JP5557707B2 - Encrypted information generating device and program thereof, secret key generating device and program thereof, distribution content generating device and program thereof, content decrypting device and program thereof, and user specifying device and program thereof - Google Patents

Description

  The present invention relates to an encrypted information generating apparatus and its program, a secret key generating apparatus and its program, a distribution content generating apparatus and its program, a content decrypting apparatus and its program, which are used in a content distribution system that encrypts and distributes content, In addition, the present invention relates to a user specifying device and a program thereof.

In recent years, various contents such as video and audio have been distributed on the Internet (network).
However, when buying and selling content on the Internet, a legitimate user may circulate the content illegally, and the number of cases in which content providers are damaged is increasing. In order to address such a problem, there is a method of using an encryption technique called “trailer tracing method” as a method of identifying from which user the content distributed illegally has been distributed ( Hereinafter, referred to as “KD98 method” (see Non-Patent Document 1).

  In the KD98 method, a secret key that is a key for decrypting encrypted content is generated using a user-specific identifier and a polynomial. That is, when the polynomial is f (x), f (ID) obtained by substituting the user-specific identifier ID into the variable x is the user's secret key. For this reason, when a user illegally creates a copy of a secret key, the identifier ID used to create the secret key f (ID) is determined to identify which user has made the fraud can do. In the KD98 method, a polynomial f (x) is used to provide resistance to a system using the unauthorized person tracking method even when k unauthorized persons perform fraud (attack). Is the k-th order.

Further, in order to improve the safety of the KD98 method, the order of the polynomial f (x) is increased to (2k−1) order, and two polynomials (f ₁ (x), f ₂ (x)) are used. It has been proposed (hereinafter referred to as “DF03 method”; see Non-Patent Document 2). By increasing the degree in this way, it is possible to have resistance against an attack called a linear attack, and further by making the number of polynomials two, the attacker seems to be suspicious in advance. Not only a non-adaptive attack that forges a new key from k keys to be generated, but also an adaptive one that obtains an arbitrary k keys and forges a new key Security can be maintained against (Adaptive) attacks.

  In the system using the KD98 method, the ciphertext and the public key that is a key used for encryption are composed of (k + 2) elements. Further, in the system using the DF03 method, the ciphertext and the public key are composed of (2k + 2) elements. The ciphertext of each method is added with a random power of the generation source as an element in addition to the coefficient of the polynomial.

Here, the number of elements of the DF03 ciphertext will be specifically described. In the DF03 method, as a ciphertext element, in addition to a cryptographic part that is a coefficient of a polynomial, a generator random number power is included.
In the DF03 method, there are (2k × 2) coefficients of two polynomials of the order (2k−1), and since these two coefficients are used together as ciphertext, the number of elements in the cipher part is ( 2k × 2) / 2 = 2k. More specifically, in the DF03 method, it is assumed that the coefficients of the terms having the same degree of the two polynomials (f ₁ (x), f ₂ (x)), for example, the coefficients of x ⁱ are a _i and b _i. Since these are synthesized using two generators (g, h) and made as one element as (g ^ai h ^bi ) ^r (r is a random number), the number of elements in the ciphertext encryption part is 2k Become.
Furthermore, in the DF03 method, two elements of values g ^r and h ^r obtained by raising the generator (g, h) to the power of a random number r are added to the ciphertext. Thus, in the DF03 method, the ciphertext is composed of (2k + 2) elements.

  On the other hand, a method is also proposed in which a ciphertext is composed of only three elements by combining “c-secure (Secure) code” (see Non-Patent Document 3) based on bilinear mapping and public key cryptography. (Hereinafter referred to as “BN08 method”, see Non-Patent Document 4).

Kaisa Nyberg, “Advances in Cryptology-EUROCRYPT’98”, Lecture Notes in Computer Science, vol1403, pp.145-157 Yvo. G. Desmedt “Public Key Cryptography-PKC’03”, LectureNotes in Computer Science, vol2567, pp.100-115 D. Boneh, J. Shaw, “Collusion-Secure Fingerprinting for Digital Data”, IEEE Trans. On Information Theory, vol.44, pp.1987-1905, 1998. “Traitor Tracing with Constant Size Ciphertext” by D. Boneh, M. Naor, Proc. Of ACM-CCS 2008, pp.501-510, 2008.

As described above, according to the KD98 method and the DF03 method, it is necessary to secretly manage and store the coefficient of the polynomial as the secret information of the provider. Here, when the number of fraudulent persons who attack the system in collusion is k, and the data length of one coefficient is | q | (generally | q | is about 160 bits), the KD98 method is used. In this system, the secret key size of each user (user) is | q |, and the ciphertext size is (k + 2) × | q | because the number of elements is (k + 2). Similarly, in the DF03 method, the size of the secret key is 2 × | q | and the size of the ciphertext is (2k + 2) × | q | because the number of elements is (2k + 2).
On the other hand, in the BN08 method, the size of the secret key increases in proportion to k ^2, the number of elements of the ciphertexts 3 × for a three | q | become.
That is, according to the conventional method, if the number of users to be managed increases, the secret key size or the number of ciphertext elements changes depending on the number k of unauthorized persons who collide and attack. In particular, in the KD98 method and the DF03 method, when the number k of unauthorized persons who collide and attack cannot be predicted, it is necessary to set k to the total number of users N, so the number of ciphertext elements is proportional to N increased and, in the BN08 method, there is a problem that the size of the secret key is increased in proportion to N ^2.

  The present invention has been made in view of the above problems, and is a key used for encryption with ciphertext while maintaining the size of a secret key held by each user of the KD98 method. Encrypted information generation apparatus and program thereof, secret key generation apparatus and program thereof, and distribution capable of making public key size independent of the number of users (or the maximum number of colluders k) (not proportional to the number of users) It is an object of the present invention to provide a content generation apparatus and its program, a content decryption apparatus and its program, and a user specifying apparatus and its program.

  The present invention was created to achieve the above object. First, the encrypted information generating device according to claim 1 is distributed to a content decrypting device in a content distribution system for encrypting and distributing content. A secret information for generating a user secret key and a public key corresponding to the user secret key, wherein the basic information generating means, master secret information generating means, And a public key generation unit.

In this configuration, the encrypted information generation device generates the prime numbers p ₁ and p ₂ and the generation sources g ₁ and g ₂ as basic information by the basic information generation unit. At this time, the generator g ₁ is a generator of the group G ₁ having the prime p ₁ as the order, and the generator g ₂ is a generator of the group G ₂ having the prime p ₂ as the order. Further, the encryption information generating apparatus, bilinear of the basic information generating means, a composite number p = p ₁ × p ₂ and of order, from the group G to g = g ₁ × g ₂ origin of the group G _T Specify map e. For example, the basic information generating means, e: as _G × G → G _T become bilinear mapping e, general "Weil Pairing", identifies the parameters of the elliptic curve on the basis of the "Tate Pairing", and the like. Here, the bilinear map e is a map represented by e (•, •) having two arguments. Further, the basic information generating means generates (p, g, e (), G, G _T ) as public information.

として生成する。なお、正整数ｍは、総ユーザ数をＮとしたとき、ｌｏｇ（Ｎ）以上の値で予め定めておく。これによって、マスタ秘密情報生成手段は、マスタ秘密情報として、秘密情報、マスタ秘密鍵及びパラメータを生成する。 Then, the encrypted information generating apparatus uses the master secret information generating means, where m is a predetermined positive integer that is the bit length of the user identifier for identifying the user, and 1 ≦ x ₀ , x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} <p where x ₀ , x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} 1, α, β, γ, δ satisfying 1 ≦ α, β, γ, δ <p are selected. Then, the encrypted information generating apparatus uses the master secret information generating means to generate the secret information (g ₁ , g ₂ , p ₁ , p ₂ , x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , X _{m, 1} , α, β, γ, δ), and the master secret key msk (msk = (g ₁ ^αβ , g ₂ )) is generated by calculating the αβ power (power) of the generator g ₁ In addition, the generator g ₁ is exponentiated with the values of (x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , x _{m, 1} ) that are part of the secret information. , Parameter param

Generate as The positive integer m is determined in advance with a value equal to or greater than log (N), where N is the total number of users. As a result, the master secret information generating means generates secret information, a master secret key, and parameters as master secret information.

により生成する。これによって、公開鍵生成手段が生成する公開鍵は、要素数が、Ｈ_１，０，Ｈ_１，１，Ｈ_２，０，Ｈ_２，１，…，Ｈ_ｍ，０，Ｈ_ｍ，１のようにユーザを識別するためのユーザ識別子のビット長ｍに依存することになる。すなわち、公開鍵のサイズは、ユーザ数の対数に依存したものとなる。また、このように、公開鍵は生成元のべき乗値を有することで、コンテンツ配信システムにおいて、離散対数計算の有する困難性により暗号系の安全性を確保することができる。 Then, the encryption information generation device uses the public key generation means to obtain the public key PK from the parameter param, the bilinear map e, and the secret information.

Generate by. As a result, the public key generated by the public key generation means has the number of elements H _1,0 , H _1,1 , H _2,0 , H _2,1 ,..., H _{m, 0} , H _{m, 1} . Thus, it depends on the bit length m of the user identifier for identifying the user. That is, the size of the public key depends on the logarithm of the number of users. In addition, since the public key has a power value of the generation source in this way, it is possible to ensure the security of the encryption system due to the difficulty of the discrete logarithm calculation in the content distribution system.

  The encrypted information generation program according to claim 2 is a content distribution system for encrypting and distributing content, wherein the master secret information for generating a user secret key distributed to the content decrypting device and the user secret In order to generate the public key corresponding to the key, the computer is configured to function as basic information generating means, master secret information generating means, and public key generating means.

In this configuration, the encrypted information generation program generates the prime numbers p ₁ and p ₂ and the generation sources g ₁ and g ₂ as basic information by the basic information generation unit. At this time, the generator g ₁ is a generator of the group G ₁ having the prime p ₁ as the order, and the generator g ₂ is a generator of the group G ₂ having the prime p ₂ as the order. Further, the encryption information generating program, bilinear of the basic information generating means, a composite number p = p ₁ × p ₂ and of order, from the group G to g = g ₁ × g ₂ origin of the group G _T Specify map e. Further, the basic information generating means generates (p, g, e (), G, G _T ) as public information.

