JP3657439B2

JP3657439B2 - Delivery method of encryption / decryption key in broadcast encryption communication

Info

Publication number: JP3657439B2
Application number: JP26349898A
Authority: JP
Inventors: 正憲山▲崎▼; 玄次西岡; 進松井
Original assignee: Hitachi Ltd
Current assignee: Hitachi Ltd
Priority date: 1997-10-03
Filing date: 1998-09-17
Publication date: 2005-06-08
Anticipated expiration: 2018-09-17
Also published as: JPH11168459A

Description

【０００１】
【発明の属する技術分野】
本発明は、同報暗号通信における復号に用いる鍵を限定された受信者に配送する鍵配送の技術に関するものである。
【０００２】
【従来の技術】
従来より、同報暗号通信の技術として、幾つかの方式が提案されている。
【０００３】
たとえば、文献「S.J.Kent:Security requirement and protocols for a broadcast scenario,IEEE Trans. Commun.,COM-29,6,pp.778-786(1981)」に記載のコピー鍵方式が知られている。
【０００４】
このコピー鍵方式は、同報暗号通信の基本的な方式であり、従来の１対１の暗号個別通信を単純に同報通信に拡張したものである。すなわち、この方式では、１種類の鍵のコピーを送信者と複数の正規の受信者に配送する。そして、送信者は配送されたコピー鍵を用いて情報を暗号化して送信し、正規の各受信者は配送されたコピー鍵を用いて暗号化された情報を復号化する。
【０００５】
また、このコピー鍵のように、送信者と受信者が共通に用いる鍵である共通鍵を、秘密裏に限定された受信者に配送する技術としては、文献「李、常盤他：多重化・多重分離法を用いた同報通信、1986年暗号と情報セキュリティシンポジウム」に記載の中国人の剰余定理を用いた情報系列の多重化・多重分離法による鍵配送方式や、文献「満保他：効率的な同報暗号通信方式、信学技法ISEC93-34（1993-10）」に記載の方式などが知られている。
【０００６】
中国人の剰余定理を用いて情報系列の多重化・多重分離法を行う方式は、次の処理を行うものである。
【０００７】
（１）鍵生成処理：
受信者ｉ（１≦ｉ≦ｒ）に対して、互いに素なｓ個の整数ｇ₁，ｇ₂，．．．，ｇ_S（ｒ≦ｓ）を作成し、ｇ_iを受信者ｉの秘密情報として、予め受信者ｉに配布する。
【０００８】
（２）暗号化処理：
多重化すべきｓ個の情報系列をＭ₁，Ｍ₂，．．．，Ｍ_sとする。送信者は、多重化送信文Ｆを、
【０００９】
【数９７】

【００１０】
により計算し、これを同報送信する。但し、Ｇ、Ｇ_i，Ａ_iは、
【００１１】
【数９８】

【００１２】
において、Ａ_iが最小の整数となる関係にある。
【００１３】
（３）復号化処理：
受信者ｉは、多重化送信文Ｆからｇ_iを用いて、
【００１４】
【数９９】

【００１５】
により、Ｍ_iを分離化する。
【００１６】
ここで、Ｍ_iは、受信者ｉに配送すべき共通鍵であってよい。したがって、この方式によれば、限定された受信者のみに秘密裏にコピー鍵を配送することができる。
【００１７】
次に、文献「満保他：効率的な同報暗号通信方式、信学技法ISEC93-34（1993-10）」に記載の方式は、次の処理を行うものである。
【００１８】
（１）鍵生成処理：
信頼できるセンタは、次の情報を作成する。
【００１９】
秘密情報：
【００２０】
【数１００】

【００２１】
公開情報：
【００２２】
【数１０１】

【００２３】
センタは、σ∈Ｓに対して、
【００２４】
【数１０２】

【００２５】
なるＳσを計算し、受信者Ｕσの秘密情報として配布する。但し、集合Ｓ＝｛ｆ｜1対1写像ｆ：Ａ＝｛１，２，．．．，ｋ｝→Ｂ＝｛１，２，．．．，ｍ｝、ｍ＞ｋ｝とする。
【００２６】
（２）鍵配送処理：
送信者は整数ｒをランダムに選び、共通鍵
【００２７】
【数１０３】

【００２８】
を限定された受信者との間で共有することを目的として、
【００２９】
【数１０４】

【００３０】
を計算し、ｚ_i（１≦ｉ≦ｍ）を同報送信する、
受信者Ｕσは、
【００３１】
【数１０５】

【００３２】
にて、共通鍵Ｋを計算する。
【００３３】
【発明が解決しようとする課題】
前述した中国人の剰余定理を用いた多重化方法を利用した鍵配送では、受信者一人一人用の共通鍵のデータをシリアルに並べて送信するので、受信者数に比例して同報通信するデータの長さが長くなる。このため、衛星放送サービスのように数百万人以上の受信者を対象とする通信には適していない。
【００３４】
これに対して、文献「満保他：効率的な同報暗号通信方式、信学技法ISEC93-34（1993-10）」に記載の方式によれば、受信者数が大きい場合であっても共通鍵配送のためのデータを小さくできる。しかし、この方式では、任意の受信者集合に属する限定された受信者のみと鍵共有を行なうことができない。
【００３５】
また、いずれの方式の場合も、送信者が複数存在する場合には、受信者は情報を受信する送信者毎に、それぞれ、前述した秘密情報を入手、管理しなければならない。
【００３６】
そこで、本発明は、受信者が唯一の秘密情報によって、複数の送信者からの個々の共通鍵の配送を受けることのできる鍵配送システムを提供することを課題とする。また、このような鍵配送システムにおいて、任意の送信者と任意の受信者集合に属する受信者のみとのデータ暗復号のための共通鍵の共有を可能とすること、および、受信者数が大きい場合に、これに伴い共通鍵配送のための同報通信データを長くする必要がない共通鍵配送を実現することを課題とする。
【００３７】
【課題を解決するための手段】
前記課題達成のために、本発明は、複数の送信者と、複数の受信者とが存在する通信システムにおいて、前記送信者が行う同報暗号通信の暗復号化鍵を、前記送信者と前記受信者との間で共有するための鍵配送方法であって、
鍵管理者を設け、当該鍵管理者において、前記送信者と前記受信者との間で鍵を共有するために用いる、前記複数の送信者について共通の第１鍵情報を作成して所定の受信者に配布するとともに、前記送信者と前記受信者との間で鍵を共有するするために用いる第２鍵情報を作成して前記送信者に配布し、
前記送信者は、前記受信者が前記第１鍵情報を用いて当該送信者が同報通信に用いる暗復号化鍵を算出するための第３鍵情報を、前記鍵管理者から配布された第２鍵情報を用いて生成して、当該送信者と鍵を共有する前記受信者に送信し、前記受信者は、前記鍵管理者から配布された第１鍵情報と前記送信者から配布された第３鍵情報とを用いて、第３鍵情報を配布した前記送信者が同報通信に用いる暗復号化鍵を入手することを特徴とする。
【００３８】
本鍵配送方法によれば、各受信者は、秘密情報として鍵管理者から配布された第１鍵情報のみを所持すればよく、新たな送信者の暗復号化鍵を入手する場合にも、新たな秘密情報の配布を受ける必要がない。
【００３９】
より詳細には、本発明は、前記課題達成のために、たとえば、複数の送信者と、複数の受信者と、鍵管理者とが存在する通信システムを用い、前記送信者が行う同報暗号通信の暗復号化鍵を、前記受信者に配送する鍵配送方法であって、
鍵管理者において、鍵管理者秘密情報として、
【００４０】
【数１０６】

【００４１】
を作成し、送信者Ａの送信者識別情報として、
【００４２】
【数１０７】

【００４３】
を作成し、受信者ｘの受信者秘密情報として、
σ_X∈Ｓ_kmと、
【００４４】
【数１０８】

【００４５】
（但し、集合
【００４６】
【数１０９】

【００４７】
に対して、σ、σ´∈Ｓ_kmのとき
【００４８】
【数１１０】

【００４９】
とし、このとき、〜はＳ_km上の同値関係となり、
【００５０】
【数１１１】

【００５１】
とする）とを作成し、受信者秘密情報σ_X、ｓ_X（σ_X）を受信者ｘに配布するステップと、
送信者Ａにおいて、
【００５２】
【数１１２】

【００５３】
（但し、
【００５４】
【数１１３】

【００５５】
は、
【００５６】
【数１１４】

【００５７】
なる最小の正整数ａを表す）なる送信者秘密情報ｇ_A、Ｌ_Aおよび有限アーベル群Ｇ_Aを作成し、送信者秘密情報ｇ_Aを鍵管理者に送信するステップと、
鍵管理者において、鍵管理者秘密情報ｅ_i、送信者識別情報ｔ_Aおよび受信者秘密情報ｓ_X（σ_X）、σ_Xから、受信者識別データ
【００５８】
【数１１５】

【００５９】
を計算し、受信者識別データｓ_X（σ_X，Ａ）を送信者Ａに送信し、送信者Ａから受信したｇ_Aと、鍵管理者秘密情報ｅ_iと、送信者識別情報ｔ_Aから、鍵配送データ
【００６０】
【数１１６】

【００６１】
を算出し、鍵配送データｙ_Aiを送信者Ａに送信するステップと、
送信者Ａにおいて、整数ｒ、ｒ´を生成し、鍵管理者から受信した受信者識別データｓ_X（σ_X，Ａ）と、送信者秘密情報Ｌ_Aと、整数ｒ´から
【００６２】
【数１１７】

【００６３】
なる受信者識別情報ｒ_X（σ_X，Ａ）を計算し、受信者識別情報ｒ_X（σ_X，Ａ）を受信者ｘに送信し、鍵管理者から受信した鍵配送データｙ_Aiと、整数ｒから、鍵配送情報
【００６４】
【数１１８】

【００６５】
を計算し、鍵配送情報ｚ_Aiを、各受信者に同報送信するステップと、
受信者ｘにおいて、送信者Ａから受信した受信者識別情報ｒ_X（σ_X，Ａ）および鍵配送情報ｚ_Aiと、鍵管理者から配布された受信者秘密情報σ_X、ｓ_X（σ_X）から、
【００６６】
【数１１９】

【００６７】
により、送信者Ａが
【００６８】
【数１２０】

【００６９】
によって生成し、同報通信に用いる暗復号化鍵Ｋ_Aを計算するステップと、を有することを特徴とする。
【００７０】
この鍵配送方法によれば、受信者は送信者毎に異なる秘密鍵を持つ必要がない他、同報暗号通信において、受信者数が大きい場合であっても、これに伴い鍵配送情報の長さを長くする必要がない。また、本鍵配送方法においては、鍵管理者のみが秘密裏に所持する送信者識別情報によって、受信者秘密情報は送信者に対して秘密化され、受信者に対して送信者秘密情報はより強固に秘密化されるので、不正に対する安全性が向上する。
【００７１】
【発明の実施の形態】
以下、本発明に係る鍵配送システムの実施形態について説明する。
【００７２】
まず、本発明の第１実施形態について説明する。
【００７３】
図１に、本発明の第１実施形態に係る鍵配送システムの構成を示す。
【００７４】
図示するように、本システムは、相互に通信回線４００で接続された鍵管理者側装置１００、送信者側装置２００、受信者側装置３００から構成される。鍵管理者側装置１００は、システムに唯一の鍵管理者組織が使用する装置であり、送信者装置２００、受信者側装置３００はシステム中に複数存在する。
【００７５】
図２に、鍵管理者側装置１００の構成を示す。
【００７６】
図示するように、鍵管理者側装置１００は、乱数生成器１０１、素数生成器１０２、べき乗算器１０３、剰余演算器１０４、演算装置１０５、メモリ１０６、通信装置１０７から構成される。また、鍵管理者側装置１００には、オフラインで受信者に配送する受信者側携帯装置３０６が接続される。
【００７７】
図３に、送信者側装置２００の構成を示す。
【００７８】
図示するように、送信者側装置２００は、乱数生成器２０１、素数生成器２０２、べき乗算器２０３、剰余演算器２０４、演算装置２０５、メモリ２０６、通信装置２０７、暗復号化装置２０８、認証装置２０９、課金装置２１０から構成される。
【００７９】
図４に、受信者側装置３００の構成を示す。
【００８０】
図示するように、受信者側装置３００は、べき乗算器３０１、剰余演算器３０２、演算装置３０３、メモリ３０４、通信装置３０５、鍵管理者からオフラインで配送された受信者側携帯装置３０６、暗復号化装置３０７、認証装置３０８から構成される。
【００８１】
以下、本システムが行う準備処理、鍵配送処理、そして暗復号化処理の３つの処理について説明する。
【００８２】
では、まず、準備処理について説明する。
【００８３】
（１）準備処理
▲１▼送信者Ａは、送信者側装置２００内の乱数生成器２０１、素数生成器２０２、べき乗算器２０３、剰余演算器２０４、および演算装置２０５を用いて、次の情報を作成し、そのうち、公開情報のみを公開する。
【００８４】
秘密情報：
【００８５】
【数１２１】

【００８６】
公開情報：
【００８７】
【数１２２】

【００８８】
秘密情報はメモリ２０６に格納する。また、秘密情報ｇ_A、Ｌ_Aを通信装置２０７を用いて鍵管理者に送信する。
【００８９】
▲２▼信頼できる鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、次の情報を作成する。
【００９０】
鍵管理者秘密情報：
【００９１】
【数１２３】

【００９２】
送信者Ａの送信者識別情報：
【００９３】
【数１２４】

【００９４】
受信者ｘの受信者秘密情報：
【００９５】
【数１２５】

【００９６】
これらは、σ_Xとともに全てメモリ１０６に格納する。
【００９７】
ただし、集合
【００９８】
【数１２６】

【００９９】
に対して、σ、σ´∈Ｓ_kmのとき、
【０１００】
【数１２７】

【０１０１】
とする。このとき、〜はＳ_km上の同値関係となり、
【０１０２】
【数１２８】

【０１０３】
とする。
【０１０４】
また、鍵管理者は、メモリ１０６から受信者秘密情報ｓ_X（σ_X）を取り出し、σ_Xとともに受信者側携帯装置３０６に格納し、これを受信者ｘにオフラインで配布する。もちろん、他の方法によって受信者に配布するようにしてもよい。
【０１０５】
次に、鍵配送処理について説明する。
【０１０６】
（２）鍵配送処理
本鍵配送処理における、鍵管理者、送信者、および受信者間の情報の流れを図５に示す。
【０１０７】
▲１▼鍵管理者は、鍵管理者側装置１００内の剰余演算器１０４、演算装置１０５を用いて、送信者Ａから受信したＬ_Aと、鍵管理者秘密情報ｅ_iと、受信者秘密情報σ_X、ｓ_X（σ_X）と、送信者識別情報ｔ_Aから、
【０１０８】
【数１２９】

【０１０９】
なる受信者ｘの受信者識別データｓ_X（σ_X，Ａ）を計算し、通信装置１０７を用いて送信者Ａに送信する。
【０１１０】
また、鍵管理者は、鍵管理者側装置１００内のべき乗算器１０３、剰余演算器１０４、演算装置１０５を用いて、送信者Ａから受信したｇ_Aと、送信者Ａの送信者公開情報Ｎ_Aと、鍵管理者秘密情報ｅ_iから、
【０１１１】
【数１３０】

【０１１２】
なる送信者Ａの送信者鍵配送データｙ_Aiを計算し、通信装置１０７を用いて送信者Ａに送信する。
【０１１３】
▲２▼送信者Ａは、送信者側装置２００内の乱数生成器２０１により、乱数ｒ、ｒ´を作成しメモリ２０６に格納する。さらに、べき乗算器２０３、剰余演算器２０４、演算装置２０５を用いて、この乱数ｒ、ｒ'と、自身の秘密情報ｇ_Aと、自身の公開情報Ｎ_Aから、
【０１１４】
【数１３１】

【０１１５】
なるデータ暗号化鍵Ｋ_Aを計算してメモリ２０６に格納し、受信者ｘとの間で鍵Ｋ_Aを共有することを目的として、剰余演算器２０４、演算装置２０５を用いて、自身の秘密情報Ｌ_Aと、乱数ｒ´と、鍵管理者から受信した受信者ｘの受信者識別データｓ_X（σ_X，Ａ）から、
【０１１６】
【数１３２】

【０１１７】
なる受信者ｘの受信者識別情報ｒ_X（σ_X，Ａ）を計算し、通信装置２０７を用いて受信者ｘに送信する。
【０１１８】
また、送信者Ａは、送信者側装置２００内のべき乗算器２０３、剰余演算器２０４、演算装置２０５を用いて、自身の公開情報Ｎ_Aと、乱数ｒと、鍵管理者から受信した送信者鍵配送データｙ_Aiから、
【０１１９】
【数１３３】

