WO2010067797A1 - Communication apparatus, server apparatus and communication program - Google Patents
Communication apparatus, server apparatus and communication program Download PDFInfo
- Publication number
- WO2010067797A1 WO2010067797A1 PCT/JP2009/070545 JP2009070545W WO2010067797A1 WO 2010067797 A1 WO2010067797 A1 WO 2010067797A1 JP 2009070545 W JP2009070545 W JP 2009070545W WO 2010067797 A1 WO2010067797 A1 WO 2010067797A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- signature
- node
- piece
- electronic signature
- information
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/60—Digital content management, e.g. content distribution
Definitions
- the present invention relates to a communication device, a server device, and a communication program.
- a distribution method that distributes data using P2P does not require a data distribution server having a huge storage and a large communication band, and is a distribution method with a large cost advantage is there.
- P2P distribution since a node receiving data distribution is expected to supply data from a plurality of nodes, high-speed data acquisition utilizing the bandwidth in download and upload is expected.
- the P2P data distribution has a great merit, but on the other hand, there is anxiety in safety from the viewpoint of data security such as copyright protection.
- the following is assumed as a general premise in considering data security such as copyright protection as well as P2P distribution. All terminal devices or nodes are not hacked. If this premise is denied, the terminal device cannot hold data that should be kept secret or perform processing that should be kept secret, and most security techniques and devices for ensuring security cannot be established.
- P2P distribution there is a content distribution system that distributes encrypted data, and a node that receives the data distribution acquires a decryption key for decrypting the data (distributed data).
- a major problem in data security in P2P distribution of such a system is that the combination of distribution data and a decryption key for decrypting the distribution data is single or small in number. In this case, it is assumed that a certain node is hacked and the decryption key is exposed. In this case, this decryption key can be used to decrypt most distribution data.
- One method for solving this problem is to individualize distribution data for each node.
- a Marking method disclosed in Patent Document 1 is known.
- distribution data is divided into pieces, and encrypted with a key matrix to generate an encrypted piece.
- a piece group consisting of encrypted pieces encrypted in a matrix is generated.
- Such a piece group is distributed via a P2P network.
- One node connected to the P2P network acquires one encrypted piece from among a plurality of encrypted pieces encrypted in a matrix for each piece.
- it is expected that the combination of encrypted pieces obtained by encrypting each piece constituting the distribution data is statistically unique for each node.
- One method is to devise a method for distributing encrypted pieces.
- One is a method in which a key server holding a decryption key for decrypting each encrypted piece restricts delivery of the decryption key.
- a node obtains a decryption key by declaring a combination of encrypted pieces to a key server in order for a node to decrypt a distributed piece group.
- the present invention has been made in view of the above, and an object of the present invention is to provide a communication device, a server device, and a communication program that can specify a node that illegally falsifies a piece distributed in a content distribution system. .
- an embodiment of the present invention is a communication device in which second device identification information and a private key are pre-assigned and a piece that is a part of data is transmitted.
- Receiving means for receiving first signature object information including first device identification information for identifying another communication device and the piece, and a first electronic signature generated for the first signature object information
- Storage means for storing the second device identification information and the private key, second signature target information including the first signature target information, the first electronic signature, and the second device identification information
- a signature generating unit that generates a second electronic signature for the first signature using the private key, and a transmission unit that transmits the second signature target information and the second electronic signature.
- an embodiment of the present invention is a program that can be executed by the above-described apparatus.
- an embodiment of the present invention is a server device connected to a plurality of communication devices that transmit pieces that are part of data, the communication device including signature target information including the pieces, and the signature Generating a new electronic signature for new signature target information including an electronic signature generated by another communication device for the target information, transmitting the generated signature target information and the generated electronic signature, Receiving means for receiving a verification request for the electronic signature from the communication device, including the signature target information and the electronic signature generated for the signature target information; and the signature target information included in the verification request And verification means for verifying the electronic signature using a public key assigned to the communication device that generated the electronic signature included in the verification request, and the electronic signature not verified
- the communication device that generated the electronic signature for the name object information characterized in that it comprises a detection means for detecting as unauthorized communication device.
- the flowchart which shows the procedure of the delivery process which the node which is a delivery start node concerning the embodiment performs.
- the flowchart which shows the procedure of the reception process in which the node concerning the embodiment receives an encryption piece from a delivery start node or another node.
- the flowchart which shows the procedure of the delivery process which nodes other than the delivery start node concerning the embodiment perform.
- the flowchart which shows the procedure of the decoding process which the node concerning the embodiment acquires a decoding key from a key server, and decodes an encryption piece using this.
- 6 is a flowchart showing a procedure of key transmission processing in which the key server according to the embodiment transmits a decryption key in response to a key request from a node.
- the flowchart which shows the procedure of the piece verification process which the key server concerning the embodiment verifies a piece according to the piece verification request
- the figure which shows typically the information transmitted to the key server from the node concerning the embodiment.
- the flowchart which shows the procedure of the piece verification process which the key server concerning the embodiment verifies a piece according to the piece verification request
- FIG. 1 is a diagram showing a configuration of a data distribution system according to the present embodiment.
- a plurality of nodes 50, 51A to 51B are connected via a P2P network NT.
- other nodes can also be connected via the P2P network NT.
- Each node 50, 51A to 51B is connected to a key server 53.
- Each of the nodes 50, 51A to 51B is a non-key used for generating an electronic signature of a piece that is a pair of a public key certificate and public key described in the public key certificate as assignment information uniquely assigned to each node. It holds a public key and a secret key that is used to encrypt the piece.
- the public key certificate includes at least a node ID that is device identification information and a public key for verifying an electronic signature.
- Public key certificates are described in, for example, the document ISO / IEC 9594-8.
- the public key certificates assigned to the nodes 50, 51A to 51B are pkc_0, pkc_1, and pkc_2, the private keys are sk_0, sk_1, and sk_2, and the node IDs included in the public key certificates are ID # 0. , ID # 1, ID # 2, public keys included in the public key certificate are pk_0, pk_1, pk_2, and private keys are s_0, s_1, s_2, respectively.
- the node 50 is a distribution start node serving as a data distribution base, and holds data to be distributed (referred to as distribution data).
- the distribution data may be plaintext or already encrypted ciphertext.
- the distribution data may be video data protected by some DRM (Digital Right Management) System as encryption.
- the key server 53 holds a node ID assigned to each of the nodes 50 and 51A to 51B and a secret key.
- the key server 53 may hold public key certificates assigned to the nodes 50 and 51A to 51B.
- a node 51 when it is not necessary to distinguish each of the nodes 51A to 51B, they are simply referred to as a node 51.
- Each device is a control device such as a CPU (Central Processing Unit) that controls the entire device, a storage device such as a ROM (Read Only Memory) or a RAM (Random Access Memory) that stores various data and various programs, and various types It has an external storage device such as an HDD (Hard Disk Drive) or CD (Compact Disk) drive device that stores data and various programs, and a bus that connects them, and has a hardware configuration that uses a normal computer.
- Each device includes a display device that displays information, an input device such as a keyboard and a mouse that accepts user instruction input, and a communication I / F (interface) that controls communication with an external device. Connected by.
- the device identification information is information assigned to each node in the data distribution system and may be any information as long as each node can be identified. For example, the node ID, the MAC (Media Access of the communication device) Control) address, serial number unique to the CPU of the communication device, and the like.
- the digital signature may be any signature information attached to the digital document in order to guarantee the validity of the digital document.
- an RSA signature DSA (Digital Signature—Algorithm), ElGamal signature, Schnorr signature, Cramer ⁇
- This is signature information generated by an algorithm such as a Shop signature, ECDSA (Elliptic Curve DSA), elliptic ElGamal signature, or elliptic Schnorr signature.
- FIG. 2 is a diagram illustrating a functional configuration of the node 50.
- the node 50 includes a unique information storage unit 500, a random number generation unit 501, a temporary symmetric key generation unit 502, a piece encryption unit 503, a piece generation unit 504, a data transmission unit 505, and a transmission request reception unit 506. And an electronic signature generation unit 507.
- the unique information storage unit 500 is reserved as a storage area in an external storage device such as an HDD of the node 50, for example.
- the entities of the random number generation unit 501, the temporary symmetric key generation unit 502, the piece encryption unit 503, the piece generation unit 504, the data transmission unit 505, the transmission request reception unit 506, and the electronic signature generation unit 507 are: It is generated on a storage device such as a RAM when the CPU program of the node 50 is executed. Note that distribution data is stored in advance in the external storage device of the node 50.
- the unique information storage unit 500 stores a public key certificate, a private key, and a secret key assigned to the node 50.
- the public key certificate includes at least the node ID assigned to the node 51 and the public key.
- the piece unit 504 divides the distribution data into a plurality of pieces. The data size at the time of division is not particularly limited, but is assumed to be predetermined.
- the transmission request receiving unit 506 receives a piece request for requesting the piece divided by the piece forming unit 504 from the other node 51.
- the random number generation unit 501 When the transmission request reception unit 506 receives a piece request, the random number generation unit 501 generates a random number that is temporary information that can be different for each occurrence. Temporary information is a disposable value that needs to be different every time it is generated at a node. In addition to a random number, for example, a time stamp, a communication sequence number, a counter value specific to a node, or Time Variant Parameter It is.
- the function F is a one-way function, a symmetric key encryption, or a pseudo-random number generator, which does not know both the secret key and the random number that are the input values, and cannot guess the temporary symmetric key that is the output value. .
- the temporary symmetric key is an output value of the function F, and it is sufficient that the relationship between the input and output value of the function F is uniquely determined.
- the function F may be a hash function such as SHA-1 or SHA256, a common key cryptosystem such as AES or Hiercrypt, or a pseudo-random number generator such as Mersenne twister. A value obtained by combining a random number and a secret key may be input to the hash function.
- a random number may be encrypted with a secret key, a secret key may be encrypted with a random number, a random number may be decrypted with a secret key, or a secret key may be decrypted with a random number.
- a value obtained by combining a random number and a secret key may be input to the pseudo-random number generator.
- the piece encryption unit 503 encrypts the piece P using the temporary symmetric key k_0 generated by the temporary symmetric key generation unit 502, and outputs an encrypted piece E (k_0) P.
- the temporary symmetric key is also an encryption key used for encryption, and is also a decryption key for decrypting the encryption performed on the encrypted piece.
- the electronic signature generation unit 507 generates an electronic signature sig_0 for the encrypted piece E (k_0) P, the public key certificate pkc_0, and the random number r_0 by the function SIGN using the private key sk_0.
- the generation of the electronic signature is expressed by the following equation (2).
- sig_0 SIGN (sk_0, E (k_0) P
- means data combination.
- the above equation (2) shows an example of the combination order of signature generation target data. If the signature verification target has a mechanism that can grasp the combination order of the signature generation target data, the combination order is It may be any way.
- a signature generation algorithm in an electronic signature scheme such as RSA signature, DSA (Digital Signature Algorithm), ElGamal signature, Schnorr signature, Cramer-Shoep signature, ECDSA (Elliptic Curve Curve DSA), elliptic ElGamal signature, elliptical Schnorr signature is used. May be.
- the data transmission unit 505 transmits the public key certificate stored in the unique information storage unit 500, the random number generated by the random number generation unit 501, and the piece encryption unit 503 to the other node 51 that transmitted the piece request. And the electronic signature generated by the electronic signature generation unit 507 are transmitted.
- FIG. 3 is a diagram illustrating a functional configuration of the node 51.
- the node 51 includes a unique information storage unit 510, a random number generation unit 511, a temporary symmetric key generation unit 512, a piece encryption unit 513, a data reception unit 514, a data transmission unit 515, and a transmission request reception unit 516.
- the unique information storage unit 510 and the data storage unit 517 are reserved as storage areas in an external storage device such as an HDD of the node 51, for example.
- the entity of the unit 519, the piece decryption unit 520, the digital signature generation unit 521, the digital signature verification unit 522, and the piece verification request transmission unit 523 is stored in a storage device such as a RAM when the CPU program of the node 51 is executed. Is generated.
- the unique information storage unit 510 stores a public key certificate, a private key, and a secret key assigned to the node 51.
- the public key certificate includes at least the node ID assigned to the node 51 and the public key.
- the configuration of the transmission request receiving unit 516 is the same as the configuration of the transmission request receiving unit 506 included in the node 50 described above.
- the transmission request transmission unit 518 transmits a piece request for requesting a piece to the node 50 or another node 51.
- the data reception unit 514 transmits at least the encrypted piece in which the piece is encrypted and the transmission of the encrypted piece from the node 50 or another node 51 to which the transmission request transmission unit 518 has transmitted the piece request.
- a public key certificate sequence including each public key certificate assigned to one other node 50, 51, a random number sequence including each random number generated by the other node 50, 51, and the other node 50, 51 51 receives the electronic signature sequence including the electronic signatures generated by 51.
- the electronic signature verification unit 522 receives the encrypted piece E (k_i-1)... E (k_0) P, the public key certificate sequence pkc_0,..., Pkc_i-1 and the random number sequence r_0,. -1 and the digital signature sequence sig_0,..., Sig_i-1 are expressed by the following formula (3) using the public key pk_i-1 included in the data sender's public key certificate.
- the electronic signature generated by the data sender is verified by the function VERIFY.
- E (k_i-1)... E (k_0) P, pkc_i-1, r_i-1, sig_i-1, and pk_i-1 each deliver the i-th encrypted piece on the delivery path. Included in the encrypted piece calculated by the intermediary node 51, the public key certificate of the node 51, the random number generated by the node 51, the electronic signature generated by the node 51, and the public key certificate of the node 51 Means public key.
- Verification success / failure VERIFY (pk_i-1, E (k_i-1) ... E (k_0) P
- Verification success / failure VERIFY (pk_0, E (k_0) P
- the signature verification algorithm that is paired with the function SIGN used when generating the signature is used.
- SIGN an RSA signature verification algorithm
- VERIFY an RSA signature verification algorithm
- the data storage unit 517 stores the public key certificate sequence, random number sequence, electronic signature sequence, and encrypted piece received by the data reception unit 514 in association with each other. If the verification fails, the data reception unit 514 discards the public key certificate sequence, random number sequence, digital signature sequence, and encrypted piece received.
- the random number generation unit 511 When the transmission request reception unit 516 receives a piece request from another node 51, the random number generation unit 511 generates a random number.
- the temporary symmetric key generation unit 512 generates a temporary symmetric key by the function F described above using the random number generated by the random number generation unit 511 and the secret key stored in the unique information storage unit 510.
- the piece encryption unit 513 further encrypts one encrypted piece stored in the data storage unit 517 using the temporary symmetric key generated by the temporary symmetric key generation unit 512, and outputs a new encrypted piece To do.
- the electronic signature generation unit 521 uses a private key stored in the unique information storage unit 510 to create a new encrypted piece output from the piece encryption unit 513 and a data storage unit associated with the encrypted piece.
- a new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 and the data storage unit 517 in association with the encrypted piece A new random number sequence including the random number generated by the random number generation unit 511 in addition to the stored random number sequence, and a new digital signature sequence associated with the encrypted piece and stored in the data storage unit 517 Generate an electronic signature.
- the data transmission unit 515 transmits the following data to the other node 51 that has transmitted the piece request received by the transmission request reception unit 516. That is, a new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 in addition to the public key certificate sequence stored in the data storage unit 517 in association with the encrypted piece to be transmitted A new random number sequence including the random number generated by the random number generation unit 511 in addition to the random number sequence stored in the data storage unit 517 in association with the encrypted piece, and the new encryption output from the piece encryption unit 513 And a new electronic signature sequence including the electronic signature generated by the electronic signature generation unit 521 in addition to the electronic signature sequence stored in the data storage unit 517 in association with the encrypted piece.
- the encrypted piece is not stored in the data storage unit 517, even if the transmission request receiving unit 516 receives the piece request, the piece encryption unit 513 does not output the encrypted piece, and the data transmission unit 515 does not send the encrypted piece.
- the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence transmitted from the nodes 50 and 51 will be specifically described.
- the public key certificate, the random number, and the electronic signature that are transmitted together with the encrypted piece from the node 50 are one each.
- these are the public key certificate string, the random number, and the like. May be described as a column and a digital signature column.
- the encrypted piece is transmitted from the node 50 to the node 51A
- the encrypted piece is transmitted from the node 51A to the node 51B
- the key request is transmitted from the node 51B to the key server 53.
- the node 50 in response to a piece request from the node 51A for a piece P, the node 50 generates a temporary symmetric key k_0 using a random number r_0 and a secret key s_0, and encrypts the piece P using this to encrypt the piece P Assume that piece E (k_0) P is output. Further, it is assumed that the node 50 generates an electronic signature sig_0 for information (signature target information) including the random number r_0, the encrypted piece E (k_0) P, and the public key certificate pkc_0 using the private key sk_0.
- the signature target information refers to information that is a target for generating an electronic signature.
- the random number r_0 generated by the node 50, the encrypted piece E (k_0) P encrypted by the node 50, and the public key certificate pkc_0 of the node 50 are used as signature target information. included.
- the public key certificate sequence pkc_0,..., Pkc_i, the random number sequence r_0,. (K_i)... E (k_0) P and electronic signature strings sig_0,..., Sig_i-1 are included in the signature target information.
- FIG. 4 is a diagram schematically illustrating information transmitted from the node 50 to the node 51A.
- the node 51A uses the public key pk_0 included in the public key certificate pkc_0 to determine whether the electronic signature sig_0 is a valid signature for the encrypted piece E (k_0) P, the public key certificate pkc_0, and the random number r_0.
- the signature verification unit 522 confirms this.
- the node 51A associates the public key certificate pkc_0, the random number r_0, the encrypted piece E (k_0) P, and the electronic signature sig_0 with each other in the data storage unit 517. I will remember it.
- the data storage unit 517 holds a correspondence relationship between the public key certificate, the random number generated by the node to which the public key certificate is assigned, and the electronic signature generated by the node to which the public key certificate is assigned.
- Each public key certificate sequence, each random number sequence, and each electronic signature sequence are stored in the state.
- the node 51A discards the public key certificate pkc_0, the random number r_0, the encrypted piece E (k_0) P, and the electronic signature sig_0.
- the node 51A When the node 51A transmits an encrypted piece for the piece P in response to the piece request from the node 51B, the node 51A generates a random number r_1, generates a temporary symmetric key k_1 using this and the secret key s_1, Assume that the encrypted piece E (k_0) P is further encrypted using this and the encrypted piece E (k_1) E (k_0) P is output. E (k_1) E (k_0) P indicates the multiple encrypted pieces P with the temporary symmetric keys k_0 and k_1 in this order.
- the node 51A obtains the electronic signature sig_1 for the signature target information including the public key certificate sequence pkc_0, pkc_1, the random number sequence r_0, r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic signature sig_0. It is assumed that it is generated using the public key sk_1.
- the node 51A assigns itself to the node 51B, which is stored in the unique information storage unit 510 in addition to the public key certificate pkc_0 stored in the data storage unit 517 and assigned to the node 50.
- FIG. 5 is a diagram schematically showing information transmitted from the node 51A to the node 51B.
- the node 51B determines whether the electronic signature sig_1 is a valid signature for the encrypted piece E (k_1) (k_0) P, the public key certificate sequence pkc_0, pkc_1, the random number sequence r_0, r_1, and the electronic signature sig_0.
- the electronic signature verification unit 522 confirms the public key pk_1 included in the document pkc_1. If the result of the electronic signature verification is successful, these public key certificate sequences pkc_0 and pkc_1, random number sequences r_0 and r_1, encrypted pieces E (k_1) E (k_0) P and electronic signature sequences sig_0 and sig_1 The data is stored in the data storage unit 517 in association with each other.
- the node ID is extracted from the received public key certificate and the node ID is transmitted instead of the public key certificate.
- the node 51A stores the unique information in addition to the node ID “ID # 0” included in the public key certificate pkc_0 assigned to the node 50 and stored in the data storage unit 517 with respect to the node 51B.
- FIG. 6 is a diagram schematically illustrating information transmitted from the node 51 ⁇ / b> A to the node 51 ⁇ / b> B when the public key certificates of all nodes are stored in the key server 53.
- the node 51B determines whether the electronic signature sig_1 is a valid signature for the encrypted piece E (k_1) (k_0) P, the node ID string “ID # 0”, the public key certificate pkc_1, the random number strings r_0 and r_1, and the electronic signature sig_0.
- the electronic signature verification unit 522 confirms whether or not using the public key pk_1 included in the public key certificate pkc_1.
- the node ID string “ID # 0”, the public key certificate pkc_1, the random number string r_0, r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic Signature sequences sig_0 and sig_1 are associated with each other and stored in the data storage unit 517.
- the key request transmission unit 519 transmits a key request for requesting a decryption key for decrypting the encrypted piece stored in the data storage unit 517 to the key server 53.
- the key request transmission unit 519 includes the node ID sequence and the random number sequence extracted from the public key certificate sequence stored in the data storage unit 517 corresponding to the encrypted piece, in the key request.
- Send to For example, a key request for requesting a decryption key for decrypting the encrypted piece E (k_1) E (k_0) P shown in FIG. 6 that is output when the node 51B performs encryption is the key.
- FIG. 7 is a diagram schematically showing information transmitted from the node 51B to the key server 53.
- the node 51 when the node 51 requests the key server 53 for a decryption key for decrypting the encrypted piece, the node 51 indicates the distribution path of the encrypted piece, with the node 50 that is the distribution start node as a base point.
- the node ID string including the node IDs of the nodes 50 and 51 that mediate the distribution of the encrypted pieces and the random number string including the random numbers generated by the nodes 50 and 51 are transmitted to the key server 53.
- the key request transmission unit 519 performs transmission while maintaining the correspondence between each node ID and the random number generated by the node to which each node ID is assigned.
- the piece decryption unit 520 receives the temporary symmetric key sequence transmitted from the key server 53 in response to the key request transmitted from the key request transmission unit 519 as a decryption key, and decrypts the encrypted piece using the temporary symmetric key sequence.
- the node 51B transmits the temporary request transmitted from the key server 53 in response to the key request including the node ID string and the random number string illustrated in FIG. Symmetric key sequences k_0 and k_1 are received. That is, each decryption key for decrypting each encryption performed at least once on the piece is received.
- FIG. 8 is a diagram schematically showing information transmitted from the key server 53 to the node 51B.
- Piece P is decrypted with the temporary symmetric key string shown in FIG. Note that how the key server 53 generates the temporary symmetric key string will be described later.
- the node 51 encrypts each of the plurality of pieces.
- Each encrypted piece is acquired from the other nodes 50 and 51 by a piece request. Further, the node 51 receives each temporary symmetric key from the key server 53 by a key request for each encrypted piece, and obtains the distribution data described above by decrypting each encrypted piece.
- the piece verification request transmission unit 523 When there is a piece that cannot be correctly decrypted using the received decryption key, or the piece verification request transmission unit 523 has received a piece to determine whether the encrypted piece can be correctly decrypted before receiving the decryption key. In this case, a piece verification request is transmitted to the key server 53. If there is a piece that could not be correctly decrypted, a method of verifying the piece with a hash value as shown in FIG. 9 can be used. An example of a method for checking whether or not a piece has been correctly decoded will be described with reference to FIG.
- the piece verification request transmission unit 523 transmits a verification request for requesting verification of the encrypted piece stored in the data storage unit 517 to the key server 53.
- the piece verification request transmission unit 523 uses the public key certificate sequence, the random number sequence, and the electronic signature sequence stored in the data storage unit 517 corresponding to the encrypted piece together with the verification target encrypted piece as a piece verification request. To the key server 53.
