WO2009130795A1 - Information processing equipment and program - Google Patents

Abstract

In realizing a secure multicast transmission to a plurality of terminal devices, a disturbing portion (212) rearranges ID's of the terminal devices connected to a server device (201) and generates various kinds of orderings of the terminal devices. Then, a structure information generating portion (219) generates structure information on a plurality of tree structures which correspond to the various kinds of orderings, respectively, and a key assignment portion (213) assigns secret information to each node of each tree structure. A set determining portion (216) determines such structure information that only the terminal devices which are the destination of the secure multicast are assigned secret information which allows for decoding of an encoded message and there is the least communication overhead. An encoding portion (218) encodes a message to be transmitted using the secret information assigned to the structure information determined by the set determining portion (216), and a communicating portion (217) multicast-transmits the encoded message.

Description

Information processing apparatus and program

The present invention relates to a technique for multicasting information by using, for example, a server device (hereinafter also referred to as a server) only to a plurality of valid terminal devices (hereinafter also referred to as a terminal) using encryption technology.

The secure multicast system broadcasts (multicasts) information from the server only to a plurality of valid terminals using encryption technology, and it is assumed that the revoked terminal (group) has collusion among revoked terminals. Is a communication system that ensures that no information leaks.
Here, the valid terminal is a terminal that is permitted to decrypt the encrypted message transmitted from the server, and the revoked terminal (groups) is a terminal to which the decryption of the encrypted message transmitted from the server is prohibited. It is (group).
With regard to such a secure multicast system, various techniques have been proposed to minimize the operation overhead for the terminal to derive the key, the number of device keys held by the terminal, the communication overhead of the multicast, and the key.

In the Complete Subtree method (CS method) and the Subset Difference method (SD method) disclosed in Non-Patent Document 1, the server arranges each terminal in a leaf (bottom layer) of a tree structure, and each node includes a leaf. Secret information is allocated, and each terminal holds secret information corresponding to each node on the path from its own node to the root node.
In these schemes, when the server performs multicasting, a plurality of valid terminals are expressed by the sum S1 + S2 +... + Sj of subsets of terminals in an appropriate manner. Thereafter, using the encryption key K1 held (or derivable) only by the terminal belonging to S1, the encryption key K2 held only by the terminal belonging to S2,..., The encryption key Kj held only by the terminal belonging to Sj A transmission message (or a session key K for encrypting the transmission message) (herein, the transmission message and the session key K are collectively referred to as a transmission message) is encrypted.
That is, although the server does not hold (cannot derive) the revoked terminal, it extracts the key that the valid terminal holds (which can be derived), encrypts the message using each of the extracted keys, and encrypts the message. Broadcast the broadcast message.
By performing encryption as described above, secure multicast can be realized in which only valid terminals can acquire information.

At this time, the communication overhead is a value proportional to the number of elements j when expressed as a sum, but in the CS method and the SD method, the value of j should be reduced by devising the secret information to be given to each terminal. Is realized.
Further, Patent Document 1 discloses a method of reducing communication overhead by a server holding a plurality of tree structures used in the CS method and the SD method.
Unexamined-Japanese-Patent No. 2006-13790 D. Naor, M. Naor, and J. Lostpiech, "Revocation and tracing schemes for stateless receivers," Advances in Cryptology-CRYPTO'01, LNCS vol. 2139, pp. 41-62, 2001.

When there are n terminals, the communication overhead for performing secure multicast on the remainder of which r has been revoked is O (r log (n / r)) by CS method and O (r) by SD method. (O is Landau's notation, log is base 2 logarithm, and the same applies to the following).
In either case, since the communication overhead is increased in a manner approximately proportional to r, there is a problem that the communication band is compressed particularly when narrow band communication is performed.

As described above, in secure multicast, the transmission message is encrypted using each of the extracted keys for the valid terminal, and all encrypted messages are multicast-transmitted. For this reason, the number of encrypted messages multicast from the server will match the number of extracted keys.
Therefore, in order to reduce communication overhead, it is necessary to minimize the number of extracted keys.

Although the method of reducing communication overhead by holding a plurality of tree structures by the server is disclosed in Patent Document 1, the configuration method of the plurality of trees and the effect thereof are configured based on the characteristics of the device and the user. It does not simply disclose the relationship between the law of construction and its effects.

The present invention has as its main object to solve the above-mentioned problems, and has as its main object to reduce the communication overhead by suppressing the number of secret information used in secure multicast.

An information processing apparatus according to the present invention is an encrypted message in which a transmission message is encrypted using secret information to two or more communication apparatuses connected to a plurality of communication apparatuses and selected from the plurality of communication apparatuses. Is an information processing apparatus for multicast transmission of
A plurality of types of ordering are performed on the plurality of communication devices, and two or more communication devices closely ordered in each ordering are grouped with each other, and a plurality of orders indicating the contents of each ordering and grouping An order information generation unit that generates information;
Device-specific secret information used for decryption of encrypted messages in each communication device is assigned in units of communication devices and shared in two or more identical group communication devices classified in the same group for each order information A secret information assignment unit that assigns group-specific secret information that can be used for decryption of
When two or more communication devices to be transmission destinations of multicast transmission are selected as the transmission destination communication devices from among the plurality of communication devices, the same group communication devices and the transmission for each group indicated in each order information And a combination deriving unit that derives a combination of secret information used for encryption of the transmission message by comparing with the previous communication device.

The combination deriving unit
It is characterized in that a combination of secret information which allows all the destination communication devices to decrypt the encrypted message, and which derives the combination of the least number of secret information.

The combination deriving unit
For each group indicated in each order information, the same group communication device is compared with the transmission destination communication device, and if all the same group communication devices are selected as the transmission destination communication device, they are assigned to that group Extracting the group-specific secret information and extracting the device-specific secret information assigned to each of the same group communication devices when one or more same group communication devices are not selected as the transmission destination communication devices Then, for each order information, extract secret information necessary for encryption so that all transmission destination communication devices can decrypt the encrypted message, and count the number of extracted secret information,
The order information having the smallest number of secret information is determined from the plurality of order information, and the secret information extracted for the determined order information is used as the secret information used for encryption of the transmission message.

The order information generation unit
Grouping two or more communication devices ordered in proximity to one another in a plurality of layers and generating order information in which a group of communication devices is indicated in the plurality of layers;
The combination deriving unit
The same group communication apparatus and the transmission destination communication apparatus are compared in order from the group of the upper hierarchy for each order information, and when all the same group communication apparatuses are selected as the transmission destination communication apparatus, the group Group secret information in the lower layer is extracted when the group-specific secret information assigned to the group is extracted and one or more same-group communication devices are not selected as the destination communication devices, the same-group communication devices in the lower layer group and the destination communication When compared with the device and one or more same group communication devices are not selected as the transmission destination communication device in the group of the lowest hierarchy, assigned to each of the same group communication devices of the group of the lowest hierarchy Device-specific secret information is extracted and encrypted so that all destination communication devices can decrypt the encrypted message for each order information And extracting the secret information necessary in order.

The combination deriving unit
For each group indicated in each order information, the same group communication device is compared with the transmission destination communication device, and if all the same group communication devices are selected as the transmission destination communication device, they are assigned to that group Extract group-specific secret information,
A combination of secret information necessary for encrypting all the destination communication devices to decrypt the encrypted message by combining the group secret information extracted for the plurality of order information, It is characterized in that the combination with the smallest number is derived.

