JP6178472B2 - COMMUNICATION CONTROL DEVICE, COMMUNICATION DEVICE, AND PROGRAM - Google Patents

Description

  Embodiments described herein relate generally to a communication control device, a communication device, and a program.

  In order to efficiently manage a large number of devices connected via a network, there is a method for managing devices in groups. There are two types of group management methods: a static management method that uses a predetermined group structure and a dynamic management method that creates and deletes groups according to the situation.

M. Baugher et al., "RFC 3547, The Group Domain of Interpretation", [online], July 2003, retrieved from the Internet: <URL: http://www.ietf.org/rfc/rfc3547.txt>

  However, the dynamic group management method can be flexibly managed according to the situation, but ensuring the scalability is a problem.

  The present invention has been made in view of the above, and an object of the present invention is to provide a communication control device, a communication device, and a program capable of realizing dynamic group management while ensuring scalability.

  The communication control device of the embodiment includes an extraction unit and an output unit. One or more communication devices belong to the first group, and one or more communication devices belong to the second group. The extraction unit extracts partial information including elements that can be processed by the communication devices belonging to the second group, from among the media key blocks including a plurality of elements. The output unit outputs the group ID for identifying the first group, the specific information, and the partial information to the communication devices belonging to the second group specified by the specific information corresponding to the partial information.

1 is a block diagram of a communication system according to an embodiment. The block diagram of the communication control apparatus concerning embodiment. The figure which shows an example of the data structure of a group operation message. The figure which shows the specific example in the case of using MKB of CS method. The figure which shows the specific example in the case of using MKB of SD method. 1 is a block diagram of a communication device according to an embodiment. The flowchart of the communication control process in embodiment. The flowchart of the group control process in embodiment. The hardware block diagram of the apparatus concerning embodiment.

  Exemplary embodiments of a communication control apparatus according to the present invention will be explained below in detail with reference to the accompanying drawings.

  GDOI (The Group Domain of Interpretation) is a technique for joining and leaving group members and securely distributing group keys using multicast. In GDOI, it is possible to create a group, update a group, and distribute a group key. However, in GDOI, key information (LKH_DOWNLOAD_ARRAY) having a hierarchical structure is updated in almost all members every time a group member is updated. Therefore, when one communication device belongs to a plurality of groups, it is necessary for a single communication device to have a plurality of LKH_DOWNLOAD_ARRAY, and it is difficult to perform efficient management.

  Therefore, in this embodiment, the group operation is performed using a technique called MKB (media key block). By using the MKB, it is possible to efficiently manage affiliation to a plurality of groups with a single device key (a key bundle corresponding to LKH_DOWNLOAD_ARRAY).

  MKB is data from which a media key for decrypting content recorded on a medium can be derived by performing processing using a corresponding device key. An MKB includes one or more elements. A typical MKB includes one or more ciphertexts (elements) generated by encrypting one media key with one or more device keys. Further, the MKB may include information for specifying a device key for processing each ciphertext. The number of ciphertexts included in the MKB is determined depending on the corresponding device key. Therefore, depending on the corresponding device key, the MKB may include a large number of ciphertexts as elements.

  In the present embodiment, a media key obtained by processing the MKB is used as a group key shared by one or more communication devices belonging to the group. That is, by distributing an MKB that can be derived from a group key by processing with a device key held by a communication device belonging to the group, the group key can be distributed only to the communication device belonging to the group. Is realized.

  In this embodiment, when group management (operation) is performed by MKB, a member who can process a certain MKB and extract a group key belongs to the group (if it does not currently belong, it newly joins the group) ) Is performed. In addition, a control is performed such that a member who fails to acquire a group key does not belong to the group (if it currently belongs, it leaves the group).

  However, when the number of target members becomes very large, the size of the MKB for group operation may become extremely large. Therefore, if the MKB is distributed to the communication network as it is, the communication load may become extremely large.

  Therefore, in this embodiment, in order to reduce the network load, the MKB including a plurality of ciphertexts as elements is divided and sent. However, if the group control method as described above is assumed, even if the MKB is simply divided and sent for each ciphertext, the intended group control may not be performed. For example, when the communication device receives the divided MKB and the group key cannot be acquired from the MKB, the communication device performs a process of leaving the group. However, actually, there is a possibility that an MKB that can be processed by the communication apparatus and obtain a group key may arrive later.