として生成する。 Then, the encrypted information generating program uses the master secret information generating means to set a predetermined positive integer that is a bit length of the user identifier for identifying the user as m, and 1 ≦ x ₀ , x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} <p where x ₀ , x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} 1, α, β, γ, δ satisfying 1 ≦ α, β, γ, δ <p are selected. Then, the encrypted information generation program generates the secret information (g ₁ , g ₂ , p ₁ , p ₂ , x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} by the master secret information generation unit. , X _{m, 1} , α, β, γ, δ), and the master secret key msk (msk = (g ₁ ^αβ , g ₂ )) is generated by calculating the αβ power (power) of the generator g ₁ In addition, the generator g ₁ is exponentiated with the values of (x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , x _{m, 1} ) that are part of the secret information. , Parameter param

Generate as

により生成する。 Then, the encryption information generation program obtains the public key PK from the parameter param, the bilinear map e, and the secret information by the public key generation means.

Generate by.

  According to a third aspect of the present invention, there is provided a secret key generation device that decrypts content based on the master secret information generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. A secret key generation apparatus that generates a user secret key to be distributed to the apparatus, and includes a user secret key generation unit and a user secret key output unit.

を含んだユーザ秘密鍵ｄ_ｖを生成する。 In such a configuration, the secret key generation device includes the public information generated by the encryption information generation device by the user secret key generation unit, the secret information that is the master secret information generated by the encryption information generation device, the parameter param, From the master secret key msk, the user identifier v for identifying the user, and the random numbers r _{v, 1} , r _{v, 2} selected in advance from Z _p ^* (= {1, 2,..., P−1}) At least as the first secret information, the second secret information, and the third secret information,

The user private key _{dv including} is generated.

Then, the secret key generation device outputs the user secret key by the user secret key output means. This user secret key may be output to the content decryption apparatus via a network, or may be written to a storage medium distributed to the content decryption apparatus and output. The user secret key is used when the user decrypts the content in the content decrypting apparatus.
In this way, the secret key generation apparatus can represent the user secret key with a fixed number of elements independent of the number of users.

  According to a fourth aspect of the present invention, there is provided a secret key generation program that decrypts content based on the master secret information generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. In order to generate a user secret key to be distributed to the apparatus, the computer is configured to function as a user secret key generation unit and a user secret key output unit.

を含んだユーザ秘密鍵ｄ_ｖを生成する。そして、秘密鍵生成プログラムは、ユーザ秘密鍵出力手段によって、ユーザ秘密鍵を出力する。 In such a configuration, the secret key generation program includes the public information generated by the encryption information generation device by the user secret key generation means, the secret information that is the master secret information generated by the encryption information generation device, the parameter param, From the master secret key msk, the user identifier v for identifying the user, and the random numbers r _{v, 1} , r _{v, 2} selected in advance from Z _p ^* (= {1, 2,..., P−1}) At least as the first secret information, the second secret information, and the third secret information,

The user private key _{dv including} is generated. Then, the secret key generation program outputs the user secret key by the user secret key output means.

  Furthermore, the distribution content generation device according to claim 5 is a content distribution system that encrypts and distributes content based on the public key PK generated by the encrypted information generation device according to claim 1. Content generating apparatus for generating content for use, comprising an encryption key generating means, a content encrypting means, a header generating means, and a header synthesizing means.

  In this configuration, the distribution content generation device generates an encryption key Ks for encrypting the content by the encryption key generation unit. Then, the distribution content generation apparatus encrypts the content with the encryption key Ks generated by the encryption key generation unit by the content encryption unit, and generates the encrypted content.

により生成する。 Then, the distribution content generation device uses the header generation unit to public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation unit, the public key PK, and Z _p in advance. ^* Encrypted content based on random numbers t, t ₀ , t ₁ selected from (= {1, 2,..., P−1}) and an index j (bit index) indicating a bit position in the user identifier. Content delivery header C to be combined into

Generate by.

That is, the header generation means generates a product (KsG _e ^t ) of the value obtained by raising the G _e included in the public key PK to the power t and the encryption key Ks, and E _γ , H ₀ , H _1, included in the public key PK _{. 0} , H _1,1 ,..., H _{m, 0} , H _{m, 1} are values obtained by raising the power to t (E _γ ^t , H ₀ ^t , H _1,0 ^t , H _1,1 ^t ,..., H _{m, 0} ^t , H _{m, 1} ^t ), E _γ to the power of t ₀ and t ₁ (E _γ ^t0 , E _γ ^t1 ), and E _δ to the power of t ₀ and t ₁ , respectively. _A content distribution header C including a value obtained by multiplying _{j, 0} ^t , H _{j, 1} ^t (H _{j, 0} ^t E _δ ^t0 , H _{j, 1} ^t E _δ ^t1 ) is generated. As a result, the content distribution header, which is a ciphertext generated by the header generation means, has the number of elements as H _1,0 ^t , H _1,1 ^t ,..., H _{m, 0} ^t , H _{m, 1} ^t It depends on the bit length m of the user identifier for identifying the user. That is, the size of the content distribution header depends on the logarithm of the number of users.

Then, the distribution content generation apparatus generates distribution content by combining the content distribution header C generated by the header generation unit and the encrypted content by the header combination unit. That is, the header synthesizing unit generates the distribution content as a file or a stream in which the encrypted content and the content distribution header are integrated.
In this way, the content generating apparatus for distribution can represent the content distribution header C, which is a ciphertext, with a number of elements proportional to the logarithm of the number of users.

  According to a sixth aspect of the present invention, there is provided a content generation program for distribution based on the public key PK generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. In order to generate the content for use, the computer is configured to function as an encryption key generation unit, a content encryption unit, a header generation unit, and a header synthesis unit.

  In this configuration, the distribution content generation program generates the encryption key Ks for encrypting the content by the encryption key generation unit. Then, the distribution content generation program encrypts the content with the encryption key Ks generated by the encryption key generation unit by the content encryption unit, and generates an encrypted content.

により生成する。 Then, the distribution content generation program includes the public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation unit, the public key PK, and Z _p in advance by the header generation unit. ^* Encrypted content based on random numbers t, t ₀ , t ₁ selected from (= {1, 2,..., P−1}) and an index j (bit index) indicating a bit position in the user identifier. Content delivery header C to be combined into

Generate by.

  Then, the distribution content generation program generates the distribution content by combining the content distribution header C generated by the header generation unit and the encrypted content by the header synthesis unit.

The content decryption device according to claim 7 is the content distribution system for encrypting and distributing the content, and the distribution content generated by the distribution content generation device according to claim 5 is described in claim 3. a content decoding apparatus for decoding based on the user private key d _v generated by the secret key generating apparatus, and a separation unit, and an encryption key decrypting unit, a content decryption unit, configured to include a.

により復号する。
なお、ここで、Ｃ_ｉ，ｖｉは、ｖ_ｉの値が“０”の場合はＣ_ｉ，０、ｖ_ｉの値が“１”の場合はＣ_ｉ，１を表す。
そして、コンテンツ復号装置は、コンテンツ復号手段によって、暗号化鍵復号手段で復号された暗号化鍵Ｋｓで、暗号化コンテンツを復号する。 In such a configuration, the content decrypting device separates the content for distribution into the content distribution header C and the encrypted content by the separating means.
Then, the content decrypting apparatus converts the content distribution header C separated by the separating means by the encryption key decrypting means to (j, C _G , C _E , C _E0 , C _E1 , C ₀ , C ₁ , ₀ , C _{1 , 1, ..., C m,} 0, C m, 1) and then, the first secret information of the user private key _{d v} the user identifier v, second secret information and third secret information _{(d v,} 1, d _{v, 2} , d _{v, 3} ), the bilinear mapping e specified by the encryption information generation device according to claim 1 and disclosed as public information is used for content encryption. The encryption key Ks

Decrypted by
Note _{that, C i, vi,} if the value of _{v i} is "0" when the value of _{C i,} 0, _{v i} is "1" represents a _{C i, 1.}
Then, the content decrypting device decrypts the encrypted content by the content decrypting unit with the encryption key Ks decrypted by the encryption key decrypting unit.

The content decryption program according to claim 8 is the content distribution system for encrypting and distributing the content, and the distribution content generated by the distribution content generation device according to claim 5 is described in claim 3. to decode based on a user private key d _v generated by the secret key generating device, computer, separating means, the encryption key decrypting unit, and configured to function as a content decryption unit.

により復号する。
そして、コンテンツ復号プログラムは、コンテンツ復号手段によって、暗号化鍵復号手段で復号された暗号化鍵Ｋｓで、暗号化コンテンツを復号する。 In this configuration, the content decryption program separates the distribution content into the content distribution header C and the encrypted content by the separating unit.
Then, the content decryption program converts the content distribution header C separated by the separation means by the encryption key decryption means (j, C _G , C _E , C _E0 , C _E1 , C ₀ , C ₁ , ₀ , C _{1 , 1, ..., C m,} 0, C m, 1) and then, the first secret information of the user private key _{d v} the user identifier v, second secret information and third secret information _{(d v,} 1, d _{v, 2} , d _{v, 3} ), using the bilinear map e (•, •) specified by the encrypted information generation device according to claim 1 and disclosed as public information, The encryption key Ks used for encryption is

Decrypted by
The content decryption program decrypts the encrypted content with the encryption key Ks decrypted by the encryption key decryption unit by the content decryption unit.

Further, the user identification device according to claim 9, in the content distribution system for distributing encrypted content, claim incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3 7 from the content decrypting apparatus according to, a user identification device for identifying a user corresponding to the user private key d _v, and the test data generating unit, a test data transmitting means, and decoded data receiving means, a user identifier identifying means And a user search means.