The order information generation unit
Grouping two or more communication devices ordered in proximity to one another in a plurality of layers and generating order information in which a group of communication devices is indicated in the plurality of layers;
The combination deriving unit
The same group communication apparatus and the transmission destination communication apparatus are compared in order from the group of the upper hierarchy for each order information, and when all the same group communication apparatuses are selected as the transmission destination communication apparatus, the group Group secret information in the lower layer is extracted when the group-specific secret information assigned to the group is extracted and one or more same-group communication devices are not selected as the destination communication devices, the same-group communication devices in the lower layer group and the destination communication It is characterized by comparing with a device.

The order information generation unit
When the number of communication apparatuses connected to the information processing apparatus is 2 ^m (m ≧ 2), m pieces of order information indicating ordering and grouping of m types are generated.

The order information generation unit
When the number of communication devices connected to the information processing device is less than 2 ^m (m 2 2), m virtual communication devices for the missing number are replenished to indicate m kinds of ordering and grouping Generating order information of

The order information generation unit
m pieces of order information indicating ordering (m ≧ 2) kinds and ordering are set as one set, and order information of t (t ≧ 2) sets is generated,
The information processing apparatus may further include
For each set of order information, the expected value of the number of pieces of secret information necessary for encrypting the transmission message is calculated using the m pieces of order information included in the set, and t sets are calculated based on the calculated expected value. And an order information selection unit for selecting a specific set from among
The combination deriving unit
When the transmission destination communication apparatus is selected, a combination of secret information used for encryption of the transmission message is derived using the m pieces of order information included in the set selected by the order information selection unit. I assume.

The order information selection unit
Among t sets, it is characterized in that the set with the smallest expected value is selected.

The order information selection unit
Combining a plurality of communication devices with a predetermined number of transmission destination communication devices to derive a plurality of combination patterns of communication devices;
From the m pieces of order information included in the set for each set of order information, the order information having the least number of secret information required to encrypt the transmission message for each combination pattern is extracted, and the combination pattern is obtained. An expected value for each set is calculated based on the number of pieces of secret information in the order information extracted for each.

The order information selection unit
Combining a plurality of communication devices with a predetermined number of transmission destination communication devices to derive a plurality of combination patterns of communication devices;
For each set of order information, the transmission message is encrypted for each combination pattern by comparing the same group communication device of each group indicated in the m pieces of order information included in the set with the communication device included in the combination pattern. Extracting a combination of groups that minimizes the number of secret information required to perform the pairing, and calculating an expected value for each set based on the number of secret information in the combination of groups extracted for each combination pattern Do.

The order information generation unit
At each stage of m (m ≧ 2) stages, generate t order information indicating ordering and grouping of t (t ≧ 2) kinds,
The information processing apparatus may further include
In each of the m stages, an expected value of the number of secret information necessary to encrypt the transmission message is calculated for each order information, and a specific one of t pieces of order information is calculated based on the calculated expected value. Having an order information selection unit for selecting order information;
The combination deriving unit
Deriving a combination of secret information used for encryption of a transmission message using the m pieces of order information selected in each of the m stages by the order information selection unit when the transmission destination communication apparatus is selected It is characterized by

The order information selection unit
In each of m stages, it is characterized in that the order information having the smallest expected value is selected from the t pieces of order information.

The order information generation unit
After specific order information is selected from the t pieces of order information by the order information selection unit, t pieces of order information indicating ordering and grouping different from the selected order information are displayed in the following t It is characterized by generating as order information.

A program according to the present invention is connected to a plurality of communication devices, and multicasts an encrypted message in which a transmission message is encrypted using secret information to two or more communication devices selected from the plurality of communication devices. On the sending computer,
A plurality of types of ordering are performed on the plurality of communication devices, and two or more communication devices closely ordered in each ordering are grouped with each other, and a plurality of orders indicating the contents of each ordering and grouping Order information generation processing for generating information;
Device-specific secret information used for decryption of encrypted messages in each communication device is assigned in units of communication devices and shared in two or more identical group communication devices classified in the same group for each order information Secret information assignment processing for assigning group-specific secret information that can be used for decryption of
When two or more communication devices to be transmission destinations of multicast transmission are selected as the transmission destination communication devices from among the plurality of communication devices, the same group communication devices and the transmission for each group indicated in each order information It is characterized in that a combination derivation process of deriving a combination of secret information used for encryption of a transmission message by comparing with the previous communication device is executed.

According to the present invention, a plurality of types of ordering are performed on the communication apparatus to generate a plurality of types of order information, and the secret information used to encrypt the transmission message based on the allocation status of the secret information in the plurality of types of order information. It is possible to derive the combination of the secret information which is the combination of the secret information that all the destination communication devices can decrypt the encrypted message in order to derive the combination of Communication overhead at the time of transmission of

Embodiment 1
In this embodiment and the following embodiments, a secure multicast system will be described in which communication overhead is reduced by devising a configuration method of a plurality of structures.

FIG. 1 shows an example of the system configuration of a secure multicast system according to the present embodiment.
In FIG. 1, a server device 201 (hereinafter, also simply referred to as a server) and a plurality of terminal devices 301 (hereinafter, also simply referred to as a terminal) are connected via a network 101.
Also in the secure multicast system according to the present embodiment, information is broadcasted (multicast) from the server device 201 to only a plurality of valid terminal devices 301 using encryption technology, and the revoked terminal (group) Even if there is a collusion among the revoked terminals, no information is leaked.
The server apparatus 201 is an example of an information processing apparatus, and the terminal apparatus 301 is an example of a communication apparatus.

FIG. 2 is a block diagram showing a configuration example of the server device 201. As shown in FIG.

In FIG. 2, an algorithm storage area 211 is data storage means for storing an algorithm such as key assignment in secure multicast and message transmission to a valid terminal.
In the present embodiment, an algorithm for managing terminals in a tree structure is used.
For example, an algorithm such as the CS method or the SD method is stored.

The stirring unit 212 is a means for rearranging all terminals and outputting the order.
Further, the structure information generation unit 219 gives a structure between the terminals according to the ordering of the terminals by the stirring unit 212, and generates plural types of structure information (order information) representing the ordering of the terminals with a predetermined structure.
In the present embodiment, the structure information of the tree structure is generated.
More specifically, stirring unit 212 performs ordering of a plurality of types with respect to a plurality of terminal devices 301, and structure information generating unit 219, two or more terminal devices ordered in proximity in each ordering. A plurality of layers 301 are grouped into a plurality of layers, and a plurality of pieces of structure information indicating contents of grouping in each ordering and a plurality of layers are generated.
In addition, when the number of terminal devices 301 connected to the server device 201 is 2 ^m (m 攪拌 2), the stirring unit 212 performs m types of ordering, and the structure information generating unit 219 generates m types of devices. Generate m pieces of structure information indicating ordering and grouping of
The stirring unit 212 and the structure information generation unit 219 are examples of the order information generation unit.

The key assignment unit 213 is a means for inputting structure information indicating an ordered terminal according to the algorithm stored in the algorithm storage area 211, and assigning secret information to each node on the structure indicated by the structure information. .
More specifically, for each piece of structure information generated by the structure information generation unit 219, the key assignment unit 213 uses the terminal-specific secret information (device-specific secret information) used to decrypt the encrypted message in each terminal device. Are allocated in terminal units, and group-specific secret information that can be commonly used for decrypting encrypted messages in two or more identical group terminal apparatuses (identical group communication apparatuses) classified into the same group is allocated in group units.
The key assignment unit 213 is an example of a secret information assignment unit.

