WO2009157050A1

WO2009157050A1 - Information processing device and program

Info

Publication number: WO2009157050A1
Application number: PCT/JP2008/061400
Authority: WO
Inventors: 伊藤　隆; 米田　健; 宏郷辻; 和美齋藤; 英憲太田; 松田　規; 充洋服部
Original assignee: 三菱電機株式会社
Priority date: 2008-06-23
Filing date: 2008-06-23
Publication date: 2009-12-30
Also published as: JPWO2009157050A1

Abstract

A key management structure generating section (212) generates the key management structure of a tree structure including n leaf-nodes and allocates confidential information to each node. A terminal arranging section (213) allocates m(2≤m<n) terminals to each of the leaf-nodes, takes a node to which a valid terminal which is subject to multicast is allocated as a valid node, takes a node to which an invalid node which is not subject to multicast is allocated as an invalid node, takes a node to which no terminals are not allocated as an unused node, and, if a new terminal is subject to multicast, allocates the new terminal to the unused node. An aggregation deriving section (215) analyzes the state in which the terminal is allocated to each of the nodes and derives the combination with the least communication overhead, which is the combination of the confidential information in which the valid terminal alone can decode an encrypted message. A cipher section (217) encrypts a transmission message by using the derived combination of the confidential information. A communication section (216) then multicast-transmits the encrypted message.

Description

Information processing apparatus and program

The present invention relates to a technique for broadcasting (multicasting) information to, for example, only a plurality of legitimate terminal devices (hereinafter also referred to as terminals) from a server device (hereinafter also referred to as a server) using encryption technology.

The secure multicast system uses cryptographic technology to broadcast information (multicast) from the server only to a number of legitimate terminals, and the revoked terminals (groups) are collocated between revoked terminals. Is a communication system that prevents any information from leaking.
Here, a legitimate terminal is a terminal that is allowed to decrypt encrypted messages transmitted from the server, and an expired terminal (group) is a terminal that is prohibited from decrypting encrypted messages transmitted from the server. (Group).

A secure multicast system in which a device key held by a terminal is not updated at all is called a stateless method.
As a stateless method, various techniques for minimizing the number of device keys held by a terminal, multicast communication overhead, and calculation overhead for the terminal to derive a key have been proposed.

In the Complete Subtree method (CS method) and the Subset Difference method (SD method) disclosed in Non-Patent Document 1, the server places each terminal on a leaf (bottom layer) of a tree structure, and each node including the leaf This is a scheme in which secret information is allocated and each terminal holds secret information corresponding to each node on the path from its own node to the root node.
In these methods, when the server performs multicasting, a plurality of valid terminals are represented by a sum of S1 + S2 +... + Sj of a subset of terminals by an appropriate method. Thereafter, using the encryption key K1 held only by the terminal belonging to S1, the encryption key K2 held only by the terminal belonging to S2,..., The encryption key Kj held only by the terminal belonging to Sj, The message M (or session key K for encrypting the message M) (in this specification, the message M and the session key K are collectively referred to as a transmission message) is encrypted.
In other words, the server does not hold (cannot derive) the revoked terminal, but extracts the key held (can be derived) by the legitimate terminal, encrypts the message using each of the extracted keys, and Broadcasts an encrypted message.
By performing encryption as described above, it is possible to realize secure multicast in which information is transmitted only to legitimate terminals.

At this time, the communication overhead becomes a value proportional to the number of elements j when expressed in the sum, but in the CS method and the SD method, the value of j is reduced by devising the secret information to be given to each terminal. Is realized.
The CS method and the SD method are methods for performing efficient secure multicast under a model in which there are a plurality of predetermined legitimate terminals, and revocation terminals are gradually generated from there.
On the other hand, in the method disclosed in Patent Document 1, it is possible to add a terminal without limitation by adding a plurality of nodes under an unused leaf node (no terminal is assigned). is doing.
JP 2003-204321 PR D. Naor, M.M. Naor, and J.M. Lostpiech, "Revocation and tracing schemes for stateless receivers," Advances in Cryptology—CRYPTO'01, LNCS vol. 2139, pp. 41-62, 2001.

Key management algorithms such as the CS method and SD method create a key management tree by placing all existing terminals on the leaf nodes of the tree structure, and then change the multicast header according to the revocation of each terminal It is a method to do.
For this reason, when the CS method or the SD method is used as it is, a new terminal cannot be added.
In the method disclosed in Patent Document 1, some leaf nodes are left without being associated with terminals, and when these nodes are reduced, a plurality of nodes are added below to add terminals. In this case, the tree becomes unbalanced as the number of terminals added increases, and there is a problem that the necessary device keys and communication overhead increase as a whole.
Also, it is not disclosed to which node the additional terminal is assigned.

The main object of the present invention is to solve the above-mentioned problems. For example, in a secure multicast system, it is possible to add a terminal and to reduce communication overhead.

The information processing apparatus according to the present invention is a cipher that is encrypted using secret information to two or more multicast target communication apparatuses selected as multicast transmission targets from m (m ≧ 2) communication apparatuses. An information processing apparatus for multicast transmission of an encrypted message,
A secret information management structure generation unit that generates a secret information management structure including n (n> m) nodes arranged;
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and a node to which no communication device is allocated among the n nodes is designated as an unused node. A device allocation unit;
A secret information selection unit that selects secret information used for encryption of an encrypted message to be multicast-transmitted to the multicast target communication device based on a result of assignment of the terminal device to the secret information management structure by the device assignment unit. It is characterized by that.