- the node 51B transmits a verification request for verifying the encrypted piece E (k_1) E (k_0) P shown in FIG. 5 output when the node 51A performs encryption to the key server 53.
- the piece verification request transmission unit 523 of the node 51B the public key certificate strings pkc_0 and pkc_1, the random number strings r_0 and r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic signature strings sig_0 and sig_1
- a piece verification request including FIG. 10 is a diagram schematically showing information transmitted from the node 51B to the key server 53. As shown in FIG.
- the node 51 when the node 51 requests the key server 53 for a verification request for verifying the encrypted piece, the node 51 indicates the distribution route of the encrypted piece, and the node 50 that is the distribution start node is the base point.
- the electronic signature sequence including each electronic signature generated by the is transmitted to the key server 53.
- the piece verification request transmission unit 523 generates each public key certificate, a random number generated by the node to which the public key certificate is assigned, and a node to which the public key certificate is assigned. Is transmitted in a state where the correspondence with the electronic signature is maintained.
- the piece verification request transmission unit 523 When the public key certificates of all nodes are stored in the key server 53, the piece verification request transmission unit 523 performs verification for requesting verification of the encrypted pieces stored in the data storage unit 517. The request is transmitted to the key server 53. At this time, the piece verification request transmission unit 523 includes the node ID sequence, random number sequence, and electronic signature sequence stored in the data storage unit 517 corresponding to the encrypted piece in the piece verification request and transmits them to the key server 53. . For example, the node 51B transmits a verification request for verifying the encrypted piece E (k_1) E (k_0) P shown in FIG. 6 output when the node 51A performs encryption to the key server 53.
- the piece verification request transmission unit 523 of the node 51B extracts the node ID “ID # 1” from the public key certificate pkc_1, and then the node ID string “ID # 0, ID # 1” and the random number sequence r_0, r_1. And a piece verification request including the encrypted piece E (k_1) E (k_0) P and the electronic signature strings sig_0 and sig_1.
- FIG. 11 is a diagram schematically showing information transmitted from the node 51B to the key server 53 when the public key certificates of all the nodes are stored in the key server 53.
- the node 51 requests the key server 53 for a verification request for verifying the encrypted piece
- the node 51 indicates the distribution route of the encrypted piece
- the node 50 that is the distribution start node is the base point.
- Each node ID string of each node 50, 51 that mediates the distribution of the encrypted piece, a random number sequence including each random number generated by each node 50, 51, and each electronic signature generated by each node 50, 51 is included.
- the electronic signature sequence is transmitted to the key server 53.
- the piece verification request transmission unit 523 associates each node ID with a random number generated by the node to which the node ID is assigned and an electronic signature generated by the node to which the node ID is assigned. Send in the state of holding.
- the data reception unit 514 receives the piece verification result transmitted from the key server 53 in response to the piece verification request transmitted by the piece verification request transmission unit 523, and responds when the verification result is a verification failure. Discard the encrypted piece and try to obtain the encrypted piece from another node 51 again.
- FIG. 12 is a diagram illustrating a functional configuration of the key server 53.
- the key server 53 includes a secret key storage unit 530, a data reception unit 531, a public key certificate storage unit 532, a temporary symmetric key generation unit 533, a data transmission unit 534, an electronic signature verification unit 535, and a piece verification.
- the request receiving unit 536, the piece decoding unit 537, and the unauthorized node list storage unit 538 are included.
- the private key storage unit 530, the public key certificate storage unit 532, and the unauthorized node list storage unit 538 are secured as storage areas in an external storage device such as an HDD of the key server 53, for example.
- the entity of the data receiving unit 531, the temporary symmetric key generation unit 533, the data transmission unit 534, the electronic signature verification unit 535, the piece verification request reception unit 536, and the piece decryption unit 537 is the CPU of the key server 53. It is generated on a storage device such as a RAM when the program is executed.
- the private key storage unit 530 stores the private key assigned to each of the nodes 50 and 51 in association with the public key certificate assigned to each of the nodes 50 and 51 or the node ID included in the public key certificate.
- the data receiving unit 531 receives a key request including the above-described node ID sequence and random number sequence from the node 51.
- the public key certificate storage unit 532 is provided when the key server 53 is configured to store the public key certificates of all nodes. In the case where the node ID is provided without storing the public key certificate, the key server 53 does not need to include the public key certificate storage unit 532.
- the public key certificate storage unit 532 stores public key certificates assigned to the nodes 50 and 51. If the public key certificates of all the nodes are stored in the public key certificate storage unit 532, the data transfer amount between the nodes and the data transfer amount in a piece verification request to be described later can be reduced.
- the temporary symmetric key generation unit 533 is associated with each node ID included in the key request received by the data reception unit 531 and is stored in the secret key storage unit 530 in the secret key s_i (0 ⁇ i ⁇ j ⁇ 1: j is the number of times the piece is encrypted, and so on, and the decryption key is obtained by function F using each secret key and each random number r_i (0 ⁇ i ⁇ j-1) included in the random number sequence included in the key request. Generate k_i. This can be expressed by the following equation (5).
- the function F is the same as that used when the node 50 or the node 51 generates a temporary symmetric key. Accordingly, here, the temporary symmetric key is restored by the function F using the random number and the secret key.
- k_i F (s_i, r_i) (5)
- the data transmission unit 534 transmits the temporary symmetric key generated by the temporary symmetric key generation unit 533 as the decryption key to the node 51 that has transmitted the key request received by the data reception unit 531.
- the key server 53 is as shown in FIG. 8 in response to the key request including the node ID string and the random number string shown in FIG.
- temporary symmetric keys k_0 and k_1 are obtained for the random numbers r_0 and r_1, and transmitted to the node 51B.
- Each symmetric key for decrypting each encryption performed on the piece is transmitted to the node 51B, so that the node 51B can completely decrypt the encryption of the encrypted piece. .
- the piece verification request reception unit 536 receives from the node 51 a piece verification request including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence.
- the temporary symmetric key generation unit 533 generates the decryption keys k_0 and k_1 by the same process as when the key request is received.
- the electronic signature verification unit 535 performs verification of the electronic signature sequences sig_0 and sig_1 using the public keys pk_0 and pk_1 included in the public key certificate sequence, and the piece decryption unit 537 stores E (k_1) (k_0) P. Perform decryption.
- the node ID of the node 51 that has transmitted the piece verification request received by the piece verification request receiving unit 536 is added to the illegal node list stored in the illegal node list storage unit 538.
- the data transmission unit 534 transmits “verification failure” to the node 51. If the above verification is successful, the encrypted piece is decrypted using the temporary symmetric key k_1, and the encrypted piece E (k_0) P, the public key certificate string pkc_0, and the random number string r_0 using the public key pk_0.
- the node ID included in the public key certificate pkc_1 is added to the unauthorized node list stored in the unauthorized node list storage unit 538, and the data transmitting unit 534 “Verification failure” is transmitted to the node 51. If the verification is successful, the data transmission unit 534 transmits “verification successful” to the node 51.
- the piece verification request receiving unit 536 receives the verification request shown in FIG.
- the verification request includes a node ID string
- the key server 53 selects the public key certificate pkc_i (0) corresponding to the node ID from among the public key certificates recorded in the public key certificate storage unit. ⁇ i ⁇ j-1) is taken out.
- the subsequent piece verification process is the same as when the verification request shown in FIG. 10 is received.
- step S1 the procedure of the distribution process performed by the node 50 that is the distribution start node will be described with reference to FIG.
- the node 50 divides the distribution data into a plurality of pieces (step S1).
- step S2 the procedure of the distribution process performed by the node 50 that is the distribution start node will be described with reference to FIG.
- the node 50 divides the distribution data into a plurality of pieces (step S1).
- step S2 receives a piece request for requesting a piece from another node 51
- step S3 the node 50 generates a random number r_0 (step S3).
- step S4 the temporary symmetric key k_0 by the function F using the random number r_0 and the secret key s_0 stored in the unique information storage unit 500.
- the node 50 encrypts the piece P to be transmitted using the temporary symmetric key generated in step S4, and outputs the encrypted piece E (k_0) P (step S5).
- how to determine the piece to be transmitted is not particularly limited.
- the node 50 uses the private key sk_0 stored in the unique information storage unit 500, the encrypted piece E (k_0) P generated in step S5, the public key certificate pkc_0 of the node 50 itself, and step S3.
- the electronic signature sig_0 for the signature target information including the random number r_0 generated in step S6 is generated (step S6).
- the node 50 transmits the public key certificate pkc_0 stored in the unique information storage unit 500 to the other node 51 that has transmitted the piece request received in step S2, as shown in FIG.
- the random number r_0 generated in step S3, the encrypted piece E (k_0) P output in step S5, and the electronic signature sig_0 generated in step S6 are transmitted (step S7). Thereafter, the process returns to step S2, and the node 50 waits for reception of a new piece request.
- the piece requests received in step S2 are not necessarily the same node 51, and the pieces P requested by the piece requests are not necessarily the same piece. Further, the random number generated in step S3 basically differs for each process in step S3.
- Step S10 a reception process procedure in which the node 51 receives an encrypted piece from the node 50 or another node 51 will be described with reference to FIG.
- the node 51 transmits a piece request for requesting a piece to the node 50 or another node 51 (step S10).
- the node 51 receives the public key certificate string, the random number string, the encrypted piece, and the electronic signature string from the node 50 or another node 51 that is the partner who transmitted the piece request in step S10 ( Step S11).
- Step S12 the electronic signature generated by the node 50 or the other node 51 which is the transmission partner is verified.
- step S12 If the verification in step S12 is successful (step S13: YES), the node 51 stores the public key certificate string, random number string, encrypted piece, and electronic signature string received in step S11 in association with each other (step S14). On the other hand, if the verification in step 12 fails (step S13: NO), the node 51 discards the public key certificate sequence, random number sequence, encrypted piece, and electronic signature sequence received in step S11 (step S15).
- the node 51 transmits a piece request to the node 50, the public key certificate string, the random number string, the encrypted piece, and the electronic signature string shown in FIG.
- a node connected to the P2P network NT where f is an integer equal to or greater than 1
- the node ID of the node is ID # f.
- the node to which the node ID “ID # f” is assigned is about the piece P as shown in FIG. 15 from the node to which the (f -1) th node ID “ID # (f-1)” is assigned.
- the node IDs “ID # 0,..., ID # (f-1)” included in the public key certificate string respectively specify which node the encrypted piece was encrypted and transmitted. Therefore, the distribution route of the encrypted piece is shown.
- the node 51 further encrypts an encrypted piece that is an encrypted piece obtained by encrypting a piece P and is stored in the data storage unit 517, and newly An encrypted piece is output (step S23). Then, using the private key stored in the unique information storage unit 510, the function SIGN generates an electronic signature for the signature target information including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence ( Step S24). Thereafter, the node 51 adds the public key certificate stored in the data storage unit 517 in association with the encrypted piece to be transmitted to the other node 51 that has transmitted the piece request received in step S20.
- step S21 In addition to the new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 and the random number sequence stored in the data storage unit 517 in association with the encrypted piece, it is generated in step S21. In addition to the new random number sequence including the random number, the new encrypted piece output in step S23, and the electronic signature sequence stored in the data storage unit 517 in association with the encrypted piece, the electronic signature generated in step S24 And an electronic signature sequence including the message (step S25).
- Step S30 a procedure of a decryption process in which the node 51 acquires a decryption key from the key server 53 and decrypts the encrypted piece using the decryption key
- the node 51 reads the public key certificate sequence and the random number sequence associated with the encrypted piece stored in the data storage unit 517 (step S30), and node ID based on the node ID included in the public key certificate A column is acquired (step S31).
- a decryption key for decrypting the encrypted piece is requested, and a key request including the node ID sequence acquired in step S31 and the random number sequence read from the data storage unit 517 is transmitted to the key server 53 (step S32).
- the node 51 receives the temporary symmetric key transmitted from the key server 53 in response to the key request transmitted in step S32 as a decryption key (step S33), and decrypts the encrypted piece using the temporary symmetric key. (Step S34).
- the node to which the above-described node ID “IDf # f” is assigned with respect to the key server 53, as shown in FIG. 18, the node ID string “ID # 0,. # (F-1) "and a random number sequence r_0, ..., r_ ⁇ f-1 ⁇ . Then, the node receives the temporary symmetric keys k_0,..., K_ ⁇ f-1 ⁇ for the piece P from the key server 53 as shown in FIG. (K_ ⁇ f-1 ⁇ )... E (k_0) P is decoded to obtain piece P. In this way, each node 51 can obtain all the temporary symmetric keys for decrypting the encryption performed for each piece, and thereby can decrypt the encryption performed for the piece.
- each node 51 receives each temporary symmetric key from the key server 53 by a key request for each encrypted piece in which each of the plurality of pieces is encrypted, and decrypts each encrypted piece,
- the above distribution data can be obtained.
- Step S40 a procedure in which the node 51 transmits a piece verification request to the key server 53 and receives a piece verification result
- the node 51 reads out the encrypted piece stored in the data storage unit 517, the public key certificate sequence, the random number sequence, and the electronic signature sequence associated with the encrypted piece (step S40), and the encrypted piece and the publicized information are disclosed.
- a piece verification request including a key certificate string, a random number string, and an electronic signature string is transmitted to the key server 53 (step S41).
- step S42 receives the piece verification result transmitted from the key server 53 in response to the piece verification request transmitted in step S41 (step S42), and ends the process if the verification result is successful (step S42).
- Step S43 YES).
- the verification result is unsuccessful (step S43: NO)
- the encrypted piece, the public key certificate sequence, the random number sequence, and the electronic signature sequence associated with the encrypted piece are discarded ( Step S44).
- ⁇ Key server Key transmission processing>
- a procedure of key transmission processing in which the key server 53 transmits a decryption key in response to a key request from the node 51 will be described with reference to FIG.
- the key server 53 is requested to receive a decryption key for decrypting the encrypted piece and receives a key request including a node ID string and a random number string from the node 51 (step S50: YES)
- the key server 53 is included in the received key request.
- the secret key stored in the secret key storage unit 530 in association with each node ID included in the node ID string to be read is read for each node ID (step S51).
- the key server 53 generates a temporary symmetric key as a decryption key by the function F for each node ID using the random numbers for all the node IDs and the secret key read in step S51 (step S52).
- the key server 53 transmits the temporary symmetric key generated as the decryption key in step S52 to the node 51 that transmitted the key request received in step S50 (step S53).
- the key server 53 responds to a key request including a node ID string and a random number string as shown in FIG. 18 for the piece P with respect to the node assigned the node ID “ID #f” described above.
- Temporary symmetric keys k_0,..., K_ ⁇ f ⁇ 1 ⁇ as shown in FIG. 19 are transmitted.
- ⁇ Key server: piece verification process> a procedure of piece verification processing in which the key server 53 verifies a piece in response to a piece verification request from the node 51 and transmits a verification result will be described with reference to FIG.
- the key server 53 is requested to verify the piece and receives a piece verification request including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence from the node 51 (step S600: YES)
- the reception is received.
- the private key stored in the private key storage unit 530 in association with each node ID included in the public key certificate string included in the piece verification request is read for each node ID (step S601).
- the key server 53 uses the random numbers for all the node IDs and the secret key read in step S601 to decrypt the temporary symmetric keys k_0,..., K_ ⁇ f-1 ⁇ by the function F for each node ID.
- f is the number of encryption times of the encrypted piece included in the piece verification request, that is, the number of times the encrypted piece is transferred.
- f can be obtained as the number of data included in each data string such as a public key certificate string, a random number string, and an electronic signature string.
- the key server 53 includes the public key certificate sequence pkc_0,..., Pkc_i, the random number sequence r_0,..., R_i, and the encrypted piece E (k_i) ... E (k_0) P included in the piece verification request.
- the electronic signature sequence sig_0,..., Sig_ ⁇ i-1 ⁇ the function VERIFY is used to determine whether the electronic signature sig_i is a valid signature using the public key pk_i included in the public key certificate pkc_i. (Step S604).
- the verification result in step S604 is a verification success (step S605: YES)
- E (k_0) P is used as the temporary symmetric key k_i.
- the encrypted piece E (k_ ⁇ i-1 ⁇ )... E (k_0) P is obtained (step S606).
- step S609 whether or not the electronic signature sig_0 is a valid signature is verified by the function VERIFY using the public key pk_0 included in the public key certificate pkc_0 (step S609).
- step S609 When the verification result in step S609 is a verification success (step S610: YES), the key server 53 transmits a verification success to the node 51 that has transmitted the piece verification request received in step S600 (step S612).
- step S604 When the verification result of step S604 is a verification failure (step S605: NO) and when the verification result of step S609 is a verification failure (step S610: NO), the key server 53 stores the unauthorized node list storage unit.
- the key server 53 stores the public key certificates of all the nodes in the public key certificate storage unit 532, and the node ID string is included in the piece verification request as shown in FIG.
- the processing in this case will be described with reference to FIG.
- the key server 53 is requested to verify the piece and receives a piece verification request including the node ID string, the random number string, the encrypted piece, and the digital signature string from the node 51 (step S700: YES)
- the received piece The secret key associated with each node ID included in the node ID string included in the verification request and stored in the secret key storage unit 530 is read for each node ID, and the node ID string included in the received piece verification request is read.
- the public key certificate associated with each included node ID and stored in the public key certificate storage unit 532 is read for each node ID (step S701).
- the key server 53 uses the random numbers for all the node IDs and the secret key read in step S701 to decrypt the temporary symmetric keys k_0,..., K_ ⁇ f-1 ⁇ by the function F for each node ID.
- f is the number of encryption times of the encrypted piece included in the piece verification request, that is, the number of times the encrypted piece is transferred.
- the key server 53 reads the public key certificate sequence pkc_0,..., Pkc_i read in step S701, the random number sequence r_0,..., R_i included in the piece verification request, and the encrypted piece E (k_i). ..
- the public key included in the public key certificate pkc_i indicates whether or not the electronic signature sig_i is a valid signature for E (k_0) P and the electronic signature sequence sig_0, ..., sig_ ⁇ i-1 ⁇ Verification is performed by the function VERIFY using pk_i (step S704).
- step S704 When the verification result in step S704 is a verification success (step S705: YES), the encrypted piece E (k_i) E (k_ ⁇ i-1 ⁇ )... E (k_0) P is used as the temporary symmetric key k_i. The encrypted piece E (k_ ⁇ i-1 ⁇ )... E (k_0) P is obtained (step S706).
- step S709 whether or not the electronic signature sig_0 is a valid signature is verified by the function VERIFY using the public key pk_0 included in the public key certificate pkc_0 (step S709).
- the verification result in step S709 is a verification success (step S710: YES)
- the key server 53 transmits a verification success to the node 51 that has transmitted the piece verification request received in step S700 (step S712).
- step S704 is a verification failure
- step S710: NO when the verification result of step S709 is a verification failure
- the unauthorized node list may be distributed from the key server 53 to each of the nodes 50 and 51 regularly or irregularly. Further, each node 50, 51 may request the key server 53 periodically or irregularly to obtain an unauthorized node list. Each of the nodes 50 and 51 may partially limit transmission / reception of the encrypted piece based on the obtained information of the illegal node list. For example, when a node 51 having an unauthorized node list receives a piece request from another node, the piece request may be rejected if the node ID of the other node is described in the unauthorized node list. . Further, when the node 51 having the illegal node list makes a piece request to another node, if the node ID of the other node is described in the illegal node list, the piece request is issued to the other node. You may decide not to do.
- the key server verifies the encrypted piece using the electronic signature generated each time the encrypted piece is transferred. This makes it possible to identify the unauthorized node.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Storage Device Security (AREA)
Abstract
A communication apparatus comprises: a data receiving unit (514) that receives first signature subject information, which includes both first apparatus identifying information for identifying another communication apparatus and a "piece", and that also receives a first electronic signature generated for the first signature subject information; a unique information storing unit (510) that stores second apparatus identifying information for identifying the communication apparatus and that also stores a non-public key assigned to the communication apparatus; an electronic signature generating unit (521) that uses the non-public key to generate a second electronic signature for second signature subject information including the first signature subject information, first electronic signature and second apparatus identifying information; and a data transmitting unit (515) that transmits the second signature subject information and second electronic signature.
Description
本発明は、通信装置、サーバ装置及び通信プログラムに関する。
The present invention relates to a communication device, a server device, and a communication program.
例えば、P2P(peer to peer)を利用してデータを配信する配信方式(P2P配信という)は、巨大なストレージと大きな通信帯域とを有するデータ配信サーバを必要とせず、コストメリットの大きい配信方式である。また、データの配信を受けるノードにおいては、複数のノードからのデータの供給が期待されるため、ダウンロードやアップロードにおける帯域幅を活かした高速なデータ取得が期待される。このようにP2Pデータ配信には大きなメリットがあるが、一方で、著作権保護などデータセキュリティの観点から安全性に不安があった。P2P配信に限らず、著作権保護などのデータセキュリティを考える上で一般的な前提として次のことを仮定する。全ての端末機器又はノードがハッキングされることはないということである。この前提を否定した場合、端末機器は秘密とすべきデータを保持したり、秘密とすべき処理を行ったりすることができなくなり、殆どのセキュリティ技術やセキュリティ確保の為の工夫が成立しない。
For example, a distribution method that distributes data using P2P (peerPto peer) (referred to as P2P distribution) does not require a data distribution server having a huge storage and a large communication band, and is a distribution method with a large cost advantage is there. Further, since a node receiving data distribution is expected to supply data from a plurality of nodes, high-speed data acquisition utilizing the bandwidth in download and upload is expected. As described above, the P2P data distribution has a great merit, but on the other hand, there is anxiety in safety from the viewpoint of data security such as copyright protection. The following is assumed as a general premise in considering data security such as copyright protection as well as P2P distribution. All terminal devices or nodes are not hacked. If this premise is denied, the terminal device cannot hold data that should be kept secret or perform processing that should be kept secret, and most security techniques and devices for ensuring security cannot be established.
さて、P2P配信において、暗号化されたデータを配信し、データの配信を受けるノードが当該データ(配信データという)を復号するための復号鍵を取得するコンテンツ配信システムがある。このようなシステムのP2P配信においてデータセキュリティ上の大きな問題点は、配信データと当該配信データを復号するための復号鍵との組み合わせが単一であったり数が少なかったりすることである。この場合、あるノードがハッキングされ、復号鍵が暴露されたとする。この場合、この復号鍵は殆どの配信データを復号するために使用できることになる。この問題を解決する一つの方法は、配信データをノード毎に個別化することである。
In P2P distribution, there is a content distribution system that distributes encrypted data, and a node that receives the data distribution acquires a decryption key for decrypting the data (distributed data). A major problem in data security in P2P distribution of such a system is that the combination of distribution data and a decryption key for decrypting the distribution data is single or small in number. In this case, it is assumed that a certain node is hacked and the decryption key is exposed. In this case, this decryption key can be used to decrypt most distribution data. One method for solving this problem is to individualize distribution data for each node.
P2P配信において配信データをノード毎に個別化する技術としては、例えば、特許文献1に示されるMarkingの方式が知られている。この方式では、配信データをピースに分割した上で、鍵の行列で暗号化を施して暗号化ピースを生成する。その結果として、行列状に暗号化された暗号化ピースからなるピース群が生成される。そしてこのようなピース群はP2Pネットワークを介して配信される。当該P2Pネットワークに接続される1つのノードは、各ピースについて行列状に暗号化された複数の暗号化ピースの中から1つの暗号化ピースを取得することになる。結果として、配信データを構成する各ピースが各々暗号化された暗号化ピースの組み合わせは、ノード毎に統計的に一意になることが期待される。
As a technique for individualizing distribution data for each node in P2P distribution, for example, a Marking method disclosed in Patent Document 1 is known. In this method, distribution data is divided into pieces, and encrypted with a key matrix to generate an encrypted piece. As a result, a piece group consisting of encrypted pieces encrypted in a matrix is generated. And such a piece group is distributed via a P2P network. One node connected to the P2P network acquires one encrypted piece from among a plurality of encrypted pieces encrypted in a matrix for each piece. As a result, it is expected that the combination of encrypted pieces obtained by encrypting each piece constituting the distribution data is statistically unique for each node.
