculated by the lossless operator;
Based on the results obtained, the selection unit is controlled to repeat selection, the power-residue calculation by the calculation unit, the reversible calculation by the reversible calculation unit, and the rewrite of the reversible calculation result value by the writing unit to the holding unit. A recording apparatus, wherein the content is encrypted and stored . In a power residue calculation method by a modular exponentiation apparatus that should comprise a holding means for holding an operand value S that is a natural number, a reading means, a selection means, a calculation means, a reversible calculation means, and a writing means. There,
Including repeating steps to repeat unit steps,
The unit step is:
A reading step of reading the operand value S by the reading means;
By the selecting means, from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection step of selecting the number of primes indicated by
The exponentiation remainder calculation on a finite field by the calculation means S ′ = S ^{1 / P} mod N (Formula 1)
(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected in the selection step )
A calculating step of performing, by the reversible operation means performs reversible operation on the operation result value S 'computed in the computing step, reversible operation to obtain a reversible operation result value,
And a writing step of overwriting the operation value S held in the holding unit as the operation value S with the reversible operation result value calculated in the reversible operation step by the writing unit. A modular exponentiation method that should be characterized by Holding means for holding the operand value T, storage means for storing the operand value S, which is a natural number, and a pieces connected to any node of a branch tree (a is a natural number of 2 or more) For each of all the numbers from 1 to (a-1), a combination for selecting the number of branches is generated and corresponding to all the generated combinations without overlapping (2 ^a -2) Prime number storage means for storing prime numbers, effective prime number selection means, calculation means , reading means, branch acquisition means, prime number selection means, generation means, first writing means, A power-residue calculating method by a power-residue calculating device to be composed of a second writing means and an arithmetic control means ,
All the branches on the route from the root of the a-tree to any one of the leaves are invalidated by the effective prime number selection means, and (2 ^a -2) number of the prime numbers stored in the prime number storage means From the a number of branches connected to any one of the nodes, an effective prime number selection step of selecting a prime number corresponding to a combination including all the branches that are not invalidated;
The exponentiation remainder calculation on the finite field T ^{1 / P} mod N (Formula 2)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected in the effective prime selection step);
a repeating step that repeats unit steps in the order from the root to the node for each branch on the path from the root of the a-tree to one node;
The unit step is:
A reading step of reading the operand value S by the reading means;
A branch acquisition step of acquiring branch designation information for designating one of the a branches by the branch acquisition means;
A prime number selection step of selecting all prime numbers corresponding to combinations including the branch specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means by the prime number selection means. When,
Power generation operation on a finite field by the generating means
S ′ = S ^{1 / Q} mod N (Formula 3)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all prime numbers selected in the prime selection step)
A generation step that performs
The first writing means performs a reversible calculation on the calculation result value S ′ calculated in the generation step, and overwrites the calculated value S held in the holding means as the calculated value S. A first writing step,
Further, the second writing means writes the result value S ′ obtained in the repetition step as T into the holding means as T, the effective control number selecting step by the arithmetic control means, A modular exponentiation method comprising: an arithmetic control step for performing control so as to perform the arithmetic step From the holding means for holding the operand number S ′, the storage means for storing the operand value S as a natural number, and a branch connected to any node of the a-ary tree, one or more ( a-1) For each of the following numbers, a combination for selecting the branch of the number is generated, and the corresponding (2 ^a -2) prime numbers corresponding to any of the generated combinations without overlapping A prime number storage means, an acquisition means, a calculation means, a reading means, a branch acquisition means, a prime number selection means, a generation means, a first writing means, a second writing means, A modular exponentiation method by a modular exponentiation apparatus to be composed of arithmetic control means ,
An acquisition step of acquiring designation information for designating one or more prime numbers among the prime numbers stored in the prime number storage means by the acquisition means;
The exponentiation remainder calculation on a finite field (S ′) ^Q mod N (Formula 4)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is the product of all the prime numbers specified by the specification information) ;
a repeating step that repeats unit steps in the order from the leaf to the node for each branch on the path from one leaf to one node of the a-branch tree,
The unit step is:
A reading step of reading the operand value S by the reading means;
A branch acquisition step of acquiring branch designation information for designating one of the a branches by the branch acquisition means;
A prime number selecting step of selecting all prime numbers corresponding to combinations including the branch specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means by the prime number selection means. When,
By the generating means,
Power-residue operation over a finite field
R = S ^P mod N (Equation 5)
(N is a product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected in the prime number selection step);
The first writing means performs a reversible operation on the operation result value R calculated in the generation step, and overwrites the operation value S stored in the storage means as the operation value S. One writing step and
Including
Furthermore, the second writing means writes the result value R obtained in the repetition step as S ′ to the holding means, and the calculation control means makes the acquisition step and the calculation step. And a calculation control step for performing control so as to perform . A holding means for holding the S ′ for performing the calculation on the calculation result S ′ according to the power-residue calculation method according to claim 13 , a selection means, a calculation means, a reversible calculation means, and a writing means. A power-residue calculating method by a power-residue calculating device , including a repetition step of repeating a unit step,
The unit step is:
By the selecting means, from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection step of selecting the number of primes indicated by
The exponentiation remainder calculation on a finite field (S ′) ^Q mod N by the calculation means
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all prime numbers selected in the selection step ) ;
A reversible operation step of performing a reversible operation on the operation result value calculated in the operation step by the reversible operation means to obtain a reversible operation result value;
