Patent Application
20100020966
The present invention relates to generation of an encryption key used in coding (encryption) and decoding (decryption) of digital data with plural types of hierarchical scalabilities and, more particularly, to a technology of automatically generating partial encryption keys corresponding to respective data units in hierarchies in each scalability.
In recent years, the spread of information and communications services through networks has also increased services to transmit data to unspecified masses, e.g., a delivery service of digital contents such as images (including one-frame data of a moving picture). In conjunction therewith, there is a demand for highly advanced functionality in protection technology of digital data.
In general, a coded digital image or the like is decoded in a quality (distortion, resolution, color representation, or the like) determined in a coding process. With diversification of communication channels, diversification of communication terminals, and diversification of delivery services, there is a demand for capability of decoding the image in a quality different from the quality determined in the coding process, by decoding a certain part of a codestream, i.e., scalability. For meeting this demand for scalability, for example, JPEG2000 (Joint Photographic Experts Group 2000) being the international standard of image compression provides hierarchized scalabilities with scales such as resolution. In the protection technology of hierarchically protecting data in different qualities, it is common practice to perform encryption using individual partial keys for respective data units located in respective hierarchies in each of scalabilities.
The known protection technologies of digital data as described above include, for example, those of Patent Documents 1 and 2 and Non-patent Documents 1 to 3.
Non-patent Document 1 discloses the technology of generating partial keys corresponding to data units in lower hierarchies from one master key by applying a one-way hash function to digital data with hierarchical scalabilities. Non-patent Document 2 discloses the technology independent of an order of streaming data, which is a problem of Non-patent Document 1. Furthermore, Non-patent Document 3 cited above discloses the technology of improving the resistance to collusion attacks, which is a problem of Non-patent Document 1.
A collusion attack is such an act that plural types of encryption keys corresponding to different hierarchical levels in respective scalabilities are shared among a plurality of users, so as to implement reproduction of the image in a quality higher than a preliminarily authorized quality.
The inventors thoroughly investigated the conventional data protection technologies and found the following problem. Namely, for hierarchically protecting digital data of different qualities, encryption keys are separately managed for respective types of scalabilities, or the encryption is carried out using individual encryption keys (partial keys) for respective data units located in respective hierarchies in each of scalabilities.
Particularly, in the case of managing individual partial keys generated for respective data units, an increase in the number of hierarchies leads to an increase in the number of keys to be managed, and a sufficient key length has to be ensured in order to maintain the resistance to collusion; therefore, the total key length will be considerably long with increase in hierarchies in each scalability.
On the contrary, in the case where partial keys corresponding to respective data units are generated from one master key, it is necessary to divide the master key by the number of partial keys, and, as in Non-patent Document 3, an increase in the number of partial keys will inevitably result in shortening the length of each partial key to be generated. In this case, the sufficient resistance to collusion cannot be ensured.
The present invention has been accomplished in order to solve the problem as discussed above, and an object of the present invention is to provide an encryption key generating method ensuring sufficient resistance to collusion attacks on digital data with hierarchical scalabilities and achieving drastic reduction in the key length of encryption keys corresponding to respective hierarchies in each scalability.
An encryption key generating method according to the present invention is to generate an encryption key used in coding and decoding of digital data with plural types (≧2) of hierarchical scalabilities. The encryption key generating method is applicable to picture transmission systems and teleconference systems using multimedia such as packet codestreams of JPEG2000 being the international standard of image compression and also applicable to streaming delivery services. The encryption key generating method is configured to generate partial keys of hierarchies at subordinately higher positions from a master key and to enable simultaneous access control on a plurality of scalabilities by a single codestream.
Specifically, an encryption key generating method according to the present invention comprises generating partial keys corresponding to data units in hierarchies in each of two types of scalabilities selected, as a minimum processing unit. The encryption key generating method comprises setting a master key, generating split keys from the master key, generating key element matrices corresponding to the respective split keys, and generating partial keys by combining entries of the generated key element matrices. The key element matrices are generated based on the split keys corresponding to the respective hierarchies, on a hierarchy-by-hierarchy basis of one scalability. In each key element matrix, coordinates of each entry are defined by respective hierarchical values (corresponding to hierarchical levels) in the two types of scalabilities, whereby each matrix entry coordinately corresponds to a data unit in respective hierarchies in the two types of scalabilities. The encryption key generating method is characterized by generating each of the partial keys in hierarchies at subordinately higher positions from the only managed master key. Therefore, partial keys in hierarchies at subordinately higher positions are also generated from a master key on a decryption occasion and, for example, in a multimedia delivery service, a user receives only a delivered decryption key for the lowest packet in a packet group authorized to open. In this case, the given decryption key itself serves as the master key in the encryption key generating method and each of hierarchies in respective scalabilities corresponding to this master key is the lowest hierarchy.
First, set as the master key prepared is an encryption key used in coding and decoding of a data unit in hierarchies at the lowest position in each of first and second scalabilities selected from the plural types of scalabilities which the digital data as a coded object has. On the contrary, when the master key is a decryption key obtained by delivery or the like, each of hierarchies in respective scalabilities corresponding to the master key is the lowest hierarchy. This master key is divided by the number of hierarchies in the first scalability set as a reference scalability out of the first and second scalabilities, to generate split keys corresponding to the respective hierarchies of the first scalability.
Key element matrices generated based on the respective split keys coordinately correspond to data units in respective hierarchies in the first and second scalabilities. In generation of a key element matrix generated based on one split key out of the resultant split keys, at least coordinate entries corresponding to respective hierarchies from the lowest hierarchy to the highest hierarchy in the second scalability in the hierarchy in the first scalability corresponding to the one split key are assigned operation data successively obtained by repeating a hash operation on the one split key using a one-way hash function. This maintains the hierarchical nature of the second scalability.
