Server apparatus, communication system, and data issuing method

• US 10,069,815 B2
• Filed: 06/11/2014
• Issued: 09/04/2018
• Est. Priority Date: 06/12/2013
• Status: Expired due to Fees

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Doi, Yusuke, Oba, Yoshihiro
• Primary Examiner(s): Lanier, Benjamin E
• Assistant Examiner(s): Callahan, Paul E
• Application Number:
  US14/301,793
• Publication Number:
  US 20140373118A1
• Time in Patent Office: 1,546 Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

There is a server apparatus in which: an issuing unit issues data to devices; a distribution manager distributes the data to devices; a data manager manages data set as issued; a revocation manager detects, from the data set, data that satisfies a condition, and invalidates the detected data; and a filter manager updates and distribute to devices a filter having a predetermined bit length each time data is invalidated, by setting one of a first value and a second value to each of bits in the filter when a revoked data set is projected onto the filter; the data manager identifies data other than the invalidated data, having projection onto at least one of bits whose value has changed between before and after the update, and having the first value for all of bits projected onto the updated filter and reissues data to the device having the identified data.

Claims

1. A server apparatus comprising:

processing circuitry configured to

communicate with a plurality of devices in a wireless network;

issue data to the devices, respectively; and

transmit the issued data to the devices, respectively; and

hardware storage configured to store a data set including the data issued to the devices, a filter having a predetermined bit length, and a revoked data set comprising a set of pieces of invalidated data, wherein

the processing circuitry is further configured to;

detect whether data satisfying a certain condition exists in the data set according to a revocation request, invalidate the data satisfying the certain condition, and add the invalidated data into the revoked data set in the hardware storage;

update the filter in the hardware storage each time invalidated data is added to the revoked data set, by setting first values to bits onto which the revoked data set including the invalidated data is projected in the filter according to a definitive projection relation and setting second values to bits different from the projected bits in the filter, and transmit the updated filter to the devices via the wireless network;

identify, from the data set in the hardware storage, reissuance target data other than the invalidated data, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first values for all of bits onto which the reissuance target data is projected in the updated filter; and

reissue, for the device having the reissuance target data, data having the second value for at least one of bits onto which the reissued data is projected in the updated filter, and transmit reissued data to the device via the wireless network, wherein

the processing circuitry is configured to discard, in a case in which a number of pieces of data having projection onto a bit onto which the issued data is projected in the filter reaches an upper limit in the data set, the issued data, and repetitively issue data until data having projection onto a bit for which the upper limit is not reached is issued.

2. The apparatus according to claim 1, wherein

the processing circuitry is further configured to

compare the filters before and after the update, to thereby identify a bit whose value has changed from the second value to the first value between before and after the update of the filter,

identify, from the data set, data having projection onto the identified bit, and

when values of all of bits onto which the identified data is projected in the updated filter are the first values, identify the identified data as the reissuance target data.

3. The apparatus according to claim 1, wherein

the processing circuitry is further configured to

identify a bit in the filter in which a value of the bit among bits onto which the invalidated data is projected in the filter before the update is the second value,

identify data having projection onto the identified bit, other than the invalidated data, from the data set, and

specify the identified data as the reissuance target data in a case that values of all of bits onto which the identified data is projected in the updated filter are the first values.

4. The apparatus according to claim 1, wherein

the processing circuitry is further configured to manage the data set using a bit-data correspondence table, which associates each bit in the filter with data having projection onto the bit.

5. The apparatus according to claim 1, wherein

the hardware storage is configured to store a list, and

for the devices for which transmission of the reissued data is failed, the processing circuitry is configured to add the reissuance target data of the devices to the list in the hardware storage, and transmit the list to the devices via the wireless network.

6. The apparatus according to claim 5, wherein

the hardware storage is configured to store a first filter having the predetermined bit length, and

the processing circuitry is configured to:

update the first filter by setting the first values to bits on which a set of pieces of reissuance target data included in the list is projected in the first filter according to the definitive projection relation and setting second values to bits different from the projected bits in the first filter; and

transmit the updated first filter instead of the list.

7. The apparatus according to claim 1, wherein

the filter is a Bloom filter, and

the definitive projection relation represents one or more hash functions whose output values each indicate an index of a bit in the filter.

8. The apparatus according to claim 1, wherein

the processing circuitry is configured to generate a random number, and issue the data on a basis of the random number.

9. The apparatus according to claim 1, wherein

the data is certificate data for permitting participation in the network.

10. The apparatus according to claim 1, wherein

the first value is 1, and

the second value is 0.