Although details will be described later, FIG. 4 is an example of structure information of a tree structure in which secret information is assigned to each terminal and group.
In the example of FIG. 4, two pieces of structural information of tree structure 1 and tree structure 2 are shown.
Both the tree structure 1 and the tree structure 2 target eight terminals of the terminal 0 to the terminal 7, and these eight terminals are arranged in the nodes of leaf parts of the tree structure (hereinafter, also referred to as leaf nodes) . In the tree structure 1 and the tree structure 2, the arrangement order of the terminals is different.
Also, in both tree structure 1 and tree structure 2, two nodes adjacent to each other in each hierarchy are grouped and finally reach the root node.
In addition, since the structure information generation unit 219 generates m pieces of structure information for 2 ^m terminals, three pieces of structure information are generated for eight terminals. However, in FIG. Two structural information is shown for reasons of

Further, k0_1, ka_1, k0_2, ka_2 and so on shown in FIG. 4 are secret information assigned to each terminal or each group. The secret information is, for example, a key or information that is the source of key derivation. The secret information for each terminal assigned to the leaf node is terminal-specific secret information (device-specific secret information), and kd_1, ke_1, kf_1, kg_1, kb_1, kc_1, and ka_1 are groups assigned to each group of terminals. It is secret information.
In FIG. 4, each terminal can use the terminal-specific secret information assigned to the leaf node and the group-specific secret information assigned to the upper node connected to the leaf node.
For example, in the tree structure 1, the terminal 0 can use the secret information k0_1, kd_1, kb_1, ka_1.
The structure information generation unit 219 arranges each terminal on the leaf node of the tree structure and performs processing to group each two nodes according to the ordering of the plurality of types of terminals by the stirring unit 212, and the secret information shown in FIG. It generates structure information in a state where (k 0 _ 1 etc.) is not assigned to each node. As described above, the structure information generation unit 219 generates a plurality of pieces of structure information, but the arrangement order of the terminals in the leaf node is different for each piece of structure information in accordance with the ordering of the plurality of types of terminals by the stirring unit 212 .
Then, the key assignment unit 213 assigns secret information to each node of each piece of structure information generated by the structure information generation unit 219, and brings it into the state shown in FIG. The secret information assigned to each node is mutually different.

The secret information storage area 214 is data storage means for storing a plurality of pieces of structure information to which secret information is assigned.
In the present embodiment, as described above, all the terminals are managed in a tree structure.
The secret information storage area 214 stores the structure information illustrated in FIG.

The set derivation unit 215 receives the structure given to the terminal and the set of valid terminals according to the algorithm stored in the algorithm storage area 211, and the set of valid terminals is the sum S1 + S2 + of subsets of terminals. It is a means to derive each subset Si so that it may be represented as ... + Sj.
The set determination unit 216 is a unit that determines a combination of subsets used for secure multicast transmission according to the output of the set derivation unit 215 for the plurality of pieces of structure information stored in the secret information storage area 214.
That is, in the set derivation unit 215 and the set determination unit 216, two or more terminal devices 301 to be transmission destinations of secure multicast transmission are selected as transmission destination terminal devices (transmission destination communication devices) from among the plurality of terminal devices 301. In this case, for each group indicated in each structure information, it is a combination of secret information that all destination terminal devices can decrypt the encrypted message by comparing the same group terminal device and the destination terminal device. Deriving and determining the least number of secret information combinations.
The set derivation unit 215 and the set determination unit 216 are examples of a combination derivation unit.

The communication unit 217 is a unit that communicates with the terminal device 301.
The encryption unit 218 is means for performing key generation / encryption, random number generation and the like of the common key / public key encryption.

FIG. 3 is a block diagram showing a configuration example of the terminal device 301 that receives the multicast from the server device 201 in the secure multicast system (FIG. 1).

In FIG. 3, an algorithm storage area 311 is data storage means for storing an algorithm such as key derivation / decryption in secure multicast.
In the present embodiment, an algorithm for managing terminals in a tree structure is used. For example, an algorithm such as the CS method or the SD method is stored.

The secret information storage area 312 is a data storage unit that stores a plurality of pieces of secret information (encryption key or information serving as an origin of derivation of the encryption key) associated with a certain structure managed by the server device 201.
In this embodiment, all the terminals store secret information associated with the tree structure.
FIG. 5 shows an example of data stored in the secret information storage area 312.
More specifically, FIG. 5 shows an example of data held by the terminal 0 shown in FIG.
That is, although it is shown that terminal 0 can use secret information k0_1, kd_1, kb_1 and ka_1 in the structure information of tree structure 1 in FIG. 4, terminal 0 corresponds to these in FIG. 5 and terminal 0 can use these k0_1 and kd_1. , Kb_1 and ka_1 are shown.
Similarly, it is shown in FIG. 4 that the terminal 0 can use the secret information k0_2, kd_2, kb_2 and ka_2 in the tree structure 2. However, in FIG. 5, the terminal 0 corresponds to the secret information k0_2, kd_2 and kb_2 in FIG. , Indicates that it holds ka_2.

The key derivation unit 313 derives, from the secret information stored in the secret information storage area 312, the encryption key required to decrypt the encrypted message received from the server device 201 according to the algorithm stored in the algorithm storage area 311. Means to

The communication unit 314 is a unit that communicates with the server device 201.
The encryption unit 315 is a unit that performs decryption of a common key and public key encryption, random number generation, and the like.

The procedure in secure multicast is roughly divided into two parts: a part where the server distributes secret information to each terminal, and a part where the server performs encrypted communication from the server to each terminal using the secret information.
FIG. 6 is a flowchart for explaining distribution processing of secret information from the server to each terminal in the present embodiment.

The operation in the distribution process will be described with reference to the flowchart of FIG.
For the sake of simplicity, it is assumed that the number of terminals n is a value represented by a power of 2 and each terminal is given a terminal ID of 0 to n-1.
Also, the number m of tree structures held and managed by the server is defined. In this embodiment, m = log n.

Before performing the distribution process, an algorithm of secure multicast is shared in advance between the server apparatus 201 and each terminal apparatus 301 (step S601).
Here, it is assumed that the algorithm storage area 211 and the algorithm storage area 311 store corresponding algorithms.

First, the stirring unit 212 of the server device 201 receives the number n of terminals and outputs a permutation in which terminal IDs from 0 to n−1 are rearranged (step S602).
Details of this process will be described later.
With the permutation obtained in step S602 as an input, structure information generation unit 219 gives a tree structure between the terminals according to the algorithm stored in algorithm storage area 211 to generate structure information, and key assignment unit 213 And the encryption unit 218 assigns secret information to each node of the tree structure according to the algorithm stored in the algorithm storage area 211, and stores the structure information to which the secret information is assigned in the secret information storage area 214 (step S603). .
At the same time, according to the algorithm stored in the algorithm storage area 211, the secret information required for each terminal is stored (step S604). The details of steps S603 and S604 depend on the algorithm (such as the CS method or the SD method) stored in the algorithm storage area 211.
The above processing is performed, and when the structure information of m tree structures is configured and stored, the processing is ended.
If not, the process returns to step S602 to repeat the process (step S605).
As a result, step S602 is executed m times, but the stirring unit 212 outputs a different permutation each time it is executed, so that m different tree structures are stored in the secret information storage area 214.