In order to avoid this problem, information that defines a set of communication devices that are targets of group operation by the MKB is attached to the MKB. For example, specific information (for example, a multicast group ID or a multicast address) that specifies a multicast group can be used as information that defines a set of communication devices. The multicast group is an example of a group (second group) managed independently of a group (first group) that is a target of group operation by the MKB. Hereinafter, an example in which a multicast group is used as the second group will be described. The second group is not limited to the multicast group, and may be any group as long as it is managed independently of the first group. The communication device that has received the MKB with the information defining the set of communication devices performs the operation shown in the following pseudo code.
if (belonging to the second group) {
Processing MKB;
if (successful group key acquisition) {
if (currently belonging to Group 1) {
First group update;
}
else {
if (currently not in the first group) {
Join the first group;
}
}
else {
if (currently belonging to Group 1) {
Leaving the first group;
}
}
}

  It is checked whether or not the communication device itself belongs to the specified set. If it belongs to the specified set, if the MKB is processed with the device key held by the communication apparatus, the group key is successfully acquired, and if it belongs to the first group, Using the derived group key, the information of the participating first group is updated. If acquisition of the group key is successful and the user does not participate in the first group, the derived group key is used to participate in the first group. If acquisition of the group key has failed and the user has joined the first group, the user leaves the first group.

  As described above, in the present embodiment, first, it is checked whether or not the communication apparatus is a group operation target apparatus. If the node itself is not the target of the group operation, the group operation is not executed. Thereby, it is possible to prevent an unintended group leaving operation from occurring even with the divided MKB.

  Details of this embodiment will be described below. FIG. 1 is a block diagram illustrating an example of a configuration of a communication system according to the present embodiment. As illustrated in FIG. 1, the communication system according to the present embodiment has a configuration in which communication devices 200 a to 200 f and a communication control device 100 are connected via a network 60. The network 60 can apply any network form such as the Internet. The communication devices 200a to 200f do not need to be directly connected to the communication control device 100.

  The communication control apparatus 100 is not limited to one, and may be configured to include two or more communication control apparatuses. Since the communication devices 200a to 200f have the same configuration, they may be simply referred to as the communication device 200 below. The number of communication devices 200 is not limited to six.

  As shown in FIG. 1, in the present embodiment, the communication control device 100 transmits a group operation command to each communication device 200. The group operation command includes, for example, a group ID for identifying the updated group, specific information for specifying the multicast group, and partial information obtained by dividing the MKB.

  FIG. 2 is a block diagram illustrating a configuration example of the communication control apparatus 100. As shown in FIG. 2, the communication control apparatus 100 includes a group information storage unit 121 (second storage unit), an address storage unit 122 (first storage unit), a key storage unit 123 (third storage unit), The receiving unit 101, the MKB generating unit 102, the extracting unit 103, and the output unit 104 are provided.

  The group information storage unit 121 includes a group ID of a group to which one or more communication devices 200 belong and a device ID (hereinafter referred to as a device ID) that identifies the communication device 200 belonging to the group identified by the group ID. Store information. That is, the group information storage unit 121 stores a group ID and a device ID of one or more communication devices 200 belonging to the group identified by the group ID in association with each other.

  In the present embodiment, the group information storage unit 121 stores one or more group IDs in advance, but does not include the group information storage unit 121, and based on the group information received from the external device, the group operation May be performed.

  The address storage unit 122 stores identification information (multicast group ID, multicast address, etc.) specifying a multicast group to which one or more communication devices 200 belong and a device ID of the communication device 200 belonging to the multicast group in association with each other. . The multicast address is, for example, an address for transmitting information by multicast communication to the communication device 200 of each corresponding device ID. When multicast communication is not used (for example, when broadcast communication is used), the address storage unit 122 may not be provided.

  In the present embodiment, it is assumed that the address storage unit 122 stores one or more pieces of specific information in advance. However, based on information received from an external device, new information can be added to the address storage unit 122, You may comprise so that the information already stored may be updated.

  The key storage unit 123 stores a device key assigned to each communication device 200. As will be described later, when the MKB is generated by a CS (Complete Subtree) method or the like, the key storage unit 123 may store a device key in association with a node having a graph structure (tree structure or the like).