を生成する。さらに、ユーザ特定装置は、テストデータ生成手段によって、テスト用コンテンツを暗号化鍵Ｋｓで暗号化した暗号化コンテンツに合成することでユーザ識別子のｊビット目をテストするためテストデータを生成する。
これによって、テストデータは、テスト用コンテンツ配信ヘッダにおいて、Ｅ_γ ^ｔ１ｇ_２ ^ｔ′^１又はＥ_γ ^ｔ０ｇ_２ ^ｔ′^０と、Ｈ_ｊ，１ ^ｔＥ_δ ^ｔ１ｇ_２ ^ｔ′^２又はＨ_ｊ，０ ^ｔＥ_δ ^ｔ０ｇ_２ ^ｔ′^２のいずれか一方が、他の要素とは異なる群Ｇ_２の生成元ｇ_２を含んでおり、ダミーデータが組み込まれることになる。 In such a configuration, the user specifying device uses the test data generating unit to generate the encryption key Ks, the public information and the public key generated by the encrypted information generating device according to claim 1, and one of the public information. Based on six different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′ selected from Z _p ^* specified by a certain composite number p, as a test content distribution header,

Is generated. Further, the user specifying device generates test data for testing the j-th bit of the user identifier by combining the test content with the encrypted content encrypted with the encryption key Ks by the test data generating means.
As a result, the test data is stored in the test content delivery header as E _γ ^t1 g ₂ ^t ′ ¹ or E _γ ^t0 g ₂ ^t ′ ⁰ and H _{j, 1} ^t E _δ ^t1 g ₂ ^t ′ ² or H _j, Any one of ₀ ^t E _δ ^t0 g ₂ ^t ′ ² includes the generation source g ₂ of the group G ₂ different from the other elements, and dummy data is incorporated.

  Then, the user specifying device transmits the test data generated by the test data generating unit to the content decrypting device by the test data transmitting unit. Then, the user specifying device receives the content decrypted by the test data from the content decrypting device by the decrypted data receiving means.

Then, the user specifying device compares the content received by the decrypted data receiving unit with the test content for all j of 1 ≦ j ≦ m by the user identifier specifying unit, and whether or not the comparison results match. Based on the above, the value of the j-th bit of the user identifier is specified. In the present invention, the fact that content is not normally decrypted when decrypted using a different t'th power value from other elements is utilized. That is, when C ^* _{j, 1} is used as the test content distribution header, the user identifier specifying means sets the value of the j-th bit of the user identifier to “1” and the comparison result matches if the comparison result matches. Otherwise, the value of the jth bit of the user identifier is set to “0”. Further, when C ^* _{j, 0} is used as the test content delivery header, the user identifier specifying means sets the value of the j-th bit of the user identifier to “0” and the comparison result matches if the comparison result matches. If not, the user identifier is specified by setting the value of the j-th bit of the user identifier to “1”.

  And a user specific device searches the user information corresponding to the user identifier specified by the user identifier specific means from the database which matched the user identifier and the user information which specifies a user beforehand by a user search means.

Further, the user identification program according to claim 10, in the content distribution system for distributing encrypted content, claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3 from the content decrypting apparatus according to, in order to identify the user corresponding to the user private key d _v, the computer, the test data generating means, the test data transmission unit, decoding the data receiving means, a user identifier identifying unit, a user searching means It was set as the structure made to function as.

を生成する。さらに、ユーザ特定プログラムは、テストデータ生成手段によって、テスト用コンテンツを暗号化鍵Ｋｓで暗号化した暗号化コンテンツに合成することでユーザ識別子のｊビット目をテストするためテストデータを生成する。 In such a configuration, the user specifying program includes the encryption key Ks, the public information and the public key generated by the encrypted information generation device according to claim 1, and one of the public information by the test data generation unit. Based on six different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′ selected from Z _p ^* specified by a certain composite number p, as a test content distribution header,

Is generated. Further, the user specifying program generates test data for testing the j-th bit of the user identifier by combining the test content with the encrypted content encrypted with the encryption key Ks by the test data generating means.

  And a user specific program transmits the test data produced | generated by the test data production | generation means to the content decoding apparatus by the test data transmission means. Then, the user specifying program receives the content decrypted by the test data from the content decrypting device by the decrypted data receiving means.

  Then, the user specifying program compares the content received by the decrypted data receiving unit and the test content for all j of 1 ≦ j ≦ m by the user identifier specifying unit, and whether or not the comparison result matches. Based on the above, the value of the j-th bit of the user identifier is specified.

  And a user specific program searches the user information corresponding to the user identifier specified by the user identifier specific means from the database which matched the user identifier and the user information which specifies a user beforehand by a user search means.

The present invention has the following excellent effects.
According to the first and second aspects of the invention, the number of elements of a secret key (user secret key) that can be a fixed number of master secret keys and content distribution headers that are ciphertext is determined by the number of users. It is possible to generate a public key that can be set to a number proportional to the logarithm of the number of users.

  According to the third and fourth aspects of the present invention, it is possible to generate a secret key (user secret key) having a fixed number of elements and a fixed length size independent of the number of users. Thereby, the data amount of the secret key held in the content decryption apparatus can be reduced.

  According to the fifth and sixth aspects of the invention, for distribution, the number of elements is a fixed number, and the ciphertext is not proportional to the number of users, but with a content distribution header having a size proportional to the logarithm of the number of users. Content can be generated. As a result, even when content is distributed all at once, the number of elements in the content distribution header that is the ciphertext is proportional to the logarithm of the number of users. Can be suppressed and the load on the network can be reduced.

  According to the seventh and eighth aspects of the invention, the encryption key can be decrypted from the content distribution header having the number of elements proportional to the logarithm of the number of users.

  According to the ninth and tenth aspects of the present invention, the user who uses the content decrypting device can be specified from the content decrypting device. As a result, even when an unauthorized user creates an unauthorized content decryption device by copying the distributed user private key, the user who created the unauthorized content decryption device can be identified.

It is a block diagram which shows the structure of the content delivery system which concerns on embodiment of this invention. It is a block diagram which shows the structure of the encryption information generation server (encryption information generation apparatus) which concerns on embodiment of this invention. It is a block diagram which shows the structure of the secret key generation server (secret key generation apparatus) which concerns on embodiment of this invention. It is a block diagram which shows the structure of the content server (content production | generation apparatus for delivery) which concerns on embodiment of this invention. It is a block diagram which shows the structure of the content delivery server which concerns on embodiment of this invention. It is a block diagram which shows the structure of the user terminal (content decoding apparatus) which concerns on embodiment of this invention. It is a block diagram which shows the structure of the unauthorized user tracking server (user specific device) which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement which produces | generates a public key and a user private key in the content delivery system which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement which produces | generates the content for delivery in the content delivery system which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement which distributes the content for delivery in the content delivery system which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement which the user terminal which concerns on embodiment of this invention decodes the content for delivery. It is a flowchart which shows the operation | movement which tracks the user who created the said user terminal from the unauthorized user terminal which concerns on embodiment of this invention.

Embodiments of the present invention will be described below with reference to the drawings.
[Content distribution system configuration]
First, the configuration of a content distribution system according to an embodiment of the present invention will be described with reference to FIG. The content distribution system 1 includes an encrypted information generation server 10, a secret key generation server 20, a content server 30, a content distribution server 40, and a content distributor (hereinafter referred to as a provider) connected via an intranet 3. The system includes a gateway (GW) 5 and distributes content to a user terminal 50 that is a terminal on the purchaser side (hereinafter referred to as a user) of the content via the Internet 7.
In the present embodiment, the content distribution system 1 further includes an unauthorized user tracking server 90 on the provider side.

  The encryption information generation server (encryption information generation device) 10 uses master secret information, which is secret information on the provider side used in the secret key generation server 20, and content as encryption information used when encrypting the content. A public key used in the server 30 is generated. The generated master secret information is transmitted to the secret key generation server 20, and the public key is transmitted to the content server 30.

  The secret key generation server (secret key generation device) 20 generates a user-specific secret key (user secret key) used when decrypting encrypted content. The generated user secret key is distributed (transmitted) to the user terminal 50 on the user side.

  The content server (distribution content generation device) 30 encrypts the content, encrypts the encryption key used for content encryption using the public key generated by the encryption information generation server 10, and generates header information ( Content distribution header) is generated and synthesized with the encrypted content, thereby generating content (distribution content) to be distributed to the user side. The content server 30 stores a plurality of distribution contents in a storage unit (not shown), and transmits the distribution contents requested from the content distribution server 40 to the content distribution server 40.

  The content distribution server 40 acquires the content requested by the user terminal 50 (distribution content) from the content server 30 and transmits it to the user terminal 50.

  The user terminal (content decryption apparatus) 50 requests the content distribution server 40 for content (distribution content) desired by the user, and decrypts the distribution content acquired from the content distribution server 40. The user terminal 50 obtains a user-specific user secret key from the secret key generation server 20 in advance, and decrypts the distribution content. Although only one user terminal 50 is shown here, it goes without saying that a plurality of user terminals 50 can be connected via the Internet 7.

  The gateway (GW) 5 is a device for connecting each network of the intranet 3 and the Internet 7. The gateway 5 is, for example, an IP router (IP: Internet Protocol), and has a firewall function that prevents unauthorized access to the intranet 3.

  The unauthorized user tracking server (user identification device) 90 identifies a user who uses the user terminal 50. For example, when an unauthorized user duplicates a distributed user secret key to create an unauthorized user terminal 50B (50), the unauthorized user tracking server 90 tests the unauthorized user terminal 50B. By inputting data and analyzing the data output from the user terminal 50B, the user who created the user terminal 50B is specified by the user identifier.

  Hereinafter, the respective configurations of the encryption information generation server 10, the secret key generation server 20, the content server 30, and the content distribution server 40, which are provider devices, and the configuration of the user terminal 50, which is a user device, will be sequentially described. Further, the configuration of the unauthorized user tracking server 90 will be described.

(Configuration of encrypted information generation server)
First, the configuration of the encrypted information generation server 10 will be described with reference to FIG. 2 (refer to FIG. 1 as appropriate). Here, the encrypted information generation server 10 includes basic information generation means 11, master secret information generation means 12, master secret information transmission means 13, public key generation means 14, and public key transmission means 15. ing.

The basic information generating unit 11 generates basic information used for generating the master secret information and the public key in the master secret information generating unit 12 and the public key generating unit 14.
Here, the basic information generation means 11 inputs a positive integer m that is the bit length of the user identifier for identifying the user from the outside by an input means (not shown), and as the basic information, the prime numbers p ₁ and p ₂ When, to produce a generating element _{g 2} of the group _{G 2} to the origin _{g 1} and the prime number _{p 2} groups _{G 1} to the prime _{p 1} and of order and of order. When the total number of users is N, the positive integer m is a number greater than log (N).

Furthermore, the basic information generating unit 11, a composite number _p = p ₁ × p ₂ a quantile, g = _{g 1} × bilinear mapping e (· of _{g 2} from the group G to a generator of the group _{G T,} · ). For example, the basic information generating means _{11, e: G × G → G} T become bilinear mapping e (·, ·) as a typical "Weil Paring", "Tate Paring " elliptic curve on the basis of parameters such as Is identified.