FIG. 7 is a flowchart for explaining the terminal ID rearranging process (step S602) of stirring unit 212 in the present embodiment.
The operation in the terminal ID rearranging process will be described with reference to the flowchart of FIG.

First, the stirring unit 212 determines whether the call of the terminal ID rearranging process is the first time (step S701).
If it is the first time, a sequence of terminal IDs from 0 to n-1 is set as the terminal ID permutation (step S702), and the result is output (step S704).
For example, when n = 8, (0, 1, 2, 3, 4, 5, 6, 7) is output.
In the case of the second and subsequent calls, for each terminal ID of the previous output, consider those displayed in binary with log n bits, and set those to which cyclic shift has been performed by 1 bit to the right (step S703) And the result is output (step S704).
For example, in the case of the second call with n = 8, each terminal ID is cyclically shifted by 1 bit to the right with respect to the previous output (0, 1, 2, 3, 4, 5, 6, 7) (0, 4 , 1, 5, 2, 6, 3, 7) are output.
As a result of the terminal ID rearranging process as described above, a plurality of different tree structures as shown in FIG. 4, for example, are stored in the secret information storage area 214 after the key assignment algorithm application (step S603). .

Next, cryptographic communication processing from the server to each terminal will be described.
FIG. 8 is a flow chart for explaining encryption communication processing from the server to each terminal using secret information shared in advance in the present embodiment.
The operation in the encryption communication process will be described with reference to the flowchart of FIG.

Before performing the encryption communication process, the server apparatus 201 and each terminal apparatus 301 share an algorithm of secure multicast in advance.
Here, it is assumed that the algorithm storage area 211 and the algorithm storage area 311 store corresponding algorithms.
Further, m tree structures are stored in the secret information storage area 214 of the server device 201, and secret information corresponding to the m tree structure is stored in the secret information storage area 312 of the terminal device 301. The secret information may be stored in the secret information storage area 312 of the terminal device 301 by encrypting the secret information and transmitting it from the server device 201 to the terminal device 301, or storing the secret information in a storage medium such as a memory card. It may be supplied to the terminal device 301 offline.
Also, a set of revoked terminals is given as an input to the server device 201 (steps S801 and S802).

First, in the server device 201, the set derivation unit 215 reads out the structure information of the first tree structure from the secret information storage area 214, and according to this tree structure and the algorithm stored in the algorithm storage area 211, a valid terminal Is expressed as a sum S1 + S2 +... + Sj of subsets of terminals (steps S803, S804, and S805).
The details of step S 805 depend on the algorithm (such as CS method or SD method) stored in the algorithm storage area 211.
This process is performed on all m tree structures (step S806).

Thereafter, the set determination unit 216 determines one of the m tree structures in which the communication overhead is minimized, that is, one in which the number of elements j when represented by the sum of subsets is minimized (step S807).
Then, in accordance with the determined tree structure and the algorithm stored in the algorithm storage area 211, the encryption unit 218 encrypts the message (step S808), and the communication unit 217 determines the terminal device 301 the determined tree structure. And the encrypted message are multicast (step S809).
The details of step S 808 depend on the algorithm (such as CS method or SD method) stored in the algorithm storage area 211.

The communication unit 314 of the valid (= not revoked) terminal device 301 receives the message (step S 810), and the key derivation unit 313 and the encryption unit 315 follow the algorithm stored in the algorithm storage area 311 and secret information The received message is decrypted with the encryption key derived from the secret information stored in the storage area 312 (step S811).
The details of step S811 depend on the algorithm (such as the CS method or the SD method) stored in the algorithm storage area 311.
On the other hand, even if the terminal device 301 that has been revoked receives a multicast message, it can not derive information because it can not derive an encryption key necessary for decryption.
By performing the above processing, secure multicast can be realized.

Next, specific examples of S806 and S807 of FIG. 8 will be described with reference to FIG.
As described above, since the specific processing contents differ depending on the algorithm such as the CS method or the SD method, only the outline of the processing will be described here.

FIG. 11 shows structure information of the tree structure 1 and the tree structure 2 shown in FIG.
For example, it is assumed that the terminal 0, the terminal 1, the terminal 3, and the terminal 7 are valid terminals, and the terminal 2, terminal 4, terminal 5, and terminal 6 are expired terminals.
Here, when all the same group terminal devices are selected as the transmission destination terminal devices by comparing the same group terminal device and the transmission destination terminal device in order from the group of the upper hierarchy for each structure information, When the secret information classified by group allocated to the group is extracted and one or more same group terminal apparatuses are not selected as a transmission destination terminal apparatus (when the same group terminal apparatus includes a revoked terminal), The same group terminal apparatus of the lower level group and the transmission destination terminal apparatus are compared.
Then, when one or more same group terminal devices are not selected as a transmission destination terminal device in the group of the lowest layer (when a revoked terminal is included in the same group terminal device), the group of the lowest layer Device-specific secret information (leaf node secret information) assigned to each of the same group terminal devices is extracted, and encrypted for each structure information so that all transmission destination terminal devices can decrypt the encrypted message. Extract secret information required for

In the tree structure 1, since the terminal 2, the terminal 4, the terminal 5, and the terminal 6 are revoked terminals, it is not possible to select the highest layer ka_1 which is included in the same group terminal device.
In addition, since the terminal 2 which is a revoked terminal is included in kb_1, it can not be selected. Similarly, kc_1 can not be selected because it includes the terminal 4 which is a revoked terminal, the terminal 5 and the terminal 6.
On the other hand, since the same secret information can be used for the terminal 0 and the terminal 1, it is possible to select kd_1 which is group-specific secret information.
Also, since the terminal 2 is a revoked terminal, ke_1 can not be selected. Thus, the terminal-specific secret information k3_1 is selected.
Similarly, kf_1 and kg_1 can not be selected because terminal 4, terminal 5, and terminal 6 are revoked terminals. Therefore, the terminal-specific secret information k7_1 is selected.
As described above, in the tree structure 1, a combination of kd_1, k3_1, and k7_1 is derived.
In the same manner, in tree structure 2, a combination of k0_2, k1_2, and kg_2 is derived.
In the example of FIG. 11, since three pieces of secret information are obtained in any of the tree structure 1 and the tree structure 2, either of the tree structure 1 and the tree structure 2 may be selected.
If the secret information of either tree structure 1 or tree structure 2 is small, the smaller one is selected.
If the number of pieces of secret information in the plurality of pieces of structure information is the same as in the example of FIG. 11, based on the preset priority (order of IDs of tree structures, LRU (Least Recently Used), etc.). , Select the structure information to use.

In general, in the key assignment methods including the CS method and the SD method, the number of elements when represented by the sum of subsets changes as the tree structure changes.
Therefore, as described above, by using the optimum of the m tree structures, the storage capacity of the secret information is m times that of the case where only a single tree structure is used, but the communication overhead is reduced. It is effective when performing secure multicast in a narrow band.
Furthermore, in the case of the number r of revoked terminals r = 2, for example, in the case of the key assignment method such as the SD method, the communication overhead is less when two revoked terminals exist in the left half and the right half of the tree structure. When the terminal ID rearranging process (step S602) described above is performed, in the first tree, the one with the most significant bit of the terminal ID of 0 is the left half and the one with the most significant bit of 1 is the right half. Similarly, in the i-th tree, the left half is the one in which the i-th bit is 0 from the top of the terminal ID, and the right half is 1 in the i-th tree. Therefore, when using m (= lon n) tree structures, there is always a tree structure in which one is in the left half and one is in the right half, regardless of which two terminals are expired, and communication overhead It is possible to reliably perform secure multicast with less
Also, the same effect can be obtained even in the case of three or more revoked terminals.