【０１２０】
なる受信者鍵配送データｚ_Aiを計算し、通信装置２０７を用いて受信者に同報送信する。
【０１２１】
ここで、以上の処理において、ｒ_X（σ_X，Ａ）、ｚ_Aiを作成する処理の一部を、鍵管理者が行う理由の一つは、送信者Ａに対して、受信者ｘの受信者秘密情報σ_X、ｓ_X（σ_X）、送信者識別番号ｔ_Aを秘密にすることにより、送信者Ａの不正を防止するためである。
【０１２２】
▲３▼受信者ｘは、送信者Ａから受信した鍵配送データｚ_Aiおよび受信者識別情報ｒ_X（σ_X，Ａ）、鍵管理者から配送された受信者秘密情報σ_X、ｓ_X（σ_X）、公開された送信者公開情報Ｎ_Aから、
【０１２３】
【数１３４】

【０１２４】
により、データ暗号化鍵Ｋ_Aを計算し、メモリ３０４に格納する。
【０１２５】
以上の処理で、送信者Ａと受信者ｘは鍵Ｋ_Aを共有できる。他の任意の送信者と受信者についても同様にして鍵を共有できる。また、この際、送信者Ａが同報送信する受信者鍵配送データｚ_Aiは、各受信者について共通である。
【０１２６】
また、以上の処理において、受信者ｘが送信者Ａより受けとる鍵配送データｚ_Aiおよび受信者識別情報ｒ_X（σ_X，Ａ）は、受信者に対して秘密化されている送信者Ａの送信者識別番号ｔ_Aが作用したものとなっている。したがって、以上の送信者識別番号ｔ_Aを用いる構成により、受信者ｘが送信者Ａより受けとった鍵配送データｚ_Ai、受信者識別情報ｒ_X（σ_X，Ａ）、他の送信者Ｂの公開情報Ｎ_B、他の送信者Ｂが同報通信した鍵配送データｚ_Biより、他の送信者Ｂのデータ暗号化鍵Ｋ_Bを割り出すことを、きわめて困難とすることができる。
【０１２７】
以下、暗復号化処理について説明する。
【０１２８】
（３）暗復号化処理
▲１▼送信者Ａは、送信者側装置２００内の暗復号化装置２０８を用いて、鍵配送処理で作成した共通鍵Ｋ_Aにより、データＰを暗号化する。そして、暗号文Ｃ＝Ｅ（Ｋ_A：Ｐ）を通信装置２０７を用いて受信者ｘに送信する。
【０１２９】
▲２▼受信者ｘは、受信者側装置３００内の通信装置３０５を用いて暗号文Ｃを受信し、暗復号化装置３０７を用いてメモリ３０４に格納していた共通鍵Ｋ_Aにより暗号文Ｃを復号化し、データを得る。
【０１３０】
以上、本発明の第１実施形態について説明した。
【０１３１】
従来の技術では、新規に送信者がシステムに参入する際、受信者秘密情報σ_X、ｓ_X（σ_X）を、送信者自身が作成し受信者にオフラインで配布する必要があった。これに対し、第１実施形態に係る鍵配送システムによれば、新規参入の送信者Ａは、送信者秘密情報Ｐ_A、Ｑ_A、Ｌ_A、ｇ_Aと、送信者公開情報Ｎ_Aを作成するだけでよい。また、受信者が持つ受信者秘密情報は、全ての送信者に対して唯一であり、新たな送信者からデータを受信したい場合に、新たな受信者秘密情報を入手する必要がない。
【０１３２】
また、受信者識別情報ｒ_X（σ_X，Ａ）によって、任意の受信者集合に属する受信者のみとのデータ暗復号のための共通鍵の共有を可能とすることができる。また、受信者数が大きい場合であっても、共通鍵配送のために同報通信する鍵配送データｚ_Aiを、これに伴い長くする必要がない。
【０１３３】
なお、以上の処理において、あらかじめ、送信者Ａが送信者秘密情報Ｌ_Aを鍵管理者に送信しておき、準備処理の段階で、鍵管理者は、送信者Ａから受信した送信者秘密鍵Ｌ_Aから
【０１３４】
【数１３５】

【０１３５】
となる鍵管理者秘密情報ｅ_i、送信者識別情報ｔ_A、受信者秘密情報ｓ_X（σ_X）を作成し、鍵配送処理の段階で、鍵管理者は、送信者秘密情報Ｌ_A、鍵管理者秘密情報ｅ_i、送信者識別情報ｔ_A、受信者秘密情報ｓ_X（σ_X）から、
【０１３６】
【数１３６】

【０１３７】
によって、受信者識別データｓ_X（σ_X，Ａ）を計算するようにしてもよい。
【０１３８】
次に、本発明の第２実施形態について説明する。
【０１３９】
本発明の第２実施形態は、上記の第１実施形態における受信者側携帯装置３０６に、図６に示すように、べき乗算器３０３６、剰余演算器３０６３、演算装置３０６１、メモリ３０６２を備えるようにしたものである。そして、上記の第１実施形態の受信者側装置３００におけるデータ暗号化鍵Ｋ_Aの計算処理の一部を、受信者側携帯装置３０６で実施するようにしたものである。
【０１４０】
すなわち、第２実施形態では、（１）準備処理の段階で、鍵管理者はσ_Xと受信者秘密情報ｓ_X（σ_X）とを、受信者携帯装置３０６（ＩＣカード等）に格納して、受信者ｘに配布する。
【０１４１】
そして、（２）鍵配送処理において、受信者ｘは、受信者側装置３００内のメモリに格納されている鍵配送データｚ_Aiを受信者携帯装置３０６に出力する。次に、受信者携帯装置３０６内で、べき乗算器３０６４、剰余演算器３０６３を用いて、受信者秘密情報σ_X、ｓ_X（σ_X）、鍵配送データｚ_Aiおよび送信者公開情報Ｎ_Aから、
【０１４２】
【数１３７】

【０１４３】
を計算し、この計算結果ξ_X（σ_X，Ａ）を受信者側装置３００に出力する。
【０１４４】
次に、受信者側装置３００内のべき乗算器３０１、剰余演算器３０２、演算装置３０３を用いて、受信者側装置３００に出力されたξ_X（σ_X，Ａ）と、メモリ３０４に格納している受信者識別鍵ｒ_X（σ_X，Ａ）および送信者公開情報Ｎ_Aから、
【０１４５】
【数１３８】

【０１４６】
により、データ暗号化鍵Ｋ_Aを計算し、メモリ３０４に格納する。
【０１４７】
このように受信者秘密情報σ_X、ｓ_X（σ_X）が受信者側携帯装置３０６外部に出力しないようにすることにより、これが電子的複写などにより盗難されることを防ぐことができる。
【０１４８】
以上、本発明の第２実施形態について説明した。
【０１４９】
次に、本発明の第３実施形態について説明する。
【０１５０】
本発明の第３実施形態は、上記の第１実施形態において、
【０１５１】
【数１３９】

【０１５２】
のｒの値を短時間毎に、周期毎に変更し、変更後のｒを用いたｚ_Aiを周期的に同報通信することにより、送信者側装置２００および受信者側装置３００で計算するデータ暗復号化鍵Ｋ_Aの更新を行うものである。
【０１５３】
また、ｒ´の値を送信データ固有の値とすることで、送信者が同報送信するデータの識別を行うようにしたものである。すなわち、受信者ｘがある同報データもしくは同報データの集合を復号するために、ある送信者から得た識別鍵ｒ_X（σ_X，Ａ）はその同報データ固有のものであり、別の同報データもしくは同報データの集合を取得するためには、その送信者から別の同報データもしくは同報データの集合用の別のｒ_X（σ_X，Ａ）を得る必要がある。
【０１５４】
以上、本発明の第３実施形態について説明した。
【０１５５】
次に、本発明の第４実施形態について説明する。
【０１５６】
本発明の第４実施形態は、上記の第１実施形態において、特定の受信者の認証を行い、送信者が鍵Ｋ_Aを用いて暗号化し送信した有償のデータＰに対する、鍵Ｋ_Aを共有する受信者への課金を行うものである。
【０１５７】
すなわち、第４実施形態では、さらに、以下の処理を行う。
【０１５８】
（１）準備処理
▲１▼鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、予め受信者ｘの番号ＵＩＤ_Xを作成し、これを受信者秘密情報ｓ_X（σ_X）と一緒に受信者携帯装置３０６内のメモリ３０６１に格納して配布する。また、ＵＩＤ_Xを、ｓ_X（σ_X）と対応させて、鍵管理者側装置１００内のメモリ１０６に格納しておく。
【０１５９】
▲２▼送信者Ａは、送信者側装置２００内の演算装置２０５を用いて、自身の番号ＢＩＤ_Aを作成し、メモリ２０６に格納しておく。また、ＢＩＤ_Aを通信装置２０７を用いて鍵管理者に送信する。
【０１６０】
▲３▼鍵管理者は、鍵管理者側装置１００内の通信装置１０７によって送信者Ａの番号ＢＩＤ_Aを受信し、メモリ１０６に送信者識別情報ｔ_Aと対応させて格納する。
【０１６１】
▲４▼受信者ｘは、受信者側装置３００内の認証装置３０８を用いて、受信者秘密情報ｓ_X（σ_X）から認証用の情報を作成し、送信者Ａに送信する。
【０１６２】
▲５▼送信者Ａは、該認証用の情報を、送信者側装置２００内の認証装置２０９によって確認する。
【０１６３】
この認証の方法は、受信者がｓ_X（σ_X）を知らない限り、認証が成立しない認証方法であれば、従来知られている各種認証方式を用いてかまわない（ただし、このとき、送信者は受信者秘密鍵ｓ_X（σ_X）自体は知ることができないようにする必要がある）。
【０１６４】
たとえば、ＲＳＡ（文献「R. L, Rivest, A. Shamir, L. Adelman. :A method for obtaining digital signatures and publickey cryptosystems, Commun. of the ACM, Vol. 21, No.2,pp.120-126, 1987.」に掲載）による署名を用いた方法によって、受信者ｘの認証を、以下の処理によって行えばよい。
【０１６５】
1:鍵管理者は、受信者ｘに対して、
【０１６６】
【数１４０】

【０１６７】
なる（ｙ_X，ｎ_X）を予め送信者に配布する。ただし、公開された関数πに対して、ｓ´_X＝π（ｓ_X（σ_X））とする。
【０１６８】
2:受信者ｘは、受信者側装置３００内の認証装置３０８を用いて、同報送信データであるＷのハッシュ値を、公開情報である一方向性ハッシュ関数ｈにより計算し（０＜ｈ（Ｗ）＜ｎ_X）、ｈ（Ｗ）に対する署名を秘密鍵ｓ´_Xを用いて、
【０１６９】
【数１４１】

【０１７０】
にて作成し、データの送信要求とともに通信装置３０５を用いて送信者Ａに送信する。
【０１７１】
3:送信者Ａは、認証装置２０９を用いて、
【０１７２】
【数１４２】

【０１７３】
が成立することを確認する。
【０１７４】
▲６▼さて、認証を行った後に、送信者Ａは、送信者側装置２００内の通信装置２０７を用いて、自身の番号ＢＩＤ_Aと受信者ｘの番号ＵＩＤ_Xを鍵管理者に送信する。
【０１７５】
▲７▼鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、受信した送信者番号ＢＩＤ_Aと受信者番号ＵＩＤ_Xに対応した、送信者識別鍵ｔ_Aと受信者秘密情報ｓ_X（σ_X）から、
【０１７６】
【数１４３】

【０１７７】
となる受信者識別データｓ_X（σ_X，Ａ）を計算し、送信者Ａに送信する。
【０１７８】
▲８▼送信者Ａは、送信者側装置２００内の剰余演算器２０４、演算装置２０５を用いて、鍵管理者から受信した受信者識別データｓ_X（σ_X，Ａ）から、
【０１７９】
【数１４４】