The basic information generation means 11 receives the input positive integer m and the generated basic information (prime numbers p ₁ , p ₂ , composite number p, generators g ₁ , g ₂ , bilinear mapping e (•, )) Is output to the master secret information generation means 12 and the public key generation means 14.

The master secret information generation unit 12 generates master secret information used when the secret key generation server 20 generates a user secret key.
Specifically, the master secret information generating means 12 is a 2m + 1 number x ₀ , where 1 ≦ x ₀ , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} <p. x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} and four numbers α, β, γ, δ satisfying 1 ≦ α, β, γ, δ <p are randomly selected. And secret information master = (g ₁ , g ₂ , p ₁ , p ₂ , x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , x _{m, 1} , α, β , Γ, δ).

Further, the master secret information generation means 12 generates the generation sources g ₁ and g ₂ generated by the basic information generation means 11 and x ₀ , x ₁ , ₀ , x ₁ , _1,. From x _{m, 0} , x _{m, 1} , a parameter (hereinafter referred to as public parameter) param for generating a user secret key or public key is generated by the following equation (1), and the master secret key msk is set to g ₁ ^αβ and g ₂ (msk = (g ₁ ^αβ , g ₂ )).

That is, the master secret information generation unit 12 calculates the .alpha..beta of origin _{g 1} th power (power), the master secret key msk including generated based _{g 2} Metropolitan (= _{(g 1} ^{.alpha..beta,} _g 2)) to generate a The public parameter param is generated by performing exponentiation of the generator g ₁ with the values of the secret information (x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , x _{m, 1} ). . This public parameter is information that is disclosed to the secret key generation server 20 in addition to the public information.

Then, the master secret information generation unit 12 outputs the generated secret information master, master secret key msk, and public parameter param to the master secret information transmission unit 13 as master secret information.
Further, the master secret information generation unit 12 outputs the generated public parameter param and secret information to the public key generation unit 14.

  The master secret information transmission unit 13 transmits the master secret information generated by the master secret information generation unit 12 to the secret key generation server 20 via the intranet 3. That is, the master secret information transmission unit 13 transmits the secret information master, the master secret key msk, and the public parameter param generated by the master secret information generation unit 12 to the secret key generation server 20.

  The public key generation unit 14 generates a public key (Trator Tracing public key) for generating a header (content distribution header) to be combined with distribution content in the content distribution server 40.

Here, the public key generation unit 14 includes the positive integer m input by the basic information generation unit 11, the bilinear map e (•, •) generated by the basic information generation unit 11, and the master secret information generation unit 12. And public information param generated in step (1) and secret information (specifically, (g ₁ , x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., X _{m, 0} , x _{m , 1} , α, β, γ, δ)) based on the following equation (2), the public key PK = (G _e , E _γ , E _δ , H ₀ , H ₁ , ₀ , H ₂ , _{0 , ..., H m, 0,} H 1,1, H 2,1, ..., H m, 1) to generate a.

Then, the public key generation unit 14 outputs the generated public key PK to the public key transmission unit 15.
The public key transmission unit 15 transmits the public key generated by the public key generation unit 14 to the content server 30 via the intranet 3.

The encrypted information generation server 10 publishes (p, g, e, G, G _T ) used for encryption, decryption, key generation, etc. generated by the basic information generation means 11 as public information.
Here, the encryption information generation server 10 publishes the public information by transmitting it to the secret key generation server 20 and the content server 30 by the master secret information transmission unit 13 and the public key transmission unit 15. In addition, in order to transmit public information, you may provide a public information transmission means (not shown) separately.

  By configuring the encryption information generation server 10 in this way, the encryption information generation server 10 can generate master secret information (secret information, master secret key, and public parameter) and a public key.

  The encrypted information generation server 10 can be realized by a general computer having a CPU and a memory (not shown). At this time, the encryption information generation server 10 operates by an encryption information generation program that causes the computer to function as each of the above-described means.

(Configuration of secret key generation server)
Next, the configuration of the secret key generation server 20 will be described with reference to FIG. 3 (refer to FIG. 1 as appropriate). Here, the secret key generation server 20 includes a master secret information receiving unit 21, a master secret information storage unit 22, a user secret key generation unit 23, and a user secret key output unit 24.

  The master secret information receiving unit 21 receives the master secret information (secret information, master secret key, and public parameter) generated by the encrypted information generation server 10 via the intranet 3. The master secret information (secret information, master secret key and public parameter) received by the master secret information receiving means 21 is stored in the master secret information storage means 22. Here, it is assumed that the master secret information receiving unit 21 also receives the public information generated by the encrypted information generation server 10 and writes and stores it in the master secret information storage unit 22.

  The master secret information storage unit 22 stores master secret information (secret information, master secret key, and public parameter) received by the master secret information reception unit 21 and public information, and is a general storage device such as a hard disk. . The secret information, master secret key, and public parameters (public information) stored in the master secret information storage unit 22 are read by the user secret key generation unit 23.

The user secret key generation unit 23 generates a user-specific secret key (user secret key) from a value for identifying the user (for example, user-specific user identifier [v]).
Here, the user secret key generation means 23 is the master secret information stored in the master secret information storage means 22 (secret information master (= (g ₁ , g ₂ , p ₁ , p ₂ , x ₀ , x _{1, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β, γ, δ)), master secret key msk (= (g ₁ ^αβ , g ₂ )) and public parameter param (the above (See formula (1))), public information, user identifier v, and Z _p ^* (= {1, 2,..., P−1}) in advance (where p is the composite number acquired as public information) The user secret key d _v including the user identifier, the first secret information, the second secret information, and the third secret information is obtained from the random numbers r _{v, 1} , r _{v, 2 selected} from the following equation (3) _: Generate. In the expression (3), the second to fourth terms correspond to the first to third secret information, respectively.

In the equation (3), the user identifier v is input via an input unit (not shown). The user identifier v is data having a bit length of a positive integer m input to the basic information generation unit 11 (see FIG. 2) of the encrypted information generation server 10. Here, the bit value of the i-th bit (1 ≦ i ≦ m) when the user identifier v is represented by a bit string is expressed as v _i . That is, the user identifier v is composed of a bit string of (v ₁ , v ₂ ,..., V _m ).

Here, the user identifier v is included in the user secret key, but the user identifier v does not necessarily have to be secret information. Therefore, the user secret key generation means 23 may generate the user secret key _dv by the following equation (4) including the first secret information, the second secret information, and the third secret information. In the equation (4), the first to third terms correspond to the first to third secret information, respectively.

  The user secret key generated by the user secret key generation unit 23 is output to the user secret key output unit 24.

The user secret key output unit 24 outputs the user secret key generated by the user secret key generation unit 23 to the outside. The user secret key output means 24 may be written in a general-purpose storage medium (external storage medium) such as a tamper-resistant IC card or a flexible disk, or via a network (intranet 3, Internet 7). It may be transmitted to the user terminal 50. However, when the user secret key is written in the storage medium, the storage medium is delivered to the user side by mail or the like.
By configuring the secret key generation server 20 in this way, the secret key generation server 20 can generate a user secret key to be distributed to the user terminal 50.

  The secret key generation server 20 can be realized by a general computer having a CPU and a memory (not shown). At this time, the secret key generation server 20 is operated by a secret key generation program that causes the computer to function as each of the means described above.

(Content server configuration)
Next, the configuration of the content server 30 will be described with reference to FIG. 4 (refer to FIG. 1 as appropriate). Here, the content server 30 includes an encryption key generation unit 31, a public key reception unit 32, a header generation unit 33, a content reception unit 34, a content encryption unit 35, a header synthesis unit 36, and a distribution purpose. A content storage unit 37, a content request receiving unit 38, and a distribution content transmitting unit 39 are provided.

  The encryption key generation unit 31 generates an encryption key for encrypting content. The encryption key generated here is output to the header generation unit 33 and the content encryption unit 35. This encryption key is an encryption key used in the content encryption means 35, and is randomized using a pseudo random number generation means, a hash function (not shown), etc., and the key lengths are made uniform. Is.

The public key receiving unit 32 receives the public key PK generated by the encrypted information generation server 10 (see the formula (2)) via the intranet 3. The public key received here is output to the header generation means 33.
Here, the public key receiving means 32 receives public information (combined number p, generator g, bilinear mapping e, group G and group G _T ) together with the public key PK. The public key receiving unit 32 writes the received public information in the distribution content storage unit 37 and outputs the composite number p of the public information to the header generation unit 33.
The public information may be received separately by providing public information receiving means (not shown) and independent of the public key PK.

The header generation unit 33 encrypts the encryption key Ks generated by the encryption key generation unit 31 with the public key PK received by the public key reception unit 32, thereby synthesizing the content with the content (content distribution header). Is generated.
Here, the header generation means 33 selects a random number t in advance from Z _p ^* (= {1, 2,..., P−1}) (where p is a composite number acquired as public information) ( A random number t is generated by a pseudo random number generating means (not shown), and a content distribution header (header information) C shown in the following expression (5), which is a ciphertext, is obtained using the encryption key Ks and the public key PK. Generate.

That is, the header generation unit 33 uses the product (KsG _e ^t ) of the value obtained by raising the G _e included in the public key PK to the power t and the encryption key Ks, and E _γ , H ₀ , H ₁ included in the public key PK. _{, 0} , H _1,1 ,..., H _{m, 0} , H _{m, 1} are raised to the power of ^t (E _γ ^t , H ₀ ^t , H _1,0 ^t , H _1,1 ^t ,..., H _{m , 0} ^t , H _{m, 1} ^t ), E _γ to the power of t ₀ and t ₁ , E _δ to the power of t ₀ and t ₁ , respectively, and H _{j, 0} ^t , H _{j, 1} ^t And a content distribution header C including the product (H _{j, 0} ^t E _δ ^t0 , H _{j, 1} ^t E _δ ^t1 ). Note that j is an index (bit index) indicating a bit position in the user identifier, and is a value of 1 ≦ j ≦ m in a positive integer m that is the bit length of the user identifier. The index j is a value selected by the provider from 1 ≦ j ≦ m in advance, and is input via an input unit (not shown). Then, the header generation unit 33 outputs the generated content distribution header to the header synthesis unit 36.

  The content receiving unit 34 receives content for distribution. The content received here is output to the content encryption unit 35. For example, the content receiving unit 34 may read content from a recording medium (not shown), or may acquire content as communication data via a network (Internet 7 or the like). .