The subsequent step is to combine key elements coordinately consistent among the key element matrices generated with the respective split keys, thereby generating partial keys corresponding to data units in the respective hierarchies in the first and second scalabilities. This configuration also maintains the hierarchical nature of the first scalability.
In the encryption key generating method according to the present invention, the aforementioned reference scalability to be selected is preferably a scalability having a smaller number of hierarchies out of the first and second scalabilities. This configuration is less likely to be affected by increase in the number of hierarchies in one or more scalabilities.
In a key element matrix generated based on one split key out of the split keys, coordinate entries corresponding to respective hierarchies from the lowest hierarchy to the highest hierarchy of the second scalability in a hierarchy at a lower position than the hierarchy in the first scalability corresponding to the one split key are assigned the same operation data as the operation data successively obtained for the hierarchy of the one split key. On the other hand, all coordinate entries corresponding to respective hierarchies from the lowest hierarchy to the highest hierarchy of the second scalability in a hierarchy at a higher position than the hierarchy in the first scalability corresponding to the one split key are assigned operation data obtained by a hash operation with a one-way hash function on a key element in the highest hierarchy of the second scalability out of key elements in the hierarchy corresponding to the one split key.
As described above, the encryption key generating method according to the present invention is not restricted by progression orders of codestreams, different from the conventional encryption key generating methods required to prepare a plurality of codestreams and master keys according to progression orders. Furthermore, the encryption key generating method according to the present invention generates the encryption keys (partial keys) corresponding to respective data units subordinately from the master key and enables simultaneous access control on a plurality of scalabilities by a single codestream. This achieves drastic reduction in information amount of the codestream and managed encryption key (master key) and enables effective improvement in safety in management and delivery of digital contents and the encryption key.
Furthermore, when the encryption key generating method according to the present invention is applied to a case where digital data as a coded object has three or more types of scalabilities, two types of scalabilities are selected out of these three or more types of scalabilities, and partial keys are generated by executing the aforementioned minimum processing unit, for all combinations of two types of scalabilities selected out thereof.
Namely, with all the combinations of two types of scalabilities, a partial key element matrix is generated for each combination. On this occasion, a hierarchy table is also generated as one showing all combinations of hierarchical values in the plural types of scalabilities. This hierarchy table is a coordinate representation of partial key matrices whose entries are partial keys corresponding to data units of respective hierarchical values in the plural types of scalabilities, by combinations of hierarchical values. This hierarchy table shows a correspondence relation between the types of scalabilities and the hierarchical values and entries of the partial key element matrices generated for all combinations of scalabilities can be specified from this relation.
Then this invention involves combining entries in the respective partial key element matrices generated for all the combinations of two types of scalabilities, each of which is specified by two hierarchical values out of hierarchical values constituting one combination and types of scalabilities thereof, for all the combinations of hierarchical values in the hierarchy table. An element resulting from this combining step for each combination of hierarchical values is an entry in a partial key element matrix as it is. Therefore, partial keys corresponding to data units in respective hierarchies in the plural types of scalabilities are sequentially generated by combining entries made in correspondence by the hierarchy table from the respective partial key element matrices.
In the generation of the encryption key used in coding and decoding of digital data with hierarchical scalabilities being three or more types of scalabilities, the resistance to collusion attacks can be further improved in comparison with the above-described encryption key generating method.
Specifically, prepared as a master key is an encryption key used in coding and decoding of a data unit in hierarchies at the lowest position in each of three or more types of scalabilities (in the case where the master key is a decryption key obtained by delivery or the like, each of hierarchies in the respective scalabilities corresponding to the master key is the lowest hierarchy). At this time, first and second reference scalabilities are also selected from the three or more types of scalabilities. The first reference scalability is a scalability for generation of split keys from the prepared master key and the prepared master key is divided by the number of hierarchies in the first reference scalability, thereby generating split keys corresponding to the respective hierarchies in the first reference scalability. On the other hand, the second reference scalability is a scalability for defining an operation direction of the hash operation with the one-way hash function as described above.
In the encryption key generating method, a multidimensional key element matrix as a coordinate representation of hierarchical values in the three or more types of scalabilities is generated by a series of operations corresponding to respective hierarchies in the first reference scalability, for each hierarchy in each of scalabilities other than the first and second reference scalabilities out of these three or more types of scalabilities. For that, let S be the number of scalabilities, and NK (K=1, 2, 3, . . . , i−1, or i), specifically, N1, N2, . . . , Ni−1, or Ni in order from the smallest be the number of hierarchies in each scalability; for the total packet number given by Mathematical Expression (1) below, the number of multidimensional key element matrices generated in the encryption key generating method is given by Mathematical Expression (2) below.
Specifically, in each of multidimensional key element matrices obtained, at least coordinate entries corresponding to respective hierarchies from the lowest to the highest in the second reference scalability in a hierarchy in the first reference scalability corresponding to one split key out of the generated split keys are assigned operation data successively obtained by repeating a hash operation on the one split key using a one-way hash function. This maintains the hierarchical nature of at least the second reference scalability in the multidimensional key element matrix obtained.
The subsequent step is to combine entries coordinately consistent among the respective multidimensional key element matrices generated by the series of operations corresponding to the respective hierarchies in the first reference scalability, for the respective hierarchies in each of the scalabilities other than the first and second reference scalabilities, so as to generate partial keys corresponding to data units in the respective hierarchies in the plural types of scalabilities. Namely, since the multidimensional key element matrices obtained are generated with the respective hierarchies of the first reference scalability, for each of hierarchies in each of the scalabilities other than the first and second reference scalabilities, the hierarchical nature of the first reference scalability is also maintained in a partial key matrix finally generated from the obtained multidimensional key element matrices.