A writing step of overwriting the reversible calculation result value calculated in the reversible calculation step by the writing unit as the calculated value S ′ on the calculated value S ′ held in the holding unit ; A modular exponentiation method that should be included. This is a program applied to a modular multiplication apparatus that should comprise a holding means that holds an operand value S that is a natural number, a reading means, a selection means, a calculation means, a reversible calculation means, and a writing means. And
Including repeating steps to repeat unit steps,
The unit step is:
A reading step of reading the operand value S by the reading means;
By the selecting means, from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection step of selecting the number of primes indicated by
The exponentiation remainder calculation on a finite field by the calculation means S ′ = S ^{1 / P} mod N (Formula 1)
(N is the product of prime number p and prime number q, where prime number p and prime number q are each greater than a predetermined value, and P is the product of all prime numbers selected in the selection step)
A calculating step of performing, by the reversible operation means performs reversible operation on the operation result value S 'computed in the computing step, reversible operation to obtain a reversible operation result value,
A writing step of overwriting, as the operand value S, the operand value S held in the holding means by the writing means with the lossless calculation result value calculated in the lossless operator step;
The program characterized by including . Holding means for holding the operand value T, storage means for storing the operand value S, which is a natural number, and a pieces connected to any node of a branch tree (a is a natural number of 2 or more) For each of all the numbers from 1 to (a-1), a combination for selecting the number of branches is generated and corresponding to all the generated combinations without overlapping (2 ^a -2) Prime number storage means for storing prime numbers, effective prime number selection means, calculation means , reading means, branch acquisition means, prime number selection means, generation means, first writing means, , A program to be applied to a modular exponentiation device that is to be composed of second writing means and arithmetic control means ,
All the branches on the route from the root of the a-tree to any one of the leaves are invalidated by the effective prime number selection means, and (2 ^a -2) number of the prime numbers stored in the prime number storage means From the a number of branches connected to any one of the nodes, an effective prime number selection step of selecting a prime number corresponding to a combination including all the branches that are not invalidated;
The exponentiation remainder calculation on the finite field T ^{1 / P} mod N (Formula 2)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a prime number selected in the effective prime selection step ) ;
a repeating step that repeats unit steps in the order from the root to the node for each branch on the path from the root of the a-tree to one node;
The unit step is:
A reading step of reading the operand value S by the reading means;
A branch acquisition step of acquiring branch designation information for designating one of the a branches by the branch acquisition means;
A prime number selection step of selecting all prime numbers corresponding to combinations including the branch specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means by the prime number selection means. When,
Power generation operation on a finite field by the generating means
S ′ = S ^{1 / Q} mod N (Formula 3)
(N is the product of prime p and prime q, where prime p and prime q are each greater than a predetermined value, and Q is the product of all primes selected in the prime selection step)
A generation step that performs
The first writing means performs a reversible calculation on the calculation result value S ′ calculated in the generation step, and overwrites the calculated value S held in the holding means as the calculated value S. A first writing step,
Further, the second writing means writes the result value S ′ obtained in the repetition step as T into the holding means as T, the effective control number selecting step by the arithmetic control means, A calculation control step for controlling the calculation step to be performed;
The program characterized by including . From the holding means for holding the operand number S ′, the storage means for storing the operand value S as a natural number, and a branch connected to any node of the a-ary tree, one or more ( a-1) For each of the following numbers, a combination for selecting the branch of the number is generated, and the corresponding (2 ^a -2) prime numbers corresponding to any of the generated combinations without overlapping A prime number storage means, an acquisition means, a calculation means, a reading means, a branch acquisition means, a prime number selection means, a generation means, a first writing means, a second writing means, A program applied to a modular multiplication unit to be composed of an arithmetic control means ,
An acquisition step of acquiring designation information for designating one or more prime numbers among the prime numbers stored in the prime number storage means by the acquisition means;
The exponentiation remainder calculation on a finite field (S ′) ^Q mod N (Formula 4)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is the product of all the prime numbers specified by the specification information) ;
a repeating step that repeats unit steps in the order from the leaf to the node for each branch on the path from one leaf to one node of the a-branch tree,
The unit step is:
A reading step of reading the operand value S by the reading means;
A branch acquisition step of acquiring branch designation information for designating one of the a branches by the branch acquisition means;
A prime number selecting step of selecting all prime numbers corresponding to combinations including the branch specified by the branch specification information from the (2 ^a -2) prime numbers stored in the prime number storage means by the prime number selection means. When,
By the generating means,
Power-residue operation over a finite field
R = S ^P mod N (Equation 5)
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and P is a product of all prime numbers selected in the prime number selection step),
The first writing means performs a reversible calculation on the calculation result value R calculated by the generating means, and overwrites the calculated value S held in the holding means as the calculated value S. One writing step and
Including
Furthermore, the second writing means writes the result value R obtained in the repetition step as S ′ to the holding means, and the calculation control means makes the acquisition step and the calculation step. An arithmetic control step for controlling
The program characterized by including . 'Performs operation on the S' operation result S by program according to claim 17 modular exponentiation which consists of a holding means for holding, and selecting means, arithmetic means, a reversible operation means, the writing means A program applied to a computing device, including a repetition step of repeating a unit step,
The unit step is:
By the selecting means, from (2 ^a -2) different prime numbers (a is a natural number of 2 or more),

(M is a variable and takes a natural number from 1 to (a-1))
A selection step of selecting the number of primes indicated by
The exponentiation remainder calculation on a finite field (S ′) ^Q mod N by the calculation means
(N is a product of a prime number p and a prime number q, where the prime numbers p and q are each greater than a predetermined value, and Q is a product of all prime numbers selected in the selection step ) ;
A reversible operation step of performing a reversible operation on the operation result value calculated in the operation step by the reversible operation means to obtain a reversible operation result value;
A writing step of overwriting the operation value S ′ held in the holding unit as the operation value S ′ by the writing unit with the reversible operation result value calculated in the reversible operation step;
The program characterized by including .

Images