JP2006148469A - Multicast delivery method, host device, and router - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a multicast distribution method, a host device, and a router capable of distributing a decryption key only to a host device that has made a distribution request and decrypting a streaming encrypted packet only by the host device that has made the distribution request. For the purpose.
A streaming server 20 transmits an encrypted packet including a key number notified from a key management server 21 and data obtained by encrypting streaming to a router 22, and a host device 24 that desires multicast distribution requests a distribution to the router. Furthermore, the encryption key packet is requested from the key management server via the router, the router transmits the encryption key packet transmitted from the key management server only to the host device that has made the distribution request, and the host device receives the encryption key packet. When the key number included in the encrypted encryption key packet matches the key number included in the encrypted packet distributed from the router, the decryption key included in the encryption key packet is used to encrypt the streaming included in the encrypted packet. Decrypt the data.
[Selection] Figure 5

Description

  The present invention relates to a multicast distribution method, a host device, and a router, and more particularly to a multicast distribution method, a host device, and a router that perform streaming multicast distribution.

  FIG. 1 is a system configuration diagram of an example of a conventional multicast distribution system, and FIG. 2 shows a conventional multicast distribution sequence. In FIG. 1, a streaming server 10 is connected to a router 11, a LAN 12 is connected to port # 1 of the router 11, and host devices 13 and 14 are connected to the LAN 12.

  As shown in FIG. 2, the streaming server 10 always distributes streaming to the router 11. The host devices 13 and 14 under the port # 1 of the router 11 receive HMQ (Host Membership Query) for confirming multicast participation from the router 11 periodically (for example, every 125 seconds).

  When the host device 13 desires multicasting to the router 11, the host device 13 transmits an HMR (Host Membership Report) to the router 11. The router 11 that has received the HMR multicasts the streaming to the LAN 12 under the port # 1. Thereby, the host devices 13 and 14 connected under the port # 1 of the router 11 can receive the streaming.

By the way, in Patent Document 1, the routing device in which the client device is accommodated has an authentication function, and the content server and the encryption key packet management device distribute the content and the decryption key to the routing device with the authentication function by multicast. It is described that a routing device with an authentication function authenticates a request from a client device and distributes content and a decryption key to the client device only when the authentication is successful.
JP 2003-174440 A

  In the conventional multicast distribution system, the host device 13 desires streaming multicast distribution, but the problem is that streaming is also multicast distributed to the host device 14 connected under port # 1 of the router 11. was there.

  Also in the technique of Patent Document 1, since the routing device with an authentication function distributes the content and the decryption key to the client device on a port basis, the routing device with the authentication function is connected to another client device connected to the same port as the authenticated client device. However, the content and the decryption key are distributed.

  The present invention has been made in view of the above points, and a multicast distribution method that distributes a decryption key only to a host apparatus that has made a distribution request and can decrypt a streaming encrypted packet only by the host apparatus that has made the distribution request. And a host device and a router.

The invention according to claim 1 is a multicast distribution method for multicast distribution streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
The streaming server transmits an encrypted packet including the key number notified from the key management server and the data obtained by encrypting the streaming to the router,
A host device that desires multicast distribution makes a distribution request to the router, further requests an encryption key packet from the key management server via the router,
The router transmits the encryption key packet transmitted from the key management server only to the host device that has made the distribution request,
The host apparatus uses the decryption key included in the encryption key packet when the key number included in the received encryption key packet matches the key number included in the encrypted packet multicast-distributed from the router. By decrypting the encrypted streaming data contained in the packet,
It is possible to distribute the decryption key only to the host apparatus that has made the distribution request, and to decrypt the encrypted encrypted packet only by the host apparatus that has made the distribution request.

The invention according to claim 2 is a host device of a multicast distribution system that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
Request means for making a distribution request to the router, and further requesting an encryption key packet from the key management server via the router;
When the key number included in the received encryption key packet from the key management server matches the key number included in the encrypted packet distributed by multicast from the router, the decryption key included in the encryption key packet is used to Having decryption means for decrypting data obtained by encrypting streaming included in the encrypted packet;
The invention according to claim 3 is a router of a multicast distribution system that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
After a distribution request from a host device that desires multicast distribution and a request for an encryption key packet to the key management server, the encryption key packet transmitted from the key management server is sent only to the host device that has made the distribution request. By having encryption key packet transmission means for transmitting to
It is possible to distribute the decryption key only to the host apparatus that has made the distribution request, and to decrypt the encrypted encrypted packet only by the host apparatus that has made the distribution request.