【０１８０】
となる受信者識別情報ｒ_X（σ_X，Ａ）を計算し、通信装置２０７により受信者ｘに送信する。その際、共通鍵Ｋ_Aによって、暗号化して配信するデータ（受信者が送信要求したデータ）が有償の場合、送信者Ａは、課金装置２１０を用いて受信者ｘに対して課金する。
【０１８１】
以上、本発明の第４実施形態について説明した。
【０１８２】
次に、本発明の第５実施形態について説明する。
【０１８３】
本発明の第５実施形態は、従来の技術の欄で述べたコピー鍵方式を、図１に示した複数の送信者と複数の受信者と鍵管理者が存在するシステムに拡張したものである。
【０１８４】
図７に、本発明の第５実施形態に係る鍵管理者側装置１００の構成を示す。図示するように、鍵管理者側装置１００は、乱数生成器１１１、演算装置１１２、メモリ１１３、通信装置１１４から構成される。また、図８に、本発明の第５実施形態に係る送信者側装置２００の構成を示す。図示するように、送信者側装置２００は、乱数生成器２１１、演算装置２１２、暗復号化装置２１３、メモリ２１４、通信装置２１５から構成される。また、図９に、本発明の第５実施形態に係る受信者側装置３００の構成を示す。図示するように、受信者側装置３００は、演算装置３１１、暗復号化装置３１２、メモリ３１３、通信装置３１４から構成される。
【０１８５】
本実施形態では、まず、準備処理として、以下の処理を行う。
【０１８６】
（１）準備処理
▲１▼鍵管理者は、鍵管理者側装置１００内の乱数生成器１１１を用いて、秘密情報Ｋ０を生成しメモリ１１３に格納する。また、送信者と受信者に配布する。
【０１８７】
▲２▼送信者Ａは、送信者側装置２００内の乱数生成器２１１を用いて送信者識別情報ＢＩＤ_Aを生成し、通信装置１１４により受信者に送信する。
【０１８８】
その後、鍵配送処理として、以下の処理を行う。
【０１８９】
（２）鍵配送処理
▲１▼送信者Ａは、送信者側装置２００内の演算装置２０５を用いて、鍵管理者から配布された秘密鍵情報Ｋ０と送信者識別情報ＢＩＤ_Aから、適当な一方向性関数Ｆにより、共通鍵Ｋ_A´＝Ｆ（Ｋ０、ＢＩＤ_A）を計算する。
【０１９０】
▲２▼受信者は、受信者側装置３００内の演算装置３１２を用いて、鍵管理者から配布された秘密情報Ｋ０と送信者から受信した送信者識別情報ＢＩＤ_Aから、一方向性関数Ｆにより、共通鍵Ｋ_A´＝Ｆ（Ｋ０、ＢＩＤ_A）を計算する。
【０１９１】
▲３▼送信者Ａは、送信者側装置２００内の乱数生成器２１１を用いて適当な整数ｒを作成し、通信装置２１５により受信者に送信する。また、演算装置２１２を用いて、整数ｒと共通鍵Ｋ_A´から、適当な関数Ｆ´によりデータ暗復号化鍵ＤＫ＝Ｆ´（ｒ，Ｋ_A´）を計算し、メモリ２１４に格納する。
【０１９２】
▲４▼受信者は、受信者側装置３００内の演算装置３１２を用いて、送信者Ａから受信した整数ｒと、共通鍵Ｋ_A´から、関数Ｆ´により、データ暗復号化鍵ＤＫ＝Ｆ´（ｒ，Ｋ_A´）を計算して、メモリ３１４に格納する。
【０１９３】
上記の鍵配送処理により、データ暗復号化鍵ＤＫの配送が行われた後、暗復号化処理は、以下の要領で行う。
【０１９４】
（３）暗復号化処理
▲１▼送信者Ａは、データ暗復号化鍵ＤＫを用いて、送信者側装置２００内の暗復号化装置２０３により配信データＰを暗号化し、通信装置２０５により受信者に送信する。
【０１９５】
▲２▼受信者は、受信者側装置３００内の通信装置３０５により暗号化された配信データＰを受信し、データ暗復号化鍵ＤＫを用いて暗復号化装置３０３により復号化する。
【０１９６】
以上説明した本発明の第５実施形態によっても、受信者は、単一の秘密情報で、複数の送信者と、各送信者個々の共通鍵を共有することができる。
【０１９７】
次に、本発明の第６実施形態について説明する。
【０１９８】
本発明の第６実施形態は、送信者と受信者が、受信者の個別の鍵を使った暗号通信により、共通鍵を共有するものである。
【０１９９】
本実施形態に係る全体のシステム、鍵管理者側装置１００、送信者側装置２００、受信者側装置３００の構成は、上述した本発明の第５実施形態のものと同様である。
【０２００】
さて、本実施形態では、準備処理において、以下の処理を行う。
【０２０１】
（１）準備処理
▲１▼鍵管理者は、鍵管理者側装置１００内の乱数生成器１１１を用いて受信者ｘの秘密情報ｓ_Xを作成し、受信者に配布する。さらに、乱数生成器１１１を用いて送信者Ａの番号ＢＩＤ_Aを作成し、送信者Ａおよび受信者ｘに配布する。
【０２０２】
▲２▼送信者Ａは、送信者側装置２００内の乱数生成器２１１を用いて共通鍵Ｋ_Aを作成する。
【０２０３】
その後、鍵配送処理において、以下の処理を行う。
【０２０４】
（２）鍵配送処理
▲１▼鍵管理者は、鍵管理者側装置１００内の演算装置１１２を用いて、送信者Ａの番号ＢＩＤ_Aと受信者秘密情報ｓ_Xから、適当な一方向性関数ＦによりＫ_AX＝Ｆ（ｓ_X、Ｋ_A）なる、受信者ｘおよび送信者Ａ間でのセッション鍵Ｋ_AXを計算し、メモリ１１３に格納する。
【０２０５】
▲２▼受信者ｘは、受信者側装置３００内の演算装置３１２を用いて、送信者Ａの番号ＢＩＤ_Aと自身の秘密情報ｓ_Xから、一方向性関数ＦによりＫ_AX＝Ｆ（ｓ_X、ＢＩＤ_A）を計算し、メモリ３１３に格納する。
【０２０６】
▲３▼送信者Ａは、送信者側装置２００内の暗復号化装置２１３を用いて、セッション鍵Ｋ_AXにより共通鍵Ｋ_Aを暗号化し、その結果、得られた鍵配送データＫ_CXを、通信装置２１５により受信者に送信する。さらに、乱数生成器２１１を用いて、適当な整数ｒを作成し、通信装置２１５により受信者に送信するとともに、演算装置２１２を用いて、整数ｒと共通鍵Ｋ_Aから、適当な関数Ｆ´によりデータ暗復号化鍵ＤＫ＝Ｆ´（ｒ，Ｋ_A）を計算し、メモリ２１４に格納する。
【０２０７】
▲４▼受信者ｘは、受信者側装置３００内の暗復号化装置３０３を用いて、送信者Ａから受信した鍵配送データＫ_CXをセッション鍵Ｋ_AXにより復号化する。そして、演算装置３０２を用いて、復号化した共通鍵Ｋ_Aと受信した整数ｒから、関数Ｆ´により、データ暗復号化鍵ＤＫ＝Ｆ´（ｒ，Ｋ_A）を計算し、メモリ３０３に格納する。
【０２０８】
上記の鍵配送処理により、データ暗復号化鍵ＤＫの配送が行われた後、暗復号化処理は、以下の要領で行う。
【０２０９】
▲１▼送信者Ａは、送信者側装置２００内の暗復号化装置２０３を用いて、データ暗復号化鍵ＤＫにより配信データＰを暗号化し、通信装置２０５により受信者ｘに送信する。
【０２１０】
▲２▼受信者ｘは、受信者側装置３００内の通信装置３０５により暗号化された配信データＰを受信する。そして、暗復号化装置３０３を用いて、受信した配信データＰをデータ暗復号化鍵ＤＫにより復号する。
【０２１１】
なお、送信者Ａは、共通鍵Ｋ_Aの値を周期的に変更することで、データ暗復号化鍵ＤＫの値を周期的に変更することができる。
【０２１２】
以上説明した本発明の第６実施形態によっても、受信者は、単一の秘密情報で、複数の送信者と、各送信者個々の共通鍵を共有することができる。
【０２１３】
次に、本発明の第７実施形態について説明する。
【０２１４】
本発明の第７実施形態は、上記の第６実施形態と同様、送信者と受信者が、受信者の個別の鍵を使った暗号通信により、共通の鍵を共有するものである。
【０２１５】
本実施形態に係る全体のシステム、鍵管理者側装置１００、送信者側装置２００、受信者側装置３００の構成は、上述した本発明の第５実施形態のものと同様である。
【０２１６】
本発明の第７実施形態では、準備処理において、以下の処理を行う。
【０２１７】
（１）準備処理
▲１▼鍵管理者は、鍵管理者側装置１００内の乱数生成器１１１、演算装置１１２を用いて、適当な公開鍵暗号Ｅに従った受信者ｘの秘密鍵ｓ_Xおよび公開鍵ｐ_Xを作成し、ｓ_Xを受信者に配布する。さらに、乱数生成器１１１により送信者Ａの番号ＢＩＤ_Aを作成し、送信者Ａおよび受信者ｘに配布または送信する。
【０２１８】
▲２▼送信者Ａは、送信者側装置２００内の乱数生成器２０１を用いて共通鍵Ｋ_Aを作成し、メモリ１１４に格納する。
【０２１９】
その後、鍵配送処理として、以下の処理を行う。
【０２２０】
（２）鍵配送処理
▲１▼送信者Ａは、送信者側装置２００内の暗復号化装置２１３を用いて、前記適当な公開鍵暗号Ｅにより、受信者公開鍵ｐ_Xと共通鍵Ｋ_Aから鍵配送データＫ_CX＝Ｅ（ｐ_X，Ｋ_A）を計算する。その後、通信装置２１５によりＫ_CXを受信者ｘに送信する。
【０２２１】
▲２▼受信者ｘは、受信者側装置３００内の暗復号化装置３１３を用いて、送信者Ａから受信した鍵配送データＫ_CXを自身の秘密鍵ｓ_Xにより復号化し、復号化した共通鍵Ｋ_Aをメモリ３１４に格納する。
【０２２２】
▲３▼送信者Ａは、送信者側装置２００内の乱数生成器２０１を用いて適当な整数ｒを生成し、通信装置２１５により受信者ｘに送信する。また、演算装置２１２を用いて、整数ｒと共通鍵Ｋ_Aから、適当な関数Ｆによりデータ暗復号化鍵ＤＫ＝Ｆ（ｒ，Ｋ_A）を計算し、メモリ２０４に格納する。
【０２２３】
▲４▼受信者ｘは、受信者側装置３００内の演算装置３１２を用いて、共通鍵ＫＡと送信者から受信した整数ｒから、関数Ｆによりデータ暗復号化鍵ＤＫ＝（ｒ，Ｋ_A）を計算し、メモリ３１４に格納する。
【０２２４】
上記の鍵配送処理により、データ暗復号化鍵ＤＫの配送が行われた後、暗復号化処理は、以下の要領で行う。
【０２２５】
（３）暗復号化処理
▲１▼送信者Ａは、送信者側装置２００内の暗復号化装置２０３を用いて、データ暗復号化鍵ＤＫにより配信データＰを暗号化し、通信装置２０５により受信者ｘに送信する。
【０２２６】
▲２▼受信者ｘは、受信者側装置３００内の通信装置３０５を用いて、暗号化された配信データＰを受信する。そして、暗復号化装置３０３を用いて、受信した配信データＰをデータ暗復号化鍵ＤＫにより復号化する。
【０２２７】
▲３▼送信者Ａは、共通鍵ＫＡの値を周期的に変更することによりデータ暗復号化鍵ＤＫを変更する。
【０２２８】
以上説明した本発明の第７実施形態によっても、受信者は、単一の秘密情報で、複数の送信者と、各送信者個々の共通鍵を共有することができる。
【０２２９】
次に、本発明の第８実施形態について説明する。
【０２３０】
本発明の第８実施形態は、上述した本発明の第６および第７実施形態において、送信者による鍵配送データＫ_CXの受信者への送信を、以下のように修正したものである。
【０２３１】
すなわち、第８実施形態では、送信者Ａは、受信者全体の集合をいくつかの部分集合にわける。次に、鍵配送データＫ_Ci（１≦i≦ｎただし、ｎは受信者数）を受信者に送信する際、前記受信者の部分集合毎に通信チャンネルを割り当て、送信者側装置２００内の通信装置２１５により受信者に送信する。
【０２３２】
一方、任意の受信者ｘは、自身の属する部分集合に割り当てられた通信チャンネルを通じて、受信者側装置３００内の通信装置３０５により、鍵配送データＫ_CXを受信する。
【０２３３】
以上、本発明の第８実施形態について説明した。
【０２３４】
次に、本発明の第９実施形態について説明する。
【０２３５】
本実施形態に係る全体のシステム、鍵管理者側装置１００、送信者側装置２００、受信者側装置３００の構成は、上述した本発明の第１実施形態のものと同様である。
【０２３６】
以下、本システムが行う準備処理、鍵配送処理、そして暗復号化処理の３つの処理について説明する。
【０２３７】
では、まず、準備処理について説明する。
【０２３８】
（１）準備処理
▲１▼送信者Ａは、送信者側装置２００内の乱数生成器２０１、素数生成器２０２、べき乗算器２０３、剰余演算器２０４、および演算装置２０５を用いて、次の情報を作成し、そのうち、公開情報のみを公開する。
【０２３９】
秘密情報：
【０２４０】
【数１４５】

【０２４１】
公開情報：
【０２４２】
【数１４６】

【０２４３】
秘密情報はメモリ２０６に格納する。また、秘密情報ｇ_A、Ｌ_Aを通信装置２０７を用いて鍵管理者に送信する。
【０２４４】
▲２▼信頼できる鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、次の情報を作成する。
【０２４５】
鍵管理者秘密情報：
【０２４６】
【数１４７】

【０２４７】
送信者Ａの送信者識別情報：
【０２４８】
【数１４８】

【０２４９】
受信者ｘの受信者秘密情報：
【０２５０】
【数１４９】

【０２５１】
これらは、σ_Xとともに全てメモリ１０６に格納する。
【０２５２】
ただし、集合
【０２５３】
【数１５０】

【０２５４】
に対して、σ、σ´∈Ｓ_kmのとき、
【０２５５】
【数１５１】

【０２５６】
とする。このとき、〜はＳ_km上の同値関係となり、
【０２５７】
【数１５２】

【０２５８】
とする。
【０２５９】
また、鍵管理者は、メモリ１０６から受信者秘密情報ｓ_X（σ_X）を取り出し、σ_Xとともに受信者側携帯装置３０６に格納し、これを受信者ｘにオフラインで配布する。もちろん、他の方法によって受信者に配布するようにしてもよい。
【０２６０】
次に、鍵配送処理について説明する。
【０２６１】
（２）鍵配送処理
▲１▼鍵管理者は、鍵管理者側装置１００内の剰余演算器１０４、演算装置１０５を用いて、送信者Ａから受信したＬ_Aと、鍵管理者秘密情報ｅ_iと、受信者秘密情報σ_X、ｓ_X（σ_X）と、送信者識別情報ｔ_Aから、
【０２６２】
【数１５３】

【０２６３】
なる受信者ｘの受信者識別データρ_X（σ_X（ｉ），Ａ）を計算し、通信装置１０７を用いて送信者Ａに送信する。
【０２６４】
また、鍵管理者は、鍵管理者側装置１００内のべき乗算器１０３、剰余演算器１０４、演算装置１０５を用いて、送信者Ａから受信したｇ_Aと、送信者Ａの送信者公開情報Ｎ_Aと、鍵管理者秘密情報ｅ_iから、
【０２６５】
【数１５４】

【０２６６】
なる送信者Ａの送信者鍵配送データｙ_Aiを計算し、通信装置１０７を用いて送信者Ａに送信する。
【０２６７】
▲２▼送信者Ａは、送信者側装置２００内の乱数生成器２０１により、乱数ｒ、ｒ´を作成しメモリ２０６に格納する。さらに、べき乗算器２０３、剰余演算器２０４、演算装置２０５を用いて、この乱数ｒ、ｒ'と、自身の秘密情報ｇ_Aと、自身の公開情報Ｎ_Aから、
【０２６８】
【数１５５】

【０２６９】
なるデータ暗号化鍵Ｋ_Aを計算してメモリ２０６に格納し、受信者ｘとの間で鍵Ｋ_Aを共有することを目的として、剰余演算器２０４、演算装置２０５を用いて、自身の秘密情報Ｌ_Aと、乱数ｒ´と、鍵管理者から受信した受信者ｘの受信者識別データρ_X（σ_X（ｉ），Ａ）から、
【０２７０】
【数１５６】

【０２７１】
なる受信者ｘの受信者識別情報ｒ_X（σ_X（ｉ），Ａ）を計算し、通信装置２０７を用いて受信者ｘに送信する。
【０２７２】
また、送信者Ａは、送信者側装置２００内のべき乗算器２０３、剰余演算器２０４、演算装置２０５を用いて、自身の公開情報Ｎ_Aと、乱数ｒと、鍵管理者から受信した送信者鍵配送データｙ_Aiから、
【０２７３】
【数１５７】

【０２７４】
なる受信者鍵配送データｚ_Aiを計算し、通信装置２０７を用いて受信者に同報送信する。
【０２７５】
ここで、以上の処理において、ｒ_X（σ_X（ｉ），Ａ）、ｚ_Aiを作成する処理の一部を、鍵管理者が行う理由の一つは、送信者Ａに対して、受信者ｘの受信者秘密情報σ_X、ｓ_X（σ_X）、送信者識別番号ｔ_Aを秘密にすることにより、送信者Ａの不正を防止するためである。
【０２７６】
▲３▼受信者ｘは、送信者Ａから受信した鍵配送データｚ_Aiおよび受信者識別情報ｒ_X（σ_X（ｉ），Ａ）、鍵管理者から配送された受信者秘密情報σ_X、ｓ_X（σ_X）、公開された送信者公開情報Ｎ_Aから、
【０２７７】
【数１５８】

【０２７８】
により、データ暗号化鍵Ｋ_Aを計算し、メモリ３０４に格納する。
【０２７９】
以上の処理で、送信者Ａと受信者ｘは鍵Ｋ_Aを共有できる。他の任意の送信者と受信者についても同様にして鍵を共有できる。また、この際、送信者Ａが同報送信する受信者鍵配送データｚ_Aiは、各受信者について共通である。
【０２８０】
また、以上の処理において、受信者ｘが送信者Ａより受けとる鍵配送データｚ_Aiおよび受信者識別情報ｒ_X（σ_X（ｉ），Ａ）は、受信者に対して秘密化されている送信者Ａの送信者識別番号ｔ_Aが作用したものとなっている。したがって、以上の送信者識別番号ｔ_Aを用いる構成により、受信者ｘが送信者Ａより受けとった鍵配送データｚ_Ai、受信者識別情報ｒ_X（σ_X（ｉ），Ａ）、他の送信者Ｂの公開情報Ｎ_B、他の送信者Ｂが同報通信した鍵配送データｚ_Biより、他の送信者Ｂのデータ暗号化鍵Ｋ_Bを割り出すことを、きわめて困難とすることができる。
【０２８１】
以下、暗復号化処理について説明する。
【０２８２】
（３）暗復号化処理
▲１▼送信者Ａは、送信者側装置２００内の暗復号化装置２０８を用いて、鍵配送処理で作成した共通鍵Ｋ_Aにより、データＰを暗号化する。そして、暗号文Ｃ＝Ｅ（Ｋ_A：Ｐ）を通信装置２０７を用いて受信者ｘに送信する。
【０２８３】
▲２▼受信者ｘは、受信者側装置３００内の通信装置３０５を用いて暗号文Ｃを受信し、暗復号化装置３０７を用いてメモリ３０４に格納していた共通鍵Ｋ_Aにより暗号文Ｃを復号化し、データを得る。
【０２８４】
以上、本発明の第９実施形態について説明した。
【０２８５】
本実施形態に係る鍵配送システムにおいても、上述した第１実施形態と同様、新規参入の送信者Ａは、送信者秘密情報Ｐ_A、Ｑ_A、Ｌ_A、ｇ_Aと、送信者公開情報Ｎ_Aを作成するだけでよい。また、受信者が持つ受信者秘密情報は、全ての送信者に対して唯一であり、新たな送信者からデータを受信したい場合に、新たな受信者秘密情報を入手する必要がない。
【０２８６】
また、受信者識別情報ｒ_X（σ_X（ｉ），Ａ）によって、任意の受信者集合に属する受信者のみとのデータ暗復号のための共通鍵の共有を可能とすることができる。また、受信者数が大きい場合であっても、共通鍵配送のために同報通信する鍵配送データｚ_Aiを、これに伴い長くする必要がない。
【０２８７】
なお、以上の処理において、あらかじめ、送信者Ａが送信者秘密情報Ｌ_Aを鍵管理者に送信しておき、準備処理の段階で、鍵管理者は、送信者Ａから受信した送信者秘密鍵Ｌ_Aから、
【０２８８】
【数１５９】

【０２８９】
となる鍵管理者秘密情報ｅ_i、送信者識別情報ｔ_A、受信者秘密情報ｓ_X（σ_X）を作成し、鍵配送処理の段階で、鍵管理者は、送信者秘密情報Ｌ_A、鍵管理者秘密情報ｅ_i、送信者識別情報ｔ_A、受信者秘密情報ｓ_X（σ_X）から、
【０２９０】
【数１６０】

