SERVER APPARATUS, COMMUNICATION SYSTEM, AND DATA ISSUING METHOD

• US 20140373118A1
• Filed: 06/11/2014
• Published: 12/18/2014
• Est. Priority Date: 06/12/2013
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: DOI, Yusuke, OBA, Yoshihiro
• Granted Patent: US 10,069,815 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

There is a server apparatus in which: an issuing unit issues data to devices; a distribution manager distributes the data to devices; a data manager manages data set as issued; a revocation manager detects, from the data set, data that satisfies a condition, and invalidates the detected data; and a filter manager updates and distribute to devices a filter having a predetermined bit length each time data is invalidated, by setting one of a first value and a second value to each of bits in the filter when a revoked data set is projected onto the filter; the data manager identifies data other than the invalidated data, having projection onto at least one of bits whose value has changed between before and after the update, and having the first value for all of bits projected onto the updated filter and reissues data to the device having the identified data.

Claims

1. A server apparatus comprising:

a communication unit to connect to a wireless network in which a plurality of devices are connected;

a data issuing unit to issue data to the devices in the wireless network, respectively;

a data distribution manager to distribute the data issued by the data issuing unit to the devices, respectively;

a data manager to manage a data set including the data issued by the data issuing unit;

a revocation manager to detect, from the data set, data that satisfies a predetermined condition and invalidate the data detected; and

a filter manager to;

manage a revoked data set that is a set of pieces of data invalidated by the revocation manager;

update a filter having a predetermined bit length each time the revocation manager invalidates data, by setting a first value to a bit projected when the revoked data set is projected onto the filter according to a definitive projection relation and setting a second value to a bit different from the projected bit in the filter; and

distribute the filter after update to the devices in the network, wherein

the data manager;

identifies, from the data set, reissuance target data other than the data invalidated by the revocation manager, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first value for all of bits projected when the reissuance target data is projected onto the filter after the update; and

for the device having the reissuance target data, reissues data having the second value for at least one of bits projected when that data is projected onto the filter after the update, by means of the data issuing unit, and distributes a reissued data to the device.

2. The apparatus according to claim 1, wherein

the data manager compares the filters before and after the update, to thereby identify a bit whose value has changed from the second value to the first value between before and after the update of the filter,

the data manager identifies, from the data set, data having projection onto the identified bit, and

when values of all of bits projected when the identified data is projected onto the filter after the update are the first value, the data manager identifies the identified data as the reissuance target data.

3. The apparatus according to claim 1, wherein

the data manager identifies a bit in the filter in which a value of the bit projected when the data invalidated by the revocation manager is projected onto the filter before the update is the second value,

identifies, from the data set, data having projection onto the identified bit other than the data invalidated by the revocation manager, and

specifies the identified data as the reissuance target data in a case that values of all of bits projected when the identified data is projected onto the filter after the update are the first value.

4. The apparatus according to claim 1, wherein

the data manager manages the data set using a bit-data correspondence table, and

the bit-data correspondence table associates, for each bit in the filter, data having projection onto the bit.

5. The apparatus according to claim 1, wherein

in a case where a number of pieces of data having projection onto a bit onto which the issued data is projected in the filter reaches an upper limit in the data set, the data issuing unit discards the issued data, and repetitively issues data until data having projection onto a bit for which the upper limit is not reached is issued.

6. The apparatus according to claim 1, wherein

for the device for which distribution of the reissued data is failed, the data manager adds the reissuance target data of the device to a list, and distributes the list to the devices in the network.

7. The apparatus according to claim 6, wherein

the data manager:

updates a first filter having the predetermined bit length, by setting the first value to a bit projected when a set of pieces of reissuance target data included in the list is projected onto the first filter according to the definitive projection relation and setting a second value to a bit different from the projected bit in the first filter; and

distribute the first filter after update instead of the list.

8. The apparatus according to claim 1, wherein

the filter is a Bloom filter, and

the definitive projection relation represents one or more hash functions whose output values each indicate an index of a bit in the filter.