The device allocation unit is
When a new communication device other than the m communication devices is selected as a multicast target communication device, the new communication device is assigned to an unused node.

The information processing apparatus further includes:
a secret information storage unit for storing n + 1 or more secret information;
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit A secret information management unit that manages secret information other than node secret information among grouped secret information as group secret information that is commonly applied to a plurality of nodes grouped,
The device allocation unit is
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and the node to which the multicast target communication device is allocated among the m nodes is designated as a valid node. And a node to which a communication device other than the multicast target communication device is allocated among the m nodes is designated as an invalid node,
The secret information selection unit
Based on the position of the valid node, the position of the invalid node and the position of the unused node in the n nodes, it is determined whether or not a plurality of valid nodes can be grouped. Secret information used for encryption of encrypted messages that are multicast-transmitted to the multicast target communication device by applying group secret information and applying corresponding node secret information to legitimate nodes that cannot be grouped It is characterized by selecting.

The device allocation unit is
When a new communication device other than the m communication devices is selected as a multicast target communication device, the new communication device is assigned to an unused node, and the unused node to which the new communication device is assigned is valid. It is characterized by changing to a node.

The device allocation unit is
When the new communication device is selected as a multicast target communication device, if there is only one unused node among the n nodes of the secret information management structure, the new communication device is assigned to the unused node. , Changing the unused node to which the new communication device is assigned to a valid node,
The secret information selection unit
It is determined whether or not a plurality of valid nodes can be grouped based on the positions of valid nodes and invalid nodes in the n nodes after the unused node is changed to a valid node by the device allocation unit. It is characterized by doing.

The secret information selection unit
When a plurality of unused nodes exist in n nodes of the secret information management structure when the new communication device is selected as a multicast target communication device, the new communication device is added to each unused node. Based on the position of the valid node, the position of the revoked node, and the position of the unused node in the n nodes when assigned, the number of secret information used for encrypting the encrypted message is calculated for each unused node. , Select an unused node that minimizes the calculated number of confidential information,
The device allocation unit is
The new communication device is assigned to an unused node selected by the secret information selection unit.

The secret information selection unit
The n nodes are divided into blocks for each k (2 ≦ k <m) nodes according to the order of arrangement, and for each block, which type of node is included in the k nodes in the block. It is characterized by analyzing whether or not a plurality of valid nodes can be grouped.

The secret information selection unit
If all k nodes in the block are unused nodes, specify an unused node as the parent node of k nodes;
If the k nodes in the block do not contain revoked nodes, specify the legitimate node as the parent node of the k nodes,
If the k nodes in the block contain an invalid node, specify the invalid node as the parent node of the k nodes,
Thereafter, the same processing is repeated,
Each time an invalid node is designated, a plurality of valid nodes corresponding to descendant nodes of the designated invalid node are grouped.

The secret information management structure generation unit
Generating a secret information management structure having a k-ary tree structure of a plurality of hierarchies in which the n nodes are arranged in the lowest hierarchy;
The secret information storage unit
Storing secret information corresponding to the number of nodes included in the secret information management structure;
The secret information management unit
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit Managing secret information other than node secret information among the secret information associated with the nodes other than the n nodes as group secret information,
The secret information selection unit
The group secret information associated with the legitimate node corresponding to the child node of the revocation node that is an ancestor node is applied to a plurality of legitimate nodes grouped.

The secret information selection unit
Designate a node that meets a given condition as an SD (Subset Difference) node,
If all k nodes in the block are unused nodes, specify an unused node as the parent node of k nodes;
If the k nodes in the block contain neither the revoked node nor the SD node, the legitimate node is designated as the parent node of the k nodes,
When k nodes in the block include only one invalid node and SD node in total, the SD node is designated as the parent node of k nodes,
If the k nodes in the block include two or more revocation nodes and SD nodes in total, specify the revocation node as the parent node of the k nodes,
Thereafter, the same processing is repeated,
Each time an invalid node is designated, a plurality of valid nodes corresponding to descendant nodes of the designated invalid node are grouped.

The secret information management structure generation unit
Generating a secret information management structure having a k-ary tree structure of a plurality of hierarchies in which the n nodes are arranged in the lowest hierarchy;
The secret information storage unit
Storing secret information corresponding to the number of nodes included in the secret information management structure;
The secret information management unit
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit Managing secret information other than node secret information among the secret information associated with the nodes other than the n nodes as group secret information,
The secret information selection unit
The group secret information associated with either the legitimate node or the SD node corresponding to the child node of the revocation node that is an ancestor node is applied to the grouped legitimate nodes.

The device allocation unit is
The m communication devices are allocated to the m nodes so that legitimate nodes, invalid nodes, and unused nodes are distributed.

The program according to the present invention provides an encrypted message encrypted using secret information to two or more multicast target communication devices selected as multicast transmission targets from m (m ≧ 2) communication devices. To computers sending multicast
A secret information management structure generation process for generating a secret information management structure including n (n> m) nodes arranged;
N secret information among n + 1 or more secret information stored in the secret information storage area is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage area Secret information management processing for managing secret information other than node secret information among stored secret information as group secret information that is commonly applied to a plurality of nodes grouped;
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and the node to which the multicast target communication device is allocated among the m nodes is designated as a valid node. Then, a node to which a communication device other than the multicast target communication device is assigned among the m nodes is designated as an invalid node, and a node to which no communication device is assigned among the n nodes is designated as an unused node. A device allocation process to be specified;
Based on the position of the valid node, the position of the invalid node and the position of the unused node in the n nodes, it is determined whether or not a plurality of valid nodes can be grouped. Secret information used for encryption of encrypted messages that are multicast-transmitted to the multicast target communication device by applying group secret information and applying corresponding node secret information to legitimate nodes that cannot be grouped And performing secret information selection processing for selecting.