11. The apparatus according to claim 1, wherein

the filter is a Bloom filter having a filter length m and phase k corresponding to a number of independent hash functions.

12. A data verification system comprising:

a plurality of devices connected in a wireless network; and

a server apparatus, wherein

the server apparatus comprises;

processing circuitry configured to

issue data to the devices in the wireless network, respectively; and

transmit the issued data to the devices, respectively;

hardware storage configured to store a data set including the data issued to the devices, a filter having a predetermined bit length, and a revoked data set comprising a set of pieces of invalidated data;

the processing circuitry being configured to

detect whether data satisfying a certain condition exist in the data set according to a revocation request and invalidate the data satisfying the certain condition;

update the filter in the hardware storage each time the invalidated data is added to the revoked data set, by setting first values to bits onto which the revoked data set after adding is projected in the filter according to a definitive projection relation and setting second values to bits different from the projected bits in the filter;

and transmit an updated filter to the devices in the network;

identify, in the data set in the hardware storage, reissuance target data other than the invalidated data, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first values for all of bits onto which the reissuance target data is projected in the updated filter; and

reissue, for the device having the reissuance target data, data having the second value for at least one of bits onto which the reissued data is projected in the updated filter, and transmit reissued data to the device, and

the devices each comprises processing circuitry configured to;

test data received from one device of the plurality of devices on a basis of the filter received from the server apparatus; and

determine that the data received from the one device is invalid when all values of bits onto which the data is projected in the filter are the first values, wherein

the processing circuitry of the server apparatus is configured to discard, in a case in which a number of pieces of data having projection onto a bit onto which the issued data is projected in the filter reaches an upper limit in the data set, the issued data, and repetitively issue data until data having projection onto a bit for which the upper limit is not reached is issued.

13. The system according to claim 12, wherein

the hardware storage is configured to store a list, and

for the devices for which transmission of the reissued data is failed, the processing circuitry of the server apparatus is configured to add the reissuance target data of the devices to the list in the hardware storage, and transmit the list to the devices via the wireless network,

the processing circuitry of the device being configured to, in a case in which the data received from the one device is included in the list, notify information indicating that the data is included in the list to the server apparatus, and

the processing circuitry of the server apparatus being configured to, in a case in which the information is received from the device, retry transmitting the reissued data.

14. The system according to claim 13, wherein

the processing circuitry of the server apparatus is configured to:

update the filter by setting the first values to bits onto which a set of pieces of reissuance target data included in the list is projected in the filter according to the definitive projection relation and setting second values to bits different from the projected bits in the filter; and

transmit the updated filter instead of the list, and

the processing circuitry of the device is configured to, when all values of bits onto which the data received from the one device is projected in the filter are the first values, notify information that all values of bits are the first values to the server apparatus.

15. The system according to claim 12, wherein

the processing circuitry of the device is configured to, in a case in which a request to participate in the wireless network is received from the one device and in which the data received from the one device is determined as invalid, reject the participation of the one device in the wireless network.

16. The apparatus according to claim 12, wherein

the filter is a Bloom filter, and

the definitive projection relation represents one or more hash functions whose output values each indicate an index of a bit in the filter.

17. The apparatus according to claim 12, wherein

the data is certificate data for permitting participation in the network.

18. A data issuing method comprising:

issuing data to devices in a wireless network, respectively;

transmitting the issued data to the devices, respectively;

storing a data set including the issued data in a hardware storage;

detecting whether data satisfying a certain condition exists in the data set according to a revocation request and invalidating the data satisfying the certain condition and adding the invalidated data into a revoked data set in the hardware storage wherein the revoked data set comprises a set of pieces of data which have been invalidated;

updating a filter having a predetermined bit length in the hardware storage each time the invalidated data is added to the revoked data set, by setting first values to bits onto which the revoked data set after adding is projected in the filter according to a definitive projection relation and setting second values to bits different from the projected bits in the filter;

transmitting the updated filter to the devices via the wireless network;

identifying, in the data set in the hardware storage, reissuance target data other than the invalidated data, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first value for all of bits onto which the reissuance target data is projected in the updated filter;

reissuing, for the device having the reissuance target data, data having the second value for at least one of bits onto which the reissued data is projected in the updated filter and transmitting reissued data to the device via the wireless network; and

discarding, in a case in which a number of pieces of data having projection onto a bit onto which the issued data is projected in the filter reaches an upper limit in the data set, the issued data, and repetitively issuing data until data having projection onto a bit for which the upper limit is not reached is issued.