The invention according to claim 4 is the multicast distribution method according to claim 1,
The streaming server changes a key number of the encryption key packet every predetermined time, and adds change information of the key number of the encryption key packet to the encrypted packet before changing the encryption key packet. To
The host device receiving the multicast distribution receives the change information of the key number of the encryption key packet and requests the changed encryption key packet from the key management server,
The router transmits the changed encryption key packet transmitted from the key management server only to the host device that has requested the encryption key packet;
The host device holds the received changed encryption key packet together with the encryption key packet in use,
The host device receiving the multicast distribution can hold the changed encryption key packet before the streaming server changes the encryption key packet.

The invention according to claim 5 is the multicast distribution method according to claim 4,
The host device can delete an unnecessary encryption key packet by deleting the encryption key packet in use when the key number of the encrypted packet distributed by multicast from the router is changed.

  According to the present invention, it is possible to distribute a decryption key only to a host apparatus that has made a distribution request, and to decrypt a streaming encrypted packet only by the host apparatus that has made the distribution request.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 3 shows a system configuration diagram of an embodiment of a system to which the multicast distribution method of the present invention is applied. In the figure, the streaming server 20 and the key management server 21 are connected, and the streaming server 20 always delivers the encrypted packet stream encrypted by using the encryption key supplied from the key management server 21 to the router 22. To do. The key management server 21 manages key numbers and decryption keys, and the key management server 21 synchronizes the key numbers with the streaming server 20 using TCP (Transmission Control Protocol). A LAN 23 is connected to the port # 1 of the router 22, and host devices 24 and 25 are connected to the LAN 23.

  For example, the router 22 periodically transmits HMQ for confirming participation in multicast every 125 s, and the host devices 24 and 25 under the port # 1 of the router 22 periodically receive HMQ from the router 22. Either of the host devices 24 and 25 desiring multicast distribution transmits HMR to the router 22. The router 22 transmits an encrypted packet to the LAN 23 from the port # 1 that has received the HMR.

  FIG. 4 shows a block diagram of an embodiment of the host devices 24 and 25 used in the multicast distribution method of the present invention. In the figure, the host device 30 includes a packet receiving unit 31, an IGMP (Internet Group Management Protocol) receiving unit 32, an encrypted packet receiving unit 33, an encryption key packet receiving unit 34, a non-protocol packet receiving unit 35, The control unit 36 includes an IGMP processing unit 37, a decoding processing unit 38, and a packet processing unit 39.

  The packet receiving unit 31 is connected to the LAN 23 and receives a packet transmitted from the router 22 to each of the IGMP receiving unit 32, the encrypted packet receiving unit 33, the encryption key packet receiving unit 34, and the non-protocol packet receiving unit 35. Supply.

  Of the packets received by the packet receiver 31, the IGMP packet is received by the IGMP receiver 32 and processed by the IGMP processor 37. The encrypted packet is received by the encrypted packet receiving unit 33, decrypted by the decryption processing unit 38, and then supplied to the packet processing unit 39. The encryption key packet is received by the encryption key packet receiving unit 34 and supplied to the decryption processing unit 38. The non-protocol packet is received by the non-protocol packet receiver 35 and supplied to the packet processor 39.

  FIG. 5 shows a flowchart of the entire system when an encrypted packet is received by the host device. In the figure, for example, the host device 24 periodically receives the HMQ from the router 22 in step S10. The host device 24 desiring multicast distribution transmits the HMR to the router 22 in step S11.

  The host device 24 that has transmitted the HMR in step S12 uses the SSL (Secure Sockets Layer: communication in which data between the host and the server is encrypted) or the like to use the encryption key to the key management server 21 via the router 22 and the streaming server 20. Request a packet.