  The content encryption unit 35 encrypts the content for distribution received by the content reception unit 34 with the encryption key generated by the encryption key generation unit 31 to generate encrypted content. The encrypted content generated here is output to the header synthesis means 36. The content encryption unit 35 encrypts the content by using a common key encryption method using the encryption key. In addition, since the content to be encrypted is assumed to be information with a large amount of data such as video, here, the common key encryption method, which is faster than the public key encryption method, is used. I will do it. For example, a common common key encryption method such as AES (Advanced Encryption Standard) may be used.

  The header synthesizing unit 36 synthesizes the encrypted content generated by the content encrypting unit 35 and the content distribution header C generated by the header generating unit 33 (see the above formula (5)) to generate the distribution content. Is to be generated. The distribution content generated here is stored in the distribution content storage unit 37 with unique content identification information (for example, a file name).

  Note that the composition of the encrypted content and the content distribution header in the header composition means 36 does not only mean that the data is synthesized as one data (file, stream). That is, the encrypted content and the content distribution header need only be associated with each other, and can be managed as individual data. However, in order to simplify the management, it is preferable to combine the encrypted content and the content distribution header into one data.

The distribution content storage unit 37 stores the distribution content generated by the header synthesis unit 36 and is a general storage device such as a hard disk. The distribution content stored in the distribution content storage unit 37 is read by the distribution content transmission unit 39.
Here, the distribution content storage unit 37 also stores the public information received by the public key receiving unit 32.

  The content request receiving unit 38 receives a request (content request) for content including content identification information for specifying content for distribution transmitted from the content distribution server 40 via the intranet 3. The content request receiving unit 38 outputs the identification information included in the content request to the distribution content transmitting unit 39.

The distribution content transmission means 39 reads the distribution content corresponding to the content identification information output from the content request reception means 38 from the distribution content storage means 37 and transmits it to the requested content distribution server 40. It is.
If the content request receiving unit 38 receives a public information request (public information request) before the content request, the content request receiving unit 38 notifies the distribution content transmitting unit 39 to that effect. Then, the distribution content transmission unit 39 reads the public information from the distribution content storage unit 37 and transmits it to the content distribution server 40.

  By configuring the content server 30 in this way, the content server 30 encrypts the content with the encryption key, and associates the encrypted encrypted content with the content distribution header to generate the content for distribution. Can do.

  The content server 30 can be realized by a general computer having a CPU and a memory (not shown). At this time, the content server 30 operates according to the distribution content generation program that causes the computer to function as each of the above-described means.

(Content distribution server configuration)
Next, the configuration of the content distribution server 40 will be described with reference to FIG. 5 (refer to FIG. 1 as appropriate). Here, the content distribution server 40 includes a user request receiving unit 41, a content request transmitting unit 42, a distribution content receiving unit 43, and a distribution content transmitting unit 44.

  The user request receiving means 41 receives a request (content request form) transmitted from the user terminal 50 and indicating the content desired by the user via the network. This content request document includes at least content identification information for specifying the content and terminal identification information (for example, an IP address) indicating which user terminal 50 is requested. The user request receiving unit 41 outputs the content identification information to the content request transmitting unit 42 and outputs the terminal identification information to the distribution content transmitting unit 44.

  The content request transmission unit 42 transmits a content request (content request) including content identification information output from the user request reception unit 41 to the content server 30 via the intranet 3.

  The distribution content receiving unit 43 receives the distribution content corresponding to the content identification information transmitted from the content request transmission unit 42 from the content server 30 via the intranet 3. The distribution content receiving unit 43 outputs the received distribution content to the distribution content transmitting unit 44.

  The distribution content transmitting unit 44 transmits the distribution content received by the distribution content receiving unit 43 to the user terminal 50 corresponding to the terminal identification information output from the user request receiving unit 41.

By configuring the content distribution server 40 in this manner, the content distribution server 40 can acquire the distribution content requested from the user terminal 50 from the content server 30 and distribute it to the requested user terminal 50. it can.
Further, when there is a request for public information from the user terminal 50, the content distribution server 40 transmits a public information request to the content server 30, acquires the public information, and transmits it to the user terminal 50. In this case, the flow of data for the public information request and the public information is the same as that for the content request and the content for distribution.

  The content distribution server 40 can be realized by a general computer having a CPU and a memory (not shown). At this time, the content distribution server 40 operates by a content distribution program that causes the computer to function as each of the above-described means.

  The configuration of each device on the provider side in the content distribution system 1 has been described above, but the present invention is not limited to this. For example, the encrypted information generation server 10 may be incorporated in the content server 30 and newly configured as the content server 30B (not shown). Alternatively, the content server 30B (not shown) may be incorporated in the content distribution server 40 and newly configured as the content distribution server 40B (not shown).

  For example, in order to distribute the load in the content distribution system 1, a plurality of content servers 30 may be provided depending on the type of content. In this case, the content distribution server 40 transmits a content request by switching the content server that requests the content depending on the type of content.

(User terminal configuration)
Next, the configuration of the user terminal 50 will be described with reference to FIG. 6 (see FIG. 1 as appropriate). Here, the user terminal 50 includes a distribution content request unit 51, a distribution content reception unit 52, a separation unit 53, a secret key storage unit 54, an encryption key decryption unit 55, a content decryption unit 56, It has.

  The distribution content request means 51 transmits a request (content request) indicating the content desired by the user (distribution content) to the content distribution server 40 on the provider side via the Internet 7. For example, the distribution content requesting unit 51 includes content identification information by inputting content identification information (for example, a file name) specifying the content desired by the user by an input unit (not shown). A content request is generated and transmitted to the content distribution server 40.

  The distribution content receiving means 52 receives the distribution content requested by the user from the provider-side content distribution server 40 via the Internet 7. The distribution content received here is output to the separating means 53. In addition, in the distribution content received here, the content distribution header C (see the above formula (5)) is combined with the encrypted content (encrypted content).

  The separating unit 53 separates the distribution content received by the distribution content receiving unit 52 into a content distribution header and an encrypted content. The separated content distribution header is output to the encryption key decryption unit 55, and the encrypted content is output to the content decryption unit 56.

  The secret key storage means 54 is a general-purpose storage medium (external storage medium) such as an IC card or a flexible disk having tamper resistance, and the user secret key is written in advance on the provider side and distributed to the user. is there.

The encryption key decryption means 55 decrypts and extracts the encryption key from the content distribution header separated by the separation means 53 based on the user secret key stored in the secret key storage means 54. The decrypted encryption key is output to the content decrypting means 56.
In the encryption key decryption means 55, the user secret key stored in the secret key storage means 54 is d _v (= formula (3)) = (v, d _{v, 1} , d _{v, 2} , d _{v 3} ), the content distribution header separated by the separation means 53 is C (= the above equation (5)) = (j, C _G , C _E , C _E0 , C _E1 , C ₀ , C ₁ , ₀ , C ₁ ,..., C _{m, 0} , C _{m, 1} ), the encryption key Ks is decrypted by the following equation (6). Note that the bilinear map e used here is acquired in advance as public information through the same route as the distribution content, and is stored in a storage unit (not shown).

Here, v is user-specific information (user identifier). Further, v _i is the value of the i-th bit of the user identifier v. The right side of the expression (6) is encrypted by the modification shown in the following expression (7) based on the expressions (2), (4) and (5), and the property of the bilinear map e. It can be proved that the key Ks is indicated.

The bilinear map e has a property of e (g ₁ ^α , g ₂ ^β ) = e (g ₁ , g ₂ ) ^αβ . Therefore, by utilizing this property, the deformation shown in the equation (7) is performed.

  The content decrypting unit 56 decrypts the encrypted content using the encryption key decrypted by the encryption key decrypting unit 55. The content decrypting unit 56 decrypts the encrypted content after the content distribution header is separated by the separating unit 53 using the encryption key. As a result, the encrypted content is decrypted into content that can be viewed and the like.

  By configuring the user terminal 50 in this way, the user terminal 50 must use user-specific information (user identifier) when decrypting the encryption key Ks. As a result, even when a certain user creates an unauthorized user terminal using a private key owned by the user, the unauthorized user terminal must include the owner's ID and secret key. Therefore, the user who created the unauthorized user terminal can be easily identified.

  The user terminal 50 can be realized by a general computer having a CPU and a memory (not shown). At this time, the user terminal 50 operates by a content decryption program that causes the computer to function as each of the means described above.

(Configuration of unauthorized user tracking server)
Next, the configuration of the unauthorized user tracking server 90 will be described with reference to FIG. 7 (refer to FIG. 1 as appropriate). Here, the unauthorized user tracking server 90 includes a public information storage unit 91, a content storage unit 92, a test data generation unit 93, a test data transmission unit 94, a decrypted data reception unit 95, and a user identifier specification unit 96. User information storage means 97 and user search means 98 are provided. Here, it is assumed that the unauthorized user tracking server 90 is connected to a user terminal 50B (50) that is a target for specifying a user.

The public information storage unit 91 stores a public key (public information) disclosed in the encryption information generation server 10 and is a general storage device such as a hard disk. Specifically, the public information storage unit 91 includes public information (p, g, e (), G, G _T ) disclosed in the encrypted information generation server 10 and a public key PK = (G _e , E _γ , E _δ , H ₀ , H ₁ , ₀ , H ₂ , ₀ ,..., H _{m, 0} , H ₁ , ₁ , H ₂ , ₁ , ..., H _{m, 1} ) deep.
The public key (public information) stored in the public information storage unit 91 is read by the test data generation unit 93.

The content storage unit 92 stores test content to be included in the test data output to the user terminal 50B, and is a general storage device such as a hard disk. The content stored in the content storage unit 92 may be the same type as that distributed to the regular user terminal 50. For example, if the user terminal 50B is a terminal for viewing video / audio content, the content storage unit 92 stores the video / audio content as content for test data. For example, if the user terminal 50B is a terminal that presents character information, the content storage unit 92 stores text data as content for test data.
The content stored in the content storage unit 92 is read by the test data generation unit 93 and the user identifier specifying unit 96.

  The test data generation means 93 generates test data for testing a predetermined bit of a user identifier of a user who uses the user terminal 50B (specifying a bit value) from the user terminal 50B. Here, the test data generation unit 93 includes a header generation unit 931, a content encryption unit 932, and a header synthesis unit 933.