【０２９１】
によって、受信者識別データρ_X（σ_X（ｉ），Ａ）を計算するようにしてもよい。
【０２９２】
次に、本発明の第１０実施形態について説明する。
【０２９３】
本発明の第１０実施形態は、上記の第９実施形態において、受信者側装置３００におけるデータ暗号化鍵Ｋ_Aの計算処理の一部を、受信者側携帯装置３０６で実施するようにしたものである。本実施形態で用いる受信者側携帯装置３０６の構成は、上述した本発明の第２実施形態のものと同様である。
【０２９４】
本実施形態では、（１）準備処理の段階で、鍵管理者は受信者秘密情報σ_X、ｓ_X（σ_X）を、受信者携帯装置３０６（ＩＣカード等）に格納して、受信者ｘに配布する。
【０２９５】
そして、（２）鍵配送処理において、受信者ｘは、受信者側装置３００内のメモリに格納されている鍵配送データｚ_Aiを受信者携帯装置３０６に出力する。次に、受信者携帯装置３０６内で、べき乗算器３０６４、剰余演算器３０６３を用いて、受信者秘密情報σ_X、ｓ_X（σ_X）、鍵配送データｚ_Aiおよび送信者公開情報Ｎ_Aから、
【０２９６】
【数１６１】

【０２９７】
を計算し、この計算結果ξ_X（σ_X（ｉ），Ａ）を受信者側装置３００に出力する。
【０２９８】
次に、受信者側装置３００内のべき乗算器３０１、剰余演算器３０２、演算装置３０３を用いて、受信者側装置３００に出力されたξ_X（σ_X（ｉ），Ａ）と、メモリ３０４に格納している受信者識別鍵ｒ_X（σ_X（ｉ），Ａ）および送信者公開情報Ｎ_Aから、
【０２９９】
【数１６２】

【０３００】
により、データ暗号化鍵Ｋ_Aを計算し、メモリ３０４に格納する。
【０３０１】
このように受信者秘密情報σ_X、ｓ_X（σ_X）が受信者側携帯装置３０６外部に出力しないようにすることにより、これが電子的複写などにより盗難されることを防ぐことができる。
【０３０２】
以上、本発明の第１０実施形態について説明した。
【０３０３】
次に、本発明の第１１実施形態について説明する。
【０３０４】
本発明の第１１実施形態は、上記の第９実施形態において、
【０３０５】
【数１６３】

【０３０６】
のｒの値を短時間毎に、周期毎に変更し、変更後のｒを用いたｚ_Aiを周期的に同報通信することにより、送信者側装置２００および受信者側装置３００で計算するデータ暗復号化鍵Ｋ_Aの更新を行うものである。
【０３０７】
また、ｒ´の値を送信データ固有の値とすることで、送信者が同報送信するデータの識別を行うようにしたものである。すなわち、受信者ｘがある同報データもしくは同報データの集合を復号するために、ある送信者から得た識別鍵ｒ_X（σ_X（ｉ），Ａ）はその同報データ固有のものであり、別の同報データもしくは同報データの集合を取得するためには、その送信者から別の同報データもしくは同報データの集合用の別のｒ_X（σ_X（ｉ），Ａ）を得る必要がある。
【０３０８】
以上、本発明の第１１実施形態について説明した。
【０３０９】
次に、本発明の第１２実施形態について説明する。
【０３１０】
本発明の第１２実施形態は、上記の第９実施形態において、特定の受信者の認証を行い、送信者が鍵Ｋ_Aを用いて暗号化し送信した有償のデータＰに対する、鍵Ｋ_Aを共有する受信者への課金を行うものである。
【０３１１】
すなわち、第１２実施形態では、さらに、以下の処理を行う。
【０３１２】
（１）準備処理
▲１▼鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、予め受信者ｘの番号ＵＩＤ_Xを作成し、これを受信者秘密情報ｓ_X（σ_X）と一緒に受信者携帯装置３０６内のメモリ３０６１に格納して配布する。また、ＵＩＤ_Xを、ｓ_X（σ_X）と対応させて、鍵管理者側装置１００内のメモリ１０６に格納しておく。
【０３１３】
▲２▼送信者Ａは、送信者側装置２００内の演算装置２０５を用いて、自身の番号ＢＩＤ_Aを作成し、メモリ２０６に格納しておく。また、ＢＩＤ_Aを通信装置２０７を用いて鍵管理者に送信する。
【０３１４】
▲３▼鍵管理者は、鍵管理者側装置１００内の通信装置１０７によって送信者Ａの番号ＢＩＤ_Aを受信し、メモリ１０６に送信者識別情報ｔ_Aと対応させて格納する。
【０３１５】
▲４▼受信者ｘは、受信者側装置３００内の認証装置３０８を用いて、受信者秘密情報ｓ_X（σ_X）から認証用の情報を作成し、送信者Ａに送信する。
【０３１６】
▲５▼送信者Ａは、該認証用の情報を、送信者側装置２００内の認証装置２０９によって確認する。
【０３１７】
この認証の方法は、上述した本発明の第４実施形態と同様、受信者がｓ_X（σ_X）を知らない限り、認証が成立しない認証方法であれば、従来知られている各種認証方式を用いてかまわない（ただし、このとき、送信者は受信者秘密鍵ｓ_X（σ_X）自体は知ることができないようにする必要がある）。
【０３１８】
▲６▼さて、認証を行った後に、送信者Ａは、送信者側装置２００内の通信装置２０７を用いて、自身の番号ＢＩＤ_Aと受信者ｘの番号ＵＩＤ_Xを鍵管理者に送信する。
【０３１９】
▲７▼鍵管理者は、鍵管理者側装置１００内の演算装置１０５を用いて、受信した送信者番号ＢＩＤ_Aと受信者番号ＵＩＤ_Xに対応した、送信者識別鍵ｔ_Aと受信者秘密情報ｓ_X（σ_X）から、
【０３２０】
【数１６４】

【０３２１】
となる受信者識別データρ_X（σ_X（ｉ），Ａ）を計算し送信者Ａに送信する。
【０３２２】
▲８▼送信者Ａは、送信者側装置２００内の剰余演算器２０４、演算装置２０５を用いて、鍵管理者から受信した受信者識別データρ_X（σ_X（ｉ），Ａ）から、
【０３２３】
【数１６５】

【０３２４】
となる受信者識別情報ｒ_X（σ_X（ｉ），Ａ）を計算し、通信装置２０７により受信者ｘに送信する。その際、共通鍵Ｋ_Aによって、暗号化して配信するデータ（受信者が送信要求したデータ）が有償の場合、送信者Ａは、課金装置２１０を用いて受信者ｘに対して課金する。
【０３２５】
以上、本発明の各実施形態について説明した。
【０３２６】
なお、以上に説明した鍵管理者側装置１００、送信者側装置２００、受信者側装置３００の各処理は、コンピュータに各処理を実行させる手順を記述したプログラムを実行させることにより実現するようにしてもよい。この場合、各処理を実行させる手順を記述した各プログラムは、記憶媒体に格納して各コンピュータに供給するようにしてもよい。あるいは、ネットワークなどの通信媒体を介して各コンピュータに供給するようにしてもよい。
【０３２７】
【発明の効果】
以上説明したように、本発明によれば、受信者が唯一の秘密情報によって、複数の送信者から個々の共通鍵の配送を受けることができる。また、一部の発明においては、このような鍵配送システムにおいて、任意の送信者と任意の受信者集合に属する受信者のみとのデータ暗復号のための共通鍵の共有を可能とすることができる。また、受信者数が大きい場合であっても、これに伴い共通鍵配送のための同報通信データを長くする必要がなくなる。
【図面の簡単な説明】
【図１】本発明の第１実施形態に係る鍵配送システムの構成を示すブロック図である。
【図２】本発明の第１実施形態に係る鍵管理者側装置の構成を示すブロック図である。
【図３】本発明の第１実施形態に係る送信者側装置の構成を示すブロック図である。
【図４】本発明の第１実施形態に係る受信者側装置の構成を示すブロック図である。
【図５】本発明の第１実施形態における鍵配送処理による情報の流れを示した図である。
【図６】本発明の第２実施形態に係る受信者側携帯装置の構成を示すブロック図である。
【図７】本発明の第５実施形態に係る鍵管理者側装置の構成を示すブロック図である。
【図８】本発明の第５実施形態に係る送信者側装置の構成を示すブロック図である。
【図９】本発明の第５実施形態に係る受信者側装置の構成を示すブロック図である。
【符号の説明】
１００鍵管理者側装置
１０１、１１１、２０１、２１１、３１１乱数生成器
１０２、２０２素数生成器
１０３、２０３、３０１、３０６４べき乗算器
１０４、２０４、３０２、３０６３剰余演算器
１０５、１１２、２０５、２１２、３０３、３１２、３０６１演算装置
１０６、１１３、２０６、２１４、３０４、３１４、３０６２メモリ
１０７、１１４、２０７、２１５、３０５、３１５通信装置
２００送信者側装置
２０８、２１３、３０７、３１３暗復号化装置
２０９、３０８認証装置
２１０課金装置
３００受信者側装置
３０６受信者側携帯装置[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a key distribution technique for distributing a key used for decryption in broadcast encryption communication to a limited recipient.
[0002]
[Prior art]
Conventionally, several methods have been proposed as techniques for broadcast encryption communication.
[0003]
For example, a copy key scheme described in the document “SJKent: Security requirement and protocols for a broadcast scenario, IEEE Trans. Commun., COM-29, 6, pp. 778-786 (1981)” is known.
[0004]
This copy key method is a basic method of broadcast encryption communication, and is a simple extension of conventional one-to-one encryption individual communication to broadcast communication. That is, in this method, one type of key copy is delivered to the sender and a plurality of authorized recipients. Then, the sender encrypts and transmits the information using the distributed copy key, and each legitimate receiver decrypts the encrypted information using the distributed copy key.
[0005]
In addition, as a technique for delivering a common key, which is a key used in common by the sender and the receiver, such as this copy key, to the receiver limited to the secret, the document “Li, Tokiwa et al. Broadcasting using demultiplexing method, key distribution method by multiplexing and demultiplexing information sequence using Chinese remainder theorem described in 1986 Symposium on Cryptography and Information Security, and literature “Manpo et al .: An efficient broadcast encryption communication method, a method described in “ISEC93-34 (1993-10)” is known.
[0006]
The method of multiplexing and demultiplexing information sequences using the Chinese remainder theorem performs the following processing.
[0007]
(1) Key generation processing:
Disjoint s integers g for receiver i (1 ≦ i ≦ r) ₁ , G ₂ ,. . . , G _S (R ≦ s) and g _i Is distributed to the receiver i in advance as confidential information of the receiver i.
[0008]
(2) Encryption processing:
S information sequences to be multiplexed are ₁ , M ₂ ,. . . , M _s And The sender sends a multiplexed transmission statement F,
[0009]
[Equation 97]

[0010]
And broadcast this. However, G, G _i , A _i Is
[0011]
[Equation 98]

[0012]
In A _i Is the smallest integer.
[0013]
(3) Decryption process:
Recipient i sends the multiplexed transmission statement F to g _i Using,
[0014]
[99]

[0015]
M _i To separate.
[0016]
Where M _i May be a common key to be delivered to recipient i. Therefore, according to this method, the copy key can be secretly delivered only to a limited recipient.
[0017]
Next, the method described in the document “Mamobo et al .: Efficient Broadcast Encryption Communication System, Science Technique ISEC93-34 (1993-10)” performs the following processing.
[0018]
(1) Key generation processing:
A trusted center creates the following information:
[0019]
Confidential information:
[0020]
[Expression 100]

[0021]
Public information:
[0022]
## EQU1 ##

[0023]
For σ∈S, the center
[0024]
## EQU10 ##

[0025]
Sσ is calculated and distributed as confidential information of the receiver Uσ. However, the set S = {f | one-to-one mapping f: A = {1, 2,. . . , K} → B = {1, 2,. . . , M}, m> k}.
[0026]
(2) Key distribution process:
The sender chooses an integer r at random, and the common key
[0027]
[Formula 103]

[0028]
For sharing with a limited number of recipients,
[0029]
[Formula 104]

[0030]
And z _i (1 ≦ i ≦ m) is broadcast.
The recipient Uσ is
[0031]
[Formula 105]

[0032]
Thus, the common key K is calculated.
[0033]
[Problems to be solved by the invention]
In key distribution using the above-mentioned multiplexing method using the Chinese remainder theorem, the common key data for each recipient is serially arranged and transmitted, so data that is broadcast in proportion to the number of recipients The length of becomes longer. For this reason, it is not suitable for communications targeting millions or more of receivers such as satellite broadcasting services.
[0034]
On the other hand, according to the method described in the document “Mamobo et al .: Efficient Broadcast Encryption Communication Method, IEICE Technology 93-34 (1993-10)”, even if the number of recipients is large. Data for common key distribution can be reduced. However, in this method, key sharing cannot be performed only with limited recipients belonging to an arbitrary recipient set.
[0035]
In any method, when there are a plurality of senders, the receivers must obtain and manage the above-described secret information for each sender who receives the information.
[0036]
Therefore, an object of the present invention is to provide a key distribution system in which a receiver can receive individual common keys from a plurality of senders by using only secret information. In such a key distribution system, it is possible to share a common key for data encryption / decryption between an arbitrary sender and only a receiver belonging to an arbitrary receiver set, and the number of receivers is large. In this case, it is an object of the present invention to realize common key distribution that does not require long broadcast data for common key distribution.
[0037]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides an encryption / decryption key for broadcast encryption communication performed by the sender in the communication system including a plurality of senders and a plurality of receivers. A key distribution method for sharing with recipients,
A key manager is provided, and the key manager uses the key manager to share the key between the sender and the receiver. A second key information used to share a key between the sender and the receiver and distribute to the sender;
The sender sends the third key information distributed from the key manager for the receiver to use the first key information to calculate an encryption / decryption key used by the sender for broadcast communication. Two-key information is generated and transmitted to the receiver sharing the key with the sender, and the receiver is distributed from the first key information distributed from the key manager and the sender. Using the third key information, the sender distributing the third key information obtains an encryption / decryption key used for broadcast communication.
[0038]
According to this key distribution method, each receiver only needs to have the first key information distributed from the key manager as secret information, and even when obtaining a new sender's encryption / decryption key, There is no need to receive new confidential information.
[0039]
More specifically, in order to achieve the above object, the present invention uses a communication system in which a plurality of senders, a plurality of receivers, and a key manager exist, for example, and broadcast encryption performed by the sender. A key delivery method for delivering a communication encryption / decryption key to the recipient,
In the key manager, as the key manager secret information,
[0040]
[Formula 106]

[0041]
As sender identification information of sender A,
[0042]
[Expression 107]

[0043]
As the receiver confidential information of the receiver x,
σ _X ∈S _km When,
[0044]
[Formula 108]

[0045]
(However, set
[0046]
[Formula 109]

[0047]
Σ, σ′∈S _km When
[0048]
## EQU1 ##

[0049]
And at this time, ~ is S _km The above equivalence relation
[0050]
[Formula 111]

[0051]
And the recipient confidential information σ _X , S _X (Σ _X ) To recipient x,
In sender A,
[0052]
## EQU1 ##

[0053]
(However,
[0054]
[Formula 113]

[0055]
Is
[0056]
[Formula 114]

[0057]
The sender secret information g (representing the smallest positive integer a) _A , L _A And finite abelian group G _A Create sender confidential information g _A Sending to the key manager;
In the key manager, the key manager secret information e _i , Sender identification information t _A And recipient confidential information _X (Σ _X ), Σ _X To recipient identification data
[0058]
[Expression 115]

[0059]
And the recipient identification data s _X (Σ _X , A) sent to sender A and received from sender A g _A And key manager secret information e _i And sender identification information t _A To key distribution data
[0060]
[Formula 116]

[0061]
And the key distribution data y _Ai Sending to sender A;
The sender A generates integers r and r ′ and receives the receiver identification data s received from the key manager. _X (Σ _X , A) and the sender secret information L _A And from the integer r ′
[0062]
[Expression 117]

[0063]
Recipient identification information r _X (Σ _X , A) and the recipient identification information r _X (Σ _X , A) to the receiver x and the key distribution data y received from the key manager _Ai And key distribution information from integer r
[0064]
[Formula 118]

[0065]
And key distribution information z _Ai Broadcast to each recipient;
Recipient identification information r received from sender A at receiver x _X (Σ _X , A) and key distribution information z _Ai And recipient confidential information σ distributed by the key administrator _X , S _X (Σ _X From)
[0066]
[Formula 119]

[0067]
Sender A
[0068]
[Expression 120]