  In step S13, the key management server 21 uses SSL or the like to send the encryption key packet (key number 1, decryption key A) via the streaming server 20 and the router 22, the HMR, and the host device 24 that has requested the encryption key packet. Just send to. In step S14, the host device 24 receives and holds the encryption key packet (key number 1, decryption key A).

  In step S15, the router 22 transmits an encrypted packet to the LAN 23 from the port # 1 that has received the HMR. In step S <b> 16, the host device 24 receives the encrypted packet from the router 22.

  FIG. 6 shows the configuration of the HMR. In the figure, HMR is a destination address (DA: MAC address of the destination), a source address (SA: MAC address of the source), and Type 0800, data indicating that the next data is IP (Internet Protocol). And FCS (Frame Check Sequence). Data consists of an IP header and an IGMP header.

  The router 22 that has received the HMR knows the host device 24 that has transmitted the HMR from the source address (SA) in the HMR, and then sends the encryption key packet from the key management server 21 only to the host device 24 that is the source of the HMR. Can be sent.

  FIG. 7 shows the configuration of the encrypted packet. In the figure, the encrypted packet is composed of a key number, an update flag, and multicast encrypted data. In the update flag, a value of 0 indicates that the key number does not need to be updated, and a value of 1 indicates that the key number needs to be updated.

  FIG. 8 shows a flowchart when the host device decrypts the encrypted packet. In the figure, in step S30, the host device compares the key number of the encryption key packet held with the key number in the received encrypted packet. If both key numbers match (in the case of the host device 24), decrypt with the decryption key (for example, decryption key A) holding the encrypted packet multicast-transmitted in step S31, and watch the streaming in step S32. Can do. If the two key numbers do not match (in the case of the host device 25), the streaming cannot be viewed in step S33.

  The update of the encryption key packet will be described. The time for updating the key number of the encrypted packet is set in advance. For example, the key number is set to be updated every m (for example, m = 60) from the start of transmission. The streaming server 20 transmits the encrypted packet with the update flag 0 with the key number 1 and transmits the encrypted packet with the update flag 1 with the key number 1 n minutes before the key number is updated (for example, n = 3). . After that, the encrypted packet with the update flag 0 is transmitted with the key number 1 for n minutes, and then the encrypted packet is transmitted with the key number 2 switched to the update flag 0.

  FIG. 9 shows a flowchart when the encryption key packet is updated in the host device. In the figure, in step S40, the host device 24 determines whether or not an encrypted packet with the update flag 1 has been received. When the encrypted packet with the update flag 1 is received, the host device 24 requests the key management server 21 to update the encryption key packet via the router 22 and the streaming server 20 using SSL or the like in step S41.

  In step S42, the key management server 21 transmits the encryption key packet (key number 2, decryption key B) via the streaming server 20 and the router 22 using SSL or the like only to the host device 24 that has requested update of the encryption key packet. To do. In step S43, the host device 24 receives the encryption key packet (key number 2, decryption key B) and holds it together with the encryption key packet (key number 1, decryption key A).

  On the other hand, if the encrypted packet with the update flag 1 is not received in step S40, the host device 24 ends the process without requesting the update of the encryption key packet.

  As a result, the host device 24 receiving the multicast distribution can hold the changed encryption key packet before the streaming server 20 changes the encryption key packet.

  FIG. 10 shows a flowchart of the host device when the encryption key packet is deleted. In the figure, in step S50, for example, the host device 24 determines whether or not a plurality of encryption key packets are held. If a plurality of encryption key packets are held, the host device 24 sets a new encryption in step S51. It is determined whether or not an encrypted packet (encrypted packet with the key number 2 and update flag 0) has been received. When a new encrypted packet (encrypted packet with update flag 0 with key number 2) is received, the host device 24 deletes the unnecessary encryption key packet (key number 1, decryption key A) in step S52.

  If a plurality of encryption key packets are not held, or if a new encrypted packet (encrypted packet with the key number 2 and the update flag 0) has not been received, the host device 24 ends this processing.

