Management apparatus, computer program product, system, device, and method

• US 10,447,469 B2
• Filed: 03/02/2017
• Issued: 10/15/2019
• Est. Priority Date: 03/16/2015
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Hanatani, Yoshikazu, Oba, Yoshihiro, Matsushita, Tatsuyuki, Ogura, Naoki
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US15/448,159
• Publication Number:
  US 20170180120A1
• Time in Patent Office: 957 Days
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure

Abstract

According to an embodiment, a management apparatus connectable to a plurality of devices through a network includes storage, one or more processors, and an assignment transmitter. The storage stores therein management tree information in which node keys are respectively assigned to nodes and devices are respectively assigned to leaf nodes. The processors calculate similarity between attribute information representing an attribute of a new device and attribute information of devices already assigned in the management tree information. The processors determine a first leaf node to which the new device is to be assigned in the management tree information, based on the similarity. The assignment transmitter transmits, to the new device, at least one node key of node keys assigned to nodes on a path from a root node to the first leaf node in the management tree information.

Claims

1. A management apparatus connectable to a plurality of devices through a network, the management apparatus comprising:

storage configured to store therein management tree information in which node keys are respectively assigned to nodes and devices are respectively assigned to leaf nodes;

one or more hardware processors; and

a hardware assignment transmitter, wherein

the hardware processors are configured to;

calculate similarity between attribute information representing an attribute of a new device and attribute information of devices already assigned in the management tree information; and

determine a first leaf node to which the new device is to be assigned in the management tree information, based on the similarity, and

the hardware assignment transmitter is configured to transmit, to the new device, at least one node key of node keys assigned to nodes on a path from a root node to the first leaf node in the management tree information, wherein

the similarity is determined based upon at least one of element information included in the attribute information of the new device and element information included in the attribute information of one of the devices already assigned being the same, a difference in value between the element information being within a certain range, and the difference being outside of the certain range.

2. The apparatus according to claim 1, wherein the hardware processors determine, as the first leaf node, an empty leaf node reachable via a predetermined number of edges from a leaf node assigned a device with the similarity equal to or greater than a reference value.

3. The apparatus according to claim 1, wherein

the hardware processors are further configured to:

when the management tree information does not exist in the storage, generate new management tree information and store the generated new management tree information into the storage, and

determine any leaf node in the new management tree information, as the first leaf node.

4. The apparatus according to claim 1, wherein

the hardware processors are further configured to expand the management tree information when the number of empty leaf nodes in the management tree information is smaller than a predetermined number, and

the hardware assignment transmitter transmits, of node keys assigned to nodes on a path from a root node to a corresponding leaf node in the management tree information, a new node key assigned to an expanded node to a device already assigned in the management tree information.

5. The apparatus according to claim 4, wherein the hardware assignment transmitter encrypts the new node key assigned to the expanded node, using a node key that has been assigned to an existing node and is not held by another device, and transmits the encrypted new node key to the device already assigned in the management tree information.

6. The apparatus according to claim 4, wherein the hardware processors further add a node to a level higher than an existing root node in the management tree information.

7. The apparatus according to claim 4, wherein the hardware processors further add a node to a level lower than an existing leaf node in the management tree information and reassign a device that has been assigned to the existing leaf node below which the node is added, to the newly added leaf node.

8. The apparatus according to claim 1, wherein

the hardware processors are further configured to change an assignment position of a device to a leaf node in the management tree information stored in the storage, such that devices having the attribute information with the similarity equal to or greater than a predetermined value belong to a range reachable via a predetermined number of edges.

9. The apparatus according to claim 1, wherein

the attribute information includes a plurality of pieces of element information representing attributes of each device, and

when the similarity between the attribute information of the new device and the attribute information of the already-assigned device is calculated, the hardware processors make comparison with respect to each corresponding element information and synthesize comparison results with respect to the pieces of element information to calculate the similarity.

10. The apparatus according to claim 9, wherein the hardware processors synthesize the comparison results by giving weights that are different for each piece of element information to calculate the similarity.

11. The apparatus according to claim 9, wherein the attribute information includes the element information not changing with time and the element information changing with time.

12. A management apparatus connectable to a plurality of devices through a network, the management apparatus comprising:

one or more hardware processors configured to;

receive first attribute information representing attribute information of a first device, and

transmit at least one node key of node keys assigned to nodes on a path from a root node to a second leaf node in a tree structure graph constructed by assigning the first device to the second leaf node closest to a first leaf node,

the first leaf node being a node to which a second device is assigned, and

the second device being a device for which second attribute information that is attribute information of the second device coincides with the first attribute information.

13. The apparatus according to claim 12, wherein the hardware processors are further configured to transmit at least one node key of node keys assigned to nodes on a path from the root node to the first leaf node in the tree structure graph.

14. The apparatus according to claim 12, wherein

the tree structure graph is configured such that, of the devices, a device whose attribute information coincides with the received attribute information is assigned to a first leaf node, and of the devices, a device whose attribute information does not coincide with the received attribute information is assigned to a second leaf node.

15. The apparatus according to claim 12, wherein

the hardware processors are configured to receive identification information of the first device and transmit at least one node key of node keys assigned to nodes on a path from a root node to a leaf node in a tree structure graph constructed based on identification information of the first device and identification information of one or more second devices.

16. A method performed in a management apparatus connectable to a plurality of devices through a network, the management apparatus including storage configured to store management tree information in which node keys are respectively assigned to nodes and devices are respectively assigned to leaf nodes, the method comprising:

calculating similarity between attribute information representing an attribute of a new device and attribute information of devices already assigned in the management tree information,

determining a first leaf node to which the new device is to be assigned in the management tree information, based on the similarity, and

transmitting, to the new device, at least one node key of node keys assigned to nodes on a path from a root node to the first leaf node in the management tree information, wherein

the similarity is determined based upon at least one of element information included in the attribute information of the new device and element information included in the attribute information of one of the devices already assigned being the same, a difference in value between the element information being within a certain range, and the difference being outside of the certain range.