According to the present invention, a secret information management structure including n nodes is generated for m terminal devices, and a node to which no terminal device is assigned is set as an unused node, thereby creating a new terminal. When a device is targeted for multicast transmission, a new terminal device can be assigned to an unused node.
In addition, a new terminal device is allocated to an unused node that already exists, and a node is not added for a new terminal device, and the node configuration of the secret information management structure is not unbalanced, Communication overhead can be suppressed.

Embodiment 1 FIG.
In this embodiment, a key management tree composed of a number of leaf nodes that is sufficiently larger than the number of terminals at the start of operation is created, and multicast is performed by managing each node in three states: valid, revoked, and unused. Thus, a secure multicast system capable of adding terminals and reducing communication overhead will be described.

FIG. 1 shows a system configuration example of a secure multicast system according to the present embodiment.
In FIG. 1, a server device 201 (hereinafter also simply referred to as a server) and a plurality of terminal devices 301 (hereinafter also simply referred to as terminals) are connected via a network 101.
In the secure multicast system according to the present embodiment, information is broadcast (multicast) only from the server apparatus 201 to a plurality of legitimate terminal apparatuses 301 using encryption technology, and the revoked terminals (groups) Even if there is a collusion between revoked terminals, no information is leaked.
The server device 201 is an example of an information processing device, and the terminal device 301 is an example of a communication device. A legitimate terminal device 301, that is, a terminal device 301 that is a target of multicast from the server device 201 is an example of a multicast target communication device.

FIG. 2 is a block diagram illustrating a configuration example of the server apparatus 201.
Server apparatus 201 according to the present embodiment determines a key to be stored in each terminal and transmits a message to each terminal.

In FIG. 2, an algorithm storage area 211 is data storage means for storing algorithms such as key assignment in secure multicast and message transmission to a valid terminal.
In this embodiment, an algorithm based on the CS method is used as an algorithm for managing terminals in a tree structure.

The key management structure generation unit 212 is a unit that generates a key management structure in accordance with an algorithm stored in the algorithm storage area 211 and assigns secret information to each element on the key management structure. The secret information is, for example, a key or information from which a key is derived.
In the present embodiment, a key management tree structure (hereinafter also referred to as a key management tree) is generated, and secret information is assigned to each node (root node, intermediate node, leaf node) on the key management tree structure.
More specifically, when the server 201 is connected to m (m ≧ 2) terminals 301 and two or more terminals 301 are selected from among the m terminals 301 as multicast transmission targets, the key The management structure generation unit 212 generates a tree-structured key management structure (secret information management structure) that includes n (n> m) arranged leaf nodes, and converts the n pieces of secret information into the key management structure. Management is performed in association with n leaf nodes. Further, the key management structure generation unit 212 manages secret information corresponding to the number of upper hierarchy nodes (also referred to as upper nodes) of leaf nodes in association with each upper hierarchy node.
The upper nodes of the leaf node are an intermediate node and a root node. An upper node of the intermediate node is a higher intermediate node and a root node.
Note that secret information associated with n leaf nodes is also referred to as node secret information. The secret information associated with the upper node of the leaf node is also referred to as group secret information. The group secret information is secret information that is commonly applied to a plurality of grouped lower layer nodes (also referred to as lower nodes).
The key management structure generation unit 212 is an example of a secret information management unit and a secret information management structure generation unit.

FIG. 6 shows an example of a key management structure in a state where the key management structure generation unit 212 assigns secret information to each node.
In the example of FIG. 6, there are eight leaf nodes, and two adjacent nodes for each hierarchy are aggregated to the upper node and finally reach the root node. Ka-ko described in each node is secret information assigned to each node.
The secret information kh-ko assigned to the eight leaf nodes corresponds to the node secret information, and the secret information ka-kg assigned to the upper node corresponds to the group secret information.

The terminal arrangement unit 213 assigns each terminal to a leaf node to which no terminal is assigned in the key management tree structure stored in the key management structure storage area 214, and according to the algorithm stored in the algorithm storage area 211, This is means for assigning appropriate secret information on the key management tree structure to the terminal.
More specifically, the terminal arrangement unit 213 is configured when the server 201 is connected to the m terminals 301 and the key management structure generation unit 212 generates a key management structure including n leaf nodes. , M terminals are allocated to m nodes of n nodes of the key management structure, and a node to which a valid terminal is allocated among m leaf nodes is designated as a valid node. Among the leaf nodes, a node to which an invalid terminal is assigned is designated as an invalid node, and a node to which no terminal is assigned among n nodes is designated as an unused node. That is, the leaf node has three states: “legitimate terminal is assigned (legitimate node)”, “revoked terminal is assigned (revocation node)”, and “terminal is not assigned (unused node)”. Managed by either.
In addition, when a new terminal other than m terminals is selected as a multicast target, the terminal placement unit 213 assigns a new terminal to an unused node and validates an unused node to which the new terminal is assigned. Whether or not a plurality of valid nodes can be grouped based on the positions of valid nodes and invalid nodes in n leaf nodes after an unused node is changed to a valid node (upper node) Whether or not confidential information can be applied).
The terminal arrangement unit 213 is an example of a device allocation unit.