[0069]
The encryption / decryption key K generated by and used for broadcast communication _A And calculating.
[0070]
According to this key distribution method, the receiver does not need to have a different secret key for each sender, and even if the number of recipients is large in broadcast encryption communication, the length of the key distribution information is increased accordingly. There is no need to lengthen the length. Also, in this key distribution method, the receiver secret information is kept secret from the sender by the sender identification information that only the key administrator has in secret, and the sender secret information is more confidential to the receiver. Because it is firmly kept secret, the security against fraud is improved.
[0071]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of a key distribution system according to the present invention will be described.
[0072]
First, a first embodiment of the present invention will be described.
[0073]
FIG. 1 shows the configuration of a key distribution system according to the first embodiment of the present invention.
[0074]
As shown in the figure, this system includes a key manager side device 100, a sender side device 200, and a receiver side device 300 that are connected to each other via a communication line 400. The key manager side device 100 is a device used by the only key manager organization in the system, and there are a plurality of sender devices 200 and receiver side devices 300 in the system.
[0075]
FIG. 2 shows the configuration of the key manager side device 100.
[0076]
As shown in the figure, the key manager side device 100 includes a random number generator 101, a prime number generator 102, a power multiplier 103, a remainder calculator 104, a calculation device 105, a memory 106, and a communication device 107. The key manager device 100 is connected to a receiver portable device 306 that delivers the message to the recipient offline.
[0077]
FIG. 3 shows the configuration of the sender apparatus 200.
[0078]
As shown in the figure, the sender-side device 200 includes a random number generator 201, a prime number generator 202, a power multiplier 203, a remainder calculator 204, a calculation device 205, a memory 206, a communication device 207, an encryption / decryption device 208, an authentication. It comprises a device 209 and a billing device 210.
[0079]
FIG. 4 shows a configuration of the receiver side device 300.
[0080]
As shown in the figure, the receiver-side device 300 includes a power multiplier 301, a remainder calculator 302, a calculation device 303, a memory 304, a communication device 305, a receiver-side portable device 306 delivered offline from the key manager, A decryption device 307 and an authentication device 308 are included.
[0081]
Hereinafter, three processes of the preparation process, the key distribution process, and the encryption / decryption process performed by the system will be described.
[0082]
First, the preparation process will be described.
[0083]
(1) Preparation process
(1) The sender A creates the following information using the random number generator 201, the prime number generator 202, the power multiplier 203, the remainder calculator 204, and the calculation device 205 in the sender apparatus 200. Among them, only public information is disclosed.
[0084]
Confidential information:
[0085]
[Equation 121]

[0086]
Public information:
[0087]
[Equation 122]

[0088]
The secret information is stored in the memory 206. Also, confidential information g _A , L _A Is transmitted to the key manager using the communication device 207.
[0089]
(2) A reliable key manager creates the following information by using the arithmetic unit 105 in the key manager side apparatus 100.
[0090]
Secret key manager information:
[0091]
[Formula 123]

[0092]
Sender identification information of sender A:
[0093]
[Expression 124]

[0094]
Recipient confidential information of recipient x:
[0095]
[Expression 125]

[0096]
These are σ _X All of them are stored in the memory 106.
[0097]
However, set
[0098]
[Expression 126]

[0099]
Σ, σ′∈S _km When,
[0100]
[Expression 127]

[0101]
And At this time, ~ is S _km The above equivalence relation
[0102]
[Expression 128]

[0103]
And
[0104]
In addition, the key manager stores the recipient secret information s from the memory 106. _X (Σ _X ) And σ _X At the same time, it is stored in the receiver's portable device 306 and distributed offline to the receiver x. Of course, it may be distributed to recipients by other methods.
[0105]
Next, the key distribution process will be described.
[0106]
(2) Key distribution process
FIG. 5 shows the flow of information among the key manager, the sender, and the receiver in this key distribution process.
[0107]
(1) The key manager uses the remainder calculator 104 and the calculator 105 in the key manager apparatus 100 to receive the L received from the sender A. _A And key manager secret information e _i And recipient confidential information σ _X , S _X (Σ _X ) And sender identification information t _A From
[0108]
[Expression 129]

[0109]
Recipient identification data s of recipient x _X (Σ _X , A) is calculated and transmitted to the sender A using the communication device 107.
[0110]
Further, the key manager uses the power multiplier 103, the remainder calculator 104, and the calculator 105 in the key manager side apparatus 100 to receive the g received from the sender A. _A And the sender public information N of the sender A _A And key manager secret information e _i From
[0111]
[Expression 130]

[0112]
Sender key delivery data y of sender A _Ai Is transmitted to the sender A using the communication device 107.
[0113]
(2) The sender A creates random numbers r and r ′ by the random number generator 201 in the sender apparatus 200 and stores them in the memory 206. Further, using the power multiplier 203, the remainder calculator 204, and the calculation device 205, the random numbers r and r ′ and its own secret information g _A And public information N _A From
[0114]
[Equation 131]

[0115]
Data encryption key K _A Is calculated and stored in the memory 206, and the key K with the recipient x is calculated. _A For the purpose of sharing the secret information L using the remainder computing unit 204 and the computing device 205. _A , A random number r ′, and receiver identification data s of the receiver x received from the key manager _X (Σ _X , A)
[0116]
[Expression 132]

[0117]
Recipient identification information r of recipient x _X (Σ _X , A) is calculated and transmitted to the receiver x using the communication device 207.
[0118]
In addition, the sender A uses the power multiplier 203, the remainder calculator 204, and the calculation device 205 in the sender-side device 200, and uses its public information N _A , Random number r, and sender key delivery data y received from the key manager _Ai From
[0119]
[Formula 133]

[0120]
Recipient key distribution data z _Ai And broadcast to the recipient using the communication device 207.
[0121]
Here, in the above processing, r _X (Σ _X , A), z _Ai One of the reasons why the key administrator performs part of the process of creating the receiver secret information σ of the receiver x with respect to the sender A _X , S _X (Σ _X ) Sender identification number t _A This is because the sender A is prevented from being fraudulent.
[0122]
(3) Recipient x is key distribution data z received from sender A _Ai And recipient identification information r _X (Σ _X , A), recipient confidential information σ delivered from the key manager _X , S _X (Σ _X ), Published sender public information N _A From
[0123]
[Formula 134]

[0124]
Data encryption key K _A Is calculated and stored in the memory 304.
[0125]
With the above processing, the sender A and the receiver x are assigned to the key K. _A Can be shared. The same key can be shared with any other sender and receiver. At this time, the receiver key distribution data z transmitted by the sender A is broadcast. _Ai Is common to each recipient.
[0126]
In the above processing, the key delivery data z received by the receiver x from the sender A _Ai And recipient identification information r _X (Σ _X , A) is the sender identification number t of sender A that is kept secret from the receiver. _A Is the one that acted. Therefore, the above sender identification number t _A The key distribution data z received by the receiver x from the sender A _Ai , Recipient identification information r _X (Σ _X , A), public information N of other sender B _B Key distribution data z broadcasted by other sender B _Bi From other sender B's data encryption key K _B Can be extremely difficult to determine.
[0127]
Hereinafter, the encryption / decryption process will be described.
[0128]
(3) Encryption / decryption processing
(1) The sender A uses the encryption / decryption device 208 in the sender-side device 200 to create the common key K created by the key distribution process. _A Thus, the data P is encrypted. And the ciphertext C = E (K _A : P) to the recipient x using the communication device 207.
[0129]
(2) The receiver x receives the ciphertext C using the communication device 305 in the receiver-side device 300 and stores the common key K stored in the memory 304 using the encryption / decryption device 307. _A To decrypt the ciphertext C to obtain data.
[0130]
The first embodiment of the present invention has been described above.
[0131]
In the conventional technology, when a new sender enters the system, the receiver confidential information σ _X , S _X (Σ _X ) Must be created by the sender himself and distributed offline to the recipient. On the other hand, according to the key distribution system according to the first embodiment, the newly-entered sender A receives the sender secret information P _A , Q _A , L _A , G _A And sender's public information N _A Just create. Also, the receiver secret information held by the receiver is unique to all the senders, and it is not necessary to obtain new receiver secret information when it is desired to receive data from a new sender.
[0132]
Also, the recipient identification information r _X (Σ _X , A), it is possible to share a common key for data encryption / decryption only with recipients belonging to an arbitrary recipient set. In addition, even when the number of recipients is large, key distribution data z to be broadcast for common key distribution _Ai Need not be lengthened accordingly.
[0133]
In the above processing, the sender A previously sends the sender secret information L _A Is transmitted to the key manager, and at the stage of the preparation process, the key manager transmits the sender private key L received from the sender A. _A From
[0134]
[Expression 135]

[0135]
Secret information for key manager e _i , Sender identification information t _A , Recipient confidential information _X (Σ _X ) And at the stage of the key distribution process, the key administrator sends the sender secret information L _A , Key manager secret information e _i , Sender identification information t _A , Recipient confidential information _X (Σ _X From)
[0136]
[Formula 136]

[0137]
By the recipient identification data s _X (Σ _X , A) may be calculated.
[0138]
Next, a second embodiment of the present invention will be described.
[0139]
In the second embodiment of the present invention, the receiver-side mobile device 306 in the first embodiment is provided with a power multiplier 3036, a remainder calculator 3063, an arithmetic device 3061, and a memory 3062 as shown in FIG. It is a thing. Then, the data encryption key K in the receiver side device 300 of the first embodiment described above. _A A part of the calculation processing is executed by the receiver-side portable device 306.
[0140]
That is, in the second embodiment, (1) at the stage of the preparation process, the key administrator _X And recipient confidential information _X (Σ _X ) Is stored in the receiver portable device 306 (IC card or the like) and distributed to the receiver x.
[0141]
(2) In the key distribution process, the receiver x receives the key distribution data z stored in the memory in the receiver apparatus 300. _Ai Is output to the recipient portable device 306. Next, in the receiver portable device 306, using the power multiplier 3064 and the remainder calculator 3063, the receiver secret information σ _X , S _X (Σ _X ), Key distribution data z _Ai And sender's public information N _A From
[0142]
[Expression 137]

[0143]
And the calculation result ξ _X (Σ _X , A) are output to the receiver apparatus 300.
[0144]
Next, using the power multiplier 301, the remainder calculator 302, and the calculation device 303 in the receiver-side device 300, ξ output to the receiver-side device 300 _X (Σ _X , A) and the recipient identification key r stored in the memory 304 _X (Σ _X , A) and sender's public information N _A From
[0145]
[Formula 138]

[0146]
Data encryption key K _A Is calculated and stored in the memory 304.
[0147]
Thus, the receiver confidential information σ _X , S _X (Σ _X ) Is not output to the outside of the receiver-side portable device 306, it is possible to prevent it from being stolen by electronic copying or the like.
[0148]
The second embodiment of the present invention has been described above.
[0149]
Next, a third embodiment of the present invention will be described.
[0150]
The third embodiment of the present invention is the same as the first embodiment described above.
[0151]
[Formula 139]

[0152]
The value of r is changed every short period and every period, and z using the changed r _Ai Data encryption / decryption key K calculated by the sender apparatus 200 and the receiver apparatus 300 by periodically broadcasting _A Update.
[0153]
In addition, the value of r ′ is set to a value unique to the transmission data so that the sender can identify the data to be broadcast. That is, an identification key r obtained from a sender in order to decrypt a broadcast data or a set of broadcast data with a receiver x. _X (Σ _X , A) is unique to the broadcast data, and in order to obtain another broadcast data or a set of broadcast data, another broadcast data or a set of broadcast data is obtained from the sender. R _X (Σ _X , A) must be obtained.
[0154]
The third embodiment of the present invention has been described above.
[0155]
Next, a fourth embodiment of the present invention will be described.
[0156]
The fourth embodiment of the present invention, in the first embodiment described above, authenticates a specific recipient, and the sender sends the key K _A Key K for paid data P encrypted and transmitted using _A Is charged to the recipient who shares the message.
[0157]
That is, in the fourth embodiment, the following processing is further performed.
[0158]
(1) Preparation process
(1) The key manager uses the arithmetic unit 105 in the key manager side device 100 to use the number UID of the recipient x in advance. _X Create the recipient confidential information _X (Σ _X ) And stored in the memory 3061 in the recipient portable device 306 for distribution. Also, UID _X S _X (Σ _X ) And stored in the memory 106 in the key manager side device 100.
[0159]
(2) The sender A uses the arithmetic unit 205 in the sender-side apparatus 200 to use his / her number BID. _A Is created and stored in the memory 206. Also, BID _A Is transmitted to the key manager using the communication device 207.
[0160]
(3) The key manager uses the communication device 107 in the key manager side device 100 to send the number BID of the sender A _A And the sender identification information t is stored in the memory 106. _A And store in correspondence.
[0161]
{Circle around (4)} The recipient x uses the authentication device 308 in the recipient-side device 300 to receive the recipient confidential information s. _X (Σ _X ) To create authentication information and send it to the sender A.
[0162]
(5) The sender A confirms the authentication information by the authentication device 209 in the sender-side device 200.
[0163]
This authentication method allows the recipient to _X (Σ _X Unless the authentication method is known, any known authentication method may be used as long as the authentication method is not established (however, at this time, the sender may use the receiver private key s). _X (Σ _X ) You must not know itself)).
[0164]
For example, RSA (references “R. L, Rivest, A. Shamir, L. Adelman .: A method for obtaining digital signatures and publickey cryptosystems, Commun. Of the ACM, Vol. 21, No. 2, pp. 120-126. , 1987. ”), the recipient x may be authenticated by the following process.
[0165]
1: The key administrator
[0166]
[Formula 140]

[0167]
(Y _X , N _X ) To the sender in advance. However, for the published function π, s ′ _X = Π (s _X (Σ _X )).
[0168]
2: The recipient x uses the authentication device 308 in the recipient-side device 300 to calculate the hash value of W that is broadcast transmission data by the one-way hash function h that is public information (0 <h (W) <n _X ), The signature for h (W) is a secret key s ′ _X Using,
[0169]
[Formula 141]

[0170]
Is transmitted to the sender A using the communication device 305 together with a data transmission request.
[0171]
3: Sender A uses the authentication device 209 to
[0172]
[Expression 142]

[0173]
Confirm that is true.
[0174]
(6) Now, after performing authentication, the sender A uses the communication device 207 in the sender-side device 200 to transmit his / her number BID. _A And recipient x number UID _X Is sent to the key manager.
[0175]
(7) The key manager uses the arithmetic unit 105 in the key manager side device 100 to receive the received sender number BID. _A And recipient number UID _X Sender identification key t corresponding to _A And recipient confidential information _X (Σ _X From)
[0176]
[Expression 143]

[0177]
Recipient identification data s _X (Σ _X , A) is calculated and transmitted to the sender A.
[0178]
(8) The sender A uses the remainder calculator 204 and the calculator 205 in the sender apparatus 200 to receive the receiver identification data s received from the key manager. _X (Σ _X , A)
[0179]
[Expression 144]