  11 and 12 show an embodiment of an operation sequence of the multicast distribution method of the present invention. In the figure, the streaming server 20 requests the key number from the key management server 21 and, after being notified of the key number 1, starts transmitting the encrypted packet with the update flag 0 with the key number 1 to the router 22 from time t1. To do. In addition, the router 22 periodically transmits HMQ to the host devices 24 and 25. When the host device 24 transmits HMR to the router 22 at time t2, the router 22 transmits an encrypted packet with the key number 1 and the update flag 0 to the host devices 24 and 25 at time t3.

  When the host device 24 requests an encryption key packet from the key management server 21 using SSL at time t4, the key management server 21 sends an encryption key packet (key number 1, decryption key A) to the host device 24 using SSL at time t5. ).

  As a result, the host device 24 can decrypt the encrypted packet with the update flag 0 with the key number 1 transmitted from the router 22. Further, since there is no encryption key packet (key number 1, decryption key A) in the host device 25, it is impossible to decrypt the encrypted packet with the update flag 0 with the key number 1 transmitted from the router 22.

  The streaming server 20 transmits the encrypted packet with the update number 1 with the key number 1 to the router 22 at time t6, and the encrypted packet is transmitted from the router 22 to the host devices 24 and 25. Thereafter, the streaming server 20 requests a key number from the key management server 21, and receives a new key number (key number 2) from the key management server 21 at time t7.

  In FIG. 12, at time t8, the host device 24 requests the key management server 21 to update the encryption key packet using SSL or the like, and at time t9, a new encryption key packet (key number 2, decryption key B) is sent from the key management server 21. ).

  Thereafter, the streaming server 20 starts transmission of the encrypted packet with the update flag 0 with the key number 2 to the router 22 at time t10. At this time, the host device 24 has the old encryption key packet (key number 1, decryption key A). After that, the host device 24 uses the decryption key B of the new encryption key packet (key number 2, decryption key B) to encrypt the encrypted packet of the update flag 0 with the key number 2 transmitted from the router 22. Decrypt.

It should be noted that steps S11 and S12 correspond to the requesting means described in the claims or supplementary notes, step S31 corresponds to the decrypting means, step S13 corresponds to the encryption key packet transmitting means, and step S41 corresponds to the changed encryption key packet requesting means. Step S43 corresponds to the holding means, and step S52 corresponds to the deletion means.
(Appendix 1)
A multicast delivery method for multicast delivery of streaming sent from a streaming server to a router to a plurality of host devices connected to the same port of the router,
The streaming server transmits an encrypted packet including the key number notified from the key management server and the data obtained by encrypting the streaming to the router,
A host device that desires multicast distribution makes a distribution request to the router, further requests an encryption key packet from the key management server via the router,
The router transmits the encryption key packet transmitted from the key management server only to the host device that has made the distribution request,
The host apparatus uses the decryption key included in the encryption key packet when the key number included in the received encryption key packet matches the key number included in the encrypted packet multicast-distributed from the router. A multicast distribution method, comprising: decrypting data obtained by encrypting streaming included in a packet.
(Appendix 2)
A host device of a multicast distribution system that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
Request means for making a distribution request to the router, and further requesting an encryption key packet from the key management server via the router;
When the key number included in the received encryption key packet from the key management server matches the key number included in the encrypted packet distributed by multicast from the router, the decryption key included in the encryption key packet is used to A host device comprising decryption means for decrypting data obtained by encrypting streaming included in an encrypted packet.
(Appendix 3)
A multicast distribution system router that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
After a distribution request from a host device that desires multicast distribution and a request for an encryption key packet to the key management server, the encryption key packet transmitted from the key management server is sent only to the host device that has made the distribution request. A router characterized by having encryption key packet transmission means for transmitting to the network.
(Appendix 4)
In the multicast distribution method according to attachment 1,
The streaming server changes the key number of the encryption key packet every predetermined time, and adds change information of the key number of the encryption key packet to the encrypted packet before changing the key number of the encryption key packet. To the router,
The host device receiving the multicast distribution receives the change information of the key number of the encryption key packet and requests the changed encryption key packet from the key management server,
The router transmits the changed encryption key packet transmitted from the key management server only to the host device that has requested the encryption key packet;
The multicast distribution method, wherein the host device holds the received changed encryption key packet together with an encryption key packet in use.
(Appendix 5)
In the multicast delivery method according to attachment 4,
The multicast distribution method, wherein the host device deletes the encryption key packet in use when the key number of the encrypted packet multicast-distributed from the router is changed.
(Appendix 6)
In the host device according to attachment 2,
The host device receiving the multicast distribution receives the change information of the key number of the encryption key packet added to the encryption packet, and requests the changed encryption key packet from the key management server. Request means;
A host device comprising: holding means for receiving the changed encryption key packet transmitted from the key management server and holding it together with the encryption key packet in use.
(Appendix 7)
In the host device according to attachment 6,
A host device comprising: deletion means for deleting an encryption key packet being used by the holding means when a key number of an encrypted packet distributed by multicast from the router is changed.