The header generation unit 931 generates a header (test content distribution header) to be combined with the test content. Here, the header generation means 931 uses six different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′ in advance as Z _p ^* (= {1, 2,..., P−1}. ) (Where p is the composite number stored in the public information storage means 91 as public information) (random numbers t, t ₀ , t ₁ , t ₀ ′ by pseudo random number generation means not shown) , T ₁ ′, t ₂ ′), and using the encryption key Ks and the public key PK, the test content distribution header (header information) C ^* _{j, 1} shown in the following equation (8) is generated. To do.

The test content delivery headers C ^* _0,1 , C ^* _1,1 ,..., C ^* _{m, 1} generated in this way are sequentially output to the header synthesis means 933.
In the equation (8), j is an integer of 1 ≦ j ≦ m, and m is the bit length of the user identifier v. Further, in the equation _{^{(8), E γ t1 g 2 t '}} 1 and _{^{H j, 1 t E δ t1}} g 2 t' 2 are, the other elements include a generator _{g 2} different groups _{G 2} Yes.
That is, the header generation means 931 sequentially adds j one by one from j = 1, and the test content distribution headers C ^* _0,1 , C ^* _1,1 ,..., C ^* _{m, 1} is generated. At this time, each C ^* _{j, 1} is a value obtained by multiplying only H _{j, 1} by the power of t and at the same time E _δ ^t1 g ₂ ^t ′ ² times.
Thus, the test content distribution header ^C _{* j, 1} is specified by the value of _{^{j H j, 1 t E δ}} t1 g 2 t '2 is a generator g of the different groups _{G 2} is other elements ₂ and dummy data is set.

On the other hand, the user's private key _{d v} used in the user terminal 50B, the equation (3), (4) As shown in equation _{x 1} of a generator _{g 1, v1 squared, x 2, v2} square, ..., _xm , generated using the power of _vm . These v ₁ , v ₂ ,..., V _m are bit values of the user identifier v.
Therefore, for example, if the value of the first bit of the user identifier v is “0”, the power of g _{1 to} the power of x _{1 and} v 1 is “g _{1 to} the power of x _{1 and 0} (H _{1, 0} ; see formula (2) above”. ) Is used, and if the value of the first bit is “1”, x _1,1 power (H _1,1 ) is used.

Here, it is assumed that, for example, dummy data is set to j = 1 in the test content distribution header C ^* _{j, 1} . That is, _{assume that} only H _1,1 is raised to the power of t and multiplied by E _δ ^t1 g ₂ ^t ′ ² . Then, if the value of the first bit of the user identifier v is “0”, the user terminal 50B can decrypt the content because the regular H _{1,0 to} the power of t is used. v if the value of the first bit is "1", ^{for 2} _'g ² t of _{^{2' H j, 1 t E}} δ t1 g 2 t is a dummy data is used, it decrypts the content Can not.

Thus, by setting H _{j, 1} ^t E _δ ^t1 g ₂ ^t ′ ² sequentially from j = 1 to j = m, each of the user identifiers v depends on whether or not the content can be decrypted. The bit value can be specified. The identification of each bit value of the user identifier v is performed by a user identifier specifying means 96 described later.

  The content encryption unit 932 encrypts the test content. Here, the content encryption unit 932 encrypts the test content stored in the content storage unit 92 with the encryption key Ks. The encryption key Ks may be generated in the same manner as the encryption key generation unit 31 (see FIG. 4), or may be stored in the content storage unit 92 in advance. The content encryption unit 932 outputs the encrypted content to the header synthesis unit 933.

The header synthesizing unit 933 synthesizes the encrypted content generated by the content encrypting unit 932 with the test content distribution header C ^* _{j, 1} (refer to the expression (8)) sequentially generated by the header generating unit 931. To generate test data. The test data generated here is output to the test data transmission means 94.

The test data transmission unit 94 sequentially transmits the test data generated by the test data generation unit 93 to the user terminal 50B that is a target for specifying the user. As a result, the user terminal 50B to which the test data is input has the encrypted content included in the test data, the test content distribution header C ^* _{j, 1} also included in the test data, and the user terminal 50B. Decrypt using the stored user private key. The decrypted data (decrypted content) decrypted by the user terminal 50B is input to the unauthorized user tracking server 90.

The decoded data receiving means 95 receives the decoded data (decoded content) decoded by the user terminal 50B. The decoded data receiving means 95 receives as many pieces of decoded data as the number of bits corresponding to the number of bits of the user identifier v output from the test data transmitting means 94 from the user terminal 50B.
The decoded data received by the decoded data receiving unit 95 is sequentially output to the user identifier specifying unit 96.

The user identifier specifying unit 96 compares the content used when the test data is generated by the test data generation unit 93 with the decrypted data (decoded content) sequentially received by the decrypted data receiving unit 95, thereby obtaining the user identifier. Is specified.
Here, the content used when the test data is generated (more specifically, the content stored in the content storage unit 92) is M, and the decrypted data input by the decrypted data receiving unit 95 is M ′ _j ( 1 ≦ j ≦ m; m is the bit length of the user identifier).

At this time, the user identifier identifying unit 96, _'the case of _j, the value of the value _{v j} of j-th bit of the user identifier _{"0", M ≠ M'} M = M For _j, j-th bit values of the user identifier Specify v _j as the value “1”.
Then, the user identifier specifying unit 96 specifies the user identifier v = (v ₁ v ₂ ... V _m ) by concatenating the bit values of the user identifier specified for all j of 1 ≦ j ≦ m. The user identifier v specified in this way is output to the user search means 98.

  The user information storage unit 97 stores a database in which user information is associated with a user identifier, and is a general storage device such as a hard disk. Here, the user information is information for identifying the user, for example, personal information (name, address, etc.) of the user. In the user information storage unit 97, the provider stores the user information and the user identifier in advance in a database.

  The user searching means 98 searches the user information corresponding to the user identifier specified by the user identifier specifying means 96 from the database stored in the user information storage means 97 and specifies the user. The user information of the user specified by the user search means 98 is output to the outside (for example, a display device not shown) as information specifying the user of the user terminal 50B.

The configuration of the unauthorized user tracking server 90 has been described above, but the present invention is not limited to this. Here, the header generation means 931 raises _one of H _{1,1 to} H _{m, 1 to} the power of t in each test content delivery header C ^* _{j, 1} , and doubles E _δ ^t1 g ₂ ^t ′ ² times However, as shown in the following equation (9), one of H _{1,0 to} H _{m, 0} is raised to the power of t and multiplied by E _δ ^t0 g ₂ ^t ′ ² , the test content delivery header C ^* _{j, 0} may be used.

In this case, for example, if the value of the first bit of the user identifier v is “1”, the user terminal 50B uses a value obtained by multiplying the regular H _{1,1 to} the power of t and E _δ ^t1. However, if the value of the first bit of the user identifier v is “0”, the dummy data H _{j, 0} ^t E _δ ^t0 g ₂ ^t ′ ² is used. The content cannot be decrypted.
Therefore, when using the equation (9), the user identifier specifying unit 96 uses M as the content used when the test data is generated, and M ′ _j (1 ≦ j) as the decoded data input by the decoded data receiving unit 95. ≦ m; m is the bit length of the user identifier). When M = M ′ _j , the value v _j of the j-th bit of the user identifier is the value “1”, and when M ≠ M ′ _j , the user identifier The value v _j of the j-th bit is specified as the value “0”.

  In this example, the unauthorized user tracking server 90 specifies user information (such as user personal information), but may simply have a function for specifying a user identifier. In this case, the unauthorized user tracking server 90 is configured by omitting the user information storage unit 97 and the user search unit 98 from the configuration described in FIG.

  Here, the unauthorized user tracking server 90 inputs the decrypted data (decrypted content) from the user terminal 50B. However, for example, when the user terminal 50B reproduces and outputs the content as a video signal or an audio signal, the test data generation unit 93 sequentially generates and outputs test data in accordance with an operator instruction input from the outside. Thus, the operator determines whether or not the video has been normally reproduced normally as video or audio, and specifies the user identifier. In this case, the unauthorized user tracking server 90 is configured to only transmit test data sequentially, and is configured by omitting the decrypted data receiving means 95, the user identifier specifying means 96, the user information storage means 97, and the user search means 98.

  The unauthorized user tracking server 90 can be realized by a general computer having a CPU and a memory (not shown). At this time, the unauthorized user tracking server 90 operates by an unauthorized user tracking program (user identification program) that causes the computer to function as each of the above-described means.

  Although the configuration of the content distribution system 1 has been described above, the encryption method in this system is based on the standard model (Standard Model), the CDH (Computational Diffie-Hellman) assumption, and the DBDH (Decisive Bilinear Diffi-Hellman) assumption. Safety proof based on this is possible. In general, it is said that the safety is proved to be higher on the standard model than the safety is proved on another model, for example, the generic model (Generic Model). Therefore, the content distribution system 1 can ensure higher safety compared to the case where the system is configured with another encryption method.

[Operation of content distribution system]
Next, operations of the content distribution system according to the embodiment of the present invention will be described with reference to FIGS.

(Public key / user secret key generation operation)
First, referring to FIG. 8 (refer to FIGS. 1, 2 and 3 as appropriate), an operation of generating a public key and a user secret key in the content distribution system 1 will be described.

First, the encrypted information generation server 10 generates (selects) the prime numbers p ₁ and p ₂ and the composite number p = p ₁ × p ₂ by the basic information generation unit 11 (step S10). Further, the encrypted information generation server 10 uses the basic information generating unit 11, of order to generate a origin g ₂ groups of origin g ₁ and of order p ₂ groups of (prime) p ₁ (selection) The generation source g = g ₁ × g ₂ is generated (step S11).

Further, the encrypted information generation server 10 is identified by the basic information generating unit 11, of order a composite number p, the bilinear mapping e from the group G to a generator element g to the group G _T a (·, ·) (Step S12).

Next, the encrypted information generation server 10 uses the master secret information generation means 12 to 2m + 1 where 1 ≦ x ₀ , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} <p. Number x ₀ , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} and four numbers α, β, 1 ≦ α, β, γ, δ <p. γ, δ are selected at random, and the secret information master = (g ₁ , g ₂ , p ₁ , p ₂ , x ₀ , x ₁ , ₀ , x ₁ , ₁ ,..., x _{m, 0} , x _{m , 1} , α, β, γ, δ).
Then, the encrypted information generation server 10 uses the master secret information generation means 12 to generate the generators g ₁ and g ₂ and x ₀ , x ₁ , ₀ , x ₁ , _{1,. From m, 0} , xm _{, 1} , a public parameter param (see equation (1)) serving as a parameter for generating a user secret key or public key and a master secret key msk (= (g ₁ ^αβ , g ₂ )) is generated as master secret information together with secret information (step S13).