In each of the multidimensional key element matrices generated by the series of operations corresponding to the respective hierarchies in the first reference scalability, for the respective hierarchies in each of the scalabilities other than the first and second scalabilities, coordinate entries corresponding to respective hierarchies from the lowest to the highest of the second reference scalability in a hierarchy at a lower position than respective corresponding hierarchies of the other scalability and the first reference scalability are assigned the same operation data as the operation data successively obtained with one split key assigned to the corresponding hierarchy of the first reference scalability. On the other hand, all coordinate entries corresponding to respective hierarchies from the lowest to the highest of the second reference scalability in a hierarchy at a higher position than the respective corresponding hierarchies of the other scalability and the first reference scalability are assigned operation data obtained by a hash operation with a one-way hash function on a key element in the highest hierarchy in the second reference scalability out of key elements in the hierarchy corresponding to the one split key.
Each of embodiments according to the present invention will become further fully understood by the following detailed description and accompanying drawings. These embodiments are presented by way of illustration only and should not be construed as limiting the present invention.
A further application range of this invention will become apparent from the following detailed description. It should be, however, noted that the detailed description and specific examples will be presented to explain preferred embodiments of the present invention by way of illustration only, and it is apparent that a variety of modifications and improvements within the scope of the invention are obvious to those skilled in the art in view of the detailed description.
According to the present invention, as described above, the partial keys for the hierarchies at subordinately higher positions are generated by making use of the one-way hash function from the master key, and, therefore, a partial key corresponding to one data unit specified by hierarchical levels in respective scalabilities cannot be generated from any partial key corresponding to a data unit at a higher hierarchical position in one of the scalabilities. Therefore, it becomes feasible to prevent collusion attacks. Since the partial keys are generated for each of combinations of two types of scalabilities as scalabilities of access control targets, it is feasible to reduce the key length of the generated partial keys.
M1-M3 key element matrices; MPa-MPc partial key element matrices; MP1-MP4 partial key matrices; QM multidimensional partial key matrix; QMRL1-QMRL4, QMRC1-QMRC4, QMLC1-QMLC3, QM1-1-QM4-1, QM1-2-QM4-2, QM1-3-QM4-3 multidimensional key element matrices.
In the following, embodiments of an encryption key generating method according to the present invention will be described below in detail with reference to
The encryption key generating method according to the present invention is to generate an encryption key used in coding and decoding of digital data with plural types of hierarchical scalabilities. Each of the embodiments will be described using a specific example of digital data with hierarchical scalabilities, as to generation of partial keys corresponding to respective packet codestreams of JPEG2000 being the international standard of image compression, for simplicity. JPEG2000 allows an order of priorities to be given to types of scalabilities. This order in a codestream is expressed as a construction order (progression order) of packets being data units. Elements to determine this progression order include four types of scalabilities, layer (L), resolution level (R), component (C), and position (P).
In this
In JPEG2000 as described above, there are five types of progression orders, LRCP, RLCP, RPCL, PCRL, and CPRL, and priorities are given to respective elements in descending order from the top.
The encryption key generating method according to the present invention reduces the key length in terms of safety and easy production in management and delivery of the encryption key, and has the resistance to collusion attacks. Since the encryption key generating method handles each packet as a matrix entry specified by hierarchical levels of respective scalabilities in order to generate encryption keys for the respective JPEG2000 packets as described above, the progression orders in JPEG2000 do not matter. As an example, the area (a) of
A collusion attack herein is such an attack that two or more users illegally share their encryption keys, so as to enable reproduction of an image in a quality higher than a regularly authorized quality. Specifically, let us consider a collusion case using an example of a JPEG2000 coded image, in which a collusion is made by a user authorized to open only the highest layer (layer 0) and a user authorized to open only the highest resolution level (resolution level 0). In this case, when Ki,j represents an encryption key for packet Pi,j, one user receives encryption keys K0,j (j=0, 1, 2) for three packets P0,j (j=0, 1, 2) and the other user receives encryption keys Ki,0 (i=0, 1, 2) for three packets Pi,0 (i=0, 1, 2), as regularly authorized keys. If the resistance is not enough to collusion attacks, these users could collude and illegally generate encryption keys K2,2, K2,1, K1,2, and K1,1 which are not authorized for the two users. In the encryption key generating method according to the present invention, as described in each of the embodiments below, an encryption key (partial key) for a certain packet cannot be generated from a packet in a hierarchy at a higher position in at least one scalability than that of the packet of interest, and can be generated from a packet in a hierarchy at an identical or lower position in each scalability. For this reason, the encryption key generating method according to the present invention has the resistance to collusion attacks.
The first embodiment of the encryption key generating method according to the present invention will be described below. In this first embodiment, scalabilities as access control targets are scalability L (layer) and scalability R (resolution level), the number of hierarchies NL in scalability L is 3, and the number of hierarchies NR in scalability R is 3. At this time, packets in the respective hierarchies in scalabilities L and R are handled as 3×3 matrix entries Pi,j (i=0, 1, 2; j=0, 1, 2).
A master key is a partial key corresponding to the lowest packet preliminarily managed and in the example of
Since in this first embodiment NL=NR=3, either of scalabilities L and R can be selected, and it is assumed as an example herein that scalability R is selected as a reference scalability. At this time, the master key K2,2 is divided by the minimum hierarchy number 3 (the number of hierarchies in scalability R) to obtain split keys eR2, eR1, and eR0. These split keys eR2, eR1, and eR0 are root keys (keys for generation of respective matrix entries) corresponding to the respective hierarchies of scalability R, and key element matrices M1-M3 are generated for the respective hierarchies of scalability R.