  The receiving unit 101 receives various types of information from an external device such as the communication device 200. The receiving unit 101 receives, for example, a group control request and information specifying a group control target. The group control request is a request for creating a new group, changing a group (changing the communication device 200 belonging to the group, and the like). For example, the receiving unit 101 receives the group ID of the group to be operated and the device ID of the communication apparatus 200 to be included in the group, which are input by the operator using an operation unit (not shown) such as a keyboard. You may comprise as follows. It should be noted that group control may be executed not only when a group control request is received from an external device, but also when it is determined that the group control is necessary within the communication control device 100 and when it is determined necessary. The receiving unit 101 sends a group control request and information (input information) designating a group control target to the MKB generating unit 102.

  The MKB generation unit 102 generates an MKB based on a group control request and information designating a group control target. The generated MKB is used for group control. For example, when receiving input information designating updating of a group, the MKB generating unit 102 updates group information in the group information storage unit 121 according to the input information. Then, when the group is updated, the MKB generation unit 102 uses only the device key of the communication device 200 belonging to the updated group, so that only the communication device belonging to the group can derive the group key of the updated group. A new MKB is generated.

  For example, the MKB generation unit 102 receives a device key list and a group key held by the communication devices 200 belonging to the group. The MKB generating unit 102 generates an MKB from which only a device that holds a device key included in the device key list can obtain a group key from the input device key list and group key. As the MKB generation method, the CS method, the SD (Subset Difference) method, the LKH (Logical Key Hierarchy) method, and the like are already known, and all such methods can be used.

  The MKB generation unit 102 reflects the change of the group information in the group information storage unit 121. Here, the change of group information refers to new addition of group ID and device ID list, deletion of group ID and device ID list, update of device ID list corresponding to a certain group ID, and the like.

  For each piece of specific information stored in the address storage unit 122, the extraction unit 103 includes partial information including elements that can be processed with the device key of the communication apparatus 200 belonging to the group (multicast group) specified by the specific information in the MKB. Extract. In addition, the extraction unit 103 generates a group operation message including the extracted partial information. For example, the partial information includes a ciphertext that can be processed with the device key of the communication apparatus 200 and information that specifies a device key used for processing the ciphertext. The ciphertext included in one partial information is not limited to one, and may include a plurality of ciphertexts.

  FIG. 3 is a diagram illustrating an example of a data structure of the group operation message. As shown in FIG. 3, the group operation message includes MSG_ID, MG_ID, GID, and MKB_DATA. MSG_ID is information indicating the type of message. In MSG_ID, for example, a number indicating a group operation message is recorded. MG_ID is a multicast group ID. The multicast group ID plays a role of limiting the communication device 200 to be a group operation target.

  GID is the group ID of the group that is the operation target of the group operation message. MKB_DATA is the data body of the MKB. In the present embodiment, not the entire MKB generated by the MKB generation unit 102 but partial information including a part of the MKB extracted from the entire MKB by the extraction unit 103 is set in MKB_DATA.

  Next, an example of the operation of the extraction unit 103 will be described. The MKB generated by the MKB generation unit 102 is defined as MKB_t. Also, the MSG_ID field, MG_ID field, and MKB_DATA field of the group operation message (referred to as msg) are set to msg. MSG_ID, msg. MG_ID, and msg. Indicated as MKB_DATA.

An example of pseudo code representing the operation of the extraction unit 103 is shown below.
for (id in [multicast group ID of the address storage unit 122]) {
msg. MKB_DATA = φ;
for (dev_id in [device ID associated with id in the address storage unit 122]) {
msg. Append [data covering dev_id included in MKB_t] to MKB_DATA;
// [data covering dev_id included in MKB_t] may be φ.
}
if (msg.MKB_DATA ≠ φ) {
msg. Record the appropriate message number in MSG_ID;
msg. MG_ID = id;
msg. Record the group ID of the operation target in GID;
msg. To the output unit 104;
}
}
The following processing is performed for each MG_ID: id stored in the address storage unit 122. msg. MKB_DATA is initialized as an empty set, data covering dev_id included in MKB_t is extracted for each device ID: dev_id belonging to the multicast group specified by id, msg. The extracted data is added to MKB_DATA. As a result of performing the above processing on all dev_ids belonging to MG_ID, msg. If MKB_DATA is not an empty set, msg. Assign an appropriate message number to MSG_ID, msg. Assign id to MG_ID, msg. A group ID to be operated is assigned to GID, and msg including at least a set of (msg.MSG_ID, msg.MG_ID, msg.GID) is sent to output section 104.