The key management structure storage area 214 is data storage means for storing data in which each terminal is assigned to a leaf node of the key management structure (including secret information) generated by the key management structure generation unit 212.
FIG. 4 shows an example of data stored in the key management structure storage area 214. As described above, in FIG. 4, ka to ko are secret information corresponding to each node.
The key management structure storage area 214 stores n + 1 or more secret information in association with the key management structure. Specifically, secret information corresponding to the number of nodes in the key management structure is stored in association with the key management structure (in the example of FIG. 4, 15 secret information is stored in association with 15 nodes. ing).
The key management structure storage area 214 is an example of a secret information storage unit and a secret information storage area.

The set deriving unit 215 inputs the key management structure stored in the key management structure storage area 214 according to the algorithm stored in the algorithm storage area 211, and the set of valid terminals is the sum of the subsets of terminals S1 + S2 + ... + Sj is a means for deriving each subset Si so that the expired terminal is not included in this.
More specifically, the set derivation unit 215 determines whether or not a plurality of valid nodes can be grouped based on the positions of valid nodes, invalid nodes, and unused nodes in n leaf nodes. The group secret information is applied to a plurality of legitimate nodes that can be grouped, and the associated node secret information is applied to a legitimate node that cannot be grouped, and multicast transmission is performed to a legitimate terminal. Select the secret information used to encrypt the encrypted message.
The set derivation unit 215 is an example of a secret information selection unit.

The server apparatus 201 can perform encryption by using the node secret information assigned to the leaf node and the group secret information assigned to the upper node connected to the leaf node, and each terminal supports itself. The encrypted message can be decrypted using the node secret information assigned to the leaf node and the group secret information assigned to the upper node connected to the leaf node.
For example, in the example of FIG. 4, the server apparatus 201 can encrypt any of secret information ka, kb, kd, and kh with respect to the terminal 0, and the terminal 0 can store the secret information ka, kb, kd, Any of kh can decrypt the encrypted message. Similarly, the server apparatus 201 can encrypt any of the secret information ka, kb, kd, ki with respect to the terminal 4, and the terminal 4 can encrypt any of the secret information ka, kb, kd, ki. Decoding of encrypted messages is possible.
For this reason, it is more communication overhead to use group secret information kd that can be commonly applied to terminal 0 and terminal 4 than to use secret information kh and ki that are node secret information for terminal 0 and terminal 4. Can be reduced. Further, if there are no revoked nodes in the two nodes on the right side of the node to which the terminal 4 is allocated, the communication overhead can be further reduced by using the group secret information kb that can be commonly applied to the four terminals. (However, in the example of FIG. 4, since the terminal 2 has expired, the secret information kb cannot be applied).
The set deriving unit 215 determines whether such group secret information can be applied, and derives a set of secret information that minimizes the communication overhead.

The communication unit 216 is means for communicating with the terminal device 301.
The encryption unit 217 is a unit that performs key generation / encryption of common key / public key encryption, random number generation, and the like.

FIG. 3 is a block diagram illustrating a configuration example of the terminal device 301 that receives the multicast from the server device 201 in the secure multicast system (FIG. 1).

In FIG. 3, an algorithm storage area 311 is data storage means for storing algorithms such as key derivation and decryption in secure multicast.
In this embodiment, an algorithm of CS method is used.

The secret information storage area 312 is a data storage unit that stores secret information (encryption key or information used to derive the encryption key) associated with the key management structure managed by the server apparatus 201.
In this embodiment, all terminals store secret information associated with a tree structure. FIG. 5 shows an example of data stored in the secret information storage area 312.
More specifically, FIG. 5 shows an example of data held by the terminal 0 shown in FIG.
That is, the terminal 0 can use the secret information ka, kb, kd, and kh in the key management structure of FIG. 4, and FIG. 5 corresponds to the terminal 0 that corresponds to the secret information ka, kb, It shows that kd and kh are held.

The key derivation unit 313 derives an encryption key necessary for decrypting the message received from the server apparatus 201 from the secret information stored in the secret information storage area 312 according to the algorithm stored in the algorithm storage area 311. It is.

The communication unit 314 is a unit that communicates with the server device 201.
The encryption unit 315 is a means for performing decryption of common key / public key encryption, random number generation, and the like.

The procedures in secure multicast are the part where the server creates the key management structure, the part where the server assigns multiple terminals to the key management structure at the start of operation, the part where the terminal is revoked, the part where the terminal is added, the server to each terminal It is roughly divided into the parts that perform cryptographic communication.
Hereinafter, each procedure will be described with reference to the flowchart of FIG.
In this embodiment, an example in which (1) to (5) are executed in numerical order will be described. However, (3) to (5) can be performed in any order (as long as the restriction on the number of terminals allows). Can be executed repeatedly.

(1) Creation of Key Management Structure The key management structure generation unit 212 and the encryption unit 217 receive the maximum value n of the number of terminals including the revoked terminals used as a whole in the system and are stored in the algorithm storage area 211. In accordance with the key management algorithm, a key management structure is created (step S1801) (secret information management structure generation process), and secret information is assigned to each node (step S1802) (secret information management process). Then, the key management structure in which the secret information is assigned to each node is stored in the key management structure storage area 214.
In the present embodiment, the key management structure generation unit 212 creates a key management tree with n leaf nodes according to the CS method. Also, the secret information may be generated by the server device 201, or information generated outside may be input to the server device 201.
At this point, no terminal is assigned to all leaf nodes, and each leaf node is an “unused node”.
For example, when n = 8, a key management tree as shown in FIG. 6 is created.