Matrix entries in the respective key element matrices M1-M3 are sequentially generated from the split keys eR2, eR1, and eR0 being the corresponding root keys, as shown in
First, in the key element matrix M1, as a matrix corresponding to the hierarchical level 2 (lowest hierarchy) of scalability R, the split key eR2 is assigned to the (2,2) entry. In the drawing, superscript R2 to each matrix entry e represents the hierarchical level of scalability R (reference scalability) corresponding to the key element matrix M1 and each subscript represents coordinates of an entry in the key element matrix M1. In this first embodiment, the entries in the key element matrix M1 will be denoted below by eR2(i,j) (i=0, 1, 2; j=0, 1, 2).
Coordinate entries eR2(1,2) and eR2(0,2) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=2) in scalability R corresponding to the split key eR2 are assigned operation data successively obtained by repeating a hash operation on the split key eR2 using a one-way hash function H*. Namely, eR2(1,2) is assigned the operation data of H*(eR2(2,2)) and the entry eR2(0,2) is assigned the operation data of H*2(eR2(2,2)). This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 2 of scalability R. In this specification, the operation of n (n=2,3, . . . ) repetitions with one-way hash function H* is denoted by H*n.
On the other hand, in the key element matrix M1, all the entries eR2(i,j) (i=0, 1, 2; j=0, 1) in the higher hierarchies than the hierarchical level 2 of scalability R are assigned operation data H*(eR2(0,2))(=H*3(eR2(2,2))) obtained by further carrying out the hash operation with the one-way hash function H* on the entry eR2(0,2). The operation data at this time is a value corresponding to a packet with the hierarchy number of scalability L being −1 (which is nonexistent in fact).
The key element matrix M1 generated as described above enables the access control to the packets Pi,2 (i=0, 1, 2), while maintaining the hierarchical nature of scalability L.
In the key element matrix M2, as a matrix corresponding to the hierarchical level 1 of scalability R, the split key eR1 is assigned to the (2,1) entry. In this first embodiment, the entries in the key element matrix M2 will be denoted below by eR1(i,j) (i=0, 1, 2; j=0, 1, 2).
Operation data of H*(eR1(2,1)) is assigned to the coordinate entry eR1(1,1) and operation data of H*2(eR1(2,1)) to the entry eR1(0,1) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=1) in scalability R corresponding to the split key eR1. This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 1 of scalability R.
Furthermore, in the key element matrix M2, all the entries eR1(i,0) (i=0, 1, 2) in the higher hierarchy than the hierarchical level 1 of scalability R are assigned operation data H*(eR1(0,1))(=H*3(eR1(2,1))) obtained by further carrying out the hash operation with the one-way hash function H* on the entry eR1(0,1). The operation data at this time is a value corresponding to a packet with the hierarchy number of scalability L being −1 (which is nonexistent in fact).
On the other hand, in the key element matrix M2, the entries eR1(i,2) (i=0, 1, 2) in the lower hierarchy than the hierarchical level 1 of scalability R are assigned the same values as the corresponding entries eR1(i,1) (i=0, 1, 2). It is synonymous with the following: the entries eR1(i,2) (i=0, 1) are assigned values obtained by successively carrying out the hash operation with the one-way hash function on the entry eR1(2,2) in which the value of entry eR1(2,1) is copied once. In
The key element matrix M2 generated as described above enables the access control to the packets Pi,1 (i=0, 1, 2), while maintaining the hierarchical nature of scalability L.
Similarly, in the key element matrix M3, as a matrix corresponding to the hierarchical level 0 (highest hierarchy) of scalability R, the split key eR0 is assigned to the (2,0) entry. In this first embodiment, the entries in the key element matrices M3 will be denoted below by eR0(i,j) (i=0, 1, 2; j=0, 1, 2).
Operation data of H*(eR0(2,0)) is assigned to the coordinate entry eR0(1,0) and operation data of H*2(eR0(2,0)) is assigned to the entry eR0(0,0) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=0) in scalability R corresponding to the split key eR0. This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 0 of scalability R.
Furthermore, since there is no higher hierarchy than the hierarchical level 0 of scalability R in the key element matrix M3, no further hash operation is carried out on the entry eR0(0,0).
On the other hand, in the key element matrix M3, the entries eR0(i,j) (i=0, 1, 2; j=1, 2) in the lower hierarchies than the hierarchical level 0 of scalability R are assigned the same values as the corresponding entries eR0(i,0) (i=0, 1, 2). This is synonymous with the following: the entries eR0(i,j) (i=0, 1, 2; j=1, 2) are assigned the values obtained by successively carrying out the hash operation with the one-way hash function on each of the entries eR0(2,2) and eR0(2,1) in which the value of the entry eR0(2,0) is copied once.
In this case, the key element matrix M3 generated also enables the access control to the packets Pi,0 (i=0, 1, 2), while maintaining the hierarchical nature of scalability L.
Subsequently, a partial key matrix MP1 is generated by combining the entries coordinately consistent among the key element matrices M1-M3 generated by the above-described matrix operation. Namely, entries in the partial key matrix MP1 serve as partial keys Ki,j (i=0, 1, 2; j=0, 1, 2) corresponding to the respective packets Pi,j (i=0, 1, 2; j=0, 1, 2). As described above, for each of the hierarchies of one scalability R (resolution level), the partial keys are generated while maintaining the hierarchical nature of the other scalability L (layer), whereby the hierarchical nature is maintained in the layer and in the resolution level. The packets Pi,j (i=0, 1, 2; j=0, 1, 2) are coded by the respective corresponding partial keys Ki,j (i=0, 1, 2; j=0, 1, 2) and the JPEG2000 packet codestreams thus encrypted are laid open to the public.