Furthermore, according to the terminal ID reordering process (step S602) in the present embodiment, the permutation of the terminals is definitely given, and there is no need for each terminal to store its own tree structure.

In the present embodiment, the determination of the key to be stored in each terminal and the message transmission to each terminal are performed by the same server device, but these may be performed by different devices.

Also, in the present embodiment, the number of terminals n is a value represented by a power of 2, but even if this is not the case, the present method is applied by adding virtual terminals until the power of 2 is obtained. It is possible.
That is, when the number of terminal devices 301 connected to the server device 201 is less than 2 ^m (m 2 2), the stirring unit 212 supplements the virtual terminals for the insufficient number and performs m types of ordering. The structure information generation unit 219 generates m pieces of order information indicating ordering and grouping of m types.

Further, in the present embodiment, the value m of the tree structure held and managed by the server is m = log n, but in consideration of the performance of the server and each terminal, a smaller value may be used.

Moreover, in the present embodiment, although the fixed permutation in which the terminal IDs are arranged in order from 0 to n-1 is output in step S702, even if the permutation rearranged in a definite or stochastic manner is output here good.
That is, the arrangement of terminal IDs in step S702 does not necessarily have to arrange the terminal IDs in order from 0 to n-1, and any arrangement can be made.

In the present embodiment, the optimum one is selected from the m tree structures in step S 807, and the sum S 1 + S 2 +... + S j of the subsets is determined based on this. It is also possible to determine each subset Si, and in this case, the number of elements j may be further reduced as compared with the case where only one is selected.
In this case, for each subset, additional information is required to indicate which tree structure.

By determining each subset Si across plural tree structures, for example, as shown in FIG. 12, kd_1 of tree structure 1 and kg_2 of tree structure 2 are combined, and two pieces of secret information are used. be able to.
In the example of FIG. 11, the tree structure 1 alone is three secret information, and the tree structure 2 alone is three secret information, but combining the tree structure 1 and the tree structure 2 into two secret information Can.
The kd_1 of the tree structure 1 can be commonly used in the terminal 0 and the terminal 1, and kg_2 of the tree structure 2 can be used in the terminal 3 and the terminal 7.
As a method of realizing such a scheme of combining subsets, it is conceivable to search for an optimal combination by combining subsets in a roundabout manner.

Also, in this embodiment, management of each terminal is performed based on the tree structure information, but if it is a secure multicast algorithm with different communication overhead by changing the permutation of the terminals, what kind of each terminal is Even if it is managed by structure, it is effective.

For example, instead of a tree structure, structural information of a line structure may be used.
In this case, as a key management algorithm, for example, it can be considered that terminals continuing on a line hold one key in common. Further, in addition to the tree structure and the line structure, any structure such as a circle, a lattice, or a graph can be used.

As described above, according to the present embodiment, the ordering of the terminal devices is changed to generate a plurality of types of structure information, and the smallest number of secret information is generated based on the allocation status of the secret information in the plurality of types of structure information. It is possible to derive a combination of the two, thereby suppressing communication overhead at the time of secure multicast transmission.

As described above, in the present embodiment, in the secure multicast system, the server transmitting information holds a plurality of representing the relationship between the terminals in a certain structure in order to manage the plurality of terminals receiving information, and multicasting We have described a method to reduce communication overhead that occurs in multicasting by using the optimal structure among them.
Further, in the present embodiment, a method has been described in which the relationship between terminals is represented by a tree structure.
Further, in the present embodiment, the method of systematically determining a plurality of tree structures based on the ID of each terminal has been described.

Second Embodiment
FIG. 9 is a block diagram showing a configuration example of the server apparatus 201 according to the present embodiment.
The algorithm storage area 211 to the structure information generation unit 219 in FIG. 9 are the same as those in FIG.
The structure determination unit 220 is a unit that generates a plurality of sets of plural pieces of structure information that manages the terminal, and determines a combination that minimizes the expected value of the communication overhead from among them.
The efficiency calculating unit 221 is a unit that receives a plurality of structures for managing terminals and the number r of revoked terminals, and calculates an expected value of communication overhead of secure multicast when r terminals are revoked.
The structure determination unit 220 and the efficiency calculation unit 221 are examples of the order information selection unit.

In this embodiment, the structure information generation unit 219 generates m pieces of structure information indicating ordering and grouping of m (m ≧ 2) types as one set, and generates structure information for t (t 2 2) sets. Do.
The efficiency calculating unit 221 calculates, for each set of structure information, an expected value of the number of pieces of secret information required when encrypting a transmission message using the m pieces of structure information included in the set.
Further, based on the expected value calculated by the efficiency calculating unit 221, the structure determining unit 220 selects a set having the smallest expected value from the t sets.
The set derivation unit 215 and the set determination unit 216 use the m pieces of structure information included in the set selected by the structure determination unit 220 when the terminal device to which secure multicast transmission is to be transmitted is selected. In the same procedure as in the first embodiment, a combination of secret information used for encryption of a transmission message is derived.

Further, the efficiency calculating unit 221 derives a plurality of combination patterns of terminal devices by combining the connection terminals with a predetermined number of transmission destination terminals (the number of terminals to be a target of secure multicast) in the calculation of the expected value. Although the details will be described later, for example, when eight terminal devices of terminal 0 to terminal 7 are connected to the server device 201 and the number of transmission destination terminals is five (the number of revoked terminals is three), the efficiency calculation unit 221 The terminal 0 to the terminal 7 are allocated to five terminals (or three terminals, which are the number of revoked terminals), which is the number of transmission destination terminals, and a plurality of combination patterns are derived.
Then, for each set of structure information, the efficiency calculation unit 221 minimizes the number of pieces of secret information required to encrypt the transmission message for each combination pattern among the m pieces of structure information included in the set. The structure information is extracted, and an expected value for each set is calculated based on the number of secret information in the structure information extracted for each combination pattern.

About the terminal device 301, since it is the same as that of the structure shown in FIG. 3, description is abbreviate | omitted.
Further, the configuration example of the secure multicast system according to the present embodiment is the same as that shown in FIG.

FIG. 10 is a flow chart for explaining distribution processing of secret information from the server to each terminal in the present embodiment.
The operation in the distribution process will be described with reference to the flowchart of FIG.
The number m of structure information held and managed by the server and the number of trials t of structure determination are determined in advance.

Before performing the distribution process, an algorithm of secure multicast is shared in advance between the server device 901 and each terminal device 301 (step S1001).
Here, it is assumed that the algorithm storage area 211 and the algorithm storage area 311 store corresponding algorithms.