[0180]
Recipient identification information r _X (Σ _X , A) is calculated and transmitted to the receiver x by the communication device 207. At that time, the common key K _A Thus, if the data to be encrypted and distributed (data requested by the receiver) is paid, the sender A charges the receiver x using the charging device 210.
[0181]
The fourth embodiment of the present invention has been described above.
[0182]
Next, a fifth embodiment of the present invention will be described.
[0183]
In the fifth embodiment of the present invention, the copy key method described in the section of the prior art is extended to a system having a plurality of senders, a plurality of receivers, and a key manager shown in FIG. .
[0184]
FIG. 7 shows the configuration of the key manager apparatus 100 according to the fifth embodiment of the present invention. As shown in the figure, the key manager side device 100 includes a random number generator 111, a calculation device 112, a memory 113, and a communication device 114. FIG. 8 shows the configuration of the sender apparatus 200 according to the fifth embodiment of the present invention. As shown in the figure, the sender-side device 200 includes a random number generator 211, an arithmetic device 212, an encryption / decryption device 213, a memory 214, and a communication device 215. FIG. 9 shows the configuration of a recipient-side device 300 according to the fifth embodiment of the present invention. As shown in the figure, the receiver-side device 300 includes an arithmetic device 311, an encryption / decryption device 312, a memory 313, and a communication device 314.
[0185]
In this embodiment, first, the following processing is performed as preparation processing.
[0186]
(1) Preparation process
(1) The key manager uses the random number generator 111 in the key manager side device 100 to generate secret information K0 and store it in the memory 113. It is also distributed to the sender and receiver.
[0187]
(2) The sender A uses the random number generator 211 in the sender apparatus 200 to send the sender identification information BID. _A Is transmitted to the recipient by the communication device 114.
[0188]
Thereafter, the following processing is performed as key distribution processing.
[0189]
(2) Key distribution process
(1) The sender A uses the arithmetic unit 205 in the sender-side device 200 to send the secret key information K0 and the sender identification information BID distributed from the key manager. _A To the common key K by an appropriate one-way function F _A '= F (K0, BID _A ).
[0190]
(2) The receiver uses the arithmetic device 312 in the receiver-side device 300, and the secret information K0 distributed from the key manager and the sender identification information BID received from the sender _A From the one-way function F, the common key K _A '= F (K0, BID _A ).
[0191]
(3) The sender A creates an appropriate integer r using the random number generator 211 in the sender apparatus 200 and transmits it to the receiver via the communication device 215. Also, using the arithmetic unit 212, the integer r and the common key K _A ′ To the data encryption / decryption key DK = F ′ (r, K _A ′) Is calculated and stored in the memory 214.
[0192]
(4) The receiver uses the arithmetic device 312 in the receiver-side device 300 and the integer r received from the sender A and the common key K _A ′ To the data encryption / decryption key DK = F ′ (r, K _A ′) Is calculated and stored in the memory 314.
[0193]
After the data encryption / decryption key DK is delivered by the key delivery process, the encryption / decryption process is performed as follows.
[0194]
(3) Encryption / decryption processing
(1) The sender A encrypts the distribution data P by the encryption / decryption device 203 in the sender-side device 200 using the data encryption / decryption key DK, and transmits it to the receiver by the communication device 205.
[0195]
(2) The recipient receives the distribution data P encrypted by the communication device 305 in the recipient-side device 300 and decrypts it by the encryption / decryption device 303 using the data encryption / decryption key DK.
[0196]
Also according to the fifth embodiment of the present invention described above, a receiver can share a common key of each sender with a plurality of senders with a single secret information.
[0197]
Next, a sixth embodiment of the present invention will be described.
[0198]
In the sixth embodiment of the present invention, a sender and a receiver share a common key by encrypted communication using individual keys of the receiver.
[0199]
The configuration of the entire system, the key manager side device 100, the sender side device 200, and the receiver side device 300 according to the present embodiment is the same as that of the fifth embodiment of the present invention described above.
[0200]
In the present embodiment, the following processing is performed in the preparation processing.
[0201]
(1) Preparation process
(1) The key manager uses the random number generator 111 in the key manager side device 100 to store the secret information s of the receiver x. _X Create and distribute to recipients. Furthermore, the number BID of the sender A using the random number generator 111 _A Is distributed to the sender A and the receiver x.
[0202]
(2) The sender A uses the random number generator 211 in the sender apparatus 200 to share the common key K _A Create
[0203]
Thereafter, the following processing is performed in the key distribution processing.
[0204]
(2) Key distribution process
(1) The key manager uses the arithmetic unit 112 in the key manager side device 100 to send the number BID of the sender A _A And recipient confidential information _X To K by an appropriate one-way function F _AX = F (s _X , K _A ), The session key K between the receiver x and the sender A _AX Is stored in the memory 113.
[0205]
(2) The receiver x uses the arithmetic device 312 in the receiver-side device 300 to send the sender A number BID _A And own secret information _X To K by the one-way function F _AX = F (s _X , BID _A ) Is calculated and stored in the memory 313.
[0206]
(3) The sender A uses the encryption / decryption device 213 in the sender-side device 200 to use the session key K _AX Due to the common key K _A And the key distribution data K obtained as a result is encrypted. _CX Is transmitted to the recipient by the communication device 215. Further, an appropriate integer r is created using the random number generator 211 and transmitted to the receiver by the communication device 215, and the integer r and the common key K are used using the arithmetic device 212. _A From the data encryption / decryption key DK = F ′ (r, K _A ) Is calculated and stored in the memory 214.
[0207]
(4) The recipient x uses the encryption / decryption device 303 in the recipient-side device 300 to receive the key distribution data K received from the sender A. _CX Session key K _AX Decrypt by Then, using the arithmetic unit 302, the decrypted common key K _A From the received integer r, the data encryption / decryption key DK = F ′ (r, K _A ) And is stored in the memory 303.
[0208]
After the data encryption / decryption key DK is delivered by the key delivery process, the encryption / decryption process is performed as follows.
[0209]
(1) The sender A encrypts the distribution data P with the data encryption / decryption key DK using the encryption / decryption device 203 in the sender-side device 200, and transmits it to the receiver x through the communication device 205.
[0210]
(2) The recipient x receives the distribution data P encrypted by the communication device 305 in the recipient-side device 300. Then, using the encryption / decryption device 303, the received distribution data P is decrypted with the data encryption / decryption key DK.
[0211]
The sender A has a common key K _A The value of the data encryption / decryption key DK can be periodically changed by periodically changing the value of.
[0212]
Also according to the sixth embodiment of the present invention described above, a receiver can share a common key of each sender with a plurality of senders with a single secret information.
[0213]
Next, a seventh embodiment of the present invention will be described.
[0214]
In the seventh embodiment of the present invention, as in the sixth embodiment, the sender and the receiver share a common key by encrypted communication using the individual keys of the receiver.
[0215]
The configuration of the entire system, the key manager side device 100, the sender side device 200, and the receiver side device 300 according to the present embodiment is the same as that of the fifth embodiment of the present invention described above.
[0216]
In the seventh embodiment of the present invention, the following processing is performed in the preparation processing.
[0217]
(1) Preparation process
(1) The key manager uses the random number generator 111 and the arithmetic unit 112 in the key manager side device 100 to use the secret key s of the receiver x according to the appropriate public key encryption E. _X And public key p _X Create _X Is distributed to recipients. Further, the number BID of the sender A by the random number generator 111 _A And distributed or transmitted to the sender A and the receiver x.
[0218]
(2) The sender A uses the random number generator 201 in the sender apparatus 200 to share the common key K _A Is stored in the memory 114.
[0219]
Thereafter, the following processing is performed as key distribution processing.
[0220]
(2) Key distribution process
(1) The sender A uses the encryption / decryption device 213 in the sender-side device 200, and uses the appropriate public key encryption E to send the recipient public key p _X And common key K _A To key distribution data K _CX = E (p _X , K _A ). After that, the communication device 215 _CX Is transmitted to the receiver x.
[0221]
(2) The receiver x uses the encryption / decryption device 313 in the receiver-side device 300 to receive the key distribution data K received from the sender A. _CX Own secret key _X Decrypted by and decrypted common key K _A Is stored in the memory 314.
[0222]
(3) The sender A uses the random number generator 201 in the sender apparatus 200 to generate an appropriate integer r and transmits it to the receiver x through the communication apparatus 215. Also, using the arithmetic unit 212, the integer r and the common key K _A From the data encryption / decryption key DK = F (r, K _A ) And stored in the memory 204.
[0223]
{Circle around (4)} The receiver x uses the arithmetic device 312 in the receiver-side device 300 to calculate the data encryption / decryption key DK = (r, K) by the function F from the common key KA and the integer r received from the sender. _A ) And stored in the memory 314.
[0224]
After the data encryption / decryption key DK is delivered by the key delivery process, the encryption / decryption process is performed as follows.
[0225]
(3) Encryption / decryption processing
(1) The sender A encrypts the distribution data P with the data encryption / decryption key DK using the encryption / decryption device 203 in the sender-side device 200, and transmits it to the receiver x through the communication device 205.
[0226]
(2) The receiver x receives the encrypted distribution data P using the communication device 305 in the receiver-side device 300. Then, using the encryption / decryption device 303, the received distribution data P is decrypted with the data encryption / decryption key DK.
[0227]
(3) The sender A changes the data encryption / decryption key DK by periodically changing the value of the common key KA.
[0228]
Also according to the seventh embodiment of the present invention described above, a receiver can share a common key of each sender with a plurality of senders with a single secret information.
[0229]
Next, an eighth embodiment of the present invention will be described.
[0230]
The eighth embodiment of the present invention is the same as the above-described sixth and seventh embodiments of the present invention in that the key distribution data K by the sender is _CX Has been modified as follows to send to the recipient:
[0231]
That is, in the eighth embodiment, the sender A divides the set of all receivers into several subsets. Next, key distribution data K _Ci (1 ≦ i ≦ n, where n is the number of recipients) is transmitted to the receiver, a communication channel is assigned to each subset of the receivers, and is transmitted to the receiver by the communication device 215 in the transmitter apparatus 200. To do.
[0232]
On the other hand, an arbitrary recipient x sends the key distribution data K by the communication device 305 in the recipient-side device 300 through the communication channel assigned to the subset to which it belongs. _CX Receive.
[0233]
The eighth embodiment of the present invention has been described above.
[0234]
Next, a ninth embodiment of the present invention will be described.
[0235]
The configuration of the entire system, the key manager side device 100, the sender side device 200, and the receiver side device 300 according to the present embodiment is the same as that of the first embodiment of the present invention described above.
[0236]
Hereinafter, three processes of the preparation process, the key distribution process, and the encryption / decryption process performed by the system will be described.
[0237]
First, the preparation process will be described.
[0238]
(1) Preparation process
(1) The sender A creates the following information using the random number generator 201, the prime number generator 202, the power multiplier 203, the remainder calculator 204, and the calculation device 205 in the sender apparatus 200. Among them, only public information is disclosed.
[0239]
Confidential information:
[0240]
[Expression 145]

[0241]
Public information:
[0242]
146

[0243]
The secret information is stored in the memory 206. Also, confidential information g _A , L _A Is transmitted to the key manager using the communication device 207.
[0244]
(2) A reliable key manager creates the following information by using the arithmetic unit 105 in the key manager side apparatus 100.
[0245]
Secret key manager information:
[0246]
[Expression 147]

[0247]
Sender identification information of sender A:
[0248]
[Formula 148]

[0249]
Recipient confidential information of recipient x:
[0250]
149

[0251]
These are σ _X All of them are stored in the memory 106.
[0252]
However, set
[0253]
[Expression 150]

[0254]
Σ, σ′∈S _km When,
[0255]
[Formula 151]

[0256]
And At this time, ~ is S _km The above equivalence relation
[0257]
[Formula 152]

[0258]
And
[0259]
In addition, the key manager stores the recipient secret information s from the memory 106. _X (Σ _X ) And σ _X At the same time, it is stored in the receiver's portable device 306 and distributed offline to the receiver x. Of course, it may be distributed to recipients by other methods.
[0260]
Next, the key distribution process will be described.
[0261]
(2) Key distribution process
(1) The key manager uses the remainder calculator 104 and the calculator 105 in the key manager apparatus 100 to receive the L received from the sender A. _A And key manager secret information e _i And recipient confidential information σ _X , S _X (Σ _X ) And sender identification information t _A From
[0262]
[Expression 153]

[0263]
Recipient identification data ρ of the recipient x _X (Σ _X (I), A) are calculated and transmitted to the sender A using the communication device 107.
[0264]
Further, the key manager uses the power multiplier 103, the remainder calculator 104, and the calculator 105 in the key manager side apparatus 100 to receive the g received from the sender A. _A And the sender public information N of the sender A _A And key manager secret information e _i From
[0265]
[Expression 154]

[0266]
Sender key delivery data y of sender A _Ai Is transmitted to the sender A using the communication device 107.
[0267]
(2) The sender A creates random numbers r and r ′ by the random number generator 201 in the sender apparatus 200 and stores them in the memory 206. Further, using the power multiplier 203, the remainder calculator 204, and the calculation device 205, the random numbers r and r ′ and its own secret information g _A And public information N _A From
[0268]
[Expression 155]

[0269]
Data encryption key K _A Is calculated and stored in the memory 206, and the key K with the recipient x is calculated. _A For the purpose of sharing the secret information L using the remainder computing unit 204 and the computing device 205. _A , A random number r ′, and receiver identification data ρ of the receiver x received from the key manager _X (Σ _X From (i), A)
[0270]
156

[0271]
Recipient identification information r of recipient x _X (Σ _X (I), A) are calculated and transmitted to the receiver x using the communication device 207.
[0272]
In addition, the sender A uses the power multiplier 203, the remainder calculator 204, and the calculation device 205 in the sender-side device 200, and uses its public information N _A , Random number r, and sender key delivery data y received from the key manager _Ai From
[0273]
[Expression 157]

[0274]
Recipient key distribution data z _Ai And broadcast to the recipient using the communication device 207.
[0275]
Here, in the above processing, r _X (Σ _X (I), A), z _Ai One of the reasons why the key administrator performs part of the process of creating the receiver secret information σ of the receiver x with respect to the sender A _X , S _X (Σ _X ) Sender identification number t _A This is because the sender A is prevented from being fraudulent.
[0276]
(3) Recipient x is key distribution data z received from sender A _Ai And recipient identification information r _X (Σ _X (I), A), recipient confidential information σ delivered from the key manager _X , S _X (Σ _X ), Published sender public information N _A From
[0277]
[Formula 158]

[0278]
Data encryption key K _A Is calculated and stored in the memory 304.
[0279]
With the above processing, the sender A and the receiver x are assigned to the key K. _A Can be shared. The same key can be shared with any other sender and receiver. At this time, the receiver key distribution data z transmitted by the sender A is broadcast. _Ai Is common to each recipient.
[0280]
In the above processing, the key delivery data z received by the receiver x from the sender A _Ai And recipient identification information r _X (Σ _X (I), A) is the sender identification number t of sender A that is kept secret from the receiver. _A Is the one that acted. Therefore, the above sender identification number t _A The key distribution data z received by the receiver x from the sender A _Ai , Recipient identification information r _X (Σ _X (I), A), public information N of other sender B _B Key distribution data z broadcasted by other sender B _Bi From other sender B's data encryption key K _B Can be extremely difficult to determine.
[0281]
Hereinafter, the encryption / decryption process will be described.
[0282]
(3) Encryption / decryption processing
(1) The sender A uses the encryption / decryption device 208 in the sender-side device 200 to create the common key K created by the key distribution process. _A Thus, the data P is encrypted. And the ciphertext C = E (K _A : P) to the recipient x using the communication device 207.
[0283]
(2) The receiver x receives the ciphertext C using the communication device 305 in the receiver-side device 300 and stores the common key K stored in the memory 304 using the encryption / decryption device 307. _A To decrypt the ciphertext C to obtain data.
[0284]
The ninth embodiment of the present invention has been described above.
[0285]
Also in the key distribution system according to the present embodiment, as in the first embodiment described above, the newly-entered sender A receives the sender secret information P _A , Q _A , L _A , G _A And sender's public information N _A Just create. Also, the receiver secret information held by the receiver is unique to all the senders, and it is not necessary to obtain new receiver secret information when it is desired to receive data from a new sender.
[0286]
Also, the recipient identification information r _X (Σ _X By (i) and (A), it is possible to share a common key for data encryption / decryption only with receivers belonging to an arbitrary receiver set. In addition, even when the number of recipients is large, key distribution data z to be broadcast for common key distribution _Ai Need not be lengthened accordingly.
[0287]
In the above processing, the sender A previously sends the sender secret information L _A Is transmitted to the key manager, and at the stage of the preparation process, the key manager transmits the sender private key L received from the sender A. _A From
[0288]
[Expression 159]

[0289]
Secret information for key manager e _i , Sender identification information t _A , Recipient confidential information _X (Σ _X ) And at the stage of the key distribution process, the key administrator sends the sender secret information L _A , Key manager secret information e _i , Sender identification information t _A , Recipient confidential information _X (Σ _X From)
[0290]
[Expression 160]

[0291]
By the recipient identification data ρ _X (Σ _X (I) and A) may be calculated.
[0292]
Next, a tenth embodiment of the present invention will be described.
[0293]
The tenth embodiment of the present invention is the same as the ninth embodiment except that the data encryption key K in the receiver-side device 300 is _A A part of the calculation processing is executed by the receiver-side portable device 306. The configuration of the receiver-side mobile device 306 used in this embodiment is the same as that of the second embodiment of the present invention described above.
[0294]
In the present embodiment, (1) at the stage of the preparation process, the key manager receives the receiver confidential information σ. _X , S _X (Σ _X ) Is stored in the receiver portable device 306 (IC card or the like) and distributed to the receiver x.
[0295]
(2) In the key distribution process, the receiver x receives the key distribution data z stored in the memory in the receiver apparatus 300. _Ai Is output to the recipient portable device 306. Next, in the receiver portable device 306, using the power multiplier 3064 and the remainder calculator 3063, the receiver secret information σ _X , S _X (Σ _X ), Key distribution data z _Ai And sender's public information N _A From
[0296]
[Formula 161]

[0297]
And the calculation result ξ _X (Σ _X (I), A) are output to the receiver apparatus 300.
[0298]
Next, using the power multiplier 301, the remainder calculator 302, and the calculation device 303 in the receiver-side device 300, ξ output to the receiver-side device 300 _X (Σ _X (I), A) and the recipient identification key r stored in the memory 304 _X (Σ _X (I), A) and sender's public information N _A From
[0299]
[Expression 162]