The second embodiment of the encryption key generating method according to the present invention will be described below. In this second embodiment, scalabilities as access control targets are scalability L (layer) and scalability R (resolution level), the number of hierarchies NL in scalability L is 3, and the number of hierarchies NR in scalability R is 2. At this time, packets in respective hierarchies in scalabilities L and R are handled as 3×2 matrix entries Pi,j (i=0, 1, 2; j=0, 1).
The master key is a partial key corresponding to the lowest packet preliminarily managed and in the example of
Matrix entries in the respective key element matrices M1, M2 are sequentially generated from the split keys eR1, eR0 being the corresponding root keys, as shown in
First, in the key element matrix M1, as a matrix corresponding to the hierarchical level 1 (lowest hierarchy) of scalability R, the split key eR1 is assigned to the (2,1) entry. In the drawing, superscript R1 to each matrix entry e represents the hierarchical level of scalability R (reference scalability) corresponding to the key element matrix M1, and each subscript represents coordinates of an entry in the key element matrix M1. In this second embodiment, the entries in the key element matrix M1 will be denoted below by eR1(i,j) (i=0, 1, 2; j=0, 1).
Coordinate entries eR1(1,1) and eR2(0,1) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=1) in scalability R corresponding to the split key eR1 are assigned operation data successively obtained by repeating the hash operation on the split key eR1 using the one-way hash function H*. Namely, eR1(1,1) is assigned the operation data of H*(eR1(2,1)) and the entry eR1(0,1) is assigned the operation data of H*2(eR1(2,1)). This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 1 of scalability R.
On the other hand, in the key element matrix M1, all the entries eR1(i,0) (i=0, 1, 2) in the higher hierarchy than the hierarchical level 1 of scalability R are assigned the operation data H*(eR1(0,1))(=H*3(eR1(2,1))) obtained by further carrying out the hash operation with the one-way hash function H* on the entry eR1(0,1). The operation data at this time is a value corresponding to a packet with the hierarchy number of scalability L being −1 (which is nonexistent in fact).
The key element matrix M1 generated as described above enables the access control to the packets Pi,1 (i=0, 1, 2), while maintaining the hierarchical nature of scalability L.
In the key element matrix M2, as a matrix corresponding to the hierarchical level 0 (highest hierarchy) of scalability R, the split key eR0 is assigned to the (2,0) entry. In this second embodiment, the entries in the key element matrix M2 will be denoted below by eR0(i,j) (i=0, 1, 2; j=0, 1).
The operation data of H* (eR0(2,0)) is assigned to the coordinate entry eR0(1,0) and the operation data of H*2(eR0(2,0)) is assigned to the entry eR0(0,0) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=0) in scalability R corresponding to the split key eR0. This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 0 of scalability R.
Furthermore, no further hash operation on the entry eR0(0,0) is carried out because there is no higher hierarchy than the hierarchical level 0 of scalability R in the key element matrix M2.
On the other hand, in the key element matrix M2, the entries eR0(i,1) (i=0, 1, 2) in the lower hierarchy than the hierarchical level 0 of scalability R are assigned the same values as the corresponding entries eR0(i,0) (i=0, 1, 2). This is synonymous with the following: the entries eR0(i,1) (i=0, 1, 2) are assigned values obtained by successively carrying out the hash operation with the one-way hash function on the entry eR0(2,1) in which the value of the entry eR0(2,0) is copied once. In
In this case, the key element matrix M2 thus generated also enables the access control to the packets Pi,0 (i=0, 1, 2), while maintaining the hierarchical nature of scalability L. In
The subsequent step is to combine the entries coordinately consistent between the key element matrices M1, M2 generated by the above matrix operation, to generate a partial key matrix MP2. Namely, the entries in the partial key matrix MP2 serve as partial keys Ki,j (i=0, 1, 2; j=0, 1) corresponding to the respective packets Pi,j (i=0, 1, 2; j=0, 1). As described above, for each hierarchy of one scalability R (resolution level), the partial keys are generated while maintaining the hierarchical nature of the other scalability L (layer), whereby the hierarchical nature is maintained in the layer and in the resolution level. The packets Pi,j (i=0, 1, 2; j=0, 1) are coded by the corresponding partial keys Ki,j (i=0, 1, 2; j=0, 1) and the JPEG2000 packet codestreams encrypted in this manner are laid open to the public.
The third embodiment of the encryption key generating method according to the present invention will be described below. In this third embodiment, the scalabilities as access control targets are scalability L (layer) and scalability R (resolution level), the number of hierarchies NL in scalability L is 4, and the number of hierarchies NR in scalability R is 3. At this time, packets in respective hierarchies in scalabilities L and R are handled as 4×3 matrix entries Pi,j (i=0, 1, 2; j=0, 1, 2, 3).
A master key is a partial key corresponding to the lowest packet preliminarily managed and in the example of
The matrix entries in the respective key element matrices M1-M3 are successively generated from the split keys eR2, eR1, and eR0 being the corresponding root keys, as shown in
First, in the key element matrix M1, as a matrix corresponding to the hierarchical level 2 (lowest hierarchy) of scalability R, the split key eR2 is assigned to the (3,2) entry. In the drawing, superscript R2 to each matrix entry e represents the hierarchical level of scalability R (reference scalability) corresponding to the key element matrix M1, and each subscript represents coordinates of an entry in the key element matrix M1. In this third embodiment, the entries in the key element matrix M1 will be denoted below by eR2(i,j) (i=0, 1, 2, 3; j=0, 1, 2).
The coordinate entries eR2(2,2), eR2(1,2), and eR2(0,2) corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=2) in scalability R corresponding to the split key eR2 are assigned operation data successively obtained by repeating the hash operation on the split key eR2 using the one-way hash function H*. Specifically, eR2(2,2) is assigned the operation data of H*(eR2(3,2)), eR2(1,2) is assigned the operation data of H*2(eR2(3,2)), and the entry eR2(0,2) is assigned the operation data of H*3(eR2(3,2)). This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 2 of scalability R.