  Through the above-described operation, one msg is sent to the output unit 104 for each multicast group ID included in the address storage unit 122.

  In MKB, data covering a certain device ID is defined as follows, for example. Here, CS method MKB is assumed. In the CS method, as will be described later, the device key is a subset of node keys that are encryption keys allocated to each node of the binary tree. Different device keys always include encryption keys assigned to nodes corresponding to different leaves. An encryption key assigned to a leaf node is called a leaf key.

  In the present embodiment, it is assumed that each leaf is assigned a leaf number for identifying the leaf. The device ID of the communication apparatus 200 managed by the communication control apparatus 100 is a leaf number of a leaf key included in the device key assigned to the communication apparatus 200. Such a device ID is merely an example, and may be allocated independently of the leaf number of the binary tree of the CS method.

  When the communication device 200 to which the leaf number is assigned can correctly process the MKB, there is data that covers the leaf number. The data covering the device ID is a ciphertext in which the group key is encrypted with the node key, and an index for specifying the node. A node to which a certain leaf number is assigned is included. On the other hand, when the communication device 200 to which the leaf number is assigned cannot correctly process the MKB, there is no data that covers the leaf number. In this case, the data covering the device ID is an empty set φ. Data covering the device ID corresponds to partial information composed of some elements of the MKB.

  That is, that the communication device 200 can correctly process the MKB means that the group key can be derived from the MKB using the device key held by the communication device 200. Further, the fact that the communication device 200 cannot correctly process the MKB indicates that the group key cannot be derived from the MKB even if all the information held by the communication device 200 is used.

  FIG. 4 is a diagram showing a specific example in the case of using the CS method MKB. Here, the leaf number is represented by a string of length 3 of 0 or 1. That is, with respect to the route from the root node to the leaf (end), 0 is assigned when going left, and 1 is assigned when going right, so that leaf numbers (“000” to “111”) can be obtained. . Node indices (“0”, “1”, “00”, “01”, “10”, “11”) are also given in the same manner. An encryption key is assigned to each node and each leaf. For example, the key k (00) is assigned to the node with index “00” (hereinafter, the node with index n is also referred to as node n).

In the example of FIG. 4, an MKB including the following three elements is given. These correspond to the node 00, the leaf of leaf number 100 (hereinafter, the leaf of leaf number m is also referred to as leaf m), and the node 11, respectively.
(00, Enc [k (00)] (Kg)), (100, Enc [k (100)] (Kg)), (11, Enc [k (11)] (Kg))
Here, Kg represents a group key, and Enc [k (00)] (Kg) represents data obtained by encrypting Kg with k (00).

  This MKB cannot be correctly processed by the communication apparatus 200 corresponding to the leaves 010, 011 and 101. That is, Kg cannot be derived from the MKB even if the device key held by the communication apparatus 200 corresponding to the leaves 010, 011 and 101 or any other information is used.

  In this MKB, the data covering the leaf 000 is (00, Enc [k (00)] (Kg)). Further, since the communication device 200 corresponding to the leaf 011 cannot correctly process the MKB, the data covering the leaf 011 is the empty set φ. Similarly, for example, the data covering the leaf 100 is (100, Enc [k (100)] (Kg)).

  Also, an MKB created by a method other than the CS method can be divided. For example, an MKB of the SD method is assumed. Similar to the CS method, the device ID is a leaf number assigned to the communication apparatus 200, but the SD method has different cover conditions from the CS method. In the SD method, when the communication device 200 that holds a certain leaf number can correctly process the MKB, the leaf number is included in a tree having a certain node as a root, but a certain node that is a descendant of the node is There are node pairs (nodes, descendant nodes) that are not included in the root tree. The data covering the device ID includes a group key encrypted with the encryption key assigned to the above-mentioned (node, descendant node) set, and an index set specifying each node included in the node set. It is.

  On the other hand, when the communication device 200 corresponding to a certain leaf number cannot correctly process the MKB, there is no tree node that covers the leaf number. That is, a leaf number assigned to a communication device that cannot correctly process an MKB is included in a tree rooted at a node having the leaf number, and also included in a tree rooted at a descendant node. There is a set of nodes (node, descendant node) or a node including the leaf number, but there is no set (node, descendant node). In this case, the data covering the device ID is an empty set φ.