しかし、上述の特許文献1の技術においては、各暗号化ピースの組み合わせがノード毎に一意であることはあくまで統計的に期待されるだけである。各暗号化ピースの組み合わせをノード毎に一意にすることを実現するには、例えば、以下の2つの方法が考えられる。1つは、暗号化ピースの配信方法に工夫を施すという方法である。また、1つは、各暗号化ピースを復号するための復号鍵を保持する鍵サーバが復号鍵の配信を制限するという方法である。例えば、配信されたピース群をノードは復号するために、各暗号化ピースの組み合わせを鍵サーバに申告して復号鍵を取得するシステムがある。このシステムにおいて、復号鍵の再配信によるリプレイアタックを阻止するためには、既に取得された復号鍵と重複が多い暗号化ピースの組み合わせを、鍵サーバがリジェクトするという方法がある。しかしいずれの方法であっても、暗号化ピースの配信効率を時として著しく低下させ、P2Pネットワークの利点を十分活かすことができなくなる恐れがある。また、前者の方法では、データの保護とデータの配信方法との独立性が損なわれ、そのことがシステム構築上の大きな制約となる恐れがある。
However, in the technique of the above-mentioned Patent Document 1, it is only statistically expected that the combination of encrypted pieces is unique for each node. In order to realize the unique combination of the encrypted pieces for each node, for example, the following two methods are conceivable. One method is to devise a method for distributing encrypted pieces. One is a method in which a key server holding a decryption key for decrypting each encrypted piece restricts delivery of the decryption key. For example, there is a system in which a node obtains a decryption key by declaring a combination of encrypted pieces to a key server in order for a node to decrypt a distributed piece group. In this system, in order to prevent a replay attack due to redistribution of the decryption key, there is a method in which the key server rejects a combination of the already obtained decryption key and an encrypted piece with many duplicates. However, either method may significantly reduce the distribution efficiency of the encrypted piece from time to time, and may not be able to take full advantage of the P2P network. In the former method, the independence of the data protection and the data distribution method is lost, which may be a major limitation in system construction.
また、P2P配信では、受信したピースが不正に改ざんされていないことを検証することが望ましい。一般的にはピースの完全性をチェックする方法として、配信データの提供者が配信データのピース毎にハッシュ値を計算して、全てのピースのハッシュ値の束(ハッシュテーブル)を利用する方法がある。しかし、このような方法では、ピースの完全性をチェックすることができるが、ピースを不正に改ざんするノードを特定することが困難である。
In P2P distribution, it is desirable to verify that the received piece has not been tampered with. In general, as a method of checking the integrity of pieces, there is a method in which a provider of delivery data calculates a hash value for each piece of delivery data and uses a bundle (hash table) of hash values of all pieces. is there. However, such a method can check the integrity of the piece, but it is difficult to identify a node that tampers with the piece.
本発明は、上記に鑑みてなされたものであって、コンテンツ配信システムにおいて配信されるピースを不正に改ざんするノードを特定可能とする通信装置、サーバ装置及び通信プログラムを提供することを目的とする。
The present invention has been made in view of the above, and an object of the present invention is to provide a communication device, a server device, and a communication program that can specify a node that illegally falsifies a piece distributed in a content distribution system. .
上述した課題を解決し、目的を達成するために、本発明の一実施形態は、第2装置識別情報と非公開鍵とが予め割り当てられ、データの一部であるピースを送信する通信装置であって、他の通信装置を識別する第1装置識別情報と前記ピースとを含む第1署名対象情報、および、前記第1署名対象情報に対して生成された第1電子署名を受信する受信手段と、前記第2装置識別情報と、前記非公開鍵と、を記憶する記憶手段と、前記第1署名対象情報と前記第1電子署名と前記第2装置識別情報とを含む第2署名対象情報に対する第2電子署名を、前記非公開鍵を用いて生成する署名生成手段と、前記第2署名対象情報と前記第2電子署名とを送信する送信手段と、を備えることを特徴とする。
In order to solve the above-described problems and achieve the object, an embodiment of the present invention is a communication device in which second device identification information and a private key are pre-assigned and a piece that is a part of data is transmitted. Receiving means for receiving first signature object information including first device identification information for identifying another communication device and the piece, and a first electronic signature generated for the first signature object information Storage means for storing the second device identification information and the private key, second signature target information including the first signature target information, the first electronic signature, and the second device identification information A signature generating unit that generates a second electronic signature for the first signature using the private key, and a transmission unit that transmits the second signature target information and the second electronic signature.
また、本発明の一実施形態は、上記装置で実行することができるプログラムである。
Also, an embodiment of the present invention is a program that can be executed by the above-described apparatus.
また、本発明の一実施形態は、データの一部であるピースを送信する複数の通信装置と接続されたサーバ装置であって、前記通信装置は、前記ピースを含む署名対象情報と、前記署名対象情報に対して他の通信装置が生成した電子署名とを含む新たな署名対象情報に対して新たな電子署名を生成し、生成した前記署名対象情報と生成した前記電子署名とを送信し、前記署名対象情報と、前記署名対象情報に対して生成された前記電子署名とを含む、前記電子署名の検証要求を前記通信装置から受信する受信手段と、前記検証要求に含まれる前記署名対象情報と、前記検証要求に含まれる前記電子署名を生成した前記通信装置に割り当てられた公開鍵とを用いて前記電子署名を検証する検証手段と、検証されなかった前記電子署名を含む前記署名対象情報に対する前記電子署名を生成した前記通信装置を、不正な通信装置として検出する検出手段と、を備えることを特徴とする。
Also, an embodiment of the present invention is a server device connected to a plurality of communication devices that transmit pieces that are part of data, the communication device including signature target information including the pieces, and the signature Generating a new electronic signature for new signature target information including an electronic signature generated by another communication device for the target information, transmitting the generated signature target information and the generated electronic signature, Receiving means for receiving a verification request for the electronic signature from the communication device, including the signature target information and the electronic signature generated for the signature target information; and the signature target information included in the verification request And verification means for verifying the electronic signature using a public key assigned to the communication device that generated the electronic signature included in the verification request, and the electronic signature not verified The communication device that generated the electronic signature for the name object information, characterized in that it comprises a detection means for detecting as unauthorized communication device.
本発明によれば、コンテンツ配信システムにおいて配信されるピースを不正に改ざんするノードを特定可能になるという効果を奏する。
According to the present invention, there is an effect that it is possible to identify a node that tampers with a piece distributed in the content distribution system.
以下に添付図面を参照して、この発明にかかる通信装置、サーバ装置及び通信プログラムの最良な実施の形態を詳細に説明する。
DETAILED DESCRIPTION Exemplary embodiments of a communication device, a server device, and a communication program according to the present invention are explained in detail below with reference to the accompanying drawings.
(1)構成
<コンテンツ配信システムの構成>
図1は、本実施の形態にかかるデータ配信システムの構成を示す図である。本実施の形態にかかるデータ配信システムにおいては、複数のノード50,51A~51BがP2PネットワークNTを介して接続されている。図示しないがこの他のノードもP2PネットワークNTを介して接続され得る。また、各ノード50,51A~51Bは鍵サーバ53と接続されている。各ノード50,51A~51Bは、各ノードに一意に割り当てられた割当情報として公開鍵証明書と、公開鍵証明書に記載された公開鍵の対となるピースの電子署名生成に使用される非公開鍵と、ピースの暗号化に使用される秘密鍵を保持している。公開鍵証明書には、少なくとも装置識別情報であるノードIDと、電子署名を検証するための公開鍵が含まれている。公開鍵証明書(Public Key Certificate)については、例えば文献ISO/IEC 9594-8に記載されている。各ノード50,51A~51Bに割り当てられた公開鍵証明書を各々pkc_0、pkc_1、pkc_2とし、非公開鍵を各々sk_0、sk_1、sk_2とし、公開鍵証明書に含まれるノードIDを各々ID #0、ID #1、ID #2とし、公開鍵証明書に含まれる公開鍵を各々pk_0、pk_1、pk_2とし、秘密鍵を各々s_0、s_1、s_2とする。尚、各ノード50,51A~51Bのうちノード50は、データの配信の基点となる配信開始ノードであり、配信対象のデータ(配信データという)を保持している。配信データは、平文である場合も既に暗号化された暗号文である場合もある。例えば、当該配信データは、暗号化として何らかのDRM(Digital Right Management) Systemによって保護されたビデオデータであっても良い。鍵サーバ53は、各ノード50,51A~51Bに各々割り当てられたノードIDと、秘密鍵を保持している。さらに鍵サーバ53は、各ノード50,51A~51Bに各々割り当てられた公開鍵証明書を保持していてもよい。尚、以降、ノード51A~51Bを各々区別する必要がない場合、単にノード51と記載する。 (1) Configuration <Configuration of content distribution system>
FIG. 1 is a diagram showing a configuration of a data distribution system according to the present embodiment. In the data distribution system according to the present embodiment, a plurality of nodes 50, 51A to 51B are connected via a P2P network NT. Although not shown, other nodes can also be connected via the P2P network NT. Each node 50, 51A to 51B is connected to a key server 53. Each of the nodes 50, 51A to 51B is a non-key used for generating an electronic signature of a piece that is a pair of a public key certificate and public key described in the public key certificate as assignment information uniquely assigned to each node. It holds a public key and a secret key that is used to encrypt the piece. The public key certificate includes at least a node ID that is device identification information and a public key for verifying an electronic signature. Public key certificates are described in, for example, the document ISO / IEC 9594-8. The public key certificates assigned to the nodes 50, 51A to 51B are pkc_0, pkc_1, and pkc_2, the private keys are sk_0, sk_1, and sk_2, and the node IDs included in the public key certificates are ID # 0. , ID # 1, ID # 2, public keys included in the public key certificate are pk_0, pk_1, pk_2, and private keys are s_0, s_1, s_2, respectively. Of the nodes 50 and 51A to 51B, the node 50 is a distribution start node serving as a data distribution base, and holds data to be distributed (referred to as distribution data). The distribution data may be plaintext or already encrypted ciphertext. For example, the distribution data may be video data protected by some DRM (Digital Right Management) System as encryption. The key server 53 holds a node ID assigned to each of the nodes 50 and 51A to 51B and a secret key. Furthermore, the key server 53 may hold public key certificates assigned to the nodes 50 and 51A to 51B. Hereinafter, when it is not necessary to distinguish each of the nodes 51A to 51B, they are simply referred to as a node 51.
<コンテンツ配信システムの構成>
図1は、本実施の形態にかかるデータ配信システムの構成を示す図である。本実施の形態にかかるデータ配信システムにおいては、複数のノード50,51A~51BがP2PネットワークNTを介して接続されている。図示しないがこの他のノードもP2PネットワークNTを介して接続され得る。また、各ノード50,51A~51Bは鍵サーバ53と接続されている。各ノード50,51A~51Bは、各ノードに一意に割り当てられた割当情報として公開鍵証明書と、公開鍵証明書に記載された公開鍵の対となるピースの電子署名生成に使用される非公開鍵と、ピースの暗号化に使用される秘密鍵を保持している。公開鍵証明書には、少なくとも装置識別情報であるノードIDと、電子署名を検証するための公開鍵が含まれている。公開鍵証明書(Public Key Certificate)については、例えば文献ISO/IEC 9594-8に記載されている。各ノード50,51A~51Bに割り当てられた公開鍵証明書を各々pkc_0、pkc_1、pkc_2とし、非公開鍵を各々sk_0、sk_1、sk_2とし、公開鍵証明書に含まれるノードIDを各々ID #0、ID #1、ID #2とし、公開鍵証明書に含まれる公開鍵を各々pk_0、pk_1、pk_2とし、秘密鍵を各々s_0、s_1、s_2とする。尚、各ノード50,51A~51Bのうちノード50は、データの配信の基点となる配信開始ノードであり、配信対象のデータ(配信データという)を保持している。配信データは、平文である場合も既に暗号化された暗号文である場合もある。例えば、当該配信データは、暗号化として何らかのDRM(Digital Right Management) Systemによって保護されたビデオデータであっても良い。鍵サーバ53は、各ノード50,51A~51Bに各々割り当てられたノードIDと、秘密鍵を保持している。さらに鍵サーバ53は、各ノード50,51A~51Bに各々割り当てられた公開鍵証明書を保持していてもよい。尚、以降、ノード51A~51Bを各々区別する必要がない場合、単にノード51と記載する。 (1) Configuration <Configuration of content distribution system>
FIG. 1 is a diagram showing a configuration of a data distribution system according to the present embodiment. In the data distribution system according to the present embodiment, a plurality of
ここで、各ノード50,51と、鍵サーバ53との各装置のハードウェア構成について説明する。各装置は各々、装置全体を制御するCPU(Central Processing Unit)等の制御装置と、各種データや各種プログラムを記憶するROM(Read Only Memory)やRAM(Random Access Memory)等の記憶装置と、各種データや各種プログラムを記憶するHDD(Hard Disk Drive)やCD(Compact Disk)ドライブ装置等の外部記憶装置と、これらを接続するバスとを備えており、通常のコンピュータを利用したハードウェア構成となっている。また、各装置には各々、情報を表示する表示装置と、ユーザの指示入力を受け付けるキーボードやマウス等の入力装置と、外部装置の通信を制御する通信I/F(interface)とが有線又は無線により接続される。
Here, the hardware configuration of each device including the nodes 50 and 51 and the key server 53 will be described. Each device is a control device such as a CPU (Central Processing Unit) that controls the entire device, a storage device such as a ROM (Read Only Memory) or a RAM (Random Access Memory) that stores various data and various programs, and various types It has an external storage device such as an HDD (Hard Disk Drive) or CD (Compact Disk) drive device that stores data and various programs, and a bus that connects them, and has a hardware configuration that uses a normal computer. ing. Each device includes a display device that displays information, an input device such as a keyboard and a mouse that accepts user instruction input, and a communication I / F (interface) that controls communication with an external device. Connected by.
なお、装置識別情報とは、データ配信システムにおける各ノードに割り当てられた情報であって、各ノードを識別できればどのような情報であっても良く、例えば、ノードID、通信装置のMAC(Media Access Control)アドレス、通信機器のCPU固有なシリアルナンバー、などである。
The device identification information is information assigned to each node in the data distribution system and may be any information as long as each node can be identified. For example, the node ID, the MAC (Media Access of the communication device) Control) address, serial number unique to the CPU of the communication device, and the like.
また、電子署名とは、デジタル文書の正当性を保証するために当該デジタル文書に付けられる署名情報であれば良く、例えば、RSA署名、DSA(Digital Signature Algorithm)、ElGamal署名、Schnorr署名、Cramer-Shoup署名、ECDSA(Elliptic Curve DSA)、楕円ElGamal署名、楕円Schnorr署名などのアルゴリズムで生成された署名情報である。
The digital signature may be any signature information attached to the digital document in order to guarantee the validity of the digital document. For example, an RSA signature, DSA (Digital Signature—Algorithm), ElGamal signature, Schnorr signature, Cramer− This is signature information generated by an algorithm such as a Shop signature, ECDSA (Elliptic Curve DSA), elliptic ElGamal signature, or elliptic Schnorr signature.
<配信開始ノードの構成>
次に、上述したハードウェア構成において、配信開始ノードであるノード50のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図2は、ノード50の機能的構成を例示する図である。ノード50は、固有情報格納部500と、乱数生成部501と、一時対称鍵生成部502と、ピース暗号化部503と、ピース化部504と、データ送信部505と、送信要求受付部506と、電子署名生成部507を有する。尚、固有情報格納部500は、例えばノード50のHDDなどの外部記憶装置に記憶領域として確保されるものである。乱数生成部501と、一時対称鍵生成部502と、ピース暗号化部503と、ピース化部504と、データ送信部505と、送信要求受付部506と、電子署名生成部507との実体は、ノード50のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。尚、ノード50の外部記憶装置には、配信データが予め記憶されている。 <Configuration of distribution start node>
Next, in the hardware configuration described above, various functions realized when the CPU of thenode 50 that is the distribution start node executes various programs stored in the storage device or the external storage device will be described. FIG. 2 is a diagram illustrating a functional configuration of the node 50. The node 50 includes a unique information storage unit 500, a random number generation unit 501, a temporary symmetric key generation unit 502, a piece encryption unit 503, a piece generation unit 504, a data transmission unit 505, and a transmission request reception unit 506. And an electronic signature generation unit 507. The unique information storage unit 500 is reserved as a storage area in an external storage device such as an HDD of the node 50, for example. The entities of the random number generation unit 501, the temporary symmetric key generation unit 502, the piece encryption unit 503, the piece generation unit 504, the data transmission unit 505, the transmission request reception unit 506, and the electronic signature generation unit 507 are: It is generated on a storage device such as a RAM when the CPU program of the node 50 is executed. Note that distribution data is stored in advance in the external storage device of the node 50.
次に、上述したハードウェア構成において、配信開始ノードであるノード50のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図2は、ノード50の機能的構成を例示する図である。ノード50は、固有情報格納部500と、乱数生成部501と、一時対称鍵生成部502と、ピース暗号化部503と、ピース化部504と、データ送信部505と、送信要求受付部506と、電子署名生成部507を有する。尚、固有情報格納部500は、例えばノード50のHDDなどの外部記憶装置に記憶領域として確保されるものである。乱数生成部501と、一時対称鍵生成部502と、ピース暗号化部503と、ピース化部504と、データ送信部505と、送信要求受付部506と、電子署名生成部507との実体は、ノード50のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。尚、ノード50の外部記憶装置には、配信データが予め記憶されている。 <Configuration of distribution start node>
Next, in the hardware configuration described above, various functions realized when the CPU of the
固有情報格納部500は、当該ノード50に割り当てられた公開鍵証明書と非公開鍵及び秘密鍵を記憶する。公開鍵証明書には、少なくとも当該ノード51に割り当てられたノードID及び公開鍵が含まれている。ピース化部504は、配信データを複数のピースに分割する。分割する際のデータサイズは特に限定されないが、予め定められているものとする。送信要求受付部506は、ピース化部504が分割したピースを要求するピース要求を他のノード51から受信する。乱数生成部501は、送信要求受付部506がピース要求を受信した場合、その発生毎に異なり得る一時情報である乱数を生成する。一時情報とは、使い捨ての値であって、ノードで生成される度に異なる値となれば良く、乱数の他、たとえば、タイムスタンプや通信のシーケンス番号やノードに固有のカウンタ値やTime Variant Parameterである。Time Variant Parameterについては、文献ISO9798-1が詳しい。
The unique information storage unit 500 stores a public key certificate, a private key, and a secret key assigned to the node 50. The public key certificate includes at least the node ID assigned to the node 51 and the public key. The piece unit 504 divides the distribution data into a plurality of pieces. The data size at the time of division is not particularly limited, but is assumed to be predetermined. The transmission request receiving unit 506 receives a piece request for requesting the piece divided by the piece forming unit 504 from the other node 51. When the transmission request reception unit 506 receives a piece request, the random number generation unit 501 generates a random number that is temporary information that can be different for each occurrence. Temporary information is a disposable value that needs to be different every time it is generated at a node. In addition to a random number, for example, a time stamp, a communication sequence number, a counter value specific to a node, or Time Variant Parameter It is. The document ISO9798-1 is detailed for Time 文献 Variant Parameter.
一時対称鍵生成部502は、乱数生成部501が生成した乱数r_0と、固有情報格納部500に記憶された秘密鍵s_0とを用いて関数Fにより一時対称鍵k_0を生成する。これを式により表すと以下の(1)式のように表される。
k_0=F(s_0, r_0) ・・・(1) The temporary symmetrickey generation unit 502 generates a temporary symmetric key k_0 by the function F using the random number r_0 generated by the random number generation unit 501 and the secret key s_0 stored in the unique information storage unit 500. This can be expressed by the following equation (1).
k_0 = F (s_0, r_0) (1)
k_0=F(s_0, r_0) ・・・(1) The temporary symmetric
k_0 = F (s_0, r_0) (1)
尚、関数Fは一方向性関数あるいは共通鍵暗号あるいは擬似乱数生成器であり、入力値である秘密鍵と乱数の両方を知らないものが、出力値である一時対称鍵を推測できないものである。一時対称鍵とは、関数Fの出力値であって、関数Fの入力と出力値との関係が一意に定められれば良い。関数Fとしては、例えばSHA-1やSHA256といったハッシュ関数であっても良く、AESやHierocryptといった共通鍵暗号方式であっても良く、Mersenne twisterといった疑似乱数生成器であってもよい。ハッシュ関数には、乱数と秘密鍵を結合した値が入力されても良い。共通鍵暗号方式では、乱数を秘密鍵で暗号化しても良く、秘密鍵を乱数で暗号化しても良く、乱数を秘密鍵で復号しても良く、秘密鍵を乱数で復号しても良い。疑似乱数生成器には、乱数と秘密鍵を結合した値が入力されても良い。
Note that the function F is a one-way function, a symmetric key encryption, or a pseudo-random number generator, which does not know both the secret key and the random number that are the input values, and cannot guess the temporary symmetric key that is the output value. . The temporary symmetric key is an output value of the function F, and it is sufficient that the relationship between the input and output value of the function F is uniquely determined. The function F may be a hash function such as SHA-1 or SHA256, a common key cryptosystem such as AES or Hiercrypt, or a pseudo-random number generator such as Mersenne twister. A value obtained by combining a random number and a secret key may be input to the hash function. In the common key cryptosystem, a random number may be encrypted with a secret key, a secret key may be encrypted with a random number, a random number may be decrypted with a secret key, or a secret key may be decrypted with a random number. A value obtained by combining a random number and a secret key may be input to the pseudo-random number generator.
ピース暗号化部503は、一時対称鍵生成部502が生成した一時対称鍵k_0を用いてピースPを暗号化して、暗号化ピースE(k_0)Pを出力する。尚、一時対称鍵は暗号化に用いられる暗号鍵でもあり、暗号化ピースに対して行われている暗号化を解くための復号鍵にもなる。電子署名生成部507は、非公開鍵sk_0を用いて関数SIGNにより暗号化ピースE(k_0)Pと公開鍵証明書pkc_0と乱数r_0に対して電子署名sig_0を生成する。電子署名の生成を式で表すと以下の(2)式のようになる。
sig_0=SIGN(sk_0, E(k_0)P || pkc_0 || r_0 ) ・・・(2) Thepiece encryption unit 503 encrypts the piece P using the temporary symmetric key k_0 generated by the temporary symmetric key generation unit 502, and outputs an encrypted piece E (k_0) P. The temporary symmetric key is also an encryption key used for encryption, and is also a decryption key for decrypting the encryption performed on the encrypted piece. The electronic signature generation unit 507 generates an electronic signature sig_0 for the encrypted piece E (k_0) P, the public key certificate pkc_0, and the random number r_0 by the function SIGN using the private key sk_0. The generation of the electronic signature is expressed by the following equation (2).
sig_0 = SIGN (sk_0, E (k_0) P || pkc_0 || r_0) (2)
sig_0=SIGN(sk_0, E(k_0)P || pkc_0 || r_0 ) ・・・(2) The
sig_0 = SIGN (sk_0, E (k_0) P || pkc_0 || r_0) (2)
ここで、記号||はデータ結合を意味する。また、上記(2)式では署名生成対象データの結合順番の1例を示しており、署名検証を行うものが当該署名生成対象データの結合順番を把握できる仕組みになっていれば、結合順番はどのようになっていてもよい。
Here, the symbol || means data combination. Further, the above equation (2) shows an example of the combination order of signature generation target data. If the signature verification target has a mechanism that can grasp the combination order of the signature generation target data, the combination order is It may be any way.