On the other hand, in the key element matrix M1, all the entries eR2(i,j) (i=0, 1, 2, 3; j=0, 1) in the higher hierarchies than the hierarchical level 2 of scalability R are assigned operation data H*(eR2(0,2))(=H*4(eR2(3,2))) obtained by further carrying out the hash operation with the one-way hash function H* on the entry eR2(0,2). The operation data at this time is a value corresponding to a packet with the hierarchy number of scalability L being −1 (which is nonexistent in fact).
The key element matrix M1 generated as described above enables the access control to the packets Pi,2 (i=0, 1, 2, 3), while maintaining the hierarchical nature of scalability L.
In the key element matrix M2, as a matrix corresponding to the hierarchical level 1 of scalability R, the split key eR1 is assigned to the (3,1) entry. In this third embodiment, the entries in the key element matrix M2 will be denoted below by eR1(i,j) (i=0, 1, 2, 3; j=0, 1, 2).
Operation data of H*(eR1(3,1)) is assigned to the coordinate entry eR1(2,1), operation data of H*2(eR1(3,1)) is assigned to the entry eR1(1,1), and operation data of H*3(eR1(3,1)) is assigned to the entry eR1(0,1), corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=1) in scalability R corresponding to the split key eR1. This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 1 of scalability R.
Furthermore, in the key element matrix M2, all the entries eR1(i,0) (i=0, 1, 2, 3) in the higher hierarchy than the hierarchical level 1 of scalability R are assigned operation data H*(eR1(0,1)) (=H*4(eR1(3,1))) obtained by further carrying out the hash operation with the one-way hash function H* on the entry eR1(0,1). The operation data at this time is a value corresponding to a packet with the hierarchy number of scalability L being −1 (which is nonexistent in fact).
On the other hand, in the key element matrix M2, the entries eR1(i,2) (i=0, 1, 2, 3) in the lower hierarchy than the hierarchical level 1 of scalability R are assigned the same values as the corresponding entries eR1(i,1) (i=0, 1, 2, 3). This is synonymous with the following: the entries eR1(i,2) (i=0, 1, 2) are assigned values obtained by successively carrying out the hash operation with the one-way hash function on the entry eR1(3,2) in which the value of the entry eR1(3,1) is copied once. In
The key element matrix M2 generated as described above enables the access control to the packets Pi,1 (i=0, 1, 2, 3), while maintaining the hierarchical nature of scalability L.
Similarly, in the key element matrix M3, as a matrix corresponding to the hierarchical level 0 (highest hierarchy) of scalability R, the split key eR0 is assigned to the (3,0) entry. In this third embodiment, the entries in the key element matrix M3 will be denoted below by eR0(i,j) (i=0, 1, 2, 3; j=0, 1, 2).
Operation data of H*(eR0(3,0)) is assigned to the coordinate entry eR0(2,0), operation data of H*2(eR0(3,0)) is assigned to the entry eR0(1,0), and operation data of H*3(eR0(3,0)) is assigned to the entry eR0(0,0), corresponding to the respective remaining hierarchies in scalability L in the hierarchy (hierarchical level=0) in scalability R corresponding to the split key eR0. This matrix operation procedure maintains the hierarchical nature of scalability L, for the hierarchical level 0 of scalability R.
Furthermore, no further hash operation is carried out on the entry eR0(0,0) because there is no higher hierarchy than the hierarchical level 0 of scalability R in the key element matrix M3.
On the other hand, in the key element matrix M3, the entries eR0(i,j) (i=0, 1, 2, 3; j=1, 2) in the lower hierarchies than the hierarchical level 0 of scalability R are assigned the same values as the corresponding entries eR0(i,0) (i=0, 1, 2, 3). This is synonymous with the following: the entries eR0(i,j) (i=0, 1, 2, 3; j=1, 2) are assigned the values obtained by successively carrying out the hash operation with the one-way hash function on each of the entries eR0(3,2) and eR0(3,1) in which the value of entry eR0(3,0) is copied once. In
In this case, the key element matrix M3 thus generated enables the access control to the packets Pi,0 (i=0, 1, 2, 3), while maintaining the hierarchical nature of scalability L.
The subsequent step is to combine the entries coordinately consistent among the key element matrices M1-M3 generated by the above-described matrix operation, to generate a partial key matrix MP3. Namely, entries in the partial key matrix MP3 serve as partial keys Ki,j (i=0, 1, 2, 3; j=0, 1, 2) corresponding to the respective packets Pi,j (i=0, 1, 2, 3; j=0, 1, 2). As described above, for each of the hierarchies in one scalability R (resolution level), the partial keys are generated while maintaining the hierarchical nature of the other scalability L (layer), whereby the hierarchical nature is maintained in the layer and in the resolution level. The packets Pi,j (i=0, 1, 2, 3; j=0, 1, 2) are coded by the respective corresponding partial keys Ki,j (i=0, 1, 2, 3; j=0, 1, 2) and the JPEG2000 packet codestreams thus encrypted are laid open to the public.
(Evaluation of Resistance to Collusion Attacks)
In the following, the encryption keys (partial keys corresponding to the packets in the respective hierarchies) generated by the encryption key generating methods of the first to third embodiments configured as described above will be evaluated as to the resistance to collusion attacks.
It is first assumed in this evaluation that data to be coded is JPEG2000 data with scalability L having the hierarchy number NL and scalability R (resolution level) having the hierarchy number NR.