  FIG. 5 is a diagram showing a specific example in the case of using the SD method MKB. As in the CS method example (FIG. 4), the leaf number is represented by a length 3 column of 0 or 1. An encryption key is assigned to a set of each node and each descendant node of the node. For example, a key k (0, 01) is assigned to a set of node 0 and node 01. If all such keys are held, a large amount of storage area is required. For this reason, the storage area may be reduced by applying a one-way function and storing only the key for sequentially calculating such a key.

In the example of FIG. 5, an MKB including the following two elements is given. These correspond to the group of node 0 and node 00 and the group of node 10 and leaf 101, respectively.
((0,01), Enc [k (0,01)] (Kg)), ((10,101), Enc [k (10,101)] (Kg)))

  Therefore, the communication device 200 corresponding to the leaves 010, 011, 101, 110, and 111 cannot correctly process this MKB. At this time, the data covering the leaf 000 is ((0,10), Enc [k (0,01)] (Kg)). Here, Kg represents a group key, and Enc [k (0,01)] (Kg) represents data obtained by encrypting Kg with k (0,01). Further, since the communication device 200 corresponding to the leaf 011 cannot correctly process this MKB, the data covering the leaf 011 is the empty set φ. That is, the device key is allocated to the leaf 011 so that k (0,01) is not held or cannot be derived. Similarly, for example, data covering the node 100 is ((10, 101), Enc [k (10, 101)] (Kg)).

  The MKB other than the CS method and the SD method also configures the extraction unit 103 so as to extract partial information that can be processed with the device key of the communication device 200 belonging to the multicast group from the entire generated MKB in accordance with the configuration of the MKB. do it.

  Returning to FIG. 2, when the group information is updated, the output unit 104 outputs the output information including the group ID of the updated group, the specific information (for example, the multicast group ID), and the partial information as the specific information. Output to the group specified by (multicast group). For example, the output unit 104 multicasts a group operation message as output information to the multicast group identified by the MG_ID included in the group operation message. In this way, by allowing the output of the output unit 104 to reach the communication device 200 that is not the target of the group change, the calculation cost required for determining the output destination by the output unit 104 is reduced as compared with the case where the output is not allowed. it can.

  Further, the output unit 104 may transmit the above-described information to a multicast group including the communication device 200 that is included in the group before update but not included in the group after update. Such a communication apparatus 200 belongs to the multicast group, but does not correctly process the partial information, and therefore leaves the updated group. In this way, a command for ordering to leave the group can be issued using the divided MKB. By issuing such a command, information to be held by the communication apparatus 200 can be appropriately managed.

  Further, it is not necessary to send the above-described command for leaving to the communication devices 200 not included in the updated group. This is because a communication device that is not included in the updated group cannot derive the updated group key from the command for updating, and therefore cannot participate in the updated group. With this configuration, the amount of commands that the communication control apparatus 100 should issue may be reduced.

  The output unit 104 is a set (group) of communication devices 200 managed independently of the group that is the target of the group operation by the MKB, and includes at least all the communication devices 200 whose groups have been updated. Output information for the set. Here, the set of communication devices 200 is a set of a plurality of communication devices 200 and does not necessarily match a group to which a group ID is allocated. Examples of the set of communication devices 200 include a set of communication devices 200 that receive data by multicast communication, a set of communication devices 200 that receive data by broadcast communication, that is, a set of all communication devices 200, and the like. Can be mentioned. For example, the output unit 104 may transmit output information to one or more sets or groups of communication apparatuses 200 including a device ID list by one or more multicast communications or broadcast communications. When transmitting output information by multicast communication, the output unit 104 selects, for example, one or more addresses (multicast addresses) associated with the device ID of the distribution target device ID from among the addresses stored in the address storage unit 122. Output information is transmitted as a destination.

  In the above example, the extraction unit 103 divides the MKB for each multicast group ID stored in the address storage unit 122, but different operations may be considered for the extraction unit 103. For example, the MKB partial information is determined from the previously received MKB, the transmission destination multicast group ID of the partial information is obtained for each partial information of the MKB, and a subset of the transmission destination multicast group and the MKB is sent to the output unit 104. Sending can be divided.