9. The apparatus according to claim 1, wherein

the data issuing unit generates a random number, and issues the data on a basis of the random number.

10. The apparatus according to claim 1, wherein

the data is certificate data for permitting participation in the network.

11. The apparatus according to claim 1, wherein

the first value is 1, and

the second value is 0.

12. A data verification system comprising:

a plurality of devices connected in a wireless network; and

a server apparatus, wherein

the server apparatus includes;

a data issuing unit to issue data to the devices in the wireless network, respectively;

a data distribution manager to distribute the data issued by the data issuing unit to the devices, respectively;

a data manager to manage a data set including the data issued by the data issuing unit;

a revocation manager to detect, from the data set, data that satisfies a predetermined condition and invalidate the data detected; and

a filter manager to;

manage a revoked data set that is a set of pieces of data invalidated by the revocation manager;

update a filter having a predetermined bit length each time the revocation manager invalidates data, by setting a first value to a bit onto which the revoked data set is projected when the revoked data set is projected onto the filter according to a definitive projection relation and setting a second value to a bit different from the projected bit in the filter; and

distribute an updated filter to the devices in the network,

the data manager;

identifies, from the data set, reissuance target data other than the data invalidated by the revocation manager, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first value for all of bits projected when the reissuance target data is projected onto the filter after the update; and

for the device having the reissuance target data, reissues data having the second value for at least one of bits projected when that data is projected onto the filter after the update, by means of the data issuing unit, and distributes reissued data to the device, and

the devices each include a network receiver to;

test data presented by one device of the plurality of devices on a basis of the filter provided by the server apparatus; and

determine that the data presented by the one device is invalid when all values of bits projected when the data is projected onto the filter are the first value.

13. The system according to claim 12, wherein

for the device for which distribution of the reissued data is failed, the data manager adds the reissuance target data of the device to a list, and distributes the list to the devices in the network,

in a case where the data presented by the one device is included in the list, the device notifies that to the server apparatus, and

in a case where notification by the device is received, the data distribution manager of the server apparatus retries to distribute the data reissued by the data issuing unit.

14. The system according to claim 13, wherein

the data manager:

updates a first filter having the predetermined bit length, by setting the first value to a bit projected when a set of pieces of reissuance target data included in the list is projected onto the first filter according to the definitive projection relation and setting a second value to a bit different from the projected bit; and

distribute the first filter after update instead of the list, and

when all values of bits projected when the data presented by the one device is projected onto the first filter are the first value, the device notifies that to the server apparatus.

15. The system according to claim 12, wherein

in a case where a request to participate in the wireless network is received from the one device and where the data presented by the one device is determined as invalid, the device rejects the participation of the one device in the wireless network.

16. The apparatus according to claim 12, wherein

the filter is a Bloom filter, and

the definitive projection relation represents one or more hash functions whose output values each indicate an index of a bit in the filter.

17. The apparatus according to claim 12, wherein

the data is certificate data for permitting participation in the network.

18. A data issuing method comprising:

issuing data to devices in a wireless network, respectively;

distributing the data issued, to the devices, respectively;

manage a data set including the data issued;

detecting, from the data set, data that satisfies a predetermined condition and invalidate the data detected;

managing a revoked data set that is a set of pieces of data invalidated;

updating a filter having a predetermined bit length each time data is invalidated, by setting a first value to a bit projected when the revoked data set is projected onto the filter according to a definitive projection relation and setting a second value to a bit different from the projected bit in the filter;

distributing the filter after update to the devices in the network,

identifying, from the data set, reissuance target data other than the data invalidated, the reissuance target data having projection onto at least one of bits whose bit value has changed from the second value to the first value between before and after the update of the filter, and having the first value for all of bits projected when the reissuance target data is projected onto the filter after the update; and

reissuing, for the device having the reissuance target data, data having the second value for at least one of bits projected when that data is projected onto the filter after the update and distributing a reissued data to the device.