(2) Terminal allocation at start of operation The terminal arrangement unit 213 allocates m (m <n) terminals used at the start of operation to the key management tree stored in the key management structure storage area 214 (step) S1803) (apparatus allocation processing).
The leaf node to which the terminal is assigned becomes a “valid node”.
Here, the arrangement is performed so that m terminals are distributed as much as possible on the key management structure.
As an example, when terminals 0 to 5 are arranged in a key management tree of n = 8, a bit string representing each terminal ID in binary notation of three digits is reversed, and the arrangement of the terminal at the position of the value represented by this is reversed. (Terminal 0 → 000 → 000 → 0th from left, terminal 1 → 001 → 100 → fourth from left, terminal 2 → 010 → 010 → second from left,...).
For example, when 6 terminals are allocated to the key management tree of FIG. 6, a key management tree as shown in FIG. 7 is created.
Thereafter, the server apparatus 201 stores secret information necessary for each terminal in accordance with the algorithm stored in the algorithm storage area 211.
In the present embodiment, secret information is stored according to the CS method.

(3) Revocation of terminal When a valid terminal needs to be revoked, the terminal arrangement unit 213 uses a “legitimate node” corresponding to the valid terminal in the key management tree stored in the key management structure storage area 214. Is changed to “revocation node” (step S1804) (apparatus allocation processing).
Thereby, a valid node and an invalid node are designated (step S1805) (device allocation process).
For example, when the terminal 2 is revoked in the key management tree of FIG. 7, a key management tree as shown in FIG. 8 is created.
(4) Addition of terminal When a new terminal is added to the system (YES in step S1806), the terminal arrangement unit 213 determines the number of “unused nodes” in the key management tree stored in the key management structure storage area 214. (Step S1807), and when the number of unused nodes is one, an additional terminal is allocated to the unused node (step S1808).
On the other hand, when there are a plurality of unused nodes, it is necessary to select one from the plurality of unused nodes.
Upon selection, the processing from S1001 to S1004 and S1006 in FIG. 10 is performed using a key management tree in which a new terminal device is assigned to each unused node (step S1809), and the entire key management tree is obtained for each unused node. The number of secret information necessary for encryption is calculated, an unused node with the smallest number of secret information is selected, and an additional terminal is assigned to the selected unused node (step S1810).
Details of each step in FIG. 10 will be described later. However, in step S1809, it is not necessary to actually perform encryption. When there are a plurality of “unused nodes” that minimize the communication overhead, a terminal that is distributed as much as possible on the key management tree is selected.
Thereafter, the node to which the additional terminal is assigned is changed to “legitimate node” (step S1811).
For example, when a new terminal 6 is assigned to an unused node (right end) in the key management tree of FIG. 8, a key management tree as shown in FIG. 9 is obtained.
The server device 201 stores secret information necessary for the additional terminal according to the algorithm stored in the algorithm storage area 211. In the present embodiment, secret information is stored according to the CS method.
Note that in “(5) Encrypted communication from server to each terminal”, the processing after S1001 in FIG. 10 is performed (step S1812). If step S1809 has already been performed, the secret already used for encryption is used. Since the information is selected, encryption is performed using the selected secret information (step S1005), encryption is performed using the selected secret information (steps S1005 and S1007), and an encrypted message is transmitted. (Step S1008) may be performed.

(5) Encryption Communication from Server to Each Terminal FIG. 10 is a flowchart for explaining the operation in the encryption communication process.
Hereinafter, a description will be given with reference to the flowchart of FIG.
Before performing the cryptographic communication process, the server apparatus 201 and each terminal apparatus 301 share the secure multicast algorithm in advance.
Here, it is assumed that the algorithm storage area 211 stores an algorithm based on the CS method (details will be described later), and the algorithm storage area 311 stores a decoding algorithm of the CS method.
The key management structure storage area 214 of the server device 201 contains the key management tree created in the above (1) to (4), and the secret information storage area 312 of the terminal device 301 contains the corresponding secret information. Stored (steps S1001, S1002).
In the following, it is assumed that the key management tree shown in FIG. 8 is stored in the key management structure storage area 214.

At the start of the process, any leaf node is assigned one of the “legitimate node”, “invalid node”, and “unused node”, and no state is assigned to the intermediate node (and the root node) ( FIG. 11).
The set deriving unit 215 selects one intermediate node (or root node) in which a state is assigned to all child nodes and a state is not assigned to itself (step S1003).
Then, according to the rules of FIG. 12, the state of the node is determined (step S1004).
Further, as described in the “encryption” column of FIG. 12, the encryption unit 217 encrypts the message (or session key) (step S1005).
The above processing is repeated until the state of the root node is determined (step S1006). If the root node finally becomes a “valid node”, the encryption unit 217 uses a key corresponding to the root node to send a message (or session). Key) is encrypted (step S1007).

The communication unit 216 multicasts all the encrypted messages (or session keys) created in step S1005 and step S1007 to the terminal device 301 (step S1008).
The communication unit 314 of the legitimate terminal device 301 receives the message (step S1009), and the key derivation unit 313 and the encryption unit 315 are stored in the secret information storage area 312 according to the algorithm stored in the algorithm storage area 311. The received message is decrypted with the encryption key derived from the stored secret information (step S1010).
Details of step S1010 depend on the algorithm stored in the algorithm storage area 311. In the present embodiment, a CS algorithm is used.
On the other hand, the revoked terminal device 301 cannot obtain information because it cannot derive an encryption key necessary for decryption even when it receives a multicast message.
By performing the above processing, secure multicast can be realized.