An example is shown below. The MKB in FIG. 4 is written as {M1, M2}. M1 and M2 are two subsets of MKB having no common part. In FIG. 4, M1 = {(00, Enc [k (00)] (Kg))}, M2 = {(100, Enc [k (100)] (Kg)), (11, Enc [k (11)) ] (Kg))}. The processing of the extraction unit 103 is shown below.
for (min in [subset of MKB]) {// m is M1 or M2
[Destination set of m] = φ;
for (node-data in [element of m]) {
for (dev_id in [device ID covered by node-data]) {
Look for the multicast group ID corresponding to dev_id in the address storage unit 122; // this is not empty id = multicast group ID found above;
Add id to [m destination set];
}
}
m and [m destination set] are sent to the output unit 104;
}

  The extraction unit 103 performs the following process for each element m belonging to the MKB subset. [Destination set of m] is initialized, and dev_id that is a device ID covered by the node-data is obtained for each node-data included in m. Here, node-data is data including a ciphertext included in the MKB. In the present embodiment, node-data is a ciphertext obtained by encrypting a group key with a node index and a node key assigned to the node specified by the index. Then, the multicast group ID to which the determined dev_id belongs is specified, and is set as id, and id is added to [m destination set]. When the above process is completed for all the node-data included in m, m and [m destination set] are sent to the output unit 104.

  In this case, upon receiving the MKB subset m and [m output destination set] from the extraction unit 103, the output unit 104 sequentially transmits m to the multicast group that is an element of the [m output destination set]. To do.

  FIG. 6 is a block diagram illustrating a configuration example of the communication apparatus 200. As illustrated in FIG. 6, the communication device 200 includes a GID storage unit 221, a group key storage unit 222, a device key storage unit 223, an MG_ID storage unit 224, a reception unit 201, a determination unit 202, and an MKB process. Unit 203 and group control unit 204.

  The GID storage unit 221 stores the group ID (GID) of the group to which the communication device 200 belongs. The group key storage unit 222 stores the group key of the group identified by the group ID stored in the GID storage unit 221. The device key storage unit 223 stores the device key of the communication apparatus 200. The MG_ID storage unit 224 stores identification information (for example, a multicast group ID) that identifies the multicast group to which the communication apparatus 200 belongs.

  The receiving unit 201 receives various types of information from external devices such as the communication control device 100 and other communication devices 200. For example, the receiving unit 201 receives a group operation message from the communication control apparatus 100. The receiving unit 201 receives output information through multicast communication, broadcast communication, or the like. The receiving unit 201 determines whether the received message is a group operation message. If it is not a group operation message, the received message is passed to another module (not shown) that should process the message and processed. If the message is a group operation message, the message data is sent to the determination unit 202.

  The determination unit 202 determines whether or not the specific information (MG_ID) included in the group operation message matches the specific information stored in the MG_ID storage unit 224. If the two do not match, the communication device 200 is not the target device of the received group operation message, and therefore stops the operation for the group operation message. If the two match, the communication device 200 is the target of the group operation message, so the group operation message is passed to the MKB processing unit 203.

  The MKB processing unit 203 generates a group key from the partial information (MKB_DATA) included in the group operation message and the device key stored in the device key storage unit 223 when the determination unit 202 determines that they match. Execute the process. If a group key is obtained as a result of the MKB process, it means that the communication apparatus 200 belongs to the group indicated by GID. The MKB processing unit 203 sends the GID and the acquired group key to the group control unit 204.

  The group control unit 204 stores the GID in the GID storage unit 221 and stores the group key in the group key storage unit 222. When the GID is already stored, the group control unit 204 updates the GID stored in the GID storage unit 221 with the GID in the group operation message.

  On the other hand, if the group key is not obtained as a result of the MKB process, it means that the communication apparatus 200 does not belong to the group indicated by the GID. Therefore, if you belong, you need to leave. Therefore, the MKB processing unit 203 sends a GID and a notification that the group key could not be acquired to the group control unit 204.

  The group control unit 204 empties the GID storage unit 221 and the group key storage unit 222. If the GID or group key is already stored, the group control unit 204 deletes them.

  Each storage unit described above can be configured by any commonly used storage medium such as an HDD (Hard Disk Drive), an optical disk, a memory card, and a RAM (Random Access Memory).

  In addition, the reception unit 101, the MKB generation unit 102, the extraction unit 103, and the output unit 104 of the communication control device 100, and the reception unit 201, the determination unit 202, the MKB processing unit 203, and the group control unit of the communication device 200. 204, for example, causing a processing device such as a CPU (Central Processing Unit) to execute a program, that is, may be realized by software, or may be realized by hardware such as an IC (Integrated Circuit), You may implement | achieve combining software and hardware.