Then, the encrypted information generation server 10 sends the master secret information (master secret key msk, public parameter param) generated in step S13 by the master secret information transmission unit 13 to the secret key generation server 20 via the intranet 3. Transmit (step S14).
The public information other than the public parameters is transmitted to the secret key generation server 20 after step S12 or at the timing of step S14.

Furthermore, the encryption information generation server 10 uses the public key generation unit 14 to input the positive integer m input in step S10, the composite number p generated in step S10, and the generation source g ₁ generated in step S11. Based on the public parameter param generated in step S13 and α, β, γ, and δ, which are part of the secret information, a public key PK (see the above equation (2)) is generated (step S15).
Thereafter, the encrypted information generation server 10 transmits the public key generated in step S15 to the content server 30 via the intranet 3 by the public key transmission unit 15 (step S16).

  The secret key generation server 20 receives the master secret information (secret information master, master secret key msk, and public parameter param) transmitted from the encryption information generation server 10 in step S14 by the master secret information receiving unit 21. Then, it is written and stored in the master secret information storage means 22 (step S17).

Then, the secret key generation server 20 uses the user secret key generation unit 23 to store the master secret key msk stored in the master secret information storage unit 22, the public parameter param, the user identifier v, and Z _p ^* (= {1,2, ..., p-1 } from) the random number selected from _{r v, 1, r v,} 2 Prefecture, by the equation (3), generating a user's private key _{d v} for each user (step S18) .

Then, the secret key generating server 20, the user secret key output unit 24 writes the user private key d _v generated at step S18 in the storage medium. Then, the provider distributes the storage medium to the user (step S19). The user secret key output unit 24, a user private key d _v, network (intranet 3, the Internet 7) may be transmitted to the user terminal 50 via the.

  Through the above operation, the encryption information generation server 10 can generate a public key and transmit it to the content server 30. The secret key generation server 20 can generate a user secret key and distribute it to the user.

(Delivery content generation operation)
Next, with reference to FIG. 9 (refer to FIGS. 1 and 4 as appropriate), the operation of generating content for distribution in the content distribution system 1 will be described. The public information is assumed to have been acquired in advance.

First, the content server 30 generates the encryption key Ks for encrypting the content by the encryption key generation means 31 (step S20).
Then, the content server 30 receives the public key PK (see formula (2)) generated by the encryption information generation server 10 by the public key receiving unit 32 via the intranet 3 (step S21).

  Thereafter, the content server 30 encrypts the encryption key Ks generated in step S20 with the public key PK received in step S21 by the header generation unit 33, so that the header (content distribution header C; (Refer to formula (5)) (step S22).

  Further, the content server 30 receives content for distribution from the outside by the content receiving unit 34 (step S23). Then, the content server 30 encrypts the content received in step S23 by the content encryption unit 35 using a common key encryption method such as AES using the encryption key Ks generated in step S20 (step S24). ).

Thereafter, the content server 30 synthesizes the content encrypted in step S24 (encrypted content) and the content distribution header C generated in step S22 by the header synthesizing unit 36, thereby generating distribution content. (Step S25). The distribution content is stored in the distribution content storage unit 37.
With the above operation, the content server 30 can generate distribution content by combining a content distribution header that cannot be decrypted without using a user secret key with the encrypted content.

(Content distribution operation for distribution)
Next, with reference to FIG. 10 (refer to FIG. 1 and FIGS. 4 to 6 as appropriate), an operation of distributing content (content for distribution) in the content distribution system 1 will be described.

First, the user terminal 50 generates a content request including content identification information indicating the content desired by the user by using the distribution content request means 51 (step S30) and transmits it to the content distribution server 40 (step S31). .
Further, the content distribution server 40 receives the content request from the user terminal 50 by the user request receiving unit 41 (step S32), and the content identification information described in the content request by the content request transmitting unit 42. (Content identification information such as a file name) is transmitted as a content request to the content server 30 (step S33).

  Then, the content server 30 receives the content request from the content distribution server 40 by the content request receiving unit 38 (step S34), and the distribution content transmitting unit 39 stores the corresponding content (distribution content) in the distribution content storage. It reads from the means 37 (step S35), and transmits to the content distribution server 40 (step S36).

Then, the content distribution server 40 receives the distribution content from the content server 30 by the distribution content receiving means 43 (step S37), and the distribution content transmission means 44 sends the distribution content to the user who requested it. It transmits to the terminal 50 (step S38).
Then, the user terminal 50 receives the distribution content by the distribution content receiving means 52 (step S39).
With the above operation, the content distribution server 40 can transmit (distribute) distribution content to the user terminal 50 that has requested it.

(Decoding content for distribution)
Next, referring to FIG. 11 (refer to FIGS. 1 and 6 as appropriate), an operation of decrypting content (content for distribution) in the content distribution system 1 will be described. The public information is assumed to have been acquired in advance.

First, the user terminal 50 receives the distribution content from the content distribution server 40 by the distribution content receiving means 52 (step S40). Then, the user terminal 50 separates the distribution content into the content distribution header and the encrypted content by the separating unit 53 (step S41).
Then, the user terminal 50, the encryption key decrypting unit 55 reads the user private key _{d v} stored in the secret key storage unit 54 (step S42), and based on the user private key _{d v,} at step S41 The encryption key Ks is decrypted and extracted from the separated content distribution header according to the equation (6) (step S43).

Then, the user terminal 50 decrypts the encrypted content using the encryption key decrypted in step S43 by the content decrypting means 56 (step S44). At this stage, the user can view the decrypted content.
Through the above operation, the user terminal 50 can decrypt the encryption key with the user private key unique to the user and decrypt the encrypted content with the encryption key.

(User specific operation)
Next, referring to FIG. 12 (refer to FIG. 7 as appropriate), an operation for specifying the user who created the unauthorized user terminal 50B (50) in the content distribution system 1 will be described. The public information is assumed to be stored in the public information storage unit 91 in advance.

First, the unauthorized user tracking server 90 initializes the variable j (value “1”) (step S50).
Then, the unauthorized user tracking server 90 generates test data for testing the j-th bit of the user identifier by the test data generating means 93 (step S51).
Specifically, the unauthorized user tracking server 90 uses the header generation unit 931 of the test data generation unit 93 to encrypt six different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′, Using the activation key Ks and the public key PK stored in the public information storage means 91, the test content distribution header C ^* _{j, 1} or C ^* _{j, 0} shown in the equation (8) or (9) (1 ≦ j ≦ m; m is the bit length of the user identifier).

In addition, the unauthorized user tracking server 90 encrypts the test content stored in the content storage unit 92 with the encryption key Ks by the content encryption unit 932 of the test data generation unit 93.
Then, the unauthorized user tracking server 90 uses the header composition unit 933 of the test data generation unit 93 to add the encrypted content to the test content distribution header C ^* _{j, 1} or C ^* _{j, 0} (1 ≦ j ≦ m). By combining, test data is generated.

Thereafter, the unauthorized user tracking server 90 transmits the test data having the test content delivery header C ^* _{j, 1} or C ^* _{j, 0} of the variable j to the user terminal 50 by the test data transmission means 94 (step S52). .
Then, the unauthorized user tracking server 90 receives the decrypted data (decrypted content) obtained by decrypting the test data by the user terminal 50 by the decrypted data receiving unit 95 (step S53).

Then, the unauthorized user tracking server 90 analyzes the decrypted data (decrypted content) received in step S53 by the user identifier identifying unit 96 and identifies the j-th bit value of the user identifier (step S54).
That is, in the case where the formula (8) (C ^* _{j, 1} ) is used in step S51, the user identifier specifying unit 96 uses the content used in step S51 and the decrypted data (decoded content) received in step S53. Are the same, the value of the j-th bit of the user identifier is specified as the value “0”, and if not the same, the value “1” is specified.

In step S51, when the equation (9) (C ^* _{j, 0} ) is used, the user identifier specifying unit 96 uses the content used in step S51 and the decrypted data (decoded content) received in step S53. Are the same, the value of the j-th bit of the user identifier is specified as the value “1”, otherwise the value “0” is specified.

Then, the unauthorized user tracking server 90 determines whether or not the variable j matches m, which is the bit length of the user identifier, that is, j = m (step S55).
If j = m is not satisfied (“No” in step S55), the unauthorized user tracking server 90 increments (+1) the variable j (step S56), and returns to step S51.
On the other hand, when j = m (“Yes” in step S55), the unauthorized user tracking server 90 specifies the user identifier by concatenating the bit values sequentially specified in step S54 by the user identifier specifying unit 96. (Step S57).

Then, the unauthorized user tracking server 90 searches the user information corresponding to the user identifier specified in step S57 from the database stored in the user information storage means 97 by the user search means 98 and specifies the user (step) S58). The user specified here is specified as the user who performed fraud.
With the above operation, the unauthorized user tracking server 90 can track (detect) which user has created the unauthorized user terminal 50.

As described above, the content distribution system 1 is proportional to the logarithm of the number of users of the master secret key that allows the number of elements of the user secret key to be a fixed number or the number of elements of the content distribution header that becomes ciphertext. A public key that can be a number can be generated.
Thereby, the content distribution system 1 can reduce the data amount of the secret key held in the user terminal (content decryption device) 50. Even when content is distributed all at once, the number of elements in the content distribution header, which is the ciphertext, is not proportional to the number of users, but is proportional to the logarithm of the number of users, so the amount of data can be suppressed. , Can reduce the load on the network.
Furthermore, since the content distribution system 1 can specify the user (user identifier) from the user terminal, the user secret key can be duplicated, and the unauthorized user can be identified from the user terminal that has been illegally created.