In the above example using the key management tree shown in FIG. 8, the final state of all the nodes is as shown in FIG. 13, and encryption is performed with the secret information corresponding to the nodes indicated by bold lines. .
The rule of FIG. 12 analyzes which kind of state (legitimate, invalid, unused) of two child nodes and determines the state of the upper node according to the combination of child node states. is there.
For example, in FIG. 8, the leaf nodes to which the terminal 0 and the terminal 4 are assigned have valid states, and therefore, an intermediate node (intermediate node 1) that is an upper node of these leaf nodes is a valid node. Also, encryption at this point is not performed.
In addition, for example, a leaf node to which the terminal 2 is assigned and a leaf node to which the terminal on the right side of the leaf node is not assigned are a combination of revocation and unused. Node 2) becomes an invalid node. Then, encryption is performed with the secret information assigned to the lower legitimate node of the intermediate node 2, but since no legitimate node exists under the intermediate node 2, no encryption is performed.
Since intermediate node 1 and intermediate node 2 are a combination of legitimacy and revocation, the upper nodes of intermediate node 1 and intermediate node 2 are revocation nodes. For this reason, encryption is performed on the terminal 0 and the terminal 4 by using the secret information assigned to the intermediate node 1 which is a lower right node of the upper node.

In this way, the set deriving unit 215 divides the n nodes into blocks (k in each of the two nodes in the example of FIG. 12) according to the order of the array (k in a case of 2 ≦ k <m). For each block, it is determined whether or not a plurality of valid nodes can be grouped by analyzing which type of node is included in k nodes in the block.
More specifically, the set derivation unit 215 designates an unused node as a parent node of k nodes when all of k nodes in the block are unused nodes, and sets the k nodes in the block. When a node does not contain an invalid node, a valid node is designated as a parent node of k nodes, and when an invalid node is included in k nodes in a block, an invalid node as a parent node of k nodes After that, the same processing is repeated.
Each time an invalid node is designated, encryption is performed on the descendant nodes that are valid nodes by applying secret information associated with the valid nodes that are child nodes of the invalid node.

In the CS method, which is one of the key management algorithms, once a key management tree is created, no nodes are added thereafter. Therefore, in order to add a terminal, it is necessary to prepare a node to which no terminal is assigned in advance. .
In the CS method, this node has to be managed in either “legitimate” or “revocation” state. However, as in this embodiment, it is managed in an “unused” state, and the CS method is modified. Since there is no terminal corresponding to “unused node” using the above algorithm, there is no need to consider “unused node” in the selection of secret information, and freedom to represent a legitimate terminal as a sum of subsets. As a result, the multicast communication overhead can be reduced.
Further, by devising selection of a node to which a terminal is allocated at the time of starting operation or adding a terminal, an effect of reducing communication overhead throughout the entire system can be obtained, which is effective when performing secure multicast in a narrow band.

In this embodiment, node addition to the key management structure is not assumed, but it is possible to combine with an existing method for adding a node to the key management structure.

In this embodiment, a key management algorithm based on the CS method is used, but an algorithm based on the SD method can also be used.
In this case, in the intermediate node state determination in step S1004, “SD node” is newly introduced as the intermediate node state, and the state determination rule of FIG. 14 is used.
In step S1007, when the root node finally becomes a “valid node” or “SD node”, the encryption unit 217 encrypts the message (or session key) with a key corresponding to the root node.
In the above example using the key management tree shown in FIG. 8, the final state of all nodes is as shown in FIG. 15, and encryption is performed with the keys corresponding to the nodes indicated by the bold lines.

That is, when the SD method is used as a base, after introducing a new “SD node” as a node state, the set deriving unit 215 determines that all k nodes in the block are unused nodes. An unused node is designated as the parent node of k nodes, and when the revocation node and the SD node are not included in the k nodes in the block, a valid node is designated as the parent node of the k nodes, and the block In the case where only one revocation node and one SD node are included in k nodes in the block, the SD node is designated as the parent node of the k nodes, and the revocation node and SD are designated in the k nodes in the block. When two or more nodes are included, an invalid node is designated as the parent node of k nodes, and the same processing is repeated thereafter.
Each time an invalid node is specified, encryption is performed on the descendant node that is a legitimate / SD node by applying secret information associated with the legitimate / SD node that is a child node of the invalid node. I do.

In this embodiment, a key management method using a tree structure is used as a key management algorithm. However, key management can be performed with an arbitrary structure such as a straight line, a circle, a grid, or a graph. It is also possible to use the method to be performed.

In this embodiment, in “(2) Terminal allocation at the start of operation”, regular allocation using a bit string is performed. However, if terminals are appropriately distributed, other than this A deterministic or probabilistic method may be used.

In the present embodiment, a binary tree is used as the tree structure, but the same secure multicast can be performed even when a triple tree or a quadtree is used. Further, the number of child nodes of each node may be different.
FIG. 16 shows an example of a state determination rule based on the CS method for a key management structure having a binary tree structure.
FIG. 17 shows an example of a state determination rule based on the SD method for a key management structure having a binary tree structure.

In the present embodiment, the same server device performs determination of the key stored in each terminal and message transmission to each terminal, but these may be performed by different devices.

As described above, in the present embodiment, in a secure multicast system, a server that transmits information manages each node in three states of valid, invalid, and unused in order to manage a plurality of terminals that receive the information. A method has been described in which a multicast header is determined based on a state to allow a terminal to be added and reduce communication overhead generated during multicast.