関数SIGNとしてはRSA署名、DSA(Digital Signature Algorithm)、ElGamal署名、Schnorr署名、Cramer-Shoup署名、ECDSA(Elliptic Curve DSA)、楕円ElGamal署名、楕円Schnorr署名などの電子署名方式における署名生成アルゴリズムを用いても良い。データ送信部505は、ピース要求を送信した他のノード51に対して、固有情報格納部500に記憶されている公開鍵証明書と、乱数生成部501が生成した乱数と、ピース暗号化部503が出力した暗号化ピースと、電子署名生成部507が生成した電子署名とを送信する。
As a function SIGN, a signature generation algorithm in an electronic signature scheme such as RSA signature, DSA (Digital Signature Algorithm), ElGamal signature, Schnorr signature, Cramer-Shoep signature, ECDSA (Elliptic Curve Curve DSA), elliptic ElGamal signature, elliptical Schnorr signature is used. May be. The data transmission unit 505 transmits the public key certificate stored in the unique information storage unit 500, the random number generated by the random number generation unit 501, and the piece encryption unit 503 to the other node 51 that transmitted the piece request. And the electronic signature generated by the electronic signature generation unit 507 are transmitted.
<配信開始ノード以外のノードの構成>
次に、配信開始ノード以外であるノード51のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図3は、ノード51の機能的構成を例示する図である。ノード51は、固有情報格納部510と、乱数生成部511と、一時対称鍵生成部512と、ピース暗号化部513と、データ受信部514と、データ送信部515と、送信要求受付部516と、データ格納部517と、送信要求送信部518と、鍵要求送信部519と、ピース復号部520と、電子署名生成部521と、電子署名検証部522と、ピース検証要求送信部523とを有する。尚、固有情報格納部510とデータ格納部517とは、例えばノード51のHDDなどの外部記憶装置に記憶領域として確保されるものである。乱数生成部511と、一時対称鍵生成部512と、ピース暗号化部513と、データ受信部514と、データ送信部515と、送信要求受付部516と、送信要求送信部518と、鍵要求送信部519と、ピース復号部520と、電子署名生成部521と、電子署名検証部522と、ピース検証要求送信部523との実体は、ノード51のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。 <Configuration of nodes other than the distribution start node>
Next, various functions realized when the CPU of thenode 51 other than the distribution start node executes various programs stored in the storage device or the external storage device will be described. FIG. 3 is a diagram illustrating a functional configuration of the node 51. The node 51 includes a unique information storage unit 510, a random number generation unit 511, a temporary symmetric key generation unit 512, a piece encryption unit 513, a data reception unit 514, a data transmission unit 515, and a transmission request reception unit 516. A data storage unit 517, a transmission request transmission unit 518, a key request transmission unit 519, a piece decryption unit 520, an electronic signature generation unit 521, an electronic signature verification unit 522, and a piece verification request transmission unit 523. . The unique information storage unit 510 and the data storage unit 517 are reserved as storage areas in an external storage device such as an HDD of the node 51, for example. Random number generation unit 511, temporary symmetric key generation unit 512, piece encryption unit 513, data reception unit 514, data transmission unit 515, transmission request reception unit 516, transmission request transmission unit 518, key request transmission The entity of the unit 519, the piece decryption unit 520, the digital signature generation unit 521, the digital signature verification unit 522, and the piece verification request transmission unit 523 is stored in a storage device such as a RAM when the CPU program of the node 51 is executed. Is generated.
次に、配信開始ノード以外であるノード51のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図3は、ノード51の機能的構成を例示する図である。ノード51は、固有情報格納部510と、乱数生成部511と、一時対称鍵生成部512と、ピース暗号化部513と、データ受信部514と、データ送信部515と、送信要求受付部516と、データ格納部517と、送信要求送信部518と、鍵要求送信部519と、ピース復号部520と、電子署名生成部521と、電子署名検証部522と、ピース検証要求送信部523とを有する。尚、固有情報格納部510とデータ格納部517とは、例えばノード51のHDDなどの外部記憶装置に記憶領域として確保されるものである。乱数生成部511と、一時対称鍵生成部512と、ピース暗号化部513と、データ受信部514と、データ送信部515と、送信要求受付部516と、送信要求送信部518と、鍵要求送信部519と、ピース復号部520と、電子署名生成部521と、電子署名検証部522と、ピース検証要求送信部523との実体は、ノード51のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。 <Configuration of nodes other than the distribution start node>
Next, various functions realized when the CPU of the
固有情報格納部510は、当該ノード51に割り当てられた公開鍵証明書と非公開鍵と秘密鍵とを記憶する。公開鍵証明書には、少なくとも当該ノード51に割り当てられたノードID及び公開鍵が含まれている。送信要求受付部516の構成は上述のノード50の有する送信要求受付部506の構成と同様である。送信要求送信部518は、ピースを要求するピース要求をノード50又は他のノード51に対して送信する。データ受信部514は、送信要求送信部518がピース要求を送信した相手であるノード50又は他のノード51から、ピースが暗号化された暗号化ピースと、当該暗号化ピースの送信を仲介した少なくとも1つの他のノード50,51に割り当てられた各公開鍵証明書を含む公開鍵証明書列と、当該他のノード50,51が生成した各乱数を含む乱数列と、当該他のノード50,51が生成した各電子署名を含む電子署名列とを受信する。電子署名検証部522は、受信した暗号化ピースE(k_i-1)・・・E(k_0)Pと公開鍵証明書列pkc_0,・・・,pkc_i-1と乱数列r_0,・・・r_i-1と電子署名列sig_0,・・・,sig_i-1とが正当かどうかを、データ送信者の公開鍵証明書に含まれる公開鍵pk_i-1を用いて、以下の(3)式で表される関数VERIFYによりデータ送信者が生成した電子署名を検証する。なおE(k_i-1)・・・E(k_0)P、pkc_i-1、r_i-1、sig_i-1、およびpk_i-1とは、それぞれ、配信経路上でi番目に暗号化ピースの配信を仲介するノード51で計算される暗号化ピース、当該ノード51の公開鍵証明書、当該ノード51が生成した乱数、当該ノード51が生成した電子署名、および当該ノード51の公開鍵証明書に含まれる公開鍵を意味する。そして、i=0のときの各データE(k_0)P、pkc_0、r_0、sig_0、およびpk_0は、配信開始ノードであるノード50で計算される暗号化ピース、ノード50の公開鍵証明書、ノード50が生成した乱数、ノード50が生成した電子署名、およびノード50の公開鍵証明書に含まれる公開鍵である。
検証成功/失敗=VERIFY(pk_i-1, E(k_i-1)・・・E(k_0)P || pkc_0 || r_0 || sig_0 || ・・・ || pkc_i-1 || r_i-1, sig_i-1) ・・・(3) The uniqueinformation storage unit 510 stores a public key certificate, a private key, and a secret key assigned to the node 51. The public key certificate includes at least the node ID assigned to the node 51 and the public key. The configuration of the transmission request receiving unit 516 is the same as the configuration of the transmission request receiving unit 506 included in the node 50 described above. The transmission request transmission unit 518 transmits a piece request for requesting a piece to the node 50 or another node 51. The data reception unit 514 transmits at least the encrypted piece in which the piece is encrypted and the transmission of the encrypted piece from the node 50 or another node 51 to which the transmission request transmission unit 518 has transmitted the piece request. A public key certificate sequence including each public key certificate assigned to one other node 50, 51, a random number sequence including each random number generated by the other node 50, 51, and the other node 50, 51 51 receives the electronic signature sequence including the electronic signatures generated by 51. The electronic signature verification unit 522 receives the encrypted piece E (k_i-1)... E (k_0) P, the public key certificate sequence pkc_0,..., Pkc_i-1 and the random number sequence r_0,. -1 and the digital signature sequence sig_0,..., Sig_i-1 are expressed by the following formula (3) using the public key pk_i-1 included in the data sender's public key certificate. The electronic signature generated by the data sender is verified by the function VERIFY. Note that E (k_i-1)... E (k_0) P, pkc_i-1, r_i-1, sig_i-1, and pk_i-1 each deliver the i-th encrypted piece on the delivery path. Included in the encrypted piece calculated by the intermediary node 51, the public key certificate of the node 51, the random number generated by the node 51, the electronic signature generated by the node 51, and the public key certificate of the node 51 Means public key. The data E (k_0) P, pkc_0, r_0, sig_0, and pk_0 when i = 0 are the encrypted piece calculated by the node 50 that is the distribution start node, the public key certificate of the node 50, the node 50 is a random number generated by the node 50, an electronic signature generated by the node 50, and a public key included in the public key certificate of the node 50.
Verification success / failure = VERIFY (pk_i-1, E (k_i-1) ... E (k_0) P || pkc_0 || r_0 || sig_0 || ... || pkc_i-1 || r_i-1, sig_i-1) (3)
検証成功/失敗=VERIFY(pk_i-1, E(k_i-1)・・・E(k_0)P || pkc_0 || r_0 || sig_0 || ・・・ || pkc_i-1 || r_i-1, sig_i-1) ・・・(3) The unique
Verification success / failure = VERIFY (pk_i-1, E (k_i-1) ... E (k_0) P || pkc_0 || r_0 || sig_0 || ... || pkc_i-1 || r_i-1, sig_i-1) (3)
例えば、ノード50から最初に暗号化ピースを受信したノード51では、以下の(4)式でノード50が生成した電子署名を検証する。
検証成功/失敗=VERIFY(pk_0, E(k_0)P || pkc_0 || r_0, sig_0) ・・・(4) For example, in thenode 51 that first receives the encrypted piece from the node 50, the electronic signature generated by the node 50 is verified by the following equation (4).
Verification success / failure = VERIFY (pk_0, E (k_0) P || pkc_0 || r_0, sig_0) (4)
検証成功/失敗=VERIFY(pk_0, E(k_0)P || pkc_0 || r_0, sig_0) ・・・(4) For example, in the
Verification success / failure = VERIFY (pk_0, E (k_0) P || pkc_0 || r_0, sig_0) (4)
関数VERIFYとしては、署名生成時に使用した関数SIGNと対になる署名検証アルゴリズムを用いる。例えば、SIGNとしてRSA署名生成アルゴリズムを用いた場合には、VERIFYとしてRSA署名検証アルゴリズムを用いる。
As the function VERIFY, the signature verification algorithm that is paired with the function SIGN used when generating the signature is used. For example, when an RSA signature generation algorithm is used as SIGN, an RSA signature verification algorithm is used as VERIFY.
電子署名の検証に成功した場合、データ格納部517は、データ受信部514が受信した公開鍵証明書列、乱数列、電子署名列及び暗号化ピースを対応付けて記憶する。検証に失敗した場合、データ受信部514が受信した公開鍵証明書列、乱数列、電子署名列及び暗号化ピースを破棄する。
When the verification of the electronic signature is successful, the data storage unit 517 stores the public key certificate sequence, random number sequence, electronic signature sequence, and encrypted piece received by the data reception unit 514 in association with each other. If the verification fails, the data reception unit 514 discards the public key certificate sequence, random number sequence, digital signature sequence, and encrypted piece received.
送信要求受付部516がピース要求を他のノード51から受信した場合、乱数生成部511は、乱数を生成する。一時対称鍵生成部512は、乱数生成部511が生成した乱数と、固有情報格納部510に記憶された秘密鍵とを用いて上述した関数Fにより一時対称鍵を生成する。ピース暗号化部513は、一時対称鍵生成部512が生成した一時対称鍵を用いて、データ格納部517に記憶されている1つの暗号化ピースを更に暗号化して、新たな暗号化ピースを出力する。電子署名生成部521は、固有情報格納部510に記憶された非公開鍵を用いて、ピース暗号化部513が出力した新たな暗号化ピースと、当該暗号化ピースに対応づけられてデータ格納部517に記憶された公開鍵証明書列に加え固有情報格納部510に記憶された公開鍵証明書を含む新たな公開鍵証明書列と、当該暗号化ピースに対応づけられてデータ格納部517に記憶された乱数列に加え乱数生成部511が生成した乱数を含む新たな乱数列と、当該暗号化ピースに対応づけられてデータ格納部517に記憶された電子署名列とに対して、新たな電子署名を生成する。
When the transmission request reception unit 516 receives a piece request from another node 51, the random number generation unit 511 generates a random number. The temporary symmetric key generation unit 512 generates a temporary symmetric key by the function F described above using the random number generated by the random number generation unit 511 and the secret key stored in the unique information storage unit 510. The piece encryption unit 513 further encrypts one encrypted piece stored in the data storage unit 517 using the temporary symmetric key generated by the temporary symmetric key generation unit 512, and outputs a new encrypted piece To do. The electronic signature generation unit 521 uses a private key stored in the unique information storage unit 510 to create a new encrypted piece output from the piece encryption unit 513 and a data storage unit associated with the encrypted piece. In addition to the public key certificate sequence stored in 517, a new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 and the data storage unit 517 in association with the encrypted piece A new random number sequence including the random number generated by the random number generation unit 511 in addition to the stored random number sequence, and a new digital signature sequence associated with the encrypted piece and stored in the data storage unit 517 Generate an electronic signature.
データ送信部515は、送信要求受付部516が受信したピース要求を送信した他のノード51に対して、以下のデータを送信する。すなわち、送信対象の暗号化ピースに対応付けられてデータ格納部517に記憶された公開鍵証明書列に加え固有情報格納部510に記憶された公開鍵証明書を含む新たな公開鍵証明書列と、当該暗号化ピースに対応付けられてデータ格納部517に記憶された乱数列に加え乱数生成部511が生成した乱数を含む新たな乱数列と、ピース暗号化部513が出力した新たな暗号化ピースと、当該暗号化ピースに対応付けられてデータ格納部517に記憶された電子署名列に加え電子署名生成部521が生成した電子署名を含む新たな電子署名列とである。尚、データ格納部517に暗号化ピースが記憶されていない場合には、送信要求受付部516がピース要求を受信したとしても、ピース暗号化部513は暗号化ピースを出力せず、データ送信部515は暗号化ピースを送信しない。
The data transmission unit 515 transmits the following data to the other node 51 that has transmitted the piece request received by the transmission request reception unit 516. That is, a new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 in addition to the public key certificate sequence stored in the data storage unit 517 in association with the encrypted piece to be transmitted A new random number sequence including the random number generated by the random number generation unit 511 in addition to the random number sequence stored in the data storage unit 517 in association with the encrypted piece, and the new encryption output from the piece encryption unit 513 And a new electronic signature sequence including the electronic signature generated by the electronic signature generation unit 521 in addition to the electronic signature sequence stored in the data storage unit 517 in association with the encrypted piece. When the encrypted piece is not stored in the data storage unit 517, even if the transmission request receiving unit 516 receives the piece request, the piece encryption unit 513 does not output the encrypted piece, and the data transmission unit 515 does not send the encrypted piece.
ここで、ノード50,51から送信される公開鍵証明書列、乱数列、暗号化ピース及び電子署名列について具体的に説明する。尚、ノード50から1つの暗号化ピースに対してこれと共に送信される公開鍵証明書、乱数及び電子署名は各々1つであるが、ここでは説明の便宜上、これらを公開鍵証明書列、乱数列及び電子署名列と各々記載する場合がある。暗号化ピースの配信経路としてここではノード50からノード51A、更にノード51Aからノード51Bに暗号化ピースを送信し、ノード51Bから鍵サーバ53に鍵要求を送信する場合について説明する。例えば、あるピースPについてノード51Aからのピース要求に応じて、ノード50が、乱数r_0と秘密鍵s_0とを用いて一時対称鍵k_0を生成し、これを用いてピースPを暗号化して暗号化ピースE(k_0)Pを出力したとする。さらに、ノード50は、乱数r_0と暗号化ピースE(k_0)Pと公開鍵証明書pkc_0とを含む情報(署名対象情報)に対する電子署名sig_0を、非公開鍵sk_0を用いて生成したとする。
Here, the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence transmitted from the nodes 50 and 51 will be specifically described. The public key certificate, the random number, and the electronic signature that are transmitted together with the encrypted piece from the node 50 are one each. Here, for convenience of explanation, these are the public key certificate string, the random number, and the like. May be described as a column and a digital signature column. Here, a case will be described in which the encrypted piece is transmitted from the node 50 to the node 51A, the encrypted piece is transmitted from the node 51A to the node 51B, and the key request is transmitted from the node 51B to the key server 53. For example, in response to a piece request from the node 51A for a piece P, the node 50 generates a temporary symmetric key k_0 using a random number r_0 and a secret key s_0, and encrypts the piece P using this to encrypt the piece P Assume that piece E (k_0) P is output. Further, it is assumed that the node 50 generates an electronic signature sig_0 for information (signature target information) including the random number r_0, the encrypted piece E (k_0) P, and the public key certificate pkc_0 using the private key sk_0.
なお、署名対象情報とは、電子署名を生成する対象となる情報をいう。上述のように、ノード50の場合は、ノード50で生成した乱数r_0と、ノード50で暗号化した暗号化ピースE(k_0)Pと、ノード50の公開鍵証明書pkc_0とが署名対象情報に含まれる。配信経路上でi番目に暗号化ピースの配信を仲介するノード51の場合は、公開鍵証明書列pkc_0、・・・、pkc_iと、乱数列r_0、・・・、r_iと、暗号化ピースE(k_i)・・・E(k_0)Pと、電子署名列sig_0、・・・、sig_i-1とが署名対象情報に含まれる。
Note that the signature target information refers to information that is a target for generating an electronic signature. As described above, in the case of the node 50, the random number r_0 generated by the node 50, the encrypted piece E (k_0) P encrypted by the node 50, and the public key certificate pkc_0 of the node 50 are used as signature target information. included. In the case of the node 51 that mediates the distribution of the encrypted piece i-th on the distribution path, the public key certificate sequence pkc_0,..., Pkc_i, the random number sequence r_0,. (K_i)... E (k_0) P and electronic signature strings sig_0,..., Sig_i-1 are included in the signature target information.
そして、ノード50が、当該暗号化ピースE(k_0)Pを公開鍵証明書pkc_0、乱数r_0及び電子署名sig_0と共にノード51Aに送信したとする。図4は、ノード50からノード51Aに送信される情報を模式的に示す図である。当該ノード51Aは、電子署名sig_0が、暗号化ピースE(k_0)Pと公開鍵証明書pkc_0及び乱数r_0に対する正当な署名かどうかを、公開鍵証明書pkc_0に含まれる公開鍵pk_0を用いて電子署名検証部522において確認する。当該電子署名検証の結果が検証成功だった場合、当該ノード51Aは、これらの公開鍵証明書pkc_0、乱数r_0、暗号化ピースE(k_0)P及び電子署名sig_0を対応付けてデータ格納部517に記憶することになる。尚、データ格納部517は、公開鍵証明書と当該公開鍵証明書が割り当てられたノードが生成した乱数と当該公開鍵証明書が割り当てられたノードが生成した電子署名との対応関係を保持した状態で各公開鍵証明書列、各乱数列及び各電子署名列を記憶する。一方、当該電子署名検証の結果が検証失敗だった場合、当該ノード51Aは、当該公開鍵証明書pkc_0と乱数r_0と暗号化ピースE(k_0)P及び電子署名sig_0を破棄する。
Then, it is assumed that the node 50 transmits the encrypted piece E (k_0) P together with the public key certificate pkc_0, the random number r_0, and the electronic signature sig_0 to the node 51A. FIG. 4 is a diagram schematically illustrating information transmitted from the node 50 to the node 51A. The node 51A uses the public key pk_0 included in the public key certificate pkc_0 to determine whether the electronic signature sig_0 is a valid signature for the encrypted piece E (k_0) P, the public key certificate pkc_0, and the random number r_0. The signature verification unit 522 confirms this. When the verification result of the electronic signature is successful, the node 51A associates the public key certificate pkc_0, the random number r_0, the encrypted piece E (k_0) P, and the electronic signature sig_0 with each other in the data storage unit 517. I will remember it. The data storage unit 517 holds a correspondence relationship between the public key certificate, the random number generated by the node to which the public key certificate is assigned, and the electronic signature generated by the node to which the public key certificate is assigned. Each public key certificate sequence, each random number sequence, and each electronic signature sequence are stored in the state. On the other hand, when the verification result of the electronic signature is a verification failure, the node 51A discards the public key certificate pkc_0, the random number r_0, the encrypted piece E (k_0) P, and the electronic signature sig_0.
そして、当該ノード51Aが、ノード51Bからのピース要求に応じてピースPに対する暗号化ピースを送信する場合、乱数r_1を生成し、これと秘密鍵s_1とを用いて一時対称鍵k_1を生成し、これを用いて暗号化ピースE(k_0)Pを更に暗号化して暗号化ピースE(k_1)E(k_0)Pを出力したとする。E(k_1)E(k_0)Pは、順に一時対称鍵k_0、k_1でピースPを多重に暗号化したものを示す。さらに、ノード51Aは、公開鍵証明書列pkc_0、pkc_1と乱数列r_0、r_1と暗号化ピースE(k_1)E(k_0)Pと電子署名sig_0とを含む署名対象情報に対する電子署名sig_1を、非公開鍵sk_1を用いて生成したとする。このとき、ノード51Aは、ノード51Bに対して、データ格納部517に記憶されている、ノード50に割り当てられた公開鍵証明書pkc_0に加え固有情報格納部510に記憶されている、自身に割り当てられた公開鍵証明書pkc_1と、データ格納部517に記憶されている乱数r_0に加え自身が生成した乱数r_1と、暗号化ピースE(k_1)E(k_0)Pと、データ格納部517に記憶されている電子署名sig_0に加え自身が生成した電子署名sig_1とを送信する。図5は、ノード51Aからノード51Bに送信される情報を模式的に示す図である。ノード51Bは、電子署名sig_1が、暗号化ピースE(k_1)(k_0)Pと公開鍵証明書列pkc_0、pkc_1と乱数列r_0、r_1及び電子署名sig_0に対する正当な署名かどうかを、公開鍵証明書pkc_1に含まれる公開鍵pk_1を用いて電子署名検証部522において確認する。当該電子署名検証の結果が検証成功だった場合、これらの公開鍵証明書列pkc_0、pkc_1、乱数列r_0、r_1、暗号化ピースE(k_1)E(k_0)P及び電子署名列sig_0、sig_1を対応付けてデータ格納部517に記憶する。
When the node 51A transmits an encrypted piece for the piece P in response to the piece request from the node 51B, the node 51A generates a random number r_1, generates a temporary symmetric key k_1 using this and the secret key s_1, Assume that the encrypted piece E (k_0) P is further encrypted using this and the encrypted piece E (k_1) E (k_0) P is output. E (k_1) E (k_0) P indicates the multiple encrypted pieces P with the temporary symmetric keys k_0 and k_1 in this order. Further, the node 51A obtains the electronic signature sig_1 for the signature target information including the public key certificate sequence pkc_0, pkc_1, the random number sequence r_0, r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic signature sig_0. It is assumed that it is generated using the public key sk_1. At this time, the node 51A assigns itself to the node 51B, which is stored in the unique information storage unit 510 in addition to the public key certificate pkc_0 stored in the data storage unit 517 and assigned to the node 50. Stored in the data storage unit 517, the random number r_1 generated by itself, the encrypted piece E (k_1) E (k_0) P, in addition to the random number r_0 stored in the data storage unit 517 In addition to the electronic signature sig_0, the electronic signature sig_1 generated by itself is transmitted. FIG. 5 is a diagram schematically showing information transmitted from the node 51A to the node 51B. The node 51B determines whether the electronic signature sig_1 is a valid signature for the encrypted piece E (k_1) (k_0) P, the public key certificate sequence pkc_0, pkc_1, the random number sequence r_0, r_1, and the electronic signature sig_0. The electronic signature verification unit 522 confirms the public key pk_1 included in the document pkc_1. If the result of the electronic signature verification is successful, these public key certificate sequences pkc_0 and pkc_1, random number sequences r_0 and r_1, encrypted pieces E (k_1) E (k_0) P and electronic signature sequences sig_0 and sig_1 The data is stored in the data storage unit 517 in association with each other.