[0300]
Data encryption key K _A Is calculated and stored in the memory 304.
[0301]
Thus, the receiver confidential information σ _X , S _X (Σ _X ) Is not output to the outside of the receiver-side portable device 306, it is possible to prevent it from being stolen by electronic copying or the like.
[0302]
The tenth embodiment of the present invention has been described above.
[0303]
Next, an eleventh embodiment of the present invention will be described.
[0304]
The eleventh embodiment of the present invention is the same as the ninth embodiment,
[0305]
[Expression 163]

[0306]
The value of r is changed every short period and every period, and z using the changed r _Ai Data encryption / decryption key K calculated by the sender apparatus 200 and the receiver apparatus 300 by periodically broadcasting _A Update.
[0307]
In addition, the value of r ′ is set to a value unique to the transmission data so that the sender can identify the data to be broadcast. That is, an identification key r obtained from a sender in order to decrypt a broadcast data or a set of broadcast data with a receiver x. _X (Σ _X (I) and (A) are unique to the broadcast data. In order to acquire another broadcast data or a set of broadcast data, another broadcast data or a set of broadcast data is obtained from the sender. Another r for _X (Σ _X It is necessary to obtain (i) and A).
[0308]
The eleventh embodiment of the present invention has been described above.
[0309]
Next, a twelfth embodiment of the present invention will be described.
[0310]
The twelfth embodiment of the present invention performs authentication of a specific recipient in the ninth embodiment described above, and the sender uses the key K _A Key K for paid data P encrypted and transmitted using _A Is charged to the recipient who shares the message.
[0311]
That is, in the twelfth embodiment, the following processing is further performed.
[0312]
(1) Preparation process
(1) The key manager uses the arithmetic unit 105 in the key manager side device 100 to use the number UID of the recipient x in advance. _X Create the recipient confidential information _X (Σ _X ) And stored in the memory 3061 in the recipient portable device 306 for distribution. Also, UID _X S _X (Σ _X ) And stored in the memory 106 in the key manager side device 100.
[0313]
(2) The sender A uses the arithmetic unit 205 in the sender-side apparatus 200 to use his / her number BID. _A Is created and stored in the memory 206. Also, BID _A Is transmitted to the key manager using the communication device 207.
[0314]
(3) The key manager uses the communication device 107 in the key manager side device 100 to send the number BID of the sender A _A And the sender identification information t is stored in the memory 106. _A And store in correspondence.
[0315]
{Circle around (4)} The recipient x uses the authentication device 308 in the recipient-side device 300 to receive the recipient confidential information s. _X (Σ _X ) To create authentication information and send it to the sender A.
[0316]
(5) The sender A confirms the authentication information by the authentication device 209 in the sender-side device 200.
[0317]
This authentication method is the same as that in the fourth embodiment of the present invention described above. _X (Σ _X Unless the authentication method is known, any known authentication method may be used as long as the authentication method is not established (however, at this time, the sender may use the receiver private key s). _X (Σ _X ) You must not know itself)).
[0318]
(6) Now, after performing authentication, the sender A uses the communication device 207 in the sender-side device 200 to transmit his / her number BID. _A And recipient x number UID _X Is sent to the key manager.
[0319]
(7) The key manager uses the arithmetic unit 105 in the key manager side device 100 to receive the received sender number BID. _A And recipient number UID _X Sender identification key t corresponding to _A And recipient confidential information _X (Σ _X From)
[0320]
[Expression 164]

[0321]
Recipient identification data ρ _X (Σ _X (I), A) is calculated and transmitted to the sender A.
[0322]
(8) The sender A uses the remainder calculator 204 and the calculator 205 in the sender apparatus 200 to receive the receiver identification data ρ received from the key manager. _X (Σ _X From (i), A)
[0323]
165

[0324]
Recipient identification information r _X (Σ _X (I), A) are calculated and transmitted to the receiver x by the communication device 207. At that time, the common key K _A Thus, if the data to be encrypted and distributed (data requested by the receiver) is paid, the sender A charges the receiver x using the charging device 210.
[0325]
The embodiments of the present invention have been described above.
[0326]
Each process of the key manager side apparatus 100, the sender side apparatus 200, and the receiver side apparatus 300 described above is realized by causing a computer to execute a program describing a procedure for executing each process. May be. In this case, each program describing a procedure for executing each process may be stored in a storage medium and supplied to each computer. Or you may make it supply to each computer via communication media, such as a network.
[0327]
【The invention's effect】
As described above, according to the present invention, the receiver can receive the delivery of individual common keys from a plurality of senders by using only the secret information. Moreover, in some inventions, in such a key distribution system, it is possible to share a common key for data encryption / decryption between an arbitrary sender and only a receiver belonging to an arbitrary receiver set. it can. Even when the number of recipients is large, it is not necessary to lengthen the broadcast data for common key distribution.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a key distribution system according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a key manager side apparatus according to the first embodiment of the present invention.
FIG. 3 is a block diagram illustrating a configuration of a sender-side device according to the first embodiment of the present invention.
FIG. 4 is a block diagram showing a configuration of a receiver side apparatus according to the first embodiment of the present invention.
FIG. 5 is a diagram showing a flow of information by key distribution processing in the first embodiment of the present invention.
FIG. 6 is a block diagram illustrating a configuration of a receiver-side mobile device according to a second embodiment of the present invention.
FIG. 7 is a block diagram showing a configuration of a key manager side apparatus according to a fifth embodiment of the present invention.
FIG. 8 is a block diagram showing a configuration of a sender device according to a fifth embodiment of the present invention.
FIG. 9 is a block diagram illustrating a configuration of a receiver-side device according to a fifth embodiment of the present invention.
[Explanation of symbols]
100 Key administrator side device
101, 111, 201, 211, 311 random number generator
102, 202 Prime number generator
103, 203, 301, 3064 power multiplier
104, 204, 302, 3063 Residue calculator
105, 112, 205, 212, 303, 312, 3061
106, 113, 206, 214, 304, 314, 3062 Memory
107, 114, 207, 215, 305, 315 Communication device
200 Sender side device
208, 213, 307, 313 Encryption / Decryption Device
209, 308 Authentication device
210 Billing device
300 Receiver device
306 Receiver mobile device

Claims

A plurality of transmitting side apparatus connected via a communication line in a communication system having a plurality of receiver side apparatus and the key management side apparatus, the encryption and decryption key for broadcast encrypted communication the transmitting side device performs A key distribution method for sharing between the sender device and the receiver device ,
The key management side apparatus, the arithmetic unit of the apparatus, so as to correspond to a subset S'finite set S generates a recipient secret information s _X recipient's device x, the self via the communication line Transmitting from the communication device of the device to the receiver- side device x, and generating the sender identification information t _A of the sender- side device A by the arithmetic device of the device itself , the receiver secret information s _X and the sender _A first step of storing the identification information t _A in the storage device of the device itself ;
The transmitter unit A is, the arithmetic unit of the own apparatus generates a sender secret information G _A itself, to calculate the encryption and decryption key K _A from the sender secret information G _A, the sender secret information G a second step of storing the _a and the encryption and decryption key K _a in its own storage device,
The key manager side device transmits the sender identification information t _A stored in the storage device of the own device from the communication device of the own device to the sender side device A via the communication line , The sender secret information s _X stored in the storage device of the device is output, and the sender device A is stored in the storage device of the own device by the calculation device of the own device. at least by the action of said sender identification information t _a and the received secret information G _a from the key management side apparatus, a key to generate a delivery information W, the key management side said receiver output from device by at least the working and the sender identification information t _a stored in the storage device of the secret key information s _X and its own device, the recipient identification information r _X of the receiver side apparatus x to said transmitter unit a And generating the key distribution information W and A third step of storing the received identification information r _X in the storage device of the apparatus,
The transmitter unit A is, the communication device of the apparatus, and transmits the received identification information r _X stored in the storage device of the apparatus to the reception side apparatus x via the communication line, A fourth step of broadcasting the key distribution information W stored in the storage device of the own device to each of the plurality of recipient devices via the communication line ;
Said receiver side apparatus x is the arithmetic unit of the apparatus, said a recipient secret information s _X output from the key management side apparatus, the key is received from the transmitter unit A delivery information W and the and a recipient identification information r _X, the transmitting side apparatus a performs calculates the encryption and decryption key K _a broadcast encrypted communication, anda fifth step of storing in a storage device of the apparatus,
The recipient secret information s _X, the key delivery information W and the recipient identification information r _X, the recipient secret information s _X, the key delivery information W and the recipient identification information r _X and the plurality of recipients more and other information side device each hold a key delivery method, wherein the encryption and decryption key K _a is generated with a possible derivation relationships.

The key distribution method according to claim 1 ,
Wherein in a second step, the sender apparatus A, the operation unit of the apparatus, the variable information r _A for changing the encryption and decryption _key, creates a r A _', the variable information r _A, r _A with calculating the encryption and decryption key K _a is allowed to act on the sender secret information G _a a ', outputs the sender secret information G _a,
In the third step, the key management side apparatus, the arithmetic unit of the apparatus, by the action of said sender identification information t _A and the transmitting side apparatus the sender secret information G _A output from the A and to generate a data W', generates data r X _'which is made to act and a sender identification information t _a and the recipient secret information s _X, by the communication device of the apparatus, said via said communication line the transmit data W'and the data r _{X 'to} the transmitting side apparatus a, and the transmitter unit a, the data W'that the arithmetic unit of the apparatus, received from the key management side apparatus the variable information r _a was allowed to act to produce the key distribution information W, allowed to act by the transmitting side apparatus a _'the variable information r _{a to'} the data r _X received from the key management side apparatus to recipients of the receiver side apparatus x for Key delivery method which is characterized in that to produce another information r _X.

A plurality of transmitting side apparatus connected via a communication line in a communication system having a plurality of receiver side apparatus and the key management side apparatus, the encryption and decryption key for broadcast encrypted communication the transmitting side device performs A key distribution method for sharing between the sender device and the receiver device ,
The key manager side device is operated by its own device,
As key manager secret information,

As produced, the sender identification information of the transmission side apparatus A a,

As produced, the recipient secret information of the receiver side apparatus x to,
σ _X ∈ S _km ,

(However, set

For σ, σ '∈ S _km

And at this time, ~ is an equivalence relation on S _km ,

Generates is) and with the key manager secret information e _i, the sender identification information t _A and the recipient secret information sigma _X, s X a _(sigma _X) stores in the storage device of the apparatus, and outputting the receiver secret information σ _{_X, s} _X a (sigma _X),
The sender device A is operated by its own computing device.

(However,

Is

The sender secret information g _A , L _A and the finite abel group G _A are generated, and the sender secret information g _A , L _A and the finite abel group G _A are stored in its own device. stores the device, and outputting the sender secret information g _a,
The key manager side device is operated by its own device,
The key manager secret information e _i stored in the storage device of the apparatus, the sender identification information t _A and the recipient secret information s _{_X (σ _X),} the sigma _X, recipient identification data

Is calculated and stored in the storage device of the device itself, and the receiver identification data s _X (σ _X , A) is transmitted to the transmitter device A via the communication line by the communication device of the device itself. and, and, by the computing device, from the transmission side apparatus a the sender secret information outputted from the g _a, and the key manager secret information e _i, and the sender identification information t _a, key distribution data

Calculating and storing the key distribution data y _Ai to the sender side device A via the communication line by the communication device ,
The sender device A is operated by its own computing device.
Integer r, to generate a r', the key management side apparatus recipient identification data _{s _X (σ X,} A) received from the, and the sender secret information _{L A,} from said integer r'

The receiver identification information r _X (σ _X , A) is calculated and stored in the storage device of the own device, and the reception device x receives the reception by the communication device of the own device via the communication line. identification information _{r _X (σ X,} a) sends, and, by the computing device, said key distribution data _{y Ai} received from the key management side apparatus, from said integer r, key distribution information

Calculating and storing it in the storage device of the device itself, and broadcasting the key distribution information z _Ai to each of the plurality of recipient devices via the communication line by the communication device ;
The receiver side device x is operated by its own device,
The recipient identification information received from the transmitting side apparatus _{_{A r X (σ X, A}} ) and the key distribution information z _Ai and the recipient secret information outputted from the key management side apparatus sigma _X, s since the _{_X (σ X),}

Accordingly, the transmitter unit A is

The dark decryption key K _A is calculated, and key distribution method characterized by comprising the steps of: storing in a storage device of the apparatus for use in broadcast generated by.

(However, set

For σ, σ '∈ S _km

And at this time, ~ is an equivalence relation on S _km ,

To generate for) and and, the key manager secret information e _i, the sender identification information t _A and the recipient secret information sigma _X, s X a _(sigma _X) stores in a storage device of its own device and outputting the recipient secret information _{_{_{σ X, s X (σ X}}} ),
The sender device A is operated by its own computing device.
As the sender secret information of the sender device A,

As produced, the sender public information of the transmitting side apparatus A a,

Generates, the sender secret information _{_{_{P A, Q A, L A}}} , with a _{g A} and the sender public information _{N A} stored in the storage device of its own device, and outputs the sender secret information _{g A} step When,
The key manager side device is operated by its own device,
The key manager secret information e _i stored in the storage device of the apparatus, the sender identification information t _A and the recipient secret information s _{_X (σ _X),} the sigma _X, recipient identification data

Is calculated and stored in the storage device of the device itself, and the receiver identification data s _X (σ _X , A) is transmitted to the transmitter device A via the communication line by the communication device of the device itself. And the sender secret information g _A output from the sender device A by the arithmetic device, the key manager secret information e _i stored in the storage device of the device itself, and the sender from the identification information _{t a,} key distribution data

Calculating and storing it in the storage device of the device itself, and transmitting the key distribution data y _Ai to the sender device A via the communication line by the communication device ;
The sender device A is operated by its own computing device.
Integer r, to generate a r', wherein the recipient identification received from the key management side apparatus data s _{_X (σ _X,} A) and the sender secret information stored in the storage unit of the own device L _A and, from the said integer r'

The receiver identification information r _X (σ _X , A) is calculated and stored in the storage device of the device itself, and is received by the receiver device x via the communication line by the communication device of the device itself. identification information _{r _X (σ X,} a) sends, and, by the arithmetic unit, from said key distribution data _{y Ai} and the integer r received from the key management side apparatus, key distribution information

Calculating and storing the same in the storage device of the device, and broadcasting the key distribution information z _Ai to each of the plurality of recipient devices via the communication line by the communication device ;
The receiver side device x is operated by its own device,
The recipient identification information received from the transmitting side apparatus _{_{A r X (σ X, A}} ) and the key distribution information z _Ai and the recipient secret information outputted from the key management side apparatus sigma _X, s since the _{_X (σ X)}

Accordingly, the transmitter unit A is

Key delivery method generated by calculating the encryption and decryption key K _A to be used for broadcast communication, and having the steps of: storing in a storage device of the self apparatus by.

The key distribution method according to claim 3 or 4 ,
The sender device A is
Prior the key management side apparatus, the arithmetic unit of the own device, the key manager secret information e _i, the sender identification information t _A, to generate the recipient secret information s _{_X (σ _X),} It said generating and outputting secret information L _a,
The key manager side device is operated by its own device,
From the output from the transmitter unit A the sender secret information L _A

Become the key manager secret information _e i, the sender identification information _t A, the receiver generates secret information _{s _X (σ X),} the sender secret information _L A, the key manager secret information _{e i} the sender identification information _t A, from the recipient secret information _{s _X (σ X)}

And calculating the recipient identification data s _X (σ _X , A).

The key distribution method according to claim 3 or 4 , further comprising:
The sender device A is operated by its own computing device.
Change the value of the integer r, according to the integer r after the change, the addition to recalculate the values of the encryption and decryption key K _A, according to the integer r after the change, and recalculates the key distribution information z _Ai Re-broadcast to each of the plurality of recipient-side devices via the communication line by the communication device of the device ,
The receiver side device x is operated by its own device,
According to the key distribution information z _Ai transmitted rebroadcast, key distribution method characterized by comprising the steps of: recalculating the encryption and decryption key K _A.

The key distribution method according to claim 3 or 4 , wherein:
The sender side device A is operated by its own device,
The value of the integer r', encrypts corresponding to each type of information or information to be broadcast to multiple generated, for each type of the information or information generated corresponding to the type of the information or information the integer r'was therefore the while calculating the encryption and decryption key K _a, the receiver side apparatus the integer r'generated in response to the type of the information or information to allow decoding in the x Thus the receiver identification information r _{_X (σ _X,} a) to calculate the, by the communication device of the apparatus, via the communication line transmits to the reception side apparatus x,
The receiver side device x is operated by its own device,
The recipient identification information received r _{_X (σ _X,} A) in accordance with, calculating the encryption and decryption key K _A for the type of the information or information the receiver side apparatus x to the decoding is permitted A key distribution method characterized by the above.