Further, in the present embodiment, a method has been described in which, when a terminal is added to the key management structure, a terminal is allocated by selecting a location where the subsequent secure multicast communication overhead is minimized.

In the present embodiment, the method of distributing and arranging legitimate terminals at the start of operation on the key management structure has been described.

Further, in the present embodiment, the method for performing secret information management based on the CS method and the method for performing secret information management based on the SD method have been described.

Finally, a hardware configuration example of the server device 201 shown in the first embodiment will be described.
FIG. 19 is a diagram illustrating an example of hardware resources of the server apparatus 201 illustrated in the first embodiment.
Note that the configuration in FIG. 19 is merely an example of the hardware configuration of the server apparatus 201, and the hardware configuration of the server apparatus 201 is not limited to the configuration illustrated in FIG. .

In FIG. 19, the server apparatus 201 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of input devices.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

The communication board 915 is connected to the network as shown in FIG. For example, the communication board 915 may be connected to a LAN (local area network), the Internet, a WAN (wide area network), or the like.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the server apparatus 201 is activated, the BIOS program in the ROM 913 and the boot program in the magnetic disk apparatus 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

The program group 923 stores a program for executing the function described as “... Unit” in the description of the first embodiment. The program is read and executed by the CPU 911.

The file group 924 includes “determination of...”, “Calculation of...”, “Calculation of...”, “Comparison of. ”Generation”, “Derivation of ...”, “Extraction of ...”, “Update of ...”, “Designation of ...”, “Registration of ...”, “Selection of ...” Information, data, signal values, variable values, and parameters indicating the results of the processing described as “...” Are stored as items of “... File” and “.
“... File” and “... Database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, the arrows in the flowchart described in the first embodiment mainly indicate input and output of data and signals. The data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic disk device. It is recorded on a recording medium such as a 920 magnetic disk, other optical disks, minidisks, and DVDs. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

In addition, what is described as “... part” in the description of the first embodiment may be “... circuit”, “... device”, “... device”. , “... Step”, “... Procedure”, “. That is, what is described as “... Unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “... Unit” in the first embodiment. Alternatively, the computer executes the procedure and method of “... Unit” in the first embodiment.

As described above, the server device 201 shown in the first embodiment includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, a display device as an output device, a communication board, and the like. As described above, the computer includes the functions indicated as “... Unit” using these processing devices, storage devices, input devices, and output devices.

1 is a diagram illustrating a configuration example of a secure multicast system according to Embodiment 1. FIG. FIG. 3 shows a configuration example of a server apparatus according to the first embodiment. FIG. 3 shows a configuration example of a terminal apparatus according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. FIG. 4 is a diagram illustrating an example of data stored in the terminal device according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. FIG. 3 is a flowchart showing an operation example of the server apparatus according to the first embodiment. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. The figure which shows the example of the state determination rule based on CS method concerning Embodiment 1. FIG. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. The figure which shows the example of the state determination rule based on SD method concerning Embodiment 1. FIG. FIG. 3 is a diagram showing an example of a key management structure according to the first embodiment. The figure which shows the example of the state determination rule based on CS method concerning Embodiment 1. FIG. The figure which shows the example of the state determination rule based on SD method concerning Embodiment 1. FIG. FIG. 3 is a flowchart showing an operation example of the server apparatus according to the first embodiment. The figure which shows the hardware structural example of the server apparatus which concerns on Embodiment 1, and a terminal device.

Explanation of symbols

101 network, 201 server device, 211 algorithm storage area, 212 key management structure generation section, 213 terminal arrangement section, 214 key management structure storage area, 215 set derivation section, 216 communication section, 217 encryption section, 301 terminal apparatus, 311 algorithm Storage area, 312 secret information storage area, 313 key derivation section, 314 communication section, 315 encryption section.