1 Content Distribution System 10 Encrypted Information Generation Server (Encrypted Information Generation Device)
DESCRIPTION OF SYMBOLS 11 Basic information generation means 12 Master secret information generation means 13 Master secret information transmission means 14 Public key generation means 15 Public key transmission means 20 Secret key generation server (secret key generation apparatus)
21 Master Secret Information Receiving Unit 22 Master Secret Information Storage Unit 23 User Secret Key Generation Unit 24 User Secret Key Output Unit 30 Content Server (Distribution Content Generation Device)
Reference Signs List 31 Encryption key generation means 32 Public key reception means 33 Header generation means 34 Content reception means 35 Content encryption means 36 Header composition means 37 Distribution content storage means 38 Content request reception means 39 Distribution content transmission means 40 Content distribution server 41 User request reception means 42 Content request transmission means 43 Distribution content reception means 44 Distribution content transmission means 50 User terminal (content decryption apparatus)
51 Distribution Content Requesting Unit 52 Distribution Content Receiving Unit 53 Separation Unit 54 Secret Key Storage Unit 55 Encryption Key Decryption Unit 56 Content Decryption Unit 90 Unauthorized User Tracking Server (User Identification Device)
91 public information storage means 92 content storage means 93 test data generation means 94 test data transmission means 95 decrypted data reception means 96 user identifier specification means 97 user information storage means (database)
98 User search means

Claims (10)

Encrypted information generating device for generating master secret information for generating a user secret key distributed to a content decrypting device and a public key corresponding to the user secret key in a content distribution system for encrypting and distributing content Because
As the basic information, the prime _p 1, _{p 2,} and, generates a generator _{g 1} of the group _{G 1} to the prime _{p 1} and of order and, the origin _{g 2} groups _{G 2} to a prime number _{p 2} and of order as well as, a composite number _p = p ₁ × p ₂ a quantile, _g = g ₁ × g ₂ identifies the bilinear mapping e from the group G to a generator to the group _{G T,} and public information (p, g , E, G, G _T ), basic information generating means,
A predetermined positive integer as the bit length of the user identifier for identifying the user as m, depending on the generated combined number p in the basic information generating _{means, 1 ≦ x 0, x 1,0} , x 1 _{, 1} ,..., X _{m, 0} , x _{m, 1} <p where x ₀ , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} and 1 ≦ α, β, gamma, [delta] <a p alpha, beta, gamma, and select and [delta], as the master secret information, secret information _{(g 1, g 2, p} 1, p 2, x 0, x 1,0, x 1 _{, 1} ,..., X _{m, 0} , x _{m, 1} , α, β, γ, δ) and master secret key msk = (g ₁ ^αβ , g ₂ ), and parameter param

Master secret information generating means generated by
From the parameter param generated by the master secret information generating means, the bilinear map e, and the secret information, the public key PK is

Public key generation means generated by
An encrypted information generating apparatus comprising: In a content distribution system that encrypts and distributes content, a computer is generated to generate master secret information for generating a user secret key distributed to the content decryption apparatus and a public key corresponding to the user secret key. ,
As the basic information, the prime _p 1, _{p 2,} and, generates a generator _{g 1} of the group _{G 1} to the prime _{p 1} and of order and, the origin _{g 2} groups _{G 2} to a prime number _{p 2} and of order as well as, a composite number _p = p ₁ × p ₂ a quantile, _g = g ₁ × g ₂ identifies the bilinear mapping e from the group G to a generator to the group _{G T,} and public information (p, g , E, G, G _T ) for generating basic information,
A predetermined positive integer as the bit length of the user identifier for identifying the user as m, depending on the generated combined number p in the basic information generating _{means, 1 ≦ x 0, x 1,0} , x 1 _{, 1} ,..., X _{m, 0} , x _{m, 1} <p where x ₀ , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} and 1 ≦ α, β, gamma, [delta] <a p alpha, beta, gamma, and select and [delta], as the master secret information, secret information _{(g 1, g 2, p} 1, p 2, x 0, x 1,0, x 1 _{, 1} ,..., X _{m, 0} , x _{m, 1} , α, β, γ, δ) and master secret key msk = (g ₁ ^αβ , g ₂ ), and parameter param

Master secret information generating means generated by
From the parameter param generated by the master secret information generating means, the bilinear map e, and the secret information, the public key PK is

Public key generation means generated by
An encryption information generation program characterized by causing it to function as: A secret key generation device for generating a user secret key to be distributed to a content decryption device based on the master secret information generated by the encryption information generation device according to claim 1 in a content distribution system for encrypting and distributing content Because
The public information generated by the encrypted information generating device, the secret information that is the master secret information generated by the encrypted information generating device, the parameter param, and the master secret key msk for identifying a user From the user identifier v and the random numbers r _{v, 1} , r _{v, 2} selected in advance from Z _p ^* , at least as the first secret information, the second secret information, and the third secret information,

And the user secret key generation means for generating a user secret key d _v that includes,
User secret key output means for outputting the user secret key _dv generated by the user secret key generation means;
A secret key generation device comprising: In a content distribution system for encrypting and distributing content, a computer for generating a user secret key to be distributed to the content decryption device based on the master secret information generated by the encrypted information generation device according to claim 1 The
The public information generated by the encrypted information generating device, the secret information that is the master secret information generated by the encrypted information generating device, the parameter param, and the master secret key msk for identifying a user From the user identifier v and the random numbers r _{v, 1} , r _{v, 2} selected in advance from Z _p ^* , at least as the first secret information, the second secret information, and the third secret information,

User secret key generation means for generating a user secret key d _v that includes,
User secret key output means for outputting the user secret key _dv generated by the user secret key generation means;
A secret key generation program characterized by functioning as In a content distribution system for encrypting and distributing content, a distribution content generation device for generating distribution content based on the public key PK generated by the encrypted information generation device according to claim 1,
Encryption key generation means for generating an encryption key Ks for encrypting the content;
A content encryption unit that encrypts the content with the encryption key Ks generated by the encryption key generation unit and generates an encrypted content;
The public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation means, the public key PK, and random numbers t, t ₀ , t previously selected from Z _p ^* ₁ and an index j indicating the bit position in the user identifier, a content distribution header C to be synthesized with the encrypted content is

Header generating means generated by
A header synthesizing unit that generates the distribution content by synthesizing the content distribution header C generated by the header generation unit and the encrypted content;
A content generating apparatus for distribution, comprising: In a content distribution system for encrypting and distributing content, in order to generate content for distribution based on the public key PK generated by the encrypted information generation device according to claim 1, a computer is provided.
An encryption key generating means for generating an encryption key Ks for encrypting the content;
A content encryption unit that encrypts the content with the encryption key Ks generated by the encryption key generation unit and generates an encrypted content;
The public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation means, the public key PK, and random numbers t, t ₀ , t previously selected from Z _p ^* ₁ and an index j indicating the bit position in the user identifier, a content distribution header C to be synthesized with the encrypted content is

Header generating means generated by
Header synthesizing means for generating the distribution content by synthesizing the content distribution header C generated by the header generation means and the encrypted content;
A content generation program for distribution, characterized in that it is made to function as: In the content distribution system for encrypting and distributing content, the distribution content generated by the distribution content generation device according to claim 5 is the user secret key d generated by the secret key generation device according to claim 3. A content decrypting device for decrypting based on _v ,
Separating means for separating the content for distribution into the content distribution header C and the encrypted content;
The content distribution header C separated by this separation means is expressed as (j, C _G , C _E , C _E0 , C _E1 , C ₀ , C ₁ , ₀ , C ₁ , ₁ ,..., C _{m, 0} , C _{m, 1),} and wherein said first secret information of the user private key _{d v} the user identifier v, the second secret information and the third secret information _{(d v, 1, d v} , 2, d v, ₃ ), the encryption key Ks used for encrypting the content is determined using the bilinear map e specified by the encryption information generation device according to claim 1 and disclosed as public information.

Encryption key decryption means for decrypting by
Content decrypting means for decrypting the encrypted content with the encryption key Ks decrypted by the encryption key decrypting means;
A content decryption apparatus comprising: In the content distribution system for encrypting and distributing content, the distribution content generated by the distribution content generation device according to claim 5 is the user secret key d generated by the secret key generation device according to claim 3. to decrypt based on _v ,
Separating means for separating the content for distribution into the content distribution header C and the encrypted content;
The content distribution header C separated by this separation means is expressed as (j, C _G , C _E , C _E0 , C _E1 , C ₀ , C ₁ , ₀ , C ₁ , ₁ ,..., C _{m, 0} , C _{m, 1),} and wherein said first secret information of the user private key _{d v} the user identifier v, the second secret information and the third secret information _{(d v, 1, d v} , 2, d v, ₃ ), the encryption key Ks used for encrypting the content is determined using the bilinear map e specified by the encryption information generation device according to claim 1 and disclosed as public information.

Encryption key decryption means for decryption by
Content decrypting means for decrypting the encrypted content with the encryption key Ks decrypted by the encryption key decrypting means;
A content decryption program that is allowed to function as: In the content distribution system for distributing encrypted content from the content decrypting apparatus of claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3, the user's private key A user identification device for identifying a corresponding user,
6 selected from the encryption key Ks, the public information and public key generated by the encrypted information generation apparatus according to claim 1, and Z _p ^* specified by the composite number p, which is one of the public information. Based on two different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′,

Generating test data for testing the j-th bit of the user identifier by synthesizing the test content with the encrypted content encrypted with the encryption key Ks;
Test data transmission means for transmitting the test data generated by the test data generation means to the content decryption device;
Decrypted data receiving means for receiving the content decrypted by the test data from the content decrypting device;
The content received by the decoded data receiving means and the test content are compared for all j of 1 ≦ j ≦ m, and based on whether the comparison result matches, j bits of the user identifier A user identifier specifying means for specifying an eye value;
User search means for searching for user information corresponding to the user identifier specified by the user identifier specifying means from a database in which the user identifier and user information for specifying the user are associated in advance;
A user specifying device comprising: In the content distribution system for distributing encrypted content from the content decrypting apparatus of claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3, the user's private key In order to identify the corresponding user,
6 selected from the encryption key Ks, the public information and public key generated by the encrypted information generation apparatus according to claim 1, and Z _p ^* specified by the composite number p, which is one of the public information. Based on two different random numbers t, t ₀ , t ₁ , t ₀ ′, t ₁ ′, t ₂ ′,

Generating test data for testing the j-th bit of the user identifier by synthesizing the test content with the encrypted content encrypted with the encryption key Ks,
Test data transmitting means for transmitting the test data generated by the test data generating means to the content decrypting device;
Decrypted data receiving means for receiving the content decrypted by the test data from the content decrypting device;
The content received by the decoded data receiving means and the test content are compared for all j of 1 ≦ j ≦ m, and based on whether the comparison result matches, j bits of the user identifier A user identifier specifying means for specifying an eye value;
User search means for searching for user information corresponding to the user identifier specified by the user identifier specifying means from a database in which the user identifier and user information for specifying the user are associated in advance;
A user-specific program that functions as:

Images