  Next, communication control processing by the communication control apparatus 100 according to the present embodiment will be described with reference to FIG. FIG. 7 is a flowchart illustrating an example of a communication control process in the present embodiment.

  The receiving unit 101 acquires (receives) the GID of the group to be operated and the device IDs of the communication devices 200 belonging to the group (step S101). The MKB generation unit 102 generates an MKB based on the acquired device ID (step S102). For example, the MKB generation unit 102 generates an MKB from which the communication device 200 with the acquired device ID can obtain a group key.

  Next, the extraction unit 103 performs processing with the device key of the communication apparatus 200 belonging to the group (multicast group) specified by the MG_ID from the generated MKB for each specific information (MG_ID) stored in the address storage unit 122. Partial information that can be extracted is extracted (step S103). The extraction unit 103 generates a group operation message including the extracted partial information.

  The output unit 104 outputs a group operation message (step S104). The group operation message is generated for each MG_ID stored in the address storage unit 122. When the group operation message corresponding to a certain MG_ID is empty, the group operation message is not output to the multicast group specified by MG_ID. Therefore, the output unit 104 outputs group operation messages as many as the number of MG_IDs stored in the address storage unit 122 at the maximum.

  Next, group control processing by the communication apparatus 200 according to the present embodiment will be described with reference to FIG. FIG. 8 is a flowchart illustrating an example of group control processing in the present embodiment.

  The receiving unit 201 receives a message from an external device such as the communication control device 100 (step S201). The receiving unit 201 determines whether or not the received message is a group operation message (step S202). If it is not a group operation message (step S202: No), the group control process is terminated. As described above, messages other than the group operation message are passed to the module that should process the message and are appropriately processed.

  When it is a group operation message (step S202: Yes), the determination unit 202 determines whether or not the MG_ID in the group operation message matches the MG_ID stored in the MG_ID storage unit 224 (step S203).

  If they do not match (step S203: No), the group control process is terminated because the group operation is out of scope. If they match (step S203: Yes), the MKB processing unit 203 processes the MKB (MKG_DATA) in the group operation message (step S204).

  The MKB processing unit 203 determines whether or not the MKB has been correctly processed (step S205). When correctly processed (step S205: Yes), the group control unit 204 stores the GID in the group operation message in the GID storage unit 221 and also stores the group key obtained by the MKB process in the group key storage unit 222. (Step S206). If not correctly processed (step S205: No), the group control unit 204 deletes the GID in the group operation message from the GID storage unit 221 and deletes it from the group key storage unit 222 from the group key (step S207). .

  As described above, the communication control apparatus according to the present embodiment can realize dynamic group management while ensuring scalability. Further, since the partial information extracted from the MKB is transmitted instead of the entire MKB for group management, the communication load can be reduced. At this time, since the partial information is transmitted together with the information that defines the range of the communication device that is the target of the group operation, it is possible to avoid an unintended group operation.

(Modification 1)
In the extraction unit 103 according to the first embodiment, partial information including some elements of the MKB covering device IDs belonging to a certain multicast group is extracted, and the extracted partial information is transmitted through the output unit 104. However, the extracted partial information is not transmitted as it is, but a part of the MKB included in the partial information is divided so that the size is smaller than a predetermined size, and the divided partial information is output to each output unit. It may be sent to 104 and sent out. Further, the partial information transmitted to each multicast group may be divided so as to have the same size, rather than a predetermined size or less. Further, a different size may be determined for each multicast group as the predetermined size. In this way, by reconfiguring the partial information, it is possible to send commands suitable for various situations in consideration of the performance such as the communication speed, the amount of temporary storage area provided in the communication device 200, the characteristics of the multicast group, and the like. .

(Modification 2)
In the extraction unit of the first embodiment, partial information including some elements of the MKB is extracted from the MKB, and for each partial information, a multicast group to which the partial information is to be transmitted is obtained, and the obtained multicast The partial information was sent to the group. However, when one or more pieces of partial information are transmitted to a certain multicast group, the partial information may be reconfigured and sent to the output unit 104 for transmission. Further, as in the first modification, the partial information to be sent may be divided so as to be equal to or smaller than a predetermined size. Further, the division may be performed so that the sets of partial information transmitted to each multicast group have the same size, not the predetermined size or less. As this predetermined size, a different size may be determined for each multicast group. In this way, by reconfiguring the partial information, it is possible to send commands suitable for various situations in consideration of the performance such as the communication speed, the amount of temporary storage area provided in the communication device 200, the characteristics of the multicast group, and the like. .