First, the stirring unit 212 receives the number n of terminals and outputs m permutations in which terminal IDs from 0 to n-1 are randomly rearranged (step S1002).
Next, with the m permutations obtained in step S1002 as input, the structure information generation unit 219 gives a tree structure between the terminals according to the algorithm stored in the algorithm storage area 211 to obtain m structure information Are generated (step S1003).
With the m pieces of structure information obtained in step S1003 as input, the efficiency calculating unit 221 calculates an expected value of communication overhead with respect to a predetermined number r of revoked terminals set in advance (step S1004).
Specifically, for all the revocation patterns for a specific number r of revoked terminals, the communication overhead in the case of using the optimal structure of m is obtained, and the expected value is calculated by averaging these.

That is, for example, when eight terminal devices of the terminal 0 to the terminal 7 are connected to the server device 201 and the number of revoked terminals is three, the efficiency calculating unit 221 compares the number r of revoked terminals with three. Terminal 0 to terminal 7 are allocated, and in the form of revocation pattern 1: (terminal 0, terminal 1, terminal 2 is expired), revocation pattern 2: (terminal 0, terminal 1, terminal 3 is revoked), terminal 0 to terminal Deriving all revocation patterns obtained from the combination of 7.
Note that a plurality of “specific revoked terminal numbers” may be set.
Furthermore, although the revocation pattern is generated by combining the terminal 0 to the terminal 7 with the number of revoked terminals here, the transmission pattern may be generated by combining the terminal 0 to the terminal 7 with respect to the number of transmission destination terminals. .
Then, the efficiency calculating unit 221 is configured to minimize the number of pieces of secret information required to encrypt the transmission message when performing secure multicast to terminals other than the revoked terminal included in the revocation pattern for each revocation pattern. Information is extracted from m pieces of structure information.
In the case of m = 3, for example, the efficiency calculating unit 221 has the smallest number of secret information for the revocation pattern 1 as the structure information 3 and the smallest number of secret information for the revocation pattern 2 The structural information is extracted for each of the revocation patterns in the form of the structural information 1 in which the number of secret information is the smallest for the structural information 2 and the revocation pattern 3.
Then, the efficiency calculating unit 221 obtains an average value of the number of pieces of secret information in the extracted structure information, and sets the obtained average value as an expected value for the m pieces of structure information.

Then, after the trial of S1002 to S1004 is repeated t times (step S1005), the structure determination unit 220 sets the smallest expected value of the communication overhead, that is, m pieces of structural information having the smallest expected value of the communication overhead. It determines (step S1006).
Then, the key assignment unit 213 assigns secret information to each node for the selected m pieces of structure information, and stores m pieces of structure information to which the secret information is assigned in the secret information storage area 214, The corresponding secret information is stored in the secret information storage area 312 of the terminal (step S1007).

The encryption communication process from the server device 201 to each terminal 301 is the same as that described with reference to FIG.

FIG. 13 is a diagram showing an outline of the process of FIG.
In FIG. 13, m = 3 and t = 5.
In each trial, m pieces of structure information (m1-1, m1-2, m1-3, etc.) are generated in S1002 and S1003, and in S1004, expected values (expected value e1, etc.) for m pieces of structure information Is calculated and t times are tried (S1005), m sets of structure information of t sets are generated, and expected values (expected values e1 to e5) of each set are generated.
In addition, each structure information (m1-1, m1-2, m1-3, etc.) is, for example, structure information of a tree structure as shown in FIG. 4 (however, in the stage up to S1004, as shown in FIG. Secret information is not assigned to each node).
Then, the structure determination unit 220 selects a set (m pieces of structure information) with the smallest expected value (S1006), and the key allocation unit 213 allocates secret information to the m pieces of structure information of the selected set. (S1007).

As described above, by determining the optimum m structures from the randomly determined structures, a structure that reduces the communication overhead automatically for any secure multicast algorithm and any key management structure (manual Can be determined without

In this embodiment, m structures are generated at one time, and the structure is determined so that the communication overhead expectation value when all m are used is minimized. However, one structure is generated. Also, it is possible to select one with the smallest expected value for each additional structure.

For example, as shown in FIG. 14, in each of the m stages, structure information having the smallest expected value is selected from the t pieces of structure information, and the structure information selected in each stage is combined to form m Structure information
More specifically, in the case of m = 3 and t = 5, the structure information generation unit 219 determines five pieces of structure information (t1-1, t1 and t2) as candidates for the first (m1) of m pieces of structure information. t1-2, t1-3, t1-4, t1-5) are generated, and the efficiency calculation unit 221 applies each of the revocation patterns to each of the five pieces of structure information, and the communication overhead for each piece of structure information The expected value (e1 to e5) of is calculated.
The generation procedure of the structure information and the calculation procedure of the expected value are the same as those described in the flow of FIG.
Then, the structure determination unit 220 selects the structure information with the smallest expected value.
In FIG. 14, t1-3 is selected.
Next, the structure information generation unit 219 sets five pieces of structure information (t2-1, t2-2, t2-3, t2-4, t2-2) as the second (m2) candidate of the m pieces of structure information. 5), and the efficiency calculation unit 221 combines each of the revocation patterns with each of the structure information (t1-3) selected so far and each of the 5 pieces of structure information generated as candidates for m2 It applies to those to calculate expected values (f1 to f5) of communication overhead for each combination. Then, the structure determination unit 220 selects, from m2 candidates, the structure information with the smallest expected value. In FIG. 14, t2-2 is selected.
The above processing is performed for m steps, and in each step, structure information with the smallest expected value (f1 to f5, g1 to g5) of communication overhead is selected, and m pieces of structure information are obtained.
In the example of FIG. 14, t1-3, t2-2, t3-1 are selected.
Then, in the same manner as described above, the set derivation unit 215 and the set determination unit 216 select the m pieces of structure information selected by the structure determination unit 220 when a terminal device to be a transmission destination of secure multicast transmission is selected. In accordance with the same procedure as in the first embodiment, a combination of secret information used for encryption of a transmission message is derived using

Further, in the present embodiment, although the efficiency calculation unit 221 calculates the expected value of the communication overhead based on all the revocation patterns for the number r of revoked terminals, the r overhead is randomly selected to select the communication overhead. The estimated value of the expected value may be calculated by repeatedly performing the desired simulation.
When the number n of terminals and the number r of revoked terminals are large, it is possible to reduce the amount of calculation by doing this.
That is, if the number of terminals n and the number r of revoked terminals are large, the number of revocation patterns becomes very large. Therefore, calculating communication overhead for all the revocation patterns requires a long time for arithmetic processing. For this reason, it is possible to estimate the entire expected value and shorten the processing time by conducting sample survey and obtaining communication overhead for a part.

Further, in the present embodiment, the determination of the key to be stored in each terminal and the message transmission to each terminal are performed by the same server device, but these may be performed by different devices.

Further, in the present embodiment, an optimum one is selected from the m tree structures in step S1004 and step S807 of the encryption communication processing, and the sum S1 + S2 +... + Sj of subsets is determined based on this. It is also possible to determine each subset Si across a plurality of tree structures, and in this case, the number of elements j may be further reduced as compared with the case where only one is selected. In this case, for each subset, additional information is required to indicate which tree structure. The details are similar to the procedure described in the first embodiment with reference to FIG.