Partial keys Ki,j for the JPEG2000 packets Pi,j (i=0, 1, . . . , NL−1; j=0, 1, . . . , NR−1) are subordinately generated with the one-way hash function H*, using a partial key KNL-1,NR-1 for the lowest packet PNL-1,NR-1 as a master key. The concepts of superordinate and subordinate of hierarchies are the same as in
Let us assume, for example, NR<NL. Elements eRji,j in partial key Ki,j for all the packets Pi,j (i=0, 1, . . . , NL−1) in the hierarchy j (0≦j≦NR−1) of scalability R are subordinately generated by the hash operation H*(NL-1-i)(eRj) with the one-way hash function H*, from the element eRj as a root key. At this time, hash operation values H*(NL-1-i)(eRj) in the higher hierarchy in the key element matrix Mj are directly reflected (or copied) into corresponding elements eRji,b1 in partial key Ki,b1 for all packets Pi,b1 (i=0, 1, . . . , NL−1) in a lower hierarchy b1 (<j) of scalability R. On the other hand, a hash operation value H*NL(eRj) is assigned to elements eRji,b2 in partial key Ki,b2 for all packets Pi,b2 (i=0, 1, . . . , NL−1) in a higher hierarchy b2 (>j) in scalability R.
For this reason, a partial key in a higher hierarchy is reflected in at least some of elements constituting a partial key in a lower hierarchy, while any elements in a partial key in a lower hierarchy are not reflected in elements constituting a partial key in a higher hierarchy. Namely, the partial keys generated by the encryption key generating method of the present invention do not allow any partial key in a lower hierarchy to be generated from a partial key in a higher hierarchy, and, therefore, they have the resistance to collusion attacks.
(Generation of Encryption Keys in Decryption)
The below will describe generation of encryption keys (partial keys corresponding to respective packets allowed) in decryption. In the foregoing encryption key generation, each of partial keys in hierarchies at higher positions was subordinately generated from the only managed master key. On the occasion of decryption, partial keys in a hierarchy at each higher position are similarly subordinately generated from a master key, but a user receives only a delivered decryption key for the lowest packet in a packet group authorized to open.
Specifically, in the case of NL=NR=3, as shown in
The following will explain a case where the user is allowed to view a coded picture Q1,1 in
For that, on the user side the received partial key K1,1 as a master key is first divided by the number of hierarchies in scalability R (i.e., by three) to generate three split keys eR2, eR1, and eR0.
Subsequently, a key element matrix is generated for each of the three hierarchies in scalability R. Among the three split keys eR2, eR1, and eR0, a split key in a lower corresponding hierarchy of scalability R than the corresponding hierarchy of the received key K1,1 is hash operation data with the hierarchical level of the other scalability L being −1. In this case, therefore, the same value as the corresponding partial key is preliminarily assigned to all entries in the key element matrix.
First, in generation of the 2×2 key element matrix M1 corresponding to the hierarchy 2 of scalability R, the partial key eR2 is hash operation data corresponding to the hierarchy −1 of scalability L. Namely, since the hierarchy (hierarchical level: 2) corresponding to the split key eR2 of scalability R is lower than the hierarchy (hierarchical level: 1) of scalability R corresponding to the received key K1,1, the value of the split key eR2 is the hash operation value with the hierarchical level of scalability L being −1. In this case, the same value as the split key eR2 (with the hierarchical level of scalability L being −1) is assigned to all the matrix entries eR2(0,1), eR2(1,1), eR2(0,0), and eR2(1,0) in the 2×2 key matrix M1 corresponding to the split key eR2.
Next, in generation of the 2×2 key element matrix M2 corresponding to the hierarchy 1 of scalability R, the value of the split key eR1 is first assigned to the eR1(1,1) entry. The entry eR1(0,1) in the higher hierarchy of scalability L is assigned operation data H*(eR1(1,1)) of the hash operation with the one-way hash function H*. Furthermore, hash operation data H*2(eR2(1,1)) with the hierarchical level of scalability L: −1 is assigned to each of the entries eR1(1,0) and eR1(0,0) corresponding to the higher hierarchy (hierarchical level: 0) than the hierarchy (hierarchical level: 1) corresponding to the split key eR1 in scalability R. Conversely, no hash operation is carried out because there is no lower hierarchy (hierarchical level: 2) than the hierarchy (hierarchical level: 1) corresponding to the split key eR1 in scalability R.
On the other hand, in generation of the 2×2 key element matrix M3 corresponding to the hierarchy 0 of scalability R, there is no higher hierarchy (hierarchical level: −1) than the hierarchy (hierarchical level: 0) corresponding to the split key eR0 in scalability R. Therefore, the value of the split key eR0 is first assigned to the eR0(1,0) entry. The entry eR0(0,0) in the higher hierarchy of scalability L is assigned operation data H*(eR1(1,0)) of the hash operation with the one-way hash function H*. Conversely, for the lower hierarchy (hierarchical level: 1) than the hierarchy (hierarchical level: 0) corresponding to the split key eR0 in scalability R, the value of the entry eR0(1,0) is copied into the eR0(1,1) entry and the hash operation is successively carried out based on this copy value. Namely, the entry eR0(0,1) in the higher hierarchy of scalability L is assigned operation data H*(eR0(1,1)) of the hash operation with the one-way hash function H*.
By combining the entries coordinately consistent among the 2×2 key element matrices M1-M3 corresponding to the respective hierarchies of scalability R generated as described above, decryption keys K1,0, K0,1, K0,0 corresponding to the packets P1,0, P0,1, P0,0 are generated from the master key K1,1.
As described above, a partial key for a certain packet is not generated from a packet in a higher hierarchy in at least one scalability than the packet of interest, but can be generated from any packet in an equivalent or lower hierarchy in each of scalabilities. For this reason, the partial keys have the resistance to collusion attacks.