  Next, the hardware configuration of the communication control apparatus according to the present embodiment will be described with reference to FIG. FIG. 9 is an explanatory diagram illustrating a hardware configuration of the communication control apparatus according to the present embodiment.

  The communication control device according to the present embodiment communicates with a control device such as a CPU (Central Processing Unit) 51 and a storage device such as a ROM (Read Only Memory) 52 and a RAM (Random Access Memory) 53 connected to a network. A communication I / F 54 for performing the above and a bus 61 for connecting each part.

  A program executed by the device (communication control device, communication device) according to the present embodiment is provided by being incorporated in advance in the ROM 52 or the like.

  A program executed by the apparatus according to the present embodiment is a file in an installable format or an executable format, and is a CD-ROM (Compact Disk Read Only Memory), a flexible disk (FD), or a CD-R (Compact Disk Recordable). Alternatively, the program may be recorded on a computer-readable recording medium such as a DVD (Digital Versatile Disk) and provided as a computer program product.

  Furthermore, the program executed by the apparatus according to the present embodiment may be provided by being stored on a computer connected to a network such as the Internet and downloaded via the network. The program executed by the apparatus according to the present embodiment may be provided or distributed via a network such as the Internet.

  The program executed by the apparatus according to the present embodiment can cause the computer to function as each unit described above. In this computer, the CPU 51 can read a program from a computer-readable storage medium onto a main storage device and execute the program.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 100 Communication control apparatus 101 Reception part 102 MKB production | generation part 103 Extraction part 104 Output part 121 Group information storage part 122 Address storage part 123 Key storage part 200 Communication apparatus 201 Reception part 202 Judgment part 203 MKB process part 204 Group control part 221 GID storage Unit 222 group key storage unit 223 device key storage unit 224 MG_ID storage unit

Claims (7)

A communication control device connected to a plurality of communication devices,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
A group ID for identifying the first group; identification information for identifying one second group of the plurality of second groups; and the identification information identified by the identification information among media key blocks including a plurality of elements. An output unit that outputs partial information including an element that can be processed by a communication device belonging to two groups to a communication device belonging to the second group specified by the specific information corresponding to the partial information;
A communication control device comprising: A communication control device connected to a plurality of communication devices,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
The group ID for identifying the first group, and the partial information including elements that can be processed by one or more communication devices belonging to the first group in the media key block including a plurality of elements, and the partial information can be processed. An output unit that outputs specific information for specifying the second group to which the communication device belongs, to a communication device belonging to the second group specified by the specific information corresponding to the partial information;
A communication control device comprising: The communication control device according to claim 1, further comprising a first storage unit that stores the specific information and device IDs of the communication devices belonging to the second group in association with each other. A program executed by a communication control device connected to a plurality of communication devices,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
The communication control device;
A group ID for identifying the first group; identification information for identifying one second group of the plurality of second groups; and the identification information identified by the identification information among media key blocks including a plurality of elements. An output unit that outputs partial information including elements that can be processed by communication devices belonging to two groups to communication devices belonging to the second group identified by the specific information corresponding to the partial information;
Program to function as. A program executed by a communication control device connected to a plurality of communication devices,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
The communication control device;
The group ID for identifying the first group, and the partial information including elements that can be processed by one or more communication devices belonging to the first group in the media key block including a plurality of elements, and the partial information can be processed. An output unit that outputs specific information for specifying the second group to which the communication device belongs to a communication device belonging to the second group specified by the specific information corresponding to the partial information;
Program to function as. One of a plurality of communication devices connected to the communication control device,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
A group ID for identifying the first group; identification information for identifying one second group of the plurality of second groups; and the identification information identified by the identification information among media key blocks including a plurality of elements. A communication device comprising: a receiving unit that receives, from the communication control device, partial information including elements that can be processed by communication devices belonging to two groups. One of a plurality of communication devices connected to the communication control device,
One or more communication devices belong to the first group, and one or more communication devices belong to the second group,
The group ID for identifying the first group, and the partial information including elements that can be processed by one or more communication devices belonging to the first group in the media key block including a plurality of elements, and the partial information can be processed. A communication apparatus comprising: a receiving unit that receives, from the communication control apparatus, identification information that identifies the second group to which the communication apparatus belongs.

Images