The key distribution method according to claim 3 or 4 ,
The sender device A is operated by its own computing device.
The recipient identification information r _{_X (σ _X,} A) to the receiving side apparatus which claims to be the said receiver side apparatus x prior to sending a and the reception side apparatus, the recipient secret information s secret _X that you have the _(sigma _X), the recipient secret information even if the reception side apparatus is in the receiver side apparatus x s _{X (sigma} _X) is the transmitter unit a A key distribution method characterized by comprising a step of authenticating according to a method to be realized.

The key distribution method according to claim 3 , 4 or 8 ,
The sender device A is operated by its own computing device.
Said receiver side apparatus x to the receiver identification information _{r _X (σ X,} A) when sending, the recipient identification information _{r _X (σ X,} A) by said encryption and decryption key _{K A} which corresponds to key distribution method characterized by comprising the step of calculating a charge for the type of information or information to be broadcast is encrypted, as the accounting information for the receiver side apparatus x.

A plurality of transmitting side apparatus connected via a communication line, a communication system having a plurality of receiver side apparatus and the key management side apparatus,
The key manager side device has an arithmetic device, a storage device, a communication device, and an input / output device,
The arithmetic unit of the key manager side device is:
As key manager secret information,

Generating and storing it in the storage device of its own device,
As sender identification information of the sender- side device A,

Generating and storing in the storage device of its own device,
As receiver confidential information of the receiver side device x,
σ _X ∈ S _km , and

(However, set

On the other hand, when σ, σ′∈S _km ,

And at this time, ~ is an equivalence relation on S _km ,

And processing to generate and store in the storage device of its own device,
The key manager secret information e _i stored in the storage device of the apparatus, the sender identification information t _A and the recipient secret information s _{_X (σ _X),} the sigma _X, recipient identification data

Calculating and storing in the storage device of the own device,
Wherein from a sender secret information g _A outputted from the transmitting side apparatus A, and the key manager secret information e _i and the sender identification information t _A is stored in the storage device of its own device, key distribution data

Calculates, performs a process of storing in the storage device of the apparatus,
The input / output device of the key manager side device is:
A process of inputting the sender secret information g _A output from the sender device A ;
Processing to output the recipient secret information σ _X , s _X (σ _X ) generated by the arithmetic device of the key manager side device ;
The communication device of the key manager side device is:
Processing for transmitting the receiver identification data s _X (σ _X , A) and the key distribution data y _Ai generated by the arithmetic unit of the key manager side device to the sender side device A via the communication line And
The transmitting side apparatus A has an arithmetic unit, a storage device, a communication device, and an input-output device,
The arithmetic unit of the sender side device A is:

(However,

Is

Minimum and process a positive integer representing the a) comprising the sender secret information g _A, generates a L _A and finite Abelian group G _A, stored in the storage device of the apparatus comprising,
Processing for generating integers r and r ′ and storing them in the storage device of the device itself;
The key management side said receiver has received from the device identification data s _{_X (σ _X,} A) and, from said sender secret information L _A and the integer r'stored in the storage device of the apparatus

A process of calculating the receiver identification information r _X (σ _X , A) and storing it in the storage device of the device itself;
Said key distribution data y _Ai received from the key management side apparatus, from said integer r stored in the storage device of its own device, key distribution information

To calculate and store in the storage device of its own device ,
The input / output device of the sender side device A is:
A process of outputting the sender secret information g _A generated by the arithmetic unit of the sender side device A ;
The communication device of the sender side device A is:
A process of receiving the receiver identification data s _X (σ _X , A) and the key distribution data y _Ai from the key manager side device via the communication line ;
Processing for transmitting the receiver identification information r _X (σ _X , A) generated by the arithmetic unit of the transmitter apparatus A to the receiver apparatus x via the communication line;
A process of broadcasting the key distribution information z _Ai generated by the arithmetic unit of the sender device A to the plurality of receiver devices via the communication line;
The receiver- side device x includes an arithmetic device, a storage device, a communication device, and an input / output device.
The arithmetic unit of the receiver side device x is:
Wherein said receiver identification received from the transmitting side apparatus A information r _{_X (σ _X,} A) and the key distribution information z _Ai and the recipient secret information outputted from the key management side apparatus sigma _X, s since the _{_X (σ X),}

Accordingly, the transmission-side user device A is

Generated by, compute the encryption and decryption key K _A to be used for broadcast, a process to be stored in the storage device of the apparatus,
The input / output device of the receiver side device x is:
A process of inputting the receiver secret information σ _X and s _X (σ _X ) output from the key manager side device ;
The communication device of the receiver side device x is:
A communication system characterized by performing a process of receiving the receiver identification information r _X (σ _X , A) and the key distribution information z _Ai from the sender apparatus A via the communication line .

A plurality of transmitting side apparatus connected via a communication line, a key management side apparatus used in a communication system having a plurality of receiver side apparatus and the key management side apparatus,
It has an arithmetic device, a storage device, a communication device, and an input / output device
The arithmetic unit is:
As key manager secret information,

Generating and storing in the storage device ;
As sender identification information of the sender- side device A,

Generating and storing in the storage device;
As receiver confidential information of the receiver side device x,
σ _X ∈ S _km , and

(However, set

For σ, σ '∈ S _km

And at this time, ~ is an equivalence relation on S _km ,

And the process of storing in the storage device,
The key manager secret information e _i stored in the storage device, the sender identification information t _A and the recipient secret information s _{_X (σ _X),} the sigma _X, recipient identification data

Calculating and storing in the storage device;
From the sender secret information g _A output from the sender side device A, the key manager secret information e _i and the sender identification information t _A stored in the storage device , key distribution data

And processing to calculate and store in the storage device,
The input / output device is
A process of inputting the sender secret information g _A output from the sender device A ;
Processing to output the receiver secret information σ _X , s _X (σ _X ) generated by the arithmetic device ;
The communication device
A process of transmitting the receiver identification data s _X (σ _X , A) and the key distribution data y _Ai generated by the arithmetic device to the sender device A through the communication line is performed. Key administrator side device.

A plurality of transmitting side apparatus connected via a communication line, a transmitting side apparatus used in a communication system having a plurality of receiver side apparatus and the key management side apparatus,
An arithmetic device, a storage device, a communication device, and an input / output device;
The arithmetic unit is:

(However,

Is

Minimum and process a positive integer representing the a) comprising the sender secret information g _A, generates a L _A and finite Abelian group G _A, is stored in the storage device comprising,
Generating integers r and r ′ and storing them in the storage device;
The key management side apparatus recipient identification data s _{_X (σ _X,} A) received from the a, a front Symbol storage device the stored the sender secret information L _A and the integer r'

Processing for calculating and storing the receiver identification information r _X (σ _X , A) as follows :
A key distribution data y _Ai received from the key management side apparatus, from said integer r which is stored in the storage device, key distribution information

Calculating and storing in the storage device;

The encryption and decryption key K _A to be used for broadcast calculated according performs a process of storing in the storage device,
The input / output device is
_A process of outputting the sender secret information g _A generated by the arithmetic device ;
The communication device
Processing for transmitting the receiver identification information r _X (σ _X , A) generated by the arithmetic device to the receiver-side device x via the communication line;
The arithmetic device the key distribution information z _Ai generated is the sender-side apparatus, characterized in that to perform a processing for broadcast transmission to the plurality of receiver side apparatus via the communication line.

A plurality of transmitting side apparatus connected via a communication line, a receiver side apparatus used in a communication system having a plurality of receiver side apparatus and the key management side apparatus,
It has an arithmetic device, a storage device, a communication device, and an input / output device
The arithmetic unit is:
Recipient identification information r _X (σ _X , A) and key distribution information z _Ai received from the sender side device A, and receiver secret information σ _X , s _X (σ _X ) received from the key manager side device And from

Thus, the sender side device A

Generated by, compute the encryption and decryption key K _A to be used for broadcast, a process of storing in the storage device,
The input / output device is
A process of receiving the receiver secret information σ _X and s _X (σ _X ) output from the key manager side device ;
The communication device
Receiver side apparatus, which comprises carrying out a process of receiving the reception identification information r _{_X (σ _X,} A) and the key distribution information z _Ai from the transmitter unit A through the communication line.

A plurality of transmitting side apparatus connected via a communication line, a receiver side apparatus used in a communication system having a plurality of receiver side apparatus and the key management side apparatus,
A main device and an auxiliary device;
The auxiliary device includes an auxiliary arithmetic device, an auxiliary connection device, and an auxiliary storage device,
The auxiliary arithmetic unit is
A process of taking receiver secret information s _X (σ _X ), σ _X from the key manager side device connected to the auxiliary connection device and storing it in the auxiliary storage device;
Wherein connected to the auxiliary connection device uptake key delivery information z _Ai of the sender unit A from the main device, the key distribution information z _Ai and, wherein the recipient secret information stored in the auxiliary storage device sigma _X , from the _{s _X (σ X),}

And a process of outputting the calculation result ξ _X (σ _X , A) to the main unit connected to the auxiliary connection device ,
The main body device includes a main body arithmetic device, a main body connection device, and a main body communication device,
The arithmetic unit for the main body is
And outputting the key distribution information z _Ai received from the transmitting side apparatus A, the connected to the main body connecting device said auxiliary device,
The transmitter unit A recipient identification information received from the r _{_X (σ _X,} A) and the input from the connected auxiliary device to the main body connecting device ξ _{_X (σ _X,} A) from the ,

The sender side device A

Generated by, it performs a process of calculating the encryption and decryption key K _A to be used for broadcast,
The communication device for the main body is
A receiver- side apparatus that performs processing for receiving the key distribution information z _Ai and the receiver identification information r _X (σ _X , A) from the sender-side apparatus A via the communication line .

A plurality of transmitting side apparatus connected via a communication line, a communication system having a plurality of receiver side apparatus and the key management side apparatus, connected to the key management side apparatus and the receiving side apparatus x An auxiliary device used,
An auxiliary arithmetic device, an auxiliary connection device, and an auxiliary storage device;
The arithmetic unit is:
A process of taking receiver secret information s _X (σ _X ), σ _X from the key manager side device connected to the auxiliary connection device and storing it in the auxiliary storage device;
Captures key distribution information z _Ai of the sender unit A from the connected the receiver side apparatus x to the auxiliary connection device, said key distribution information z _Ai, the recipient secret stored in the auxiliary storage device since the information _{_{_{σ X, s X (σ X}}} ) and,

And processing to output the calculation result ξ _X (σ _X , A) to the receiver- side device x connected to the auxiliary connection device.

A plurality of transmitting side apparatus connected via a communication line, a communication system having a plurality of receiver side apparatus and the key management side apparatus, storing a program for executing the processing in the key management side apparatus to the computer Storage medium,
The program is stored on the computer
As key manager secret information,

Is generated using an arithmetic device and stored in a storage device;
As sender identification information of the sender- side device A,

Is generated using the arithmetic device and stored in the storage device;
As receiver confidential information of the receiver side device x,
σ _X ∈ S _km , and

(However, set

For σ, σ '∈ S _km

And at this time, ~ is an equivalence relation on S _km ,

Is generated using the arithmetic device and stored in the storage device;
Processing for outputting the receiver secret information σ _X , s _X (σ _X ) ;
The key manager secret information e _i stored in the storage device, the sender identification information t _A and the recipient secret information s _{_X (σ _X),} the sigma _X, recipient identification data

Is calculated using the arithmetic device and stored in the storage device;
The recipient identification data s _{_X (σ _X,} A), said sender unit A through the communication line, a process of transmitting by using the communication device,
A process of inputting the sender secret information g _A that the output from the transmitting side apparatus A,
Wherein from the transmitting side device A the sender secret information outputted from the g _A, and the key manager secret information e _i and the sender identification information t _A is stored in the storage device, key distribution data

Is calculated using the arithmetic device and stored in the storage device ;
Said key distribution data y _Ai stored in the storage device, a program for causing to execute a process of transmitting by using the communication device to the transmitter unit A through the communication line Stored storage medium.

A plurality of transmitting side apparatus connected via a communication line, a communication system having a plurality of receiver side apparatus and the key management side apparatus, storing a program for executing the processing in the transmitting side apparatus to the computer A storage medium,
The program is stored on the computer

(However,

Is

Minimum and process a positive integer representing the a) comprising the sender secret information g _A, the L _A and finite Abelian group G _A, generated using an arithmetic unit in the storage apparatus comprising,
And outputting the sender secret information _{g A,}
Processing for generating integers r and r ′ using the arithmetic device and storing them in the storage device;
Processing for receiving receiver identification data s _X (σ _X , A) from the key manager side device via the communication line using the communication device;
From the receiver identification data s _X (σ _X , A) received from the key manager side device, the sender secret information L _A and the integer r ′ stored in the storage device ,

A process of calculating the receiver identification information r _X (σ _X , A) using the arithmetic device and storing it in the storage device;
The recipient identification information r _{_X (σ _X,} A) and a process of transmitting to said receiver side apparatus x via the communication line,
Processing for receiving the key distribution data y _Ai from the key manager side device using the communication device via the communication line ;
From the key distribution data y _Ai received from the key manager side device and the integer r stored in the storage device , key distribution information

Is calculated using the arithmetic device and stored in the storage device;
The key distribution information z _Ai, to the plurality of receiver side apparatus through the communication line, a process of transmitting broadcast using the communication device,

The boric encryption and decryption key K _A to be used for communication, the arithmetic device calculates using a storage medium storing a program, characterized in that to execute a process of storing in the storage device in accordance with.

A plurality of transmitting side apparatus connected via a communication line, a communication system having a plurality of receiver side apparatus and the key management side apparatus, storing a program for executing the processing in the receiver side apparatus to the computer A storage medium,
The program is stored on the computer
The recipient identification information through the communication line from the transmitting side apparatus _{_{A r X (σ X, A}} ) and the key distribution information z _Ai, a process of receiving through the communication device,
A process for inputting the key management side apparatus the recipient secret sigma _X output _from, s X a _(sigma _X),
The receiver identification information r _X (σ _X , A) and the key distribution information z _Ai received from the sender side device A, and the receiver secret information σ _X , s _X output from the key manager side device. From (σ _X )

Thus, the sender side device A

_A storage medium storing a program characterized in that the encryption / decryption key KA generated by the above-described method and used for broadcast communication is calculated using an arithmetic device and stored in a storage device .

Processing to generate
As sender identification information of the sender- side device A,

(However, set

For σ, σ '∈ S _km

And at this time, ~ is an equivalence relation on S _km ,

Generating and storing in the storage device;
Wherein from the transmitting side apparatus A the sender secret information outputted from the g _A, and the key manager secret information e _i and the sender identification information t _A is stored in the storage device, key distribution data

And processing to calculate and store in the storage device,
The input / output device of the key manager side device is:
A process of inputting the sender secret information g _A output from the sender device A ;
A process of outputting the receiver secret information σ _X , s _X (σ _X ) generated by the arithmetic device of the key manager side device ;
The communication device of the key manager side device is:
Processing for transmitting the receiver identification data s _X (σ _X , A) and the key distribution data y _Ai generated by the arithmetic unit of the key manager side device to the sender side device A via the communication line And
The transmitting side apparatus A has an arithmetic unit, a storage device, a communication device, and an input-output device,
The arithmetic unit of the sender side device A is:
As the sender secret information of the sender device A,

Generating and storing it in the storage device of its own device,
As sender public information of the sender side device A,

Generating and storing it in the storage device of its own device,
Generating integers r and r ′ and storing them in the storage device;
The key management side receiver receives from the device identification data s _{_X (σ _X,} A) and, from said sender secret information L _A and the integer r'stored in the storage device of the apparatus

Processing for calculating the receiver identification information r _X (σ _X , A) and storing it in the storage device of the device itself;
A key distribution data y _Ai received from the key management side apparatus, from said integer r stored in the storage device of its own device, key distribution information

To calculate and store it in the storage device of its own device.
The input / output device of the sender side device A is:
A process of outputting the sender secret information g _A generated by the arithmetic unit of the sender side device A ;
The communication device of the sender side device A is:
A process of receiving the receiver identification data s _X (σ _X , A) and the key distribution data y _Ai from the key manager side device via the communication line ;
A process of transmitting the receiver identification information r _X (σ _X , A) generated by the arithmetic unit of the sender apparatus A to the receiver apparatus x via the communication line;
A process of broadcasting the key distribution information z _Ai generated by the arithmetic unit of the sender device A to the plurality of receiver devices via the communication line;
The receiver device x includes an arithmetic device, a storage device, a communication device, and an input / output device.
The arithmetic unit of the receiver side device x is:
Wherein said receiver identification received from the transmitting side apparatus A information _{r _X (σ X,} A) and the key distribution information _{z Ai} and the recipient secret information received from the key management side apparatus sigma _X, _{s X} since the (σ _X),

Thus, the sender side device A