When there are three or more types of scalabilities as access control targets, a first conceivable method is to repeat the aforementioned key generation procedure as a minimum processing unit for combinations of two types of scalabilities. In this case, where the number of scalabilities as access control targets is NS, the number of repetitions of the minimum processing unit is given by NSC2(=(NS(NS−1))/2).
In the example shown in
On that occasion, as shown in
The key combinations listed in the partial key element table 11b generated in this manner correspond to the hierarchical value combinations in the hierarchy table 11a showing coordinates of respective entries in the partial key matrix MP4. Each entry KL,R,C (L=0, 1, 2; R=0, 1; C=0, 1, 2) in the partial key matrix MP4 is obtained by combining key elements KRLR,L, KRCR,C, and KLCL,C constituting one combination in the partial key element table 11b, as shown in the area (a) of
Each entry in the partial key matrix MP4 obtained in this manner is an encryption key corresponding to each packet in the digital data having L (layer) with three hierarchies, R (resolution level) with two hierarchies, and C (component) with three hierarchies as the scalabilities. Namely, each entry in the partial key matrix MP4 is a partial key corresponding to a packet specified by hierarchical values of the scalabilities indicating coordinates of the entry.
In cases where there are three or more types of scalabilities as access control targets, the partial keys thus obtained have the resistance to collusion attacks as in the case of two types of scalabilities.
The above encryption key generating method of the fourth embodiment was described using the two-dimensional matrix representation as in the first to third embodiments, and the following will explain the encryption key generating method as a generalized method of the fourth embodiment in a stereoscopic state using a three-dimensional matrix representation. It is assumed in the description below that the access control targets are scalabilities L, R, and C, the number of hierarchies NL in the scalability L (layer) is 6, the number of hierarchies NR in the scalability R (resolution level) is 4, and the number of hierarchies NC in the scalability C (component) is 3. In this case, packets in the respective hierarchies in scalabilities L, R, and C are handled as 6×4×3 matrix entries Pi,j,k (i=0, 1, 2, 3, 4, 5; j=0, 1, 2, 3; k=0, 1, 2), as shown in the area (a) of
As shown in the area (a) of
In the case where the 6×4×3 three-dimensional partial key matrix QM as in the area (a) of
First, the split key eRLR3 is assigned to the coordinate entry P5,3,2 (the hatched portion in the area (a) of
Subsequently, the split key eRLR2 is assigned to the coordinate entry P5,2,2 (the hatched portion in the area (b) of
Furthermore, a three-dimensional key element matrix QMRL3 shown in the area (c) of
Next,
The split key eRCR3 is assigned to the coordinate entry P5,3,2 (the hatched portion in the area (a) of
A three-dimensional key element matrix QMRC2 shown in the area (b) of
The split key eLCC2 is assigned to the coordinate entry P5,3,2 (the hatched portion in the area (a) of
A three-dimensional key element matrix QMLC2 shown in the area (b) of
A three-dimensional partial key matrix QM by the encryption key generating method as the generalized method of the fourth embodiment is obtained by combining the coordinate entries at the same positions in the three-dimensional key element matrices QMRL1-QMRL4, QMRC1-QMRC4, QMLC1-QMLC3 shown of
Since in the above-described encryption key generating method of the fourth embodiment the minimum processing unit is definitely the partial key generating procedure with two types of scalabilities, the resultant partial keys are vulnerable to collusion attacks by three or more persons with increase in the number of hierarchies in each scalability (e.g., there are a plurality of coordinate lines with the same partial key in a multidimensional partial key matrix like the three-dimensional partial key matrix QM in the area (a) of
First, the encryption key generating method of the fifth embodiment includes preliminarily setting two types of scalabilities as reference scalabilities out of the three or more types of scalabilities, as shown in
In the encryption key generating method of the fifth embodiment, a three-dimensional key element matrix in coordinate representation with hierarchical values in three or more types of scalabilities L, R, C (cf. the area (a) of
First, the area (a) of
The split key eRLR3 is assigned to the coordinate entry P5,3,2 (the hatched portion in the area (a) of
The area (b) of
In generation of this three-dimensional key element matrix QM2-1, the split key eRLR2 is assigned to the coordinate entry P5,2,2 (the hatched portion in the area (b) of
The three-dimensional key element matrix QM3-1 shown in the area (c) of
Next, the area (a) of
The split key eRLR3 is assigned to the coordinate entry P5,3,2 (the hatched portion in the area (a) of
The are (b) of
In generation of this three-dimensional key element matrix QM2-2, the split key eRLR2 is assigned to the coordinate entry P5,2,1 (the hatched portion in the area (b) of
The three-dimensional key element matrix QM3-2 shown in the area (c) of
Furthermore, the area (a) of
The split key eRLR3 is assigned to the coordinate entry P5,3,0 (the hatched portion in the area (a) of
The area (b) of
In generation of this three-dimensional key element matrix QM2-3, the split key eRLR2 is assigned to the coordinate entry P5,2,0 (the hatched portion in the area (b) of
The three-dimensional key element matrix QM3-3 shown in the area (c) of
The three-dimensional partial key matrix QM by the encryption key generating method of the fifth embodiment is obtained by combining the coordinate entries at the same coordinate positions in the three-dimensional key element matrices QM1-1-QM4-1, QM1-2-QM4-2, and QM1-3-QM4-3 shown in
It is obvious that the present invention can be modified in many ways in view of the above description of the present invention. Such modifications should not be construed as a departure from the spirit and scope of the present invention and all improvements obvious to those skilled in the art are intended for inclusion in the scope of claims which follow.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2007-287756 | Nov 2007 | JP | national |
| 2008-108115 | Apr 2008 | JP | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/JP2008/070037 | 11/4/2008 | WO | 00 | 7/9/2009 |