Further, in the present embodiment, the expected value of the communication overhead of m pieces of structure information is calculated for each set in S1004 of FIG. 10, but m sets of the structure information are generated after t sets are generated. From the (t) pieces of structure information, m combinations in which the expected value of the communication overhead is the smallest may be extracted.
For example, in the case of m = 3 and t = 5 as shown in FIG. 13, in FIG. 10, the expected value of the communication overhead is calculated for each set (every three pieces of structure information), but m1-1 to m5 Among the fifteen pieces of structure information of -3, three pieces of structure information with the smallest expected communication overhead value may be selected.
As a specific method of extracting m combinations having the smallest expected value of communication overhead from such m × t pieces of structure information, the m × t pieces of structure information are combined in a round-robin manner to be optimum. It is conceivable to search for combinations.

Also in the present embodiment, as long as the secure multicast algorithm has a different communication overhead by changing the permutation of the terminals, a structure other than the tree structure can be used.

As described above, in the present embodiment, determination of a plurality of tree structures by random numbers is repeated, and a method of holding the plurality of tree structures with respect to an optimal combination thereof has been described.

Finally, a hardware configuration example of the server device 201 and the terminal device 301 shown in the first and second embodiments will be described.
FIG. 15 is a diagram illustrating an example of hardware resources of the server device 201 and the terminal device 301 described in the first and second embodiments.
The configuration of FIG. 15 merely shows an example of the hardware configuration of the server device 201 and the terminal device 301, and the hardware configuration of the server device 201 and the terminal device 301 is not limited to the configuration described in FIG. It may be another configuration.

In FIG. 15, the server device 201 and the terminal device 301 each include a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, or a processor) that executes a program.
The CPU 911 is connected to, for example, a read only memory (ROM) 913, a random access memory (RAM) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903 and a magnetic disk drive 920 via a bus 912. Control the hardware devices of
Furthermore, the CPU 911 may be connected to a flexible disk drive (FDD) 904, a compact disk drive 905 (CDD), a printer 906, and a scanner 907. Also, instead of the magnetic disk drive 920, a storage device such as an optical disk drive or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk drive 920 are examples of non-volatile memory. These are examples of storage devices.
The communication board 915, the keyboard 902, the mouse 903, the scanner device 907, the FDD 904, and the like are examples of the input device.
The communication board 915, the display device 901, the printer device 906, etc. are examples of the output device.

The communication board 915 is connected to the network as shown in FIG. For example, the communication board 915 may be connected to a LAN (local area network), the Internet, a WAN (wide area network) or the like.

The magnetic disk drive 920 stores an operating system 921 (OS), a window system 922, programs 923, and files 924.
The programs of the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least a part of a program of the operating system 921 to be executed by the CPU 911 and an application program.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk drive 920 stores a boot program.
When the server device 201 and the terminal device 301 start up, the BIOS program of the ROM 913 and the boot program of the magnetic disk drive 920 are executed, and the operating system 921 is started up by the BIOS program and the boot program.

The program group 923 stores programs for executing the functions described as “... Unit” in the description of the first and second embodiments. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first and second embodiments, "determination of ...", "calculation of ...", "calculation of ...", "comparison of ...", "· · ·・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・ ・Information, data, signal values, variable values, and parameters indicating the result of the process described as “selection of” and the like are stored as items of “... File” and “... Database”.
"... file" and "... database" are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in storage media such as disks and memories are read by the CPU 911 to the main memory or cache memory via the read / write circuit, and are extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in main memory, registers, cache memory, and buffers during CPU operation of extraction, search, reference, comparison, operation, calculation, processing, editing, printing, and display. It is temporarily stored in a memory or the like.
The arrows in the flowcharts described in the first and second embodiments mainly indicate input and output of data and signals, and data and signal values are stored in the memory of the RAM 914, the flexible disk of the FDD 904, the compact disk of the CDD 905, and the magnetic It is recorded on the magnetic disk of the disk drive 920, and other recording media such as an optical disk, a mini disk, and a DVD. Also, data and signals are transmitted online via the bus 912, signal lines, cables and other transmission media.

Furthermore, in the description of the first and second embodiments, what is described as “... Part” may be “... Circuit”, “. Also, "... Step", "... Procedure", "... Processing" may be used. That is, what is described as “... Part” may be realized by the firmware stored in the ROM 913. Alternatively, it may be implemented by only software, or only hardware such as an element, device, substrate, wiring, or a combination of software and hardware, or a combination of firmware. The firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as the “... Unit” in the first and second embodiments. Alternatively, the computer is made to execute the procedure and method of “... Unit” in the first and second embodiments.

As described above, the server device 201 and the terminal device 301 described in the first and second embodiments display the CPU as the processing device, the memory as the storage device, the magnetic disk etc., the keyboard as the input device, the display as the output device such as the mouse. It is a computer provided with an apparatus, a communication board, etc., and realizes the functions indicated as “... Part” as described above using these processing apparatus, storage apparatus, input apparatus, and output apparatus.

FIG. 1 is a diagram showing an example of the configuration of a secure multicast system according to a first embodiment. FIG. 2 shows an exemplary configuration of a server apparatus according to Embodiment 1; FIG. 2 is a diagram showing an example of configuration of a terminal apparatus according to Embodiment 1; FIG. 3 is a diagram showing an example of structure information of a tree structure according to the first embodiment. FIG. 6 is a diagram showing an example of data stored by the terminal device according to the first embodiment. FIG. 5 is a flowchart showing an example of a process of distributing secret information according to the first embodiment. FIG. 7 is a flowchart showing an example of terminal ID rearrangement processing according to the first embodiment. FIG. 5 is a flowchart showing an example of encryption communication processing according to the first embodiment. FIG. 7 is a view showing an example of the arrangement of a server apparatus according to Embodiment 2; FIG. 7 is a flowchart showing an example of a process of distributing secret information according to the second embodiment. FIG. 7 is a diagram showing an example of a selection procedure of secret information according to the first embodiment. FIG. 7 is a diagram showing an example of a selection procedure of secret information according to the first embodiment. FIG. 7 is a view showing an example of a selection procedure of structure information according to the second embodiment. FIG. 7 is a view showing an example of a selection procedure of structure information according to the second embodiment. The figure which shows the hardware structural example of the server apparatus and terminal device which concern on Embodiment 1, 2. FIG.

Explanation of sign

DESCRIPTION OF SYMBOLS 101 network, 201 server apparatus, 211 algorithm storage area, 212 stirring part, 213 key allocation part, 214 secret information storage area, 215 set derivation part, 216 set determination part, 217 communication part, 218 encryption part, 219 structure information generation part , 220 structure determination unit, 221 efficiency calculation unit, 301 terminal device, 311 algorithm storage area, 312 secret information storage area, 313 key derivation unit, 314 communication unit, 315 encryption unit.