また、鍵サーバ53に全てのノードの公開鍵証明書が格納されている場合には、受信した公開鍵証明書からノードIDを取り出して、当該ノードIDを公開鍵証明書の代わりに送信することで、ノード間で送られるデータを削減できる。すなわち、ノード51Aは、ノード51Bに対して、データ格納部517に記憶されている、ノード50に割り当てられた公開鍵証明書pkc_0に含まれているノードID「ID #0」に加え固有情報格納部510に記憶されている、自身に割り当てられた公開鍵証明書pkc_1と、データ格納部517に記憶されている乱数r_0に加え自身が生成した乱数r_1と、暗号化ピースE(k_1)E(k_0)Pと、データ格納部517に記憶されている電子署名sig_0に加え自身が生成した電子署名sig_1とを送信する。図6は、鍵サーバ53に全てのノードの公開鍵証明書が格納されている場合のノード51Aからノード51Bに送信される情報を模式的に示す図である。ノード51Bは、電子署名sig_1が、暗号化ピースE(k_1)(k_0)PとノードID列「ID #0」と公開鍵証明書pkc_1と乱数列r_0、r_1及び電子署名sig_0に対する正当な署名かどうかを、公開鍵証明書pkc_1に含まれる公開鍵pk_1を用いて電子署名検証部522において確認する。当該電子署名検証の結果が検証成功だった場合、これらのノードID列「ID #0」、公開鍵証明書pkc_1、乱数列r_0、r_1、暗号化ピースE(k_1)E(k_0)P及び電子署名列sig_0、sig_1を対応付けてデータ格納部517に記憶する。
When the public key certificates of all nodes are stored in the key server 53, the node ID is extracted from the received public key certificate and the node ID is transmitted instead of the public key certificate. Thus, data sent between nodes can be reduced. That is, the node 51A stores the unique information in addition to the node ID “ID # 0” included in the public key certificate pkc_0 assigned to the node 50 and stored in the data storage unit 517 with respect to the node 51B. Public key certificate pkc_1 assigned to itself stored in unit 510, random number r_1 generated by itself in addition to random number r_0 stored in data storage unit 517, encrypted piece E (k_1) E ( k_0) P and the electronic signature sig_1 generated by itself are transmitted in addition to the electronic signature sig_0 stored in the data storage unit 517. FIG. 6 is a diagram schematically illustrating information transmitted from the node 51 </ b> A to the node 51 </ b> B when the public key certificates of all nodes are stored in the key server 53. The node 51B determines whether the electronic signature sig_1 is a valid signature for the encrypted piece E (k_1) (k_0) P, the node ID string “ID # 0”, the public key certificate pkc_1, the random number strings r_0 and r_1, and the electronic signature sig_0. The electronic signature verification unit 522 confirms whether or not using the public key pk_1 included in the public key certificate pkc_1. If the result of the electronic signature verification is successful, the node ID string “ID # 0”, the public key certificate pkc_1, the random number string r_0, r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic Signature sequences sig_0 and sig_1 are associated with each other and stored in the data storage unit 517.
鍵要求送信部519は、データ格納部517に記憶された暗号化ピースを復号するための復号鍵を要求する鍵要求を鍵サーバ53に送信する。ここで鍵要求送信部519は、当該暗号化ピースに対応してデータ格納部517に記憶されている公開鍵証明書列から取り出されたノードID列及び乱数列を鍵要求に含めて鍵サーバ53に送信する。例えば、ノード51Bが、ノード51Aが暗号化を行った場合に出力された図6に示した暗号化ピースE(k_1)E(k_0)Pを復号するための復号鍵を要求する鍵要求を鍵サーバ53に送信する場合、ノード51Bの鍵要求送信部519は、ノードID列「ID #0、ID #1」と、乱数列r_0、r_1とを含む鍵要求を送信する。図7は、ノード51Bから鍵サーバ53に送信される情報を模式的に示す図である。このように、ノード51は、暗号化ピースを復号するための復号鍵を鍵サーバ53に要求する際に、当該暗号化ピースの配信経路を示すものとして、配信開始ノードであるノード50を基点として当該暗号化ピースの配信を仲介する各ノード50,51の各ノードIDを含むノードID列及び当該各ノード50,51が生成した各乱数を含む乱数列を鍵サーバ53に送信する。尚、これらの送信に際し、鍵要求送信部519は、各ノードIDと当該各ノードIDが割り当てられたノードが生成した乱数との対応関係を保持した状態で送信する。
The key request transmission unit 519 transmits a key request for requesting a decryption key for decrypting the encrypted piece stored in the data storage unit 517 to the key server 53. Here, the key request transmission unit 519 includes the node ID sequence and the random number sequence extracted from the public key certificate sequence stored in the data storage unit 517 corresponding to the encrypted piece, in the key request. Send to. For example, a key request for requesting a decryption key for decrypting the encrypted piece E (k_1) E (k_0) P shown in FIG. 6 that is output when the node 51B performs encryption is the key. When transmitting to the server 53, the key request transmission unit 519 of the node 51B transmits a key request including the node ID string “ID # 0, ID # 1” and the random number sequences r_0 and r_1. FIG. 7 is a diagram schematically showing information transmitted from the node 51B to the key server 53. As shown in FIG. As described above, when the node 51 requests the key server 53 for a decryption key for decrypting the encrypted piece, the node 51 indicates the distribution path of the encrypted piece, with the node 50 that is the distribution start node as a base point. The node ID string including the node IDs of the nodes 50 and 51 that mediate the distribution of the encrypted pieces and the random number string including the random numbers generated by the nodes 50 and 51 are transmitted to the key server 53. At the time of these transmissions, the key request transmission unit 519 performs transmission while maintaining the correspondence between each node ID and the random number generated by the node to which each node ID is assigned.
ピース復号部520は、鍵要求送信部519が送信した鍵要求に応じて鍵サーバ53から送信された一時対称鍵列を復号鍵として受信し、当該一時対称鍵列を用いて暗号化ピースを復号する。例えば、上述の例では、ノード51Aが暗号化を行っていた場合には、ノード51Bは、図7に示したノードID列及び乱数列を含む鍵要求に応じて鍵サーバ53から送信された一時対称鍵列k_0、k_1を受信する。ここで、即ち、ピースに対して少なくとも1回以上行われている各暗号化を解くための各復号鍵が受信される。図8は、鍵サーバ53からノード51Bに送信される情報を模式的に示す図である。同図に示される一時対称鍵列によりピースPが復号される。尚、鍵サーバ53がどのように一時対称鍵列を生成するのかは後述する。
The piece decryption unit 520 receives the temporary symmetric key sequence transmitted from the key server 53 in response to the key request transmitted from the key request transmission unit 519 as a decryption key, and decrypts the encrypted piece using the temporary symmetric key sequence. To do. For example, in the above-described example, when the node 51A performs encryption, the node 51B transmits the temporary request transmitted from the key server 53 in response to the key request including the node ID string and the random number string illustrated in FIG. Symmetric key sequences k_0 and k_1 are received. That is, each decryption key for decrypting each encryption performed at least once on the piece is received. FIG. 8 is a diagram schematically showing information transmitted from the key server 53 to the node 51B. Piece P is decrypted with the temporary symmetric key string shown in FIG. Note that how the key server 53 generates the temporary symmetric key string will be described later.
尚、ノード51が、複数のピースのそれぞれについてどのような順番やタイミングでどのノードから取得するかは特に限定されないが、以上のようにして、ノード51は、複数のピースのそれぞれが暗号化された各暗号化ピースをピース要求によって他のノード50,51から取得する。また、ノード51は、各暗号化ピースについて鍵要求によって各一時対称鍵を鍵サーバ53から受信し、各暗号化ピースを復号することにより、上述の配信データを得る。
Note that the order in which the node 51 obtains each of the plurality of pieces from which node and from which node is not particularly limited, but as described above, the node 51 encrypts each of the plurality of pieces. Each encrypted piece is acquired from the other nodes 50 and 51 by a piece request. Further, the node 51 receives each temporary symmetric key from the key server 53 by a key request for each encrypted piece, and obtains the distribution data described above by decrypting each encrypted piece.
ピース検証要求送信部523は、受信した復号鍵を用いて正しく復号できなかったピースが存在した場合、あるいは復号鍵を受信する前に暗号化ピースが正しく復号可能かどうかを判断したいピースが存在した場合、鍵サーバ53に対して、ピースの検証要求を送信する。なお、正しく復号できなかったピースが存在した場合は、図9に示すようにハッシュ値でピースを検証する方法を用いることもできる。図9を用いてピースが正しく復号できたかどうかを調べる方法の1例を説明する。例えば配信データの提供者が、配信データのピース毎のハッシュ値をあらかじめ計算して、ハッシュ値列(ハッシュテーブル)を準備しておき、各ノードが復号された配信データを入手したときに、当該配信データのハッシュ値とハッシュテーブルのハッシュ値を比較することで、ピースが正しく復号できたかどうかを調べることができる。ピース検証要求送信部523は、データ格納部517に記憶された暗号化ピースの検証を依頼するための検証要求を鍵サーバ53に送信する。ここでピース検証要求送信部523は、検証対象暗号化ピースと共に当該暗号化ピースに対応してデータ格納部517に記憶されている公開鍵証明書列と乱数列及び電子署名列をピース検証要求に含めて鍵サーバ53に送信する。
When there is a piece that cannot be correctly decrypted using the received decryption key, or the piece verification request transmission unit 523 has received a piece to determine whether the encrypted piece can be correctly decrypted before receiving the decryption key. In this case, a piece verification request is transmitted to the key server 53. If there is a piece that could not be correctly decrypted, a method of verifying the piece with a hash value as shown in FIG. 9 can be used. An example of a method for checking whether or not a piece has been correctly decoded will be described with reference to FIG. For example, when a provider of distribution data calculates a hash value for each piece of distribution data in advance and prepares a hash value string (hash table), and each node obtains decrypted distribution data, By comparing the hash value of the distribution data with the hash value of the hash table, it is possible to check whether or not the piece has been correctly decrypted. The piece verification request transmission unit 523 transmits a verification request for requesting verification of the encrypted piece stored in the data storage unit 517 to the key server 53. Here, the piece verification request transmission unit 523 uses the public key certificate sequence, the random number sequence, and the electronic signature sequence stored in the data storage unit 517 corresponding to the encrypted piece together with the verification target encrypted piece as a piece verification request. To the key server 53.
例えば、ノード51Bが、ノード51Aが暗号化を行った場合に出力された図5に示した暗号化ピースE(k_1)E(k_0)Pを検証するための検証要求を鍵サーバ53に送信する場合、ノード51Bのピース検証要求送信部523は、公開鍵証明書列pkc_0、pkc_1と、乱数列r_0、r_1と、暗号化ピースE(k_1)E(k_0)Pと、電子署名列sig_0、sig_1とを含むピース検証要求を送信する。図10は、ノード51Bから鍵サーバ53に送信される情報を模式的に示す図である。このように、ノード51は、暗号化ピースを検証するための検証要求を鍵サーバ53に要求する際に、当該暗号化ピースの配信経路を示すものとして、配信開始ノードであるノード50を基点として当該暗号化ピースの配信を仲介する各ノード50,51の各公開鍵証明書を含む公開鍵証明書列、当該各ノード50,51が生成した各乱数を含む乱数列及び当該各ノード50,51が生成した各電子署名を含む電子署名列を鍵サーバ53に送信する。尚、これらの送信に際し、ピース検証要求送信部523は、各公開鍵証明書と当該各公開鍵証明書が割り当てられたノードが生成した乱数と当該各公開鍵証明書が割り当てられたノードが生成した電子署名との対応関係を保持した状態で送信する。
For example, the node 51B transmits a verification request for verifying the encrypted piece E (k_1) E (k_0) P shown in FIG. 5 output when the node 51A performs encryption to the key server 53. In this case, the piece verification request transmission unit 523 of the node 51B, the public key certificate strings pkc_0 and pkc_1, the random number strings r_0 and r_1, the encrypted piece E (k_1) E (k_0) P, and the electronic signature strings sig_0 and sig_1 A piece verification request including FIG. 10 is a diagram schematically showing information transmitted from the node 51B to the key server 53. As shown in FIG. Thus, when the node 51 requests the key server 53 for a verification request for verifying the encrypted piece, the node 51 indicates the distribution route of the encrypted piece, and the node 50 that is the distribution start node is the base point. A public key certificate sequence including each public key certificate of each of the nodes 50 and 51 that mediates distribution of the encrypted piece, a random number sequence including each random number generated by each of the nodes 50 and 51, and each of the nodes 50 and 51 The electronic signature sequence including each electronic signature generated by the is transmitted to the key server 53. In these transmissions, the piece verification request transmission unit 523 generates each public key certificate, a random number generated by the node to which the public key certificate is assigned, and a node to which the public key certificate is assigned. Is transmitted in a state where the correspondence with the electronic signature is maintained.
また、鍵サーバ53に全てのノードの公開鍵証明書が格納されている場合には、ピース検証要求送信部523は、データ格納部517に記憶された暗号化ピースの検証を依頼するための検証要求を鍵サーバ53に送信する。このときピース検証要求送信部523は、当該暗号化ピースに対応してデータ格納部517に記憶されているノードID列と乱数列及び電子署名列をピース検証要求に含めて鍵サーバ53に送信する。例えば、ノード51Bが、ノード51Aが暗号化を行った場合に出力された図6に示した暗号化ピースE(k_1)E(k_0)Pを検証するための検証要求を鍵サーバ53に送信する場合、ノード51Bのピース検証要求送信部523は、公開鍵証明書pkc_1からノードID「ID #1」を取り出した後に、ノードID列「ID #0、ID #1」と、乱数列r_0、r_1と、暗号化ピースE(k_1)E(k_0)Pと、電子署名列sig_0、sig_1とを含むピース検証要求を送信する。
When the public key certificates of all nodes are stored in the key server 53, the piece verification request transmission unit 523 performs verification for requesting verification of the encrypted pieces stored in the data storage unit 517. The request is transmitted to the key server 53. At this time, the piece verification request transmission unit 523 includes the node ID sequence, random number sequence, and electronic signature sequence stored in the data storage unit 517 corresponding to the encrypted piece in the piece verification request and transmits them to the key server 53. . For example, the node 51B transmits a verification request for verifying the encrypted piece E (k_1) E (k_0) P shown in FIG. 6 output when the node 51A performs encryption to the key server 53. In this case, the piece verification request transmission unit 523 of the node 51B extracts the node ID “ID # 1” from the public key certificate pkc_1, and then the node ID string “ID # 0, ID # 1” and the random number sequence r_0, r_1. And a piece verification request including the encrypted piece E (k_1) E (k_0) P and the electronic signature strings sig_0 and sig_1.
図11は、鍵サーバ53に全てのノードの公開鍵証明書が格納されている場合における、ノード51Bから鍵サーバ53に送信される情報を模式的に示す図である。このように、ノード51は、暗号化ピースを検証するための検証要求を鍵サーバ53に要求する際に、当該暗号化ピースの配信経路を示すものとして、配信開始ノードであるノード50を基点として当該暗号化ピースの配信を仲介する各ノード50,51の各ノードID列、当該各ノード50,51が生成した各乱数を含む乱数列及び当該各ノード50,51が生成した各電子署名を含む電子署名列を鍵サーバ53に送信する。尚、これらの送信に際し、ピース検証要求送信部523は、各ノードIDと当該各ノードIDが割り当てられたノードが生成した乱数と当該ノードIDが割り当てられたノードが生成した電子署名との対応関係を保持した状態で送信する。
FIG. 11 is a diagram schematically showing information transmitted from the node 51B to the key server 53 when the public key certificates of all the nodes are stored in the key server 53. Thus, when the node 51 requests the key server 53 for a verification request for verifying the encrypted piece, the node 51 indicates the distribution route of the encrypted piece, and the node 50 that is the distribution start node is the base point. Each node ID string of each node 50, 51 that mediates the distribution of the encrypted piece, a random number sequence including each random number generated by each node 50, 51, and each electronic signature generated by each node 50, 51 is included. The electronic signature sequence is transmitted to the key server 53. In these transmissions, the piece verification request transmission unit 523 associates each node ID with a random number generated by the node to which the node ID is assigned and an electronic signature generated by the node to which the node ID is assigned. Send in the state of holding.
データ受信部514は、ピース検証要求送信部523が送信したピース検証要求に応じて鍵サーバ53から送信されたピース検証結果を受信して、当該検証結果が検証失敗であった場合には対応する暗号化ピースを破棄し、再度他のノード51から暗号化ピースの取得を試みる。
The data reception unit 514 receives the piece verification result transmitted from the key server 53 in response to the piece verification request transmitted by the piece verification request transmission unit 523, and responds when the verification result is a verification failure. Discard the encrypted piece and try to obtain the encrypted piece from another node 51 again.
<鍵サーバの構成>
次に、鍵サーバ53のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図12は、鍵サーバ53の機能的構成を例示する図である。鍵サーバ53は、秘密鍵格納部530と、データ受信部531と、公開鍵証明書格納部532と、一時対称鍵生成部533と、データ送信部534と、電子署名検証部535と、ピース検証要求受付部536と、ピース復号部537と、不正ノードリスト格納部538とを有する。尚、秘密鍵格納部530と公開鍵証明書格納部532及び不正ノードリスト格納部538とは、例えば鍵サーバ53のHDDなどの外部記憶装置に記憶領域として確保されるものである。データ受信部531と、一時対称鍵生成部533と、データ送信部534と、電子署名検証部535と、ピース検証要求受付部536と、ピース復号部537との実体は、鍵サーバ53のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。 <Key server configuration>
Next, various functions realized when the CPU of thekey server 53 executes various programs stored in the storage device or the external storage device will be described. FIG. 12 is a diagram illustrating a functional configuration of the key server 53. The key server 53 includes a secret key storage unit 530, a data reception unit 531, a public key certificate storage unit 532, a temporary symmetric key generation unit 533, a data transmission unit 534, an electronic signature verification unit 535, and a piece verification. The request receiving unit 536, the piece decoding unit 537, and the unauthorized node list storage unit 538 are included. The private key storage unit 530, the public key certificate storage unit 532, and the unauthorized node list storage unit 538 are secured as storage areas in an external storage device such as an HDD of the key server 53, for example. The entity of the data receiving unit 531, the temporary symmetric key generation unit 533, the data transmission unit 534, the electronic signature verification unit 535, the piece verification request reception unit 536, and the piece decryption unit 537 is the CPU of the key server 53. It is generated on a storage device such as a RAM when the program is executed.
次に、鍵サーバ53のCPUが記憶装置や外部記憶装置に記憶された各種プログラムを実行することにより実現される各種機能について説明する。図12は、鍵サーバ53の機能的構成を例示する図である。鍵サーバ53は、秘密鍵格納部530と、データ受信部531と、公開鍵証明書格納部532と、一時対称鍵生成部533と、データ送信部534と、電子署名検証部535と、ピース検証要求受付部536と、ピース復号部537と、不正ノードリスト格納部538とを有する。尚、秘密鍵格納部530と公開鍵証明書格納部532及び不正ノードリスト格納部538とは、例えば鍵サーバ53のHDDなどの外部記憶装置に記憶領域として確保されるものである。データ受信部531と、一時対称鍵生成部533と、データ送信部534と、電子署名検証部535と、ピース検証要求受付部536と、ピース復号部537との実体は、鍵サーバ53のCPUのプログラム実行時にRAMなどの記憶装置上に生成されるものである。 <Key server configuration>
Next, various functions realized when the CPU of the
秘密鍵格納部530は、各ノード50,51に割り当てられた秘密鍵を、各ノード50,51に割り当てられた公開鍵証明書あるいは公開鍵証明書に含まれるノードIDと対応付けて記憶する。データ受信部531は、上述したノードID列及び乱数列を含む鍵要求をノード51から受信する。
The private key storage unit 530 stores the private key assigned to each of the nodes 50 and 51 in association with the public key certificate assigned to each of the nodes 50 and 51 or the node ID included in the public key certificate. The data receiving unit 531 receives a key request including the above-described node ID sequence and random number sequence from the node 51.
公開鍵証明書格納部532は、鍵サーバ53に全てのノードの公開鍵証明書を格納するように構成する場合に備えられる。公開鍵証明書を格納せずにノードIDを備えるように構成する場合は、鍵サーバ53は公開鍵証明書格納部532を備える必要はない。公開鍵証明書格納部532は、各ノード50,51に割り当てられた公開鍵証明書を記憶する。当該公開鍵証明書格納部532に全ノードの公開鍵証明書が記憶されていると、ノード間のデータ転送量や、後述するピース検証要求におけるデータ転送量を削減できる。
The public key certificate storage unit 532 is provided when the key server 53 is configured to store the public key certificates of all nodes. In the case where the node ID is provided without storing the public key certificate, the key server 53 does not need to include the public key certificate storage unit 532. The public key certificate storage unit 532 stores public key certificates assigned to the nodes 50 and 51. If the public key certificates of all the nodes are stored in the public key certificate storage unit 532, the data transfer amount between the nodes and the data transfer amount in a piece verification request to be described later can be reduced.
一時対称鍵生成部533は、データ受信部531が受信した鍵要求に含まれる各ノードIDに対応づけられて秘密鍵格納部530に記憶されている秘密鍵s_i(0≦i≦j-1:jはピースの暗号化回数、以下同様)を読み出し、当該秘密鍵と当該鍵要求に含まれる乱数列に含まれる各乱数r_i(0≦i≦j-1)を用いて、関数Fにより復号鍵k_iを生成する。これを式により表すと以下の(5)式のように表される。尚、関数Fは上述のノード50又はノード51が一時対称鍵を生成する際に用いたものと同じである。従って、ここでは、乱数と秘密鍵とを用いて当該関数Fにより一時対称鍵を復元することになる。
k_i = F(s_i, r_i) ・・・(5) The temporary symmetrickey generation unit 533 is associated with each node ID included in the key request received by the data reception unit 531 and is stored in the secret key storage unit 530 in the secret key s_i (0 ≦ i ≦ j−1: j is the number of times the piece is encrypted, and so on, and the decryption key is obtained by function F using each secret key and each random number r_i (0 ≦ i ≦ j-1) included in the random number sequence included in the key request. Generate k_i. This can be expressed by the following equation (5). The function F is the same as that used when the node 50 or the node 51 generates a temporary symmetric key. Accordingly, here, the temporary symmetric key is restored by the function F using the random number and the secret key.
k_i = F (s_i, r_i) (5)
k_i = F(s_i, r_i) ・・・(5) The temporary symmetric
k_i = F (s_i, r_i) (5)
データ送信部534は、一時対称鍵生成部533が復号鍵として生成した一時対称鍵を、データ受信部531が受信した鍵要求を送信したノード51に対して送信する。例えば、上述の例では、ノード51Aが暗号化を行っていた場合には、鍵サーバ53は、図7に示されるノードID列及び乱数列を含む鍵要求に応じて、図8に示されるように、各乱数r_0、r_1に対して一時対称鍵k_0、k_1を得て、これをノード51Bに対して送信する。当該ピースについて行われた全ての暗号化のそれぞれを復号するための各対称鍵がノード51Bに対して送信されることにより、ノード51Bは当該暗号化ピースの暗号化を完全に復号することができる。
The data transmission unit 534 transmits the temporary symmetric key generated by the temporary symmetric key generation unit 533 as the decryption key to the node 51 that has transmitted the key request received by the data reception unit 531. For example, in the above example, when the node 51A performs encryption, the key server 53 is as shown in FIG. 8 in response to the key request including the node ID string and the random number string shown in FIG. Then, temporary symmetric keys k_0 and k_1 are obtained for the random numbers r_0 and r_1, and transmitted to the node 51B. Each symmetric key for decrypting each encryption performed on the piece is transmitted to the node 51B, so that the node 51B can completely decrypt the encryption of the encrypted piece. .