It is a system block diagram of an example of the conventional multicast delivery system. It is a conventional multicast distribution sequence diagram. It is a system configuration figure of one embodiment of a system to which a multicast distribution method of the present invention is applied. It is a block diagram of one Embodiment of the host apparatuses 24 and 25 used with the multicast delivery method of this invention. It is a flowchart of the whole system when an encryption packet is received with a host apparatus. It is a figure which shows the structure of HMR. It is a figure which shows the structure of an encryption packet. It is a flowchart when an encrypted packet is decrypted by a host device. It is a flowchart when an encryption key packet is updated in a host device. It is a flowchart of a host apparatus when deleting an encryption key packet. It is an operation | movement sequence of the multicast delivery method of this invention. It is an operation | movement sequence of the multicast delivery method of this invention.

Explanation of symbols

20 Streaming server 21 Key management server 22 Router 23 LAN
24,25 Host device 31 Host device 32 IGMP receiving unit 33 Encrypted packet receiving unit 34 Encryption key packet receiving unit 35 Non-protocol packet receiving unit 36 Control unit 37 IGMP processing unit 38 Decryption processing unit 39 Packet processing unit

Claims (5)

A multicast delivery method for multicast delivery of streaming sent from a streaming server to a router to a plurality of host devices connected to the same port of the router,
The streaming server transmits an encrypted packet including the key number notified from the key management server and the data obtained by encrypting the streaming to the router,
A host device that desires multicast distribution makes a distribution request to the router, further requests an encryption key packet from the key management server via the router,
The router transmits the encryption key packet transmitted from the key management server only to the host device that has made the distribution request,
The host apparatus uses the decryption key included in the encryption key packet when the key number included in the received encryption key packet matches the key number included in the encrypted packet multicast-distributed from the router. A multicast distribution method, comprising: decrypting data obtained by encrypting streaming included in a packet. A host device of a multicast distribution system that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
Request means for making a distribution request to the router, and further requesting an encryption key packet from the key management server via the router;
When the key number included in the received encryption key packet from the key management server matches the key number included in the encrypted packet distributed by multicast from the router, the decryption key included in the encryption key packet is used to A host device comprising decryption means for decrypting data obtained by encrypting streaming included in an encrypted packet. A multicast distribution system router that multicasts streaming transmitted from a streaming server to a router to a plurality of host devices connected to the same port of the router,
After a distribution request from a host device that desires multicast distribution and a request for an encryption key packet to the key management server, the encryption key packet transmitted from the key management server is sent only to the host device that has made the distribution request. A router characterized by having encryption key packet transmission means for transmitting to the network. The multicast delivery method according to claim 1, wherein
The streaming server changes the key number of the encryption key packet every predetermined time, and adds change information of the key number of the encryption key packet to the encrypted packet before changing the key number of the encryption key packet. To the router,
The host device receiving the multicast distribution receives the change information of the key number of the encryption key packet and requests the changed encryption key packet from the key management server,
The router transmits the changed encryption key packet transmitted from the key management server only to the host device that has requested the encryption key packet;
The multicast distribution method, wherein the host device holds the received changed encryption key packet together with an encryption key packet in use. The multicast distribution method according to claim 4, wherein
The multicast distribution method, wherein the host device deletes the encryption key packet in use when the key number of the encrypted packet multicast-distributed from the router is changed.

Images