Claims (16)

1. An information processing apparatus connected to a plurality of communication apparatuses and performing multicast transmission of an encrypted message obtained by encrypting a transmission message using secret information to two or more communication apparatuses selected from the plurality of communication apparatuses. ,
   A plurality of types of ordering are performed on the plurality of communication devices, and two or more communication devices closely ordered in each ordering are grouped with each other, and a plurality of orders indicating the contents of each ordering and grouping An order information generation unit that generates information;
   Device-specific secret information used for decryption of encrypted messages in each communication device is assigned in units of communication devices and shared in two or more identical group communication devices classified in the same group for each order information A secret information assignment unit that assigns group-specific secret information that can be used for decryption of
   When two or more communication devices to be transmission destinations of multicast transmission are selected as the transmission destination communication devices from among the plurality of communication devices, the same group communication devices and the transmission for each group indicated in each order information What is claimed is: 1. An information processing apparatus comprising: a combination deriving unit configured to compare a destination communication apparatus and derive a combination of secret information used for encryption of a transmission message.
2. The combination deriving unit
   2. The information processing apparatus according to claim 1, wherein a combination of secret information which allows all the destination communication apparatuses to decrypt the encrypted message and which is the combination of the least number of secret information is derived.
3. The combination deriving unit
   For each group indicated in each order information, the same group communication device is compared with the transmission destination communication device, and if all the same group communication devices are selected as the transmission destination communication device, they are assigned to that group Extracting the group-specific secret information and extracting the device-specific secret information assigned to each of the same group communication devices when one or more same group communication devices are not selected as the transmission destination communication devices Then, for each order information, extract secret information necessary for encryption so that all transmission destination communication devices can decrypt the encrypted message, and count the number of extracted secret information,
   The order information having the smallest number of secret information is determined from the plurality of order information, and the secret information extracted for the determined order information is used as the secret information used for encryption of the transmission message. The information processing apparatus according to 1 or 2.
4. The order information generation unit
   Grouping two or more communication devices ordered in proximity to one another in a plurality of layers and generating order information in which a group of communication devices is indicated in the plurality of layers;
   The combination deriving unit
   The same group communication apparatus and the transmission destination communication apparatus are compared in order from the group of the upper hierarchy for each order information, and when all the same group communication apparatuses are selected as the transmission destination communication apparatus, the group Group secret information in the lower layer is extracted when the group-specific secret information assigned to the group is extracted and one or more same-group communication devices are not selected as the destination communication devices, the same-group communication devices in the lower layer group and the destination communication When compared with the device and one or more same group communication devices are not selected as the transmission destination communication device in the group of the lowest hierarchy, assigned to each of the same group communication devices of the group of the lowest hierarchy Device-specific secret information is extracted and encrypted so that all destination communication devices can decrypt the encrypted message for each order information The information processing apparatus according to claim 3, characterized in that to extract the secret information necessary in order.
5. The combination deriving unit
   For each group indicated in each order information, the same group communication device is compared with the transmission destination communication device, and if all the same group communication devices are selected as the transmission destination communication device, they are assigned to that group Extract group-specific secret information,
   A combination of secret information necessary for encrypting all the destination communication devices to decrypt the encrypted message by combining the group secret information extracted for the plurality of order information, The information processing apparatus according to any one of claims 1 to 4, wherein a combination that minimizes the number is derived.
6. The order information generation unit
   Grouping two or more communication devices ordered in proximity to one another in a plurality of layers and generating order information in which a group of communication devices is indicated in the plurality of layers;
   The combination deriving unit
   The same group communication apparatus and the transmission destination communication apparatus are compared in order from the group of the upper hierarchy for each order information, and when all the same group communication apparatuses are selected as the transmission destination communication apparatus, the group Group secret information in the lower layer is extracted when the group-specific secret information assigned to the group is extracted and one or more same-group communication devices are not selected as the destination communication devices, the same-group communication devices in the lower layer group and the destination communication The information processing apparatus according to claim 5, wherein the apparatus is compared with the apparatus.
7. The order information generation unit
   In the case where the number of communication devices connected to the information processing device is 2 ^m (m 、 2), m pieces of order information indicating ordering and grouping of m types are generated. The information processing apparatus according to any one of Items 1 to 6.
8. The order information generation unit
   When the number of communication devices connected to the information processing device is less than 2 ^m (m 2 2), m virtual communication devices for the missing number are replenished to indicate m kinds of ordering and grouping The information processing apparatus according to any one of claims 1 to 6, wherein order information of is generated.
9. The order information generation unit
   m pieces of order information indicating ordering (m ≧ 2) kinds and ordering are set as one set, and order information of t (t ≧ 2) sets is generated,
   The information processing apparatus may further include
   For each set of order information, the expected value of the number of pieces of secret information necessary for encrypting the transmission message is calculated using the m pieces of order information included in the set, and t sets are calculated based on the calculated expected value. And an order information selection unit for selecting a specific set from among
   The combination deriving unit
   When the transmission destination communication apparatus is selected, a combination of secret information used for encryption of the transmission message is derived using the m pieces of order information included in the set selected by the order information selection unit. The information processing apparatus according to any one of claims 1 to 8, wherein:
10. The order information selection unit
    10. The information processing apparatus according to claim 9, wherein a set having the smallest expected value is selected from the t sets.
11. The order information selection unit
    Combining a plurality of communication devices with a predetermined number of transmission destination communication devices to derive a plurality of combination patterns of communication devices;
    From the m pieces of order information included in the set for each set of order information, the order information having the least number of secret information required to encrypt the transmission message for each combination pattern is extracted, and the combination pattern is obtained. 11. The information processing apparatus according to claim 9, wherein an expected value for each set is calculated based on the number of pieces of secret information in the order information extracted for each.
12. The order information selection unit
    Combining a plurality of communication devices with a predetermined number of transmission destination communication devices to derive a plurality of combination patterns of communication devices;
    For each set of order information, the transmission message is encrypted for each combination pattern by comparing the same group communication device of each group indicated in the m pieces of order information included in the set with the communication device included in the combination pattern. Extracting a combination of groups that minimizes the number of secret information required to perform the pairing, and calculating an expected value for each set based on the number of secret information in the combination of groups extracted for each combination pattern The information processing apparatus according to any one of claims 9 to 11.
13. The order information generation unit
    At each stage of m (m ≧ 2) stages, generate t order information indicating ordering and grouping of t (t ≧ 2) kinds,
    The information processing apparatus may further include
    In each of the m stages, an expected value of the number of secret information necessary to encrypt the transmission message is calculated for each order information, and a specific one of t pieces of order information is calculated based on the calculated expected value. Having an order information selection unit for selecting order information;
    The combination deriving unit
    Deriving a combination of secret information used for encryption of a transmission message using the m pieces of order information selected in each of the m stages by the order information selection unit when the transmission destination communication apparatus is selected The information processing apparatus according to any one of claims 1 to 8, wherein
14. The order information selection unit
    14. The information processing apparatus according to claim 13, wherein the order information having the smallest expected value is selected from the t pieces of order information at each of m stages.
15. The order information generation unit
    After specific order information is selected from the t pieces of order information by the order information selection unit, t pieces of order information indicating ordering and grouping different from the selected order information are displayed in the following t 15. The information processing apparatus according to claim 13, generating as order information.
16. To a computer that is connected to a plurality of communication devices and multicasts an encrypted message obtained by encrypting a transmission message using secret information to two or more communication devices selected from the plurality of communication devices,
    A plurality of types of ordering are performed on the plurality of communication devices, and two or more communication devices closely ordered in each ordering are grouped with each other, and a plurality of orders indicating the contents of each ordering and grouping Order information generation processing for generating information;
    Device-specific secret information used for decryption of encrypted messages in each communication device is assigned in units of communication devices and shared in two or more identical group communication devices classified in the same group for each order information Secret information assignment processing for assigning group-specific secret information that can be used for decryption of
    When two or more communication devices to be transmission destinations of multicast transmission are selected as the transmission destination communication devices from among the plurality of communication devices, the same group communication devices and the transmission for each group indicated in each order information A program for executing a combination derivation process for comparing a destination communication device and deriving a combination of secret information used for encryption of a transmission message.

Images