ピース検証要求受付部536は、上述した公開鍵証明書列と乱数列と暗号化ピースと電子署名列とを含むピース検証要求をノード51から受信する。例として、図10で示されるピース検証要求を受信したとすると、一時対称鍵生成部533は、鍵要求を受信したときと同様の処理で復号鍵k_0、k_1を生成する。電子署名検証部535は、公開鍵証明書列に含まれる各公開鍵pk_0、pk_1を用いて電子署名列sig_0、sig_1の検証を実施し、ピース復号部537はE(k_1)(k_0)Pの復号を実施する。電子署名の検証および暗号化ピースの復号の手順は以下の通りである。まず、公開鍵pk_1を用いて、暗号化ピースE(k_1)E(k_0)Pと公開鍵証明書列pkc_0、pkc_1と乱数列r_0、r_1と電子署名sig_0とを含む署名対象情報に対する電子署名sig_1を以下の(6)式のように関数VERIFYにより検証する。
検証結果=VERIFY(pk_1, E(k_1)(k_0)P || pkc_0 || r_0 || sig_0 || pck_1 || r_1, sig_1) ・・・(6) The piece verificationrequest reception unit 536 receives from the node 51 a piece verification request including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence. As an example, if the piece verification request shown in FIG. 10 is received, the temporary symmetric key generation unit 533 generates the decryption keys k_0 and k_1 by the same process as when the key request is received. The electronic signature verification unit 535 performs verification of the electronic signature sequences sig_0 and sig_1 using the public keys pk_0 and pk_1 included in the public key certificate sequence, and the piece decryption unit 537 stores E (k_1) (k_0) P. Perform decryption. The procedure for verifying the electronic signature and decrypting the encrypted piece is as follows. First, using the public key pk_1, the electronic signature sig_1 for the signature target information including the encrypted piece E (k_1) E (k_0) P, the public key certificate sequence pkc_0, pkc_1, the random number sequence r_0, r_1, and the electronic signature sig_0 Is verified by the function VERIFY as shown in the following equation (6).
Verification result = VERIFY (pk_1, E (k_1) (k_0) P || pkc_0 || r_0 || sig_0 || pck_1 || r_1, sig_1) (6)
検証結果=VERIFY(pk_1, E(k_1)(k_0)P || pkc_0 || r_0 || sig_0 || pck_1 || r_1, sig_1) ・・・(6) The piece verification
Verification result = VERIFY (pk_1, E (k_1) (k_0) P || pkc_0 || r_0 || sig_0 || pck_1 || r_1, sig_1) (6)
上記(6)式の検証に失敗した場合には、不正ノードリスト格納部538に記憶された不正ノードリストに、ピース検証要求受付部536が受信したピース検証要求を送信したノード51のノードIDが追記されて、データ送信部534が「検証失敗」を当該ノード51に対して送信する。上記の検証に成功した場合には、一時対称鍵k_1を用いて暗号化ピースを復号し、公開鍵pk_0を用いて、暗号化ピースE(k_0)Pと公開鍵証明書列pkc_0と乱数列r_0とを含む署名対象情報に対する電子署名sig_0を以下の(7)式のように関数VERIFYにより検証する。
検証結果=VERIFY(pk_0, E(k_0)P || pkc_0 || r_0, sig_0) ・・・(7) When the verification of the expression (6) fails, the node ID of thenode 51 that has transmitted the piece verification request received by the piece verification request receiving unit 536 is added to the illegal node list stored in the illegal node list storage unit 538. In addition, the data transmission unit 534 transmits “verification failure” to the node 51. If the above verification is successful, the encrypted piece is decrypted using the temporary symmetric key k_1, and the encrypted piece E (k_0) P, the public key certificate string pkc_0, and the random number string r_0 using the public key pk_0. The electronic signature sig_0 for the signature target information including the above is verified by the function VERIFY as shown in the following equation (7).
Verification result = VERIFY (pk_0, E (k_0) P || pkc_0 || r_0, sig_0) (7)
検証結果=VERIFY(pk_0, E(k_0)P || pkc_0 || r_0, sig_0) ・・・(7) When the verification of the expression (6) fails, the node ID of the
Verification result = VERIFY (pk_0, E (k_0) P || pkc_0 || r_0, sig_0) (7)
上記(7)式の検証に失敗した場合には、不正ノードリスト格納部538に記憶された不正ノードリストに、公開鍵証明書pkc_1に含まれるノードIDが追記されて、データ送信部534が「検証失敗」を当該ノード51に対して送信する。上記の検証に成功した場合には、データ送信部534が「検証成功」を当該ノード51に対して送信する。
When the verification of the expression (7) fails, the node ID included in the public key certificate pkc_1 is added to the unauthorized node list stored in the unauthorized node list storage unit 538, and the data transmitting unit 534 “Verification failure” is transmitted to the node 51. If the verification is successful, the data transmission unit 534 transmits “verification successful” to the node 51.
また、鍵サーバ53に全てのノードの公開鍵証明書が格納されている場合には、ピース検証要求受付部536は、図11に示す検証依頼を受信する。当該検証依頼には、ノードID列が含まれており、鍵サーバ53は公開鍵証明書格納部に記録されている公開鍵証明書の中から当該ノードIDに対応する公開鍵証明書pkc_i(0≦i≦j-1)を取り出す。その後のピース検証処理は、上述の図10に示す検証依頼を受信した場合と同様である。
If the public key certificates of all nodes are stored in the key server 53, the piece verification request receiving unit 536 receives the verification request shown in FIG. The verification request includes a node ID string, and the key server 53 selects the public key certificate pkc_i (0) corresponding to the node ID from among the public key certificates recorded in the public key certificate storage unit. ≦ i ≦ j-1) is taken out. The subsequent piece verification process is the same as when the verification request shown in FIG. 10 is received.
(2)動作
<配信開始ノード:配信処理>
次に、本実施の形態にかかるデータ配信システムで行われる処理の手順について説明する。まず、配信開始ノードであるノード50が行う配信処理の手順について図13を用いて説明する。ノード50は、配信データを複数のピースに分割する(ステップS1)。そして、ノード50は、ピースを要求するピース要求を他のノード51から受信すると(ステップS2:YES)、乱数r_0を生成する(ステップS3)。次いで、ノード50は、乱数r_0と固有情報格納部500に記憶された秘密鍵s_0とを用いて関数Fにより一時対称鍵k_0を生成する(ステップS4)。そして、ノード50は、ステップS4で生成した一時対称鍵を用いて、送信対象となるピースPを暗号化して、暗号化ピースE(k_0)Pを出力する(ステップS5)。尚、送信対象となるピースをどのように決定するかは特に限定されない。さらに、ノード50は、固有情報格納部500に記憶された非公開鍵sk_0を用いて、ステップS5で生成された暗号化ピースE(k_0)Pとノード50自身の公開鍵証明書pkc_0とステップS3で生成された乱数r_0とを含む署名対象情報に対する電子署名sig_0を生成する(ステップS6)。そして、ノード50は、ステップS2で受信されたピース要求を送信した他のノード51に対して、例えば図4に示されるように、固有情報格納部500に記憶されている公開鍵証明書pkc_0と、ステップS3で生成した乱数r_0と、ステップS5で出力した暗号化ピースE(k_0)Pと、ステップS6で生成した電子署名sig_0とを送信する(ステップS7)。その後ステップS2に戻り、ノード50は、新たなピース要求の受信を待機する。尚、ステップS2で受信されるピース要求は、同一のノード51であるとは限らず、当該ピース要求によって要求されるピースPは、同一のピースであるとは限らない。また、ステップS3で生成する乱数は基本的にステップS3の処理毎に異なる。 (2) Operation <Distribution start node: distribution processing>
Next, a procedure of processing performed in the data distribution system according to the present embodiment will be described. First, the procedure of the distribution process performed by thenode 50 that is the distribution start node will be described with reference to FIG. The node 50 divides the distribution data into a plurality of pieces (step S1). When the node 50 receives a piece request for requesting a piece from another node 51 (step S2: YES), the node 50 generates a random number r_0 (step S3). Next, the node 50 generates the temporary symmetric key k_0 by the function F using the random number r_0 and the secret key s_0 stored in the unique information storage unit 500 (step S4). Then, the node 50 encrypts the piece P to be transmitted using the temporary symmetric key generated in step S4, and outputs the encrypted piece E (k_0) P (step S5). In addition, how to determine the piece to be transmitted is not particularly limited. Further, the node 50 uses the private key sk_0 stored in the unique information storage unit 500, the encrypted piece E (k_0) P generated in step S5, the public key certificate pkc_0 of the node 50 itself, and step S3. The electronic signature sig_0 for the signature target information including the random number r_0 generated in step S6 is generated (step S6). Then, the node 50 transmits the public key certificate pkc_0 stored in the unique information storage unit 500 to the other node 51 that has transmitted the piece request received in step S2, as shown in FIG. The random number r_0 generated in step S3, the encrypted piece E (k_0) P output in step S5, and the electronic signature sig_0 generated in step S6 are transmitted (step S7). Thereafter, the process returns to step S2, and the node 50 waits for reception of a new piece request. Note that the piece requests received in step S2 are not necessarily the same node 51, and the pieces P requested by the piece requests are not necessarily the same piece. Further, the random number generated in step S3 basically differs for each process in step S3.
<配信開始ノード:配信処理>
次に、本実施の形態にかかるデータ配信システムで行われる処理の手順について説明する。まず、配信開始ノードであるノード50が行う配信処理の手順について図13を用いて説明する。ノード50は、配信データを複数のピースに分割する(ステップS1)。そして、ノード50は、ピースを要求するピース要求を他のノード51から受信すると(ステップS2:YES)、乱数r_0を生成する(ステップS3)。次いで、ノード50は、乱数r_0と固有情報格納部500に記憶された秘密鍵s_0とを用いて関数Fにより一時対称鍵k_0を生成する(ステップS4)。そして、ノード50は、ステップS4で生成した一時対称鍵を用いて、送信対象となるピースPを暗号化して、暗号化ピースE(k_0)Pを出力する(ステップS5)。尚、送信対象となるピースをどのように決定するかは特に限定されない。さらに、ノード50は、固有情報格納部500に記憶された非公開鍵sk_0を用いて、ステップS5で生成された暗号化ピースE(k_0)Pとノード50自身の公開鍵証明書pkc_0とステップS3で生成された乱数r_0とを含む署名対象情報に対する電子署名sig_0を生成する(ステップS6)。そして、ノード50は、ステップS2で受信されたピース要求を送信した他のノード51に対して、例えば図4に示されるように、固有情報格納部500に記憶されている公開鍵証明書pkc_0と、ステップS3で生成した乱数r_0と、ステップS5で出力した暗号化ピースE(k_0)Pと、ステップS6で生成した電子署名sig_0とを送信する(ステップS7)。その後ステップS2に戻り、ノード50は、新たなピース要求の受信を待機する。尚、ステップS2で受信されるピース要求は、同一のノード51であるとは限らず、当該ピース要求によって要求されるピースPは、同一のピースであるとは限らない。また、ステップS3で生成する乱数は基本的にステップS3の処理毎に異なる。 (2) Operation <Distribution start node: distribution processing>
Next, a procedure of processing performed in the data distribution system according to the present embodiment will be described. First, the procedure of the distribution process performed by the
<受信処理>
次に、ノード51がノード50又は他のノード51から暗号化ピースを受信する受信処理の手順について図14を用いて説明する。ノード51は、ピースを要求するピース要求をノード50又は他のノード51に対して送信する(ステップS10)。そして、ノード51は、ステップS10でピース要求を送信した相手であるノード50又は他のノード51から、公開鍵証明書列と、乱数列と、暗号化ピースと、電子署名列とを受信する(ステップS11)。次いで、送信した相手であるノード50又は他のノード51が生成した電子署名の検証を行なう(ステップS12)。ステップS12の検証に成功すると(ステップS13:YES)、ノード51は、ステップS11で受信した公開鍵証明書列、乱数列、暗号化ピース及び電子署名列を対応付けて記憶する(ステップS14)。一方、ステップ12の検証に失敗すると(ステップS13:NO)、ノード51は、ステップS11で受信した公開鍵証明書列、乱数列、暗号化ピース及び電子署名列を破棄する(ステップS15)。 <Reception processing>
Next, a reception process procedure in which thenode 51 receives an encrypted piece from the node 50 or another node 51 will be described with reference to FIG. The node 51 transmits a piece request for requesting a piece to the node 50 or another node 51 (step S10). Then, the node 51 receives the public key certificate string, the random number string, the encrypted piece, and the electronic signature string from the node 50 or another node 51 that is the partner who transmitted the piece request in step S10 ( Step S11). Next, the electronic signature generated by the node 50 or the other node 51 which is the transmission partner is verified (step S12). If the verification in step S12 is successful (step S13: YES), the node 51 stores the public key certificate string, random number string, encrypted piece, and electronic signature string received in step S11 in association with each other (step S14). On the other hand, if the verification in step 12 fails (step S13: NO), the node 51 discards the public key certificate sequence, random number sequence, encrypted piece, and electronic signature sequence received in step S11 (step S15).
次に、ノード51がノード50又は他のノード51から暗号化ピースを受信する受信処理の手順について図14を用いて説明する。ノード51は、ピースを要求するピース要求をノード50又は他のノード51に対して送信する(ステップS10)。そして、ノード51は、ステップS10でピース要求を送信した相手であるノード50又は他のノード51から、公開鍵証明書列と、乱数列と、暗号化ピースと、電子署名列とを受信する(ステップS11)。次いで、送信した相手であるノード50又は他のノード51が生成した電子署名の検証を行なう(ステップS12)。ステップS12の検証に成功すると(ステップS13:YES)、ノード51は、ステップS11で受信した公開鍵証明書列、乱数列、暗号化ピース及び電子署名列を対応付けて記憶する(ステップS14)。一方、ステップ12の検証に失敗すると(ステップS13:NO)、ノード51は、ステップS11で受信した公開鍵証明書列、乱数列、暗号化ピース及び電子署名列を破棄する(ステップS15)。 <Reception processing>
Next, a reception process procedure in which the
尚、ノード51がノード50にピース要求を送信した場合は、ステップS11ではピースPについて図4に示される公開鍵証明書列と、乱数列と、暗号化ピースと電子署名列とを受信する。ここで、図示はしないが、P2PネットワークNTに接続されるノードであって、fを1以上の整数として、f番目にピースPを受信するノードについて一般化して説明する。説明の便宜上、当該ノードのノードIDをID# fとする。ノードID「ID# f」が割り当てられたノードは、(f -1)番目のノードID「ID# (f-1)」が割り当てられたノードから、図15に示されるように、ピースPについて、公開鍵証明書列pkc_0、・・・、pkc_{f-1}と、乱数列r_0、・・・、r_{f-1}と、暗号化ピースE(k_{f-1})・・・E(k_0)Pと、電子署名列sig_0・・・、sig_{f-1}とを受信する。このとき、公開鍵証明書列に含まれるノードID「ID #0、・・・、ID #(f-1)」によって、暗号化ピースがどのノードによって暗号化されて送信されたかが各々特定されるため、暗号化ピースの配信経路が示されることになる。
When the node 51 transmits a piece request to the node 50, the public key certificate string, the random number string, the encrypted piece, and the electronic signature string shown in FIG. Here, although not shown in the figure, a node connected to the P2P network NT, where f is an integer equal to or greater than 1, will be described in a generalized manner. For convenience of explanation, the node ID of the node is ID # f. The node to which the node ID “ID # f” is assigned is about the piece P as shown in FIG. 15 from the node to which the (f -1) th node ID “ID # (f-1)” is assigned. , Public key certificate sequence pkc_0,..., Pkc_ {f-1}, random number sequence r_0,..., R_ {f-1}, and encrypted piece E (k_ {f-1}). Receive E (k_0) P and digital signature sequence sig_0... Sig_ {f-1}. At this time, the node IDs “ID # 0,..., ID # (f-1)” included in the public key certificate string respectively specify which node the encrypted piece was encrypted and transmitted. Therefore, the distribution route of the encrypted piece is shown.
<配信開始ノード以外のノード:配信処理>
次に、配信開始ノード以外のノード51が行う配信処理の手順について図16を用いて説明する。ノード51は、ピースを要求するピース要求を他のノード51から受信すると(ステップS20:YES)、乱数を生成する(ステップS21)。そしてノード51は、ステップS21で生成した乱数と、固有情報格納部510に記憶された秘密鍵とを用いて関数Fにより一時対称鍵を生成する(ステップS22)。次いでノード51は、ステップS22で生成した一時対称鍵を用いて、あるピースPが暗号化された暗号化ピースであってデータ格納部517に記憶されている暗号化ピースを更に暗号化して、新たな暗号化ピースを出力する(ステップS23)。そして、固有情報格納部510に記憶された非公開鍵を用いて、関数SIGNにより公開鍵証明書列と乱数列と暗号化ピースと電子署名列とを含む署名対象情報に対する電子署名を生成する(ステップS24)。その後ノード51は、ステップS20で受信されたピース要求を送信した他のノード51に対して、送信対象である暗号化ピースに対応付けられてデータ格納部517に記憶された公開鍵証明書に加え固有情報格納部510に記憶された公開鍵証明書を含む新たな公開鍵証明書列と、当該暗号化ピースに対応付けられてデータ格納部517に記憶された乱数列に加えステップS21で生成した乱数を含む新たな乱数列と、ステップS23で出力した新たな暗号化ピースと、当該暗号化ピースに対応付けられてデータ格納部517に記憶された電子署名列に加えステップS24で生成した電子署名を含む電子署名列とを送信する(ステップS25)。 <Nodes other than the distribution start node: distribution processing>
Next, the procedure of distribution processing performed by thenodes 51 other than the distribution start node will be described with reference to FIG. When the node 51 receives a piece request for requesting a piece from another node 51 (step S20: YES), the node 51 generates a random number (step S21). Then, the node 51 generates a temporary symmetric key by the function F using the random number generated in step S21 and the secret key stored in the unique information storage unit 510 (step S22). Next, using the temporary symmetric key generated in step S22, the node 51 further encrypts an encrypted piece that is an encrypted piece obtained by encrypting a piece P and is stored in the data storage unit 517, and newly An encrypted piece is output (step S23). Then, using the private key stored in the unique information storage unit 510, the function SIGN generates an electronic signature for the signature target information including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence ( Step S24). Thereafter, the node 51 adds the public key certificate stored in the data storage unit 517 in association with the encrypted piece to be transmitted to the other node 51 that has transmitted the piece request received in step S20. In addition to the new public key certificate sequence including the public key certificate stored in the unique information storage unit 510 and the random number sequence stored in the data storage unit 517 in association with the encrypted piece, it is generated in step S21. In addition to the new random number sequence including the random number, the new encrypted piece output in step S23, and the electronic signature sequence stored in the data storage unit 517 in association with the encrypted piece, the electronic signature generated in step S24 And an electronic signature sequence including the message (step S25).
次に、配信開始ノード以外のノード51が行う配信処理の手順について図16を用いて説明する。ノード51は、ピースを要求するピース要求を他のノード51から受信すると(ステップS20:YES)、乱数を生成する(ステップS21)。そしてノード51は、ステップS21で生成した乱数と、固有情報格納部510に記憶された秘密鍵とを用いて関数Fにより一時対称鍵を生成する(ステップS22)。次いでノード51は、ステップS22で生成した一時対称鍵を用いて、あるピースPが暗号化された暗号化ピースであってデータ格納部517に記憶されている暗号化ピースを更に暗号化して、新たな暗号化ピースを出力する(ステップS23)。そして、固有情報格納部510に記憶された非公開鍵を用いて、関数SIGNにより公開鍵証明書列と乱数列と暗号化ピースと電子署名列とを含む署名対象情報に対する電子署名を生成する(ステップS24)。その後ノード51は、ステップS20で受信されたピース要求を送信した他のノード51に対して、送信対象である暗号化ピースに対応付けられてデータ格納部517に記憶された公開鍵証明書に加え固有情報格納部510に記憶された公開鍵証明書を含む新たな公開鍵証明書列と、当該暗号化ピースに対応付けられてデータ格納部517に記憶された乱数列に加えステップS21で生成した乱数を含む新たな乱数列と、ステップS23で出力した新たな暗号化ピースと、当該暗号化ピースに対応付けられてデータ格納部517に記憶された電子署名列に加えステップS24で生成した電子署名を含む電子署名列とを送信する(ステップS25)。 <Nodes other than the distribution start node: distribution processing>
Next, the procedure of distribution processing performed by the
<復号処理>
次に、ノード51が鍵サーバ53から復号鍵を取得しこれを用いて暗号化ピースを復号する復号処理の手順について図17を用いて説明する。ノード51は、データ格納部517に記憶された暗号化ピースに対応付けられている公開鍵証明書列及び乱数列を読み出し(ステップS30)、公開鍵証明書に含まれるノードIDを元にノードID列を取得する(ステップS31)。そして、当該暗号化ピースを復号するための復号鍵を要求すると共に、ステップS31で取得したノードID列及びデータ格納部517から読み出した乱数列を含む鍵要求を鍵サーバ53に送信する(ステップS32)。次いで、ノード51は、ステップS32で送信された鍵要求に応じて鍵サーバ53から送信された一時対称鍵を復号鍵として受信し(ステップS33)、当該一時対称鍵を用いて暗号化ピースを復号する(ステップS34)。 <Decryption process>
Next, a procedure of a decryption process in which thenode 51 acquires a decryption key from the key server 53 and decrypts the encrypted piece using the decryption key will be described with reference to FIG. The node 51 reads the public key certificate sequence and the random number sequence associated with the encrypted piece stored in the data storage unit 517 (step S30), and node ID based on the node ID included in the public key certificate A column is acquired (step S31). Then, a decryption key for decrypting the encrypted piece is requested, and a key request including the node ID sequence acquired in step S31 and the random number sequence read from the data storage unit 517 is transmitted to the key server 53 (step S32). ). Next, the node 51 receives the temporary symmetric key transmitted from the key server 53 in response to the key request transmitted in step S32 as a decryption key (step S33), and decrypts the encrypted piece using the temporary symmetric key. (Step S34).