Claims

Information processing apparatus for multicast transmission of encrypted message encrypted using secret information to two or more multicast target communication apparatuses selected as multicast transmission targets from m (m ≧ 2) communication apparatuses Because
A secret information management structure generation unit that generates a secret information management structure including n (n> m) nodes arranged;
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and a node to which no communication device is allocated among the n nodes is designated as an unused node. A device allocation unit;
A secret information selection unit that selects secret information used for encryption of an encrypted message to be multicast-transmitted to the multicast target communication device based on a result of assignment of the terminal device to the secret information management structure by the device assignment unit. An information processing apparatus characterized by that.
The device allocation unit is
2. The information processing apparatus according to claim 1, wherein when a new communication apparatus other than the m communication apparatuses is selected as a multicast target communication apparatus, the new communication apparatus is assigned to an unused node.
The information processing apparatus further includes:
a secret information storage unit for storing n + 1 or more secret information;
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit A secret information management unit that manages secret information other than node secret information among grouped secret information as group secret information that is commonly applied to a plurality of nodes grouped,
The device allocation unit is
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and the node to which the multicast target communication device is allocated among the m nodes is designated as a valid node. And a node to which a communication device other than the multicast target communication device is allocated among the m nodes is designated as an invalid node,
The secret information selection unit
Based on the position of the valid node, the position of the invalid node and the position of the unused node in the n nodes, it is determined whether or not a plurality of valid nodes can be grouped. Secret information used for encryption of encrypted messages that are multicast-transmitted to the multicast target communication device by applying group secret information and applying corresponding node secret information to legitimate nodes that cannot be grouped The information processing apparatus according to claim 1, wherein the information processing apparatus is selected.
The device allocation unit is
When a new communication device other than the m communication devices is selected as a multicast target communication device, the new communication device is assigned to an unused node, and the unused node to which the new communication device is assigned is valid. The information processing apparatus according to claim 3, wherein the information processing apparatus is changed to a node.
The device allocation unit is
When the new communication device is selected as a multicast target communication device, if there is only one unused node among the n nodes of the secret information management structure, the new communication device is assigned to the unused node. , Changing the unused node to which the new communication device is assigned to a valid node,
The secret information selection unit
It is determined whether or not a plurality of valid nodes can be grouped based on the positions of valid nodes and invalid nodes in the n nodes after the unused node is changed to a valid node by the device allocation unit. The information processing apparatus according to claim 4, wherein:
The secret information selection unit
When a plurality of unused nodes exist in n nodes of the secret information management structure when the new communication device is selected as a multicast target communication device, the new communication device is added to each unused node. Based on the position of the valid node, the position of the revoked node, and the position of the unused node in the n nodes when assigned, the number of secret information used for encrypting the encrypted message is calculated for each unused node. , Select an unused node that minimizes the calculated number of confidential information,
The device allocation unit is
The information processing apparatus according to claim 4, wherein the new communication apparatus is assigned to an unused node selected by the secret information selection unit.
The secret information selection unit
The n nodes are divided into blocks for each k (2 ≦ k <m) nodes according to the order of arrangement, and for each block, which type of node is included in the k nodes in the block. 4. The information processing apparatus according to claim 3, wherein analysis is performed to determine whether or not a plurality of valid nodes can be grouped.
The secret information selection unit
If all k nodes in the block are unused nodes, specify an unused node as the parent node of k nodes;
If the k nodes in the block do not contain revoked nodes, specify the legitimate node as the parent node of the k nodes,
If the k nodes in the block contain an invalid node, specify the invalid node as the parent node of the k nodes,
Thereafter, the same processing is repeated,
8. The information processing apparatus according to claim 7, wherein each time an invalid node is designated, a plurality of valid nodes corresponding to descendant nodes of the designated invalid node are grouped.
The secret information management structure generation unit
Generating a secret information management structure having a k-ary tree structure of a plurality of hierarchies in which the n nodes are arranged in the lowest hierarchy;
The secret information storage unit
Storing secret information corresponding to the number of nodes included in the secret information management structure;
The secret information management unit
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit Managing secret information other than node secret information among the secret information associated with the nodes other than the n nodes as group secret information,
The secret information selection unit
9. The information processing according to claim 8, wherein group secret information associated with a legitimate node corresponding to a child node of an invalid node that is an ancestor node is applied to a plurality of legitimate nodes grouped. apparatus.
The secret information selection unit
Designate a node that meets a given condition as an SD (Subset Difference) node,
If all k nodes in the block are unused nodes, specify an unused node as the parent node of k nodes;
If the k nodes in the block contain neither the revoked node nor the SD node, the legitimate node is designated as the parent node of the k nodes,
When k nodes in the block include only one invalid node and SD node in total, the SD node is designated as the parent node of k nodes,
If the k nodes in the block include two or more revocation nodes and SD nodes in total, specify the revocation node as the parent node of the k nodes,
Thereafter, the same processing is repeated,
8. The information processing apparatus according to claim 7, wherein each time an invalid node is designated, a plurality of valid nodes corresponding to descendant nodes of the designated invalid node are grouped.
The secret information management structure generation unit
Generating a secret information management structure having a k-ary tree structure of a plurality of hierarchies in which the n nodes are arranged in the lowest hierarchy;
The secret information storage unit
Storing secret information corresponding to the number of nodes included in the secret information management structure;
The secret information management unit
Of the secret information stored in the secret information storage unit, n secret information is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage unit Managing secret information other than node secret information among the secret information associated with the nodes other than the n nodes as group secret information,
The secret information selection unit
The group secret information associated with any one of a valid node and an SD node corresponding to a child node of an invalid node that is an ancestor node is applied to a plurality of valid nodes grouped together. The information processing apparatus according to 10.
The device allocation unit is
4. The information processing apparatus according to claim 3, wherein the m communication apparatuses are allocated to the m nodes so that legitimate nodes, invalid nodes, and unused nodes are arranged in a distributed manner.
To a computer that multicasts an encrypted message encrypted using secret information to two or more multicast target communication devices selected from among m (m ≧ 2) communication devices as multicast transmission targets,
A secret information management structure generation process for generating a secret information management structure including n (n> m) nodes arranged;
N secret information among n + 1 or more secret information stored in the secret information storage area is managed as node secret information in association with n nodes of the secret information management structure, and stored in the secret information storage area Secret information management processing for managing secret information other than node secret information among stored secret information as group secret information that is commonly applied to a plurality of nodes grouped;
The m communication devices are allocated to m nodes among the n nodes of the secret information management structure, and the node to which the multicast target communication device is allocated among the m nodes is designated as a valid node. Then, a node to which a communication device other than the multicast target communication device is assigned among the m nodes is designated as an invalid node, and a node to which no communication device is assigned among the n nodes is designated as an unused node. A device allocation process to be specified;
Based on the position of the valid node, the position of the invalid node and the position of the unused node in the n nodes, it is determined whether or not a plurality of valid nodes can be grouped. Secret information used for encryption of encrypted messages that are multicast-transmitted to the multicast target communication device by applying group secret information and applying corresponding node secret information to legitimate nodes that cannot be grouped And a secret information selection process for selecting the program.