次に、ノード51が鍵サーバ53から復号鍵を取得しこれを用いて暗号化ピースを復号する復号処理の手順について図17を用いて説明する。ノード51は、データ格納部517に記憶された暗号化ピースに対応付けられている公開鍵証明書列及び乱数列を読み出し(ステップS30)、公開鍵証明書に含まれるノードIDを元にノードID列を取得する(ステップS31)。そして、当該暗号化ピースを復号するための復号鍵を要求すると共に、ステップS31で取得したノードID列及びデータ格納部517から読み出した乱数列を含む鍵要求を鍵サーバ53に送信する(ステップS32)。次いで、ノード51は、ステップS32で送信された鍵要求に応じて鍵サーバ53から送信された一時対称鍵を復号鍵として受信し(ステップS33)、当該一時対称鍵を用いて暗号化ピースを復号する(ステップS34)。 <Decryption process>
Next, a procedure of a decryption process in which the
例えば、上述したノードID「ID #f」が割り当てられたノードは、鍵サーバ53に対して、図18に示されるように、ピースPについて、ノードID列「ID #0、・・・、ID #(f-1)」と、乱数列r_0、・・・、r_{f-1}とを送信する。そして、当該ノードは、鍵サーバ53から、図19に示されるように、ピースPについて、一時対称鍵k_0、・・・、k_{f-1}を受信し、これらを用いて暗号化ピースE(k_{f-1})・・・E(k_0)Pを復号して、ピースPを得る。このようにして、各ノード51は、各ピースについて行われている暗号化を解くための一時対称鍵を全て得ることにより、当該ピースについて行われている暗号化を解くことができ、当該暗号化ピースを完全に復号することが可能になる。このようにして、各ノード51は、複数のピースのそれぞれが暗号化された各暗号化ピースについて鍵要求によって各一時対称鍵を鍵サーバ53から受信し、各暗号化ピースを復号することにより、上述の配信データを得ることができる。
For example, the node to which the above-described node ID “IDf # f” is assigned, with respect to the key server 53, as shown in FIG. 18, the node ID string “ID # 0,. # (F-1) "and a random number sequence r_0, ..., r_ {f-1}. Then, the node receives the temporary symmetric keys k_0,..., K_ {f-1} for the piece P from the key server 53 as shown in FIG. (K_ {f-1})... E (k_0) P is decoded to obtain piece P. In this way, each node 51 can obtain all the temporary symmetric keys for decrypting the encryption performed for each piece, and thereby can decrypt the encryption performed for the piece. The piece can be completely decrypted. In this way, each node 51 receives each temporary symmetric key from the key server 53 by a key request for each encrypted piece in which each of the plurality of pieces is encrypted, and decrypts each encrypted piece, The above distribution data can be obtained.
<ピース検証要求処理>
次に、ノード51が鍵サーバ53にピース検証要求を送信し、ピース検証結果を受信する手順について図20を用いて説明する。ノード51は、データ格納部517に記憶された暗号化ピースと、暗号化ピースに対応付けられている公開鍵証明書列と乱数列及び電子署名列を読み出し(ステップS40)、暗号化ピースと公開鍵証明書列と乱数列及び電子署名列を含むピース検証要求を鍵サーバ53に送信する(ステップS41)。次いで、ノード51は、ステップS41で送信されたピース検証要求に応じて鍵サーバ53から送信されたピース検証結果を受信し(ステップS42)、検証結果が成功であった場合は処理を終了する(ステップS43:YES)。一方、検証結果が失敗であった場合(ステップS43:NO)は、当該暗号化ピースと、当該暗号化ピースに対応づけられている公開鍵証明書列と乱数列及び電子署名列を廃棄する(ステップS44)。 <Peace verification request processing>
Next, a procedure in which thenode 51 transmits a piece verification request to the key server 53 and receives a piece verification result will be described with reference to FIG. The node 51 reads out the encrypted piece stored in the data storage unit 517, the public key certificate sequence, the random number sequence, and the electronic signature sequence associated with the encrypted piece (step S40), and the encrypted piece and the publicized information are disclosed. A piece verification request including a key certificate string, a random number string, and an electronic signature string is transmitted to the key server 53 (step S41). Next, the node 51 receives the piece verification result transmitted from the key server 53 in response to the piece verification request transmitted in step S41 (step S42), and ends the process if the verification result is successful (step S42). Step S43: YES). On the other hand, if the verification result is unsuccessful (step S43: NO), the encrypted piece, the public key certificate sequence, the random number sequence, and the electronic signature sequence associated with the encrypted piece are discarded ( Step S44).
次に、ノード51が鍵サーバ53にピース検証要求を送信し、ピース検証結果を受信する手順について図20を用いて説明する。ノード51は、データ格納部517に記憶された暗号化ピースと、暗号化ピースに対応付けられている公開鍵証明書列と乱数列及び電子署名列を読み出し(ステップS40)、暗号化ピースと公開鍵証明書列と乱数列及び電子署名列を含むピース検証要求を鍵サーバ53に送信する(ステップS41)。次いで、ノード51は、ステップS41で送信されたピース検証要求に応じて鍵サーバ53から送信されたピース検証結果を受信し(ステップS42)、検証結果が成功であった場合は処理を終了する(ステップS43:YES)。一方、検証結果が失敗であった場合(ステップS43:NO)は、当該暗号化ピースと、当該暗号化ピースに対応づけられている公開鍵証明書列と乱数列及び電子署名列を廃棄する(ステップS44)。 <Peace verification request processing>
Next, a procedure in which the
例えば、上述したノードID「ID #f」が割り当てられたノードは、鍵サーバ53に対して、図15に示されるように、あるピースPについて、公開鍵証明書列pkc_0、・・・、pkc_{f-1}と、乱数列r_0、・・・、r_{f-1}と暗号化ピースE(k_{f-1})、・・・、E(k_0)P及び電子署名列sig_0、・・・、sig_{f-1}を送信する。そして当該ノードは、鍵サーバ53から、ピース検証結果(成功もしくは失敗)を受信する。
For example, the node to which the above-described node ID “IDf # f” is assigned, with respect to the key server 53, as shown in FIG. 15, the public key certificate string pkc_ 0,. {F-1}, random number sequence r_0,..., R_ {f-1}, encrypted piece E (k_ {f-1}),..., E (k_0) P and electronic signature sequence sig_0, ..., sig_ {f-1} is transmitted. Then, the node receives the piece verification result (success or failure) from the key server 53.
<鍵サーバ:鍵送信処理>
次に、鍵サーバ53がノード51からの鍵要求に応じて復号鍵を送信する鍵送信処理の手順について図21を用いて説明する。鍵サーバ53は、暗号化ピースを復号するための復号鍵を要求されると共に、ノードID列及び乱数列を含む鍵要求をノード51から受信すると(ステップS50:YES)、受信した鍵要求に含まれるノードID列に含まれる各ノードIDに対応付けられて秘密鍵格納部530に記憶されている秘密鍵をノードID毎に読み出す(ステップS51)。そして鍵サーバ53は、全てのノードIDに対する乱数と、ステップS51で読み出した秘密鍵とを用いてノードID毎に関数Fにより一時対称鍵を復号鍵として生成する(ステップS52)。次いで、鍵サーバ53は、ステップS52で復号鍵として生成した一時対称鍵を、ステップS50で受信した鍵要求を送信したノード51に対して送信する(ステップS53)。 <Key server: Key transmission processing>
Next, a procedure of key transmission processing in which thekey server 53 transmits a decryption key in response to a key request from the node 51 will be described with reference to FIG. When the key server 53 is requested to receive a decryption key for decrypting the encrypted piece and receives a key request including a node ID string and a random number string from the node 51 (step S50: YES), the key server 53 is included in the received key request. The secret key stored in the secret key storage unit 530 in association with each node ID included in the node ID string to be read is read for each node ID (step S51). Then, the key server 53 generates a temporary symmetric key as a decryption key by the function F for each node ID using the random numbers for all the node IDs and the secret key read in step S51 (step S52). Next, the key server 53 transmits the temporary symmetric key generated as the decryption key in step S52 to the node 51 that transmitted the key request received in step S50 (step S53).
次に、鍵サーバ53がノード51からの鍵要求に応じて復号鍵を送信する鍵送信処理の手順について図21を用いて説明する。鍵サーバ53は、暗号化ピースを復号するための復号鍵を要求されると共に、ノードID列及び乱数列を含む鍵要求をノード51から受信すると(ステップS50:YES)、受信した鍵要求に含まれるノードID列に含まれる各ノードIDに対応付けられて秘密鍵格納部530に記憶されている秘密鍵をノードID毎に読み出す(ステップS51)。そして鍵サーバ53は、全てのノードIDに対する乱数と、ステップS51で読み出した秘密鍵とを用いてノードID毎に関数Fにより一時対称鍵を復号鍵として生成する(ステップS52)。次いで、鍵サーバ53は、ステップS52で復号鍵として生成した一時対称鍵を、ステップS50で受信した鍵要求を送信したノード51に対して送信する(ステップS53)。 <Key server: Key transmission processing>
Next, a procedure of key transmission processing in which the
例えば、鍵サーバ53は、上述したノードID「ID #f」が割り当てられたノードに対して、ピースPについて、図18に示されるようなノードID列及び乱数列を含む鍵要求に応じて、図19に示されるような一時対称鍵k_0、・・・、k_{f-1}を送信する。
For example, the key server 53 responds to a key request including a node ID string and a random number string as shown in FIG. 18 for the piece P with respect to the node assigned the node ID “ID #f” described above. Temporary symmetric keys k_0,..., K_ {f−1} as shown in FIG. 19 are transmitted.
<鍵サーバ:ピース検証処理>
次に、鍵サーバ53がノード51からのピース検証要求に応じてピースを検証し、検証結果を送信するピース検証処理の手順について図22を用いて説明する。鍵サーバ53は、ピースの検証を要求されると共に、公開鍵証明書列と乱数列と暗号化ピースと電子署名列とを含むピース検証要求をノード51から受信すると(ステップS600:YES)、受信したピース検証要求に含まれる公開鍵証明書列に含まれる各ノードIDに対応づけられて秘密鍵格納部530に記憶されている秘密鍵をノードID毎に読み出す(ステップS601)。そして鍵サーバ53は、全てのノードIDに対する乱数と、ステップS601で読み出した秘密鍵とを用いてノードID毎に関数Fにより一時対称鍵k_0、・・・、k_{f-1}を復号鍵として生成する(ステップS602)。ここで、fをピース検証要求に含まれる暗号化ピースの暗号化回数すなわち暗号化ピースの転送回数とする。fは、例えば公開鍵証明書列、乱数列、および電子署名列などの各データ列に含まれるデータの個数として求めることができる。次いで鍵サーバ53は、i=f-1として(ステップS603)、以下のステップS604~S607をi=0となるまで繰り返す。まず鍵サーバ53は、ピース検証要求に含まれる公開鍵証明書列pkc_0、・・・、pkc_iと乱数列r_0、・・・、r_iと暗号化ピースE(k_i)・・・E(k_0)Pと電子署名列sig_0、・・・、sig_{i-1}とに対して、電子署名sig_iが正当な署名であるかどうかを、公開鍵証明書pkc_iに含まれる公開鍵pk_iを用いて関数VERIFYにより検証する(ステップS604)。ステップS604の検証結果が検証成功となったとき(ステップS605:YES)は、暗号化ピースE(k_i)E(k_{i-1})・・・E(k_0)Pを一時対称鍵k_iを用いて復号して、暗号化ピースE(k_{i-1})・・・E(k_0)Pを得る(ステップS606)。次いで鍵サーバ53は、i=i-1とし(ステップS607)、i=0となった場合(ステップS608:YES)は、公開鍵証明書pkc_0と乱数r_0と暗号化ピースE(k_0)Pとに対して、電子署名sig_0が正当な署名であるかどうかを、公開鍵証明書pkc_0に含まれる公開鍵pk_0を用いて関数VERIFYにより検証する(ステップS609)。ステップS609の検証結果が検証成功となったとき(ステップS610:YES)、鍵サーバ53はステップS600で受信したピース検証要求を送信したノード51に対して、検証成功を送信する(ステップS612)。鍵サーバ53は、ステップS604の検証結果が検証失敗となったとき(ステップS605:NO)及び、ステップS609の検証結果が検証失敗となったとき(ステップS610:NO)は、不正ノードリスト格納部538に記録された不正ノードリストに、pkc_{i+1}に含まれているノード51のノードIDを追記し(ステップS611)、データ送信部534が「検証失敗」を当該ノード51に対して送信する(ステップS613)。また、鍵サーバ53は、ステップS607でi=0とならなかった場合(ステップS608:NO)は、ステップS604以降の処理をステップS608でi=0となるまで繰り返す。 <Key server: piece verification process>
Next, a procedure of piece verification processing in which thekey server 53 verifies a piece in response to a piece verification request from the node 51 and transmits a verification result will be described with reference to FIG. When the key server 53 is requested to verify the piece and receives a piece verification request including the public key certificate sequence, the random number sequence, the encrypted piece, and the electronic signature sequence from the node 51 (step S600: YES), the reception is received. The private key stored in the private key storage unit 530 in association with each node ID included in the public key certificate string included in the piece verification request is read for each node ID (step S601). Then, the key server 53 uses the random numbers for all the node IDs and the secret key read in step S601 to decrypt the temporary symmetric keys k_0,..., K_ {f-1} by the function F for each node ID. (Step S602). Here, f is the number of encryption times of the encrypted piece included in the piece verification request, that is, the number of times the encrypted piece is transferred. For example, f can be obtained as the number of data included in each data string such as a public key certificate string, a random number string, and an electronic signature string. Next, the key server 53 sets i = f−1 (step S603), and repeats the following steps S604 to S607 until i = 0. First, the key server 53 includes the public key certificate sequence pkc_0,..., Pkc_i, the random number sequence r_0,..., R_i, and the encrypted piece E (k_i) ... E (k_0) P included in the piece verification request. And the electronic signature sequence sig_0,..., Sig_ {i-1}, the function VERIFY is used to determine whether the electronic signature sig_i is a valid signature using the public key pk_i included in the public key certificate pkc_i. (Step S604). When the verification result in step S604 is a verification success (step S605: YES), the encrypted piece E (k_i) E (k_ {i-1})... E (k_0) P is used as the temporary symmetric key k_i. The encrypted piece E (k_ {i-1})... E (k_0) P is obtained (step S606). Next, the key server 53 sets i = i−1 (step S607), and if i = 0 (step S608: YES), the public key certificate pkc_0, the random number r_0, and the encrypted piece E (k_0) P On the other hand, whether or not the electronic signature sig_0 is a valid signature is verified by the function VERIFY using the public key pk_0 included in the public key certificate pkc_0 (step S609). When the verification result in step S609 is a verification success (step S610: YES), the key server 53 transmits a verification success to the node 51 that has transmitted the piece verification request received in step S600 (step S612). When the verification result of step S604 is a verification failure (step S605: NO) and when the verification result of step S609 is a verification failure (step S610: NO), the key server 53 stores the unauthorized node list storage unit. The node ID of the node 51 included in pkc_ {i + 1} is added to the unauthorized node list recorded in 538 (step S611), and the data transmission unit 534 indicates “verification failure” to the node 51. Transmit (step S613). If i = 0 is not satisfied in step S607 (step S608: NO), the key server 53 repeats the processing from step S604 onward until i = 0 in step S608.
次に、鍵サーバ53がノード51からのピース検証要求に応じてピースを検証し、検証結果を送信するピース検証処理の手順について図22を用いて説明する。鍵サーバ53は、ピースの検証を要求されると共に、公開鍵証明書列と乱数列と暗号化ピースと電子署名列とを含むピース検証要求をノード51から受信すると(ステップS600:YES)、受信したピース検証要求に含まれる公開鍵証明書列に含まれる各ノードIDに対応づけられて秘密鍵格納部530に記憶されている秘密鍵をノードID毎に読み出す(ステップS601)。そして鍵サーバ53は、全てのノードIDに対する乱数と、ステップS601で読み出した秘密鍵とを用いてノードID毎に関数Fにより一時対称鍵k_0、・・・、k_{f-1}を復号鍵として生成する(ステップS602)。ここで、fをピース検証要求に含まれる暗号化ピースの暗号化回数すなわち暗号化ピースの転送回数とする。fは、例えば公開鍵証明書列、乱数列、および電子署名列などの各データ列に含まれるデータの個数として求めることができる。次いで鍵サーバ53は、i=f-1として(ステップS603)、以下のステップS604~S607をi=0となるまで繰り返す。まず鍵サーバ53は、ピース検証要求に含まれる公開鍵証明書列pkc_0、・・・、pkc_iと乱数列r_0、・・・、r_iと暗号化ピースE(k_i)・・・E(k_0)Pと電子署名列sig_0、・・・、sig_{i-1}とに対して、電子署名sig_iが正当な署名であるかどうかを、公開鍵証明書pkc_iに含まれる公開鍵pk_iを用いて関数VERIFYにより検証する(ステップS604)。ステップS604の検証結果が検証成功となったとき(ステップS605:YES)は、暗号化ピースE(k_i)E(k_{i-1})・・・E(k_0)Pを一時対称鍵k_iを用いて復号して、暗号化ピースE(k_{i-1})・・・E(k_0)Pを得る(ステップS606)。次いで鍵サーバ53は、i=i-1とし(ステップS607)、i=0となった場合(ステップS608:YES)は、公開鍵証明書pkc_0と乱数r_0と暗号化ピースE(k_0)Pとに対して、電子署名sig_0が正当な署名であるかどうかを、公開鍵証明書pkc_0に含まれる公開鍵pk_0を用いて関数VERIFYにより検証する(ステップS609)。ステップS609の検証結果が検証成功となったとき(ステップS610:YES)、鍵サーバ53はステップS600で受信したピース検証要求を送信したノード51に対して、検証成功を送信する(ステップS612)。鍵サーバ53は、ステップS604の検証結果が検証失敗となったとき(ステップS605:NO)及び、ステップS609の検証結果が検証失敗となったとき(ステップS610:NO)は、不正ノードリスト格納部538に記録された不正ノードリストに、pkc_{i+1}に含まれているノード51のノードIDを追記し(ステップS611)、データ送信部534が「検証失敗」を当該ノード51に対して送信する(ステップS613)。また、鍵サーバ53は、ステップS607でi=0とならなかった場合(ステップS608:NO)は、ステップS604以降の処理をステップS608でi=0となるまで繰り返す。 <Key server: piece verification process>
Next, a procedure of piece verification processing in which the
次に、鍵サーバ53が全てのノードの公開鍵証明書を公開鍵証明書格納部532に記憶されており、かつ図23に示されるように、ピース検証要求にノードID列が含まれていた場合の処理を、図24を用いて説明する。鍵サーバ53は、ピースの検証を要求されると共に、ノードID列と乱数列と暗号化ピースと電子署名列とを含むピース検証要求をノード51から受信すると(ステップS700:YES)、受信したピース検証要求に含まれるノードID列に含まれる各ノードIDに対応づけられて秘密鍵格納部530に記憶されている秘密鍵をノードID毎に読み出し、受信したピース検証要求に含まれるノードID列に含まれる各ノードIDに対応づけられて公開鍵証明書格納部532に記憶されている公開鍵証明書をノードID毎に読み出す(ステップS701)。まず鍵サーバ53は、全てのノードIDに対する乱数と、ステップS701で読み出した秘密鍵とを用いてノードID毎に関数Fにより一時対称鍵k_0、・・・、k_{f-1}を復号鍵として生成する(ステップS702)。ここで、fをピース検証要求に含まれる暗号化ピースの暗号化回数すなわち暗号化ピースの転送回数とする。次いで鍵サーバ53は、i=f-1として(ステップS703)、以下のステップS704~S707をi=0となるまで繰り返す。そして鍵サーバ53は、ステップS701で読み出された公開鍵証明書列pkc_0、・・・、pkc_iとピース検証要求に含まれる乱数列r_0、・・・、r_iと暗号化ピースE(k_i)・・・E(k_0)P及び電子署名列sig_0、・・・、sig_{i-1}に対して、電子署名sig_iが正当な署名であるかどうかを、公開鍵証明書pkc_iに含まれる公開鍵pk_iを用いて関数VERIFYにより検証する(ステップS704)。ステップS704の検証結果が検証成功となったとき(ステップS705:YES)は、暗号化ピースE(k_i)E(k_{i-1})・・・E(k_0)Pを一時対称鍵k_iを用いて復号して、暗号化ピースE(k_{i-1})・・・E(k_0)Pを得る(ステップS706)。次いで鍵サーバ53は、i=i-1とし(ステップS707)、i=0となった場合(ステップS708:YES)は、公開鍵証明書pkc_0と乱数r_0及び暗号化ピースE(k_0)Pに対して、電子署名sig_0が正当な署名であるかどうかを、公開鍵証明書pkc_0に含まれる公開鍵pk_0を用いて関数VERIFYにより検証する(ステップS709)。ステップS709の検証結果が検証成功となったとき(ステップS710:YES)、鍵サーバ53はステップS700で受信したピース検証要求を送信したノード51に対して、検証成功を送信する(ステップS712)。鍵サーバ53は、ステップS704の検証結果が検証失敗となったとき(ステップS705:NO)及び、ステップS709の検証結果が検証失敗となったとき(ステップS710:NO)は、不正ノードリスト格納部538に記録された不正ノードリストに、pkc_{i+1}に含まれているノード51のノードIDを追記し(ステップS711)、データ送信部534が「検証失敗」を当該ノード51に対して送信する(ステップS713)。また、鍵サーバ53は、ステップS707でi=0とならなかった場合(ステップS708:NO)は、ステップS704以降の処理をステップS708でi=0となるまで繰り返す。
Next, the key server 53 stores the public key certificates of all the nodes in the public key certificate storage unit 532, and the node ID string is included in the piece verification request as shown in FIG. The processing in this case will be described with reference to FIG. When the key server 53 is requested to verify the piece and receives a piece verification request including the node ID string, the random number string, the encrypted piece, and the digital signature string from the node 51 (step S700: YES), the received piece The secret key associated with each node ID included in the node ID string included in the verification request and stored in the secret key storage unit 530 is read for each node ID, and the node ID string included in the received piece verification request is read. The public key certificate associated with each included node ID and stored in the public key certificate storage unit 532 is read for each node ID (step S701). First, the key server 53 uses the random numbers for all the node IDs and the secret key read in step S701 to decrypt the temporary symmetric keys k_0,..., K_ {f-1} by the function F for each node ID. (Step S702). Here, f is the number of encryption times of the encrypted piece included in the piece verification request, that is, the number of times the encrypted piece is transferred. Next, the key server 53 sets i = f−1 (step S703), and repeats the following steps S704 to S707 until i = 0. Then, the key server 53 reads the public key certificate sequence pkc_0,..., Pkc_i read in step S701, the random number sequence r_0,..., R_i included in the piece verification request, and the encrypted piece E (k_i). .. The public key included in the public key certificate pkc_i indicates whether or not the electronic signature sig_i is a valid signature for E (k_0) P and the electronic signature sequence sig_0, ..., sig_ {i-1} Verification is performed by the function VERIFY using pk_i (step S704). When the verification result in step S704 is a verification success (step S705: YES), the encrypted piece E (k_i) E (k_ {i-1})... E (k_0) P is used as the temporary symmetric key k_i. The encrypted piece E (k_ {i-1})... E (k_0) P is obtained (step S706). Next, the key server 53 sets i = i−1 (step S707). If i = 0 (step S708: YES), the public key certificate pkc_0, the random number r_0, and the encrypted piece E (k_0) P are stored. On the other hand, whether or not the electronic signature sig_0 is a valid signature is verified by the function VERIFY using the public key pk_0 included in the public key certificate pkc_0 (step S709). When the verification result in step S709 is a verification success (step S710: YES), the key server 53 transmits a verification success to the node 51 that has transmitted the piece verification request received in step S700 (step S712). When the verification result of step S704 is a verification failure (step S705: NO) and when the verification result of step S709 is a verification failure (step S710: NO), the key server 53 stores the unauthorized node list storage unit. The node ID of the node 51 included in pkc_ {i + 1} is added to the unauthorized node list recorded in 538 (step S711), and the data transmission unit 534 indicates “verification failure” to the node 51. Transmit (step S713). If i = 0 is not satisfied in step S707 (step S708: NO), the key server 53 repeats the processing after step S704 until i = 0 in step S708.
不正ノードリストは、鍵サーバ53から各ノード50,51に定期的にあるいは不定期に配布されてもよい。また、各ノード50,51が、鍵サーバ53に定期的にあるいは不定期に要求して不正ノードリストを入手しても良い。各ノード50、51は入手した不正ノードリストの情報を元に、暗号化ピースの送受信を一部制限してもよい。例えば、不正ノードリストを持つノード51に他のノードからのピース要求を受信したときに、当該他のノードのノードIDが不正ノードリストに記載されていた場合に、ピース要求を拒否してもよい。また、不正ノードリストを持つノード51が他のノードにピース要求をする際に、当該他のノードのノードIDが不正ノードリストに記載されていた場合には、当該他のノードに対してピース要求を行なわないことにしてもよい。
The unauthorized node list may be distributed from the key server 53 to each of the nodes 50 and 51 regularly or irregularly. Further, each node 50, 51 may request the key server 53 periodically or irregularly to obtain an unauthorized node list. Each of the nodes 50 and 51 may partially limit transmission / reception of the encrypted piece based on the obtained information of the illegal node list. For example, when a node 51 having an unauthorized node list receives a piece request from another node, the piece request may be rejected if the node ID of the other node is described in the unauthorized node list. . Further, when the node 51 having the illegal node list makes a piece request to another node, if the node ID of the other node is described in the illegal node list, the piece request is issued to the other node. You may decide not to do.
以上のような構成によれば、ある不正ノードが暗号化ピースを不正に改ざんした場合、鍵サーバは暗号化ピースを転送するごとに生成された電子署名を用いて当該暗号化ピースを検証することで当該不正ノードを特定することが可能となる。
According to the above configuration, when a certain illegal node tampers with the encrypted piece, the key server verifies the encrypted piece using the electronic signature generated each time the encrypted piece is transferred. This makes it possible to identify the unauthorized node.
50,51,51A,51B ノード
53 鍵サーバ
500 固有情報格納部
501 乱数生成部
502 一時対称鍵生成部
503 ピース暗号化部
504 ピース化部
505 データ送信部
506 送信要求受付部
507 電子署名生成部
510 固有情報格納部
511 乱数生成部
512 一時対称鍵生成部
513 ピース暗号化部
514 データ受信部
515 データ送信部
516 送信要求受付部
517 データ格納部
518 送信要求送信部
519 鍵要求送信部
520 ピース復号部
521 電子署名生成部
522 電子署名検証部
523 ピース検証要求送信部
530 秘密鍵格納部
531 データ受信部
532 公開鍵証明書格納部
533 一時対称鍵生成部
534 データ送信部
535 電子署名検証部
536 ピース検証要求受付部
537 ピース復号部
538 不正ノードリスト格納部
NT P2Pネットワーク 50, 51, 51A,51B Node 53 Key server 500 Unique information storage unit 501 Random number generation unit 502 Temporary symmetric key generation unit 503 Piece encryption unit 504 Piece generation unit 505 Data transmission unit 506 Transmission request reception unit 507 Electronic signature generation unit 510 Unique information storage unit 511 Random number generation unit 512 Temporary symmetric key generation unit 513 Piece encryption unit 514 Data reception unit 515 Data transmission unit 516 Transmission request reception unit 517 Data storage unit 518 Transmission request transmission unit 519 Key request transmission unit 520 Piece decryption unit 521 Electronic signature generation unit 522 Electronic signature verification unit 523 Piece verification request transmission unit 530 Private key storage unit 531 Data reception unit 532 Public key certificate storage unit 533 Temporary symmetric key generation unit 534 Data transmission unit 535 Electronic signature verification unit 536 Piece verification Request acceptance unit 537 Piece decryption unit 538 Dorisuto storage unit NT P2P networks
53 鍵サーバ
500 固有情報格納部
501 乱数生成部
502 一時対称鍵生成部
503 ピース暗号化部
504 ピース化部
505 データ送信部
506 送信要求受付部
507 電子署名生成部
510 固有情報格納部
511 乱数生成部
512 一時対称鍵生成部
513 ピース暗号化部
514 データ受信部
515 データ送信部
516 送信要求受付部
517 データ格納部
518 送信要求送信部
519 鍵要求送信部
520 ピース復号部
521 電子署名生成部
522 電子署名検証部
523 ピース検証要求送信部
530 秘密鍵格納部
531 データ受信部
532 公開鍵証明書格納部
533 一時対称鍵生成部
534 データ送信部
535 電子署名検証部
536 ピース検証要求受付部
537 ピース復号部
538 不正ノードリスト格納部
NT P2Pネットワーク 50, 51, 51A,
Claims (10)
- 第2装置識別情報と非公開鍵とが予め割り当てられ、データの一部であるピースを送信する通信装置であって、
他の通信装置を識別する第1装置識別情報と前記ピースとを含む第1署名対象情報、および、前記第1署名対象情報に対して生成された第1電子署名を受信する受信手段と、
前記第2装置識別情報と、前記非公開鍵と、を記憶する記憶手段と、
前記第1署名対象情報と前記第1電子署名と前記第2装置識別情報とを含む第2署名対象情報に対する第2電子署名を、前記非公開鍵を用いて生成する署名生成手段と、
前記第2署名対象情報と前記第2電子署名とを送信する送信手段と、
を備えることを特徴とする通信装置。 The second device identification information and the private key are pre-assigned, and a communication device that transmits a piece that is a part of data,
Receiving means for receiving first signature object information including first device identification information for identifying another communication device and the piece, and a first electronic signature generated for the first signature object information;
Storage means for storing the second device identification information and the private key;
Signature generating means for generating a second electronic signature for the second signature object information including the first signature object information, the first electronic signature, and the second device identification information using the private key;
Transmitting means for transmitting the second signature object information and the second electronic signature;
A communication apparatus comprising: - 前記受信手段は、前記第1装置識別情報と前記他の通信装置によって暗号化されたピースである第1暗号化ピースとを含む前記第1署名対象情報、前記第1電子署名、および、前記他の通信装置が暗号化する際に生成した第1一時情報を受信し、
その生成毎に異なり得る第2一時情報を生成する一時情報生成手段と、
前記第2一時情報を用いて一時対称鍵を生成する鍵生成手段と、
前記一時対称鍵を用いて前記第1暗号化ピースを更に暗号化した第2暗号化ピースを出力する暗号化手段と、をさらに備え、
前記署名生成手段は、前記第1暗号化ピースを前記第2暗号化ピースで置換した前記第1署名対象情報と前記第1電子署名と前記記憶手段に記憶された前記第2装置識別情報とを含む第2署名対象情報に対する第2電子署名を、前記記憶手段に記憶された前記非公開鍵を用いて生成し、
前記送信手段は、前記第2署名対象情報と、前記第2電子署名と、前記第1一時情報と、前記第2一時情報と、を送信すること、
を特徴とする請求項1に記載の通信装置。 The receiving means includes the first signature object information including the first device identification information and a first encrypted piece that is a piece encrypted by the other communication device, the first electronic signature, and the other Receiving the first temporary information generated when the communication device encrypts,
Temporary information generating means for generating second temporary information that may differ for each generation;
Key generation means for generating a temporary symmetric key using the second temporary information;
An encryption means for outputting a second encrypted piece obtained by further encrypting the first encrypted piece using the temporary symmetric key;
The signature generation means includes the first signature object information obtained by replacing the first encrypted piece with the second encrypted piece, the first electronic signature, and the second device identification information stored in the storage means. Generating a second electronic signature for the second signature target information including using the private key stored in the storage means;
The transmission means transmits the second signature target information, the second electronic signature, the first temporary information, and the second temporary information;
The communication apparatus according to claim 1. - 前記第1署名対象情報は、前記第1装置識別情報と前記他の通信装置に割り当てられた公開鍵とを含む公開鍵証明書と、前記第1暗号化ピースとを含むこと、
を特徴とする請求項2に記載の通信装置。 The first signature object information includes a public key certificate including the first device identification information and a public key assigned to the other communication device, and the first encrypted piece;
The communication device according to claim 2. - 前記受信手段は、さらに、前記第1電子署名を生成するときに用いられた非公開鍵に対応する公開鍵を受信し、
前記公開鍵と前記第1署名対象情報とを用いて前記第1電子署名を検証する検証手段をさらに備え、
前記署名生成手段は、前記第1電子署名が正しいことが検証されたときに、前記第2署名対象情報に対する前記第2電子署名を、前記記憶手段に記憶された前記非公開鍵を用いて生成すること、
を特徴とする請求項1に記載の通信装置。 The receiving means further receives a public key corresponding to the private key used when generating the first electronic signature,
Verification means for verifying the first electronic signature using the public key and the first signature object information;
The signature generation unit generates the second electronic signature for the second signature target information using the private key stored in the storage unit when it is verified that the first electronic signature is correct. To do,
The communication apparatus according to claim 1. - 前記受信手段は、前記ピースの送信を仲介した複数の前記他の通信装置それぞれを識別する複数の前記第1装置識別情報と前記ピースとを含む前記第1署名対象情報と、前記ピースを送信するごとに複数の前記他の通信装置のそれぞれが生成した複数の前記第1電子署名と、を受信し、
前記送信手段は、さらに、電子署名を検証可能なサーバ装置に対して、前記第1署名対象情報と、前記第1電子署名とを含む、前記第1電子署名の検証要求を送信し、
前記受信手段は、さらに、前記検証要求に対する応答として前記第1電子署名の検証結果を前記サーバ装置から受信すること、
を特徴とする請求項1に記載の通信装置。 The receiving means transmits the pieces of first signature object information including a plurality of pieces of the first device identification information for identifying each of the plurality of other communication devices that mediate transmission of the pieces, and the pieces. A plurality of the first electronic signatures generated by each of the plurality of other communication devices for each,
The transmission means further transmits a verification request for the first electronic signature including the first signature object information and the first electronic signature to a server device capable of verifying the electronic signature,
The receiving means further receives the verification result of the first electronic signature from the server device as a response to the verification request;
The communication apparatus according to claim 1. - データの一部であるピースを送信する複数の通信装置と接続されたサーバ装置であって、
前記通信装置は、前記ピースを含む署名対象情報と、前記署名対象情報に対して他の通信装置が生成した電子署名とを含む新たな署名対象情報に対して新たな電子署名を生成し、生成した前記署名対象情報と生成した前記電子署名とを送信し、
前記署名対象情報と、前記署名対象情報に対して生成された前記電子署名とを含む、前記電子署名の検証要求を前記通信装置から受信する受信手段と、
前記検証要求に含まれる前記署名対象情報と、前記検証要求に含まれる前記電子署名を生成した前記通信装置に割り当てられた公開鍵とを用いて前記電子署名を検証する検証手段と、
検証されなかった前記電子署名を含む前記署名対象情報に対する前記電子署名を生成した前記通信装置を、不正な通信装置として検出する検出手段と、
を備えることを特徴とするサーバ装置。 A server device connected to a plurality of communication devices that transmit pieces that are part of data,
The communication device generates a new electronic signature for new signature target information including signature target information including the piece and an electronic signature generated by another communication device for the signature target information, and generates the signature Transmitting the signature target information and the generated electronic signature,
Receiving means for receiving a verification request for the electronic signature from the communication device, including the signature target information and the electronic signature generated for the signature target information;
Verification means for verifying the electronic signature using the signature target information included in the verification request and a public key assigned to the communication device that generated the electronic signature included in the verification request;
Detection means for detecting the communication device that has generated the electronic signature for the signature target information including the electronic signature that has not been verified as an unauthorized communication device;
A server device comprising: - 前記通信装置を識別する装置識別情報と、前記通信装置のそれぞれに割り当てられた前記公開鍵とを対応づけて記憶する記憶手段をさらに備え、
前記受信手段は、前記署名対象情報と、前記電子署名と、前記署名対象情報を送信した複数の前記通信装置の前記装置識別情報と、を対応づけて含む前記検証要求を受信し、
前記検証手段は、前記検証要求に含まれる前記署名対象情報と、前記検証要求に含まれる前記装置識別情報に対応する前記記憶手段の前記公開鍵とを用いて、前記電子署名を検証すること、
を特徴とする請求項6に記載のサーバ装置。 Further comprising storage means for storing device identification information for identifying the communication device and the public key assigned to each of the communication devices in association with each other.
The receiving means receives the verification request including the signature target information, the electronic signature, and the device identification information of the plurality of communication devices that transmitted the signature target information in association with each other,
The verification means verifies the electronic signature using the signature object information included in the verification request and the public key of the storage means corresponding to the device identification information included in the verification request;
The server device according to claim 6. - 前記受信手段は、前記署名対象情報と、前記電子署名と、前記署名対象情報を送信した複数の前記通信装置に割り当てられた前記公開鍵と、を対応づけて含む前記検証要求を受信し、
前記検証手段は、前記検証要求に含まれる前記署名対象情報と、前記検証要求に含まれる前記公開鍵とを用いて、前記電子署名を検証すること、
を特徴とする請求項6に記載のサーバ装置。 The receiving unit receives the verification request including the signature target information, the electronic signature, and the public keys assigned to the plurality of communication devices that transmitted the signature target information in association with each other;
The verification means verifies the electronic signature using the signature object information included in the verification request and the public key included in the verification request;
The server device according to claim 6. - 前記通信装置のそれぞれに割り当てられた秘密情報と、前記通信装置を識別する装置識別情報とを各々対応付けて記憶する記憶手段をさらに備え、
前記検証要求は、さらに、複数の前記通信装置それぞれが生成した生成毎に異なり得る情報であって、前記ピースを暗号化する暗号鍵を生成するための複数の一時情報を対応づけた前記装置識別情報を含み、
前記署名対象情報は、複数の前記通信装置により前記一時情報を用いて生成された複数の暗号鍵によって、複数の前記通信装置が前記署名対象情報を送信するごとに暗号化されており、
前記検証手段は、前記検証要求に含まれる前記一時情報と、前記検証要求に含まれる前記装置識別情報に対応する前記記憶手段の前記秘密情報とを用いて暗号鍵を生成し、生成した暗号鍵によって前記署名対象情報を復号し、復号した前記署名対象情報と、前記公開鍵とを用いて前記電子署名を検証すること、
を特徴とする請求項6に記載のサーバ装置。 And further comprising storage means for storing the secret information assigned to each of the communication devices and the device identification information for identifying the communication device in association with each other.
The verification request is information that can be different for each generation generated by each of the plurality of communication devices, and the device identification associated with a plurality of temporary information for generating an encryption key for encrypting the piece Including information,
The signature target information is encrypted each time a plurality of communication devices transmit the signature target information with a plurality of encryption keys generated using the temporary information by a plurality of communication devices,
The verification unit generates an encryption key using the temporary information included in the verification request and the secret information of the storage unit corresponding to the device identification information included in the verification request. The signature object information is decrypted by using the decrypted signature object information and the public key to verify the electronic signature;
The server device according to claim 6. - 予め割り当てられた第2装置識別情報と非公開鍵とを記憶する記憶手段を備え、データの一部であるピースを送信する通信装置を、
他の通信装置を識別する第1装置識別情報と前記ピースとを含む第1署名対象情報、および、前記第1署名対象情報に対して生成された第1電子署名を受信する受信手段と、
前記第2装置識別情報と前記第1署名対象情報と前記第1電子署名とを含む第2署名対象情報に対する第2電子署名を、前記非公開鍵を用いて生成する署名生成手段と、
前記第2署名対象情報と前記第2電子署名とを送信する送信手段と、
として機能させるための通信プログラム。 A communication device comprising storage means for storing pre-assigned second device identification information and a private key, and transmitting a piece that is part of the data,
Receiving means for receiving first signature object information including first device identification information for identifying another communication device and the piece, and a first electronic signature generated for the first signature object information;
Signature generating means for generating a second electronic signature for the second signature object information including the second device identification information, the first signature object information, and the first electronic signature using the private key;
Transmitting means for transmitting the second signature object information and the second electronic signature;
Communication program to function as
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2008316306A JP2010141619A (en) | 2008-12-11 | 2008-12-11 | Communication apparatus, server apparatus, communication program, and data |
JP2008-316306 | 2008-12-11 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2010067797A1 true WO2010067797A1 (en) | 2010-06-17 |
Family
ID=42242786
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2009/070545 WO2010067797A1 (en) | 2008-12-11 | 2009-12-08 | Communication apparatus, server apparatus and communication program |
Country Status (2)
Country | Link |
---|---|
JP (1) | JP2010141619A (en) |
WO (1) | WO2010067797A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2010004269A (en) * | 2008-06-19 | 2010-01-07 | Toshiba Corp | Communication device, key server, and data |
CN111680311A (en) * | 2020-05-28 | 2020-09-18 | 北京理工大学 | Data exchange system and method based on block chain |
CN113326529A (en) * | 2021-06-24 | 2021-08-31 | 北京八分量信息科技有限公司 | Decentralized architecture unifying method based on trusted computing |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2005286989A (en) * | 2004-03-02 | 2005-10-13 | Ntt Docomo Inc | Communication terminal and ad hoc network rout controlling method |
JP2006222738A (en) * | 2005-02-10 | 2006-08-24 | Nagoya Institute Of Technology | Data exchange based on evaluation values in ad hoc network |
JP2007005898A (en) * | 2005-06-21 | 2007-01-11 | Toshiba Corp | Node unit, anonymous communication method and program |
JP2008192129A (en) * | 2007-01-09 | 2008-08-21 | Docomo Technology Inc | Network data distribution sharing system |
-
2008
- 2008-12-11 JP JP2008316306A patent/JP2010141619A/en active Pending
-
2009
- 2009-12-08 WO PCT/JP2009/070545 patent/WO2010067797A1/en active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2005286989A (en) * | 2004-03-02 | 2005-10-13 | Ntt Docomo Inc | Communication terminal and ad hoc network rout controlling method |
JP2006222738A (en) * | 2005-02-10 | 2006-08-24 | Nagoya Institute Of Technology | Data exchange based on evaluation values in ad hoc network |
JP2007005898A (en) * | 2005-06-21 | 2007-01-11 | Toshiba Corp | Node unit, anonymous communication method and program |
JP2008192129A (en) * | 2007-01-09 | 2008-08-21 | Docomo Technology Inc | Network data distribution sharing system |
Non-Patent Citations (7)
Title |
---|
SATORU KUROKAWA: "Study on the Distributed Data Sharing Mechanism with a Mutual Authentication", IEICE TECHNICAL REPORT, vol. 106, no. 578, 1 March 2007 (2007-03-01), pages 203 - 206 * |
SATORU KUROKAWA: "Study on the Distributed Data Sharing Mechanism with a Mutual Authentication", PROCEEDINGS OF THE 2007 IEICE GENERAL CONFERENCE TSUSHIN 2, - 7 March 2007 (2007-03-07), pages S-35 - S-36 * |
TATSUYUKI MATSUSHITA: "JetJigsaw ni Okeru Piece Kaizan Kenchi Hoho no Teian", IEICE TECHNICAL REPORT, 02 MARCH 2009, vol. 108, no. 473, 2 March 2009 (2009-03-02), pages 1 - 6 * |
TORU KAMIBAYASHI: "JetJigsaw:P2P o Riyo shita Chosakuken Hogo Hoshiki no Shin Teian", NEN SYMPOSIUM ON CRYPTOGRAPHY AND INFORMATION SECURITY (SCIS2009), - 20 January 2009 (2009-01-20) * |
YUICHI NINO: "P2P Network ni Okeru Joho no Ryutsu Kanshi Hoshiki no Teian", DAI 67 KAI (HEISEI 17 NEN) ZENKOKU TAIKAI KOEN RONBUNSHU (3) DATABASE TO MEDIA NETWORK, 2 March 2005 (2005-03-02), pages 3-99 - 3-100 * |
YUTA OKAMOTO: "DiMPS: Distributed Meta-P2P Storage for Content Delivery System", THE INSTITUTE OF ELECTRONICS, INFORMATION AND COMMUNICATION ENGINEERS DAI 19 KAI DATA ENGINEERING WORKSHOP RONBUNSHU [ONLINE] DEWS2008 DATA ENGINEERING WORKSHOP MIYAZAKI, 7 April 2008 (2008-04-07), pages 1 - 6 * |
YUTA OKAMOTO: "P2P File Kyoyu Network o Riyo shita Daikibo Bunsan Storage no Jitsugen", DAI 69 KAI (HEISEI 19 NEN) ZENKOKU TAIKAI KOEN RONBUNSHU (3) NETWORK SECURITY, 6 March 2007 (2007-03-06), pages 3-297 - 3-298 * |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2010004269A (en) * | 2008-06-19 | 2010-01-07 | Toshiba Corp | Communication device, key server, and data |
US8548169B2 (en) | 2008-06-19 | 2013-10-01 | Kabushiki Kaisha Toshiba | Communication apparatus, key server, and data |
CN111680311A (en) * | 2020-05-28 | 2020-09-18 | 北京理工大学 | Data exchange system and method based on block chain |
CN111680311B (en) * | 2020-05-28 | 2022-12-20 | 北京理工大学 | Data exchange system and method based on block chain |
CN113326529A (en) * | 2021-06-24 | 2021-08-31 | 北京八分量信息科技有限公司 | Decentralized architecture unifying method based on trusted computing |
Also Published As
Publication number | Publication date |
---|---|
JP2010141619A (en) | 2010-06-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP4617763B2 (en) | Device authentication system, device authentication server, terminal device, device authentication method, and device authentication program | |
CA2619420C (en) | Distributed single sign-on service | |
US7979707B2 (en) | Secure seed generation protocol | |
JP5395372B2 (en) | Communication device, key server and data | |
CN103763356B (en) | A kind of SSL establishment of connection method, apparatus and system | |
US8130961B2 (en) | Method and system for client-server mutual authentication using event-based OTP | |
KR100568233B1 (en) | Device Authentication Method using certificate and digital content processing device using the method | |
US7653713B2 (en) | Method of measuring round trip time and proximity checking method using the same | |
EP3318043A1 (en) | Mutual authentication of confidential communication | |
CN101764803A (en) | Efficient and secure authentication of computing systems | |
JP5378296B2 (en) | Communication apparatus and communication method | |
US9165148B2 (en) | Generating secure device secret key | |
WO2019093478A1 (en) | Key exchange device, key exchange system, key exchange method, and key exchange program | |
CN111080299B (en) | Anti-repudiation method for transaction information, client and server | |
JP2006109107A (en) | Signature formation method, signature verification method, public key distribution method, and information processing apparatus | |
KR20150135032A (en) | System and method for updating secret key using physical unclonable function | |
JP5416544B2 (en) | Data distribution device, data reception device, data distribution program, and data reception program | |
JP2009049731A (en) | Encryption method, decryption method, and key management method | |
JP2010124071A (en) | Communication device, communication method, and program | |
JP2010004390A (en) | Communication apparatus, key server and data | |
JP2010141567A (en) | Communication apparatus, communication method and program | |
WO2010067797A1 (en) | Communication apparatus, server apparatus and communication program | |
CN115549910B (en) | Data transmission method, equipment and storage medium | |
CN114651419A (en) | Method and system for verifiable identity-based encryption (VIBE) using certificateless authenticated encryption (CLAE) | |
JP5354656B2 (en) | Cryptographic communication system, cryptographic communication method, transmitting apparatus and receiving apparatus |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 09831901 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 09831901 Country of ref document: EP Kind code of ref document: A1 |