DESCRIPTION INFORMATION PROCESSING METHOD, DECRYPTION PROCESSING METHOD, INFORMATION PROCESSING APPARATUS, AND COMPUTER PROGRAM Technical Field [0001] The present invention relates to an information processing method, a decryption processing method, an information processing apparatus, and a computer program. • More particularly, the present invention relates to an information processing method, a decryption processing method, an information processing apparatus, and a computer program, which enable efficient and secure information distribution while reducing amounts of secret information such as labels which a receiver needs to hold safely, in a Subset Difference (SD) scheme and a Layered Subset Difference (LSD) scheme which are currently known in a Broadcast Encryption scheme to which a hierarchical tree structure is applied. Background Art [0002] Recently, various kinds of software data including audio data, e.g., music, image data, e.g., movies, game programs and various application programs (these are hereinafter referred to as contents) have been circulated through networks such as the Internet, or through various information recording media including compact discs (CDs), digital versatile disks (DVDs), mini disks (MDs). These circulated contents are reproduced and used by a reproducing apparatus such as a personal computer (PC), a player, or game equipment which is owned by users. [0003] Rights of distribution or the like of many contents such as music data and image data are generally held by their creators or their distributors. Consequently, at the time of the distribution of these contents, a configuration for setting certain restricted access is generally adopted, that is to say, only the authorized users are permitted to use the contents for preventing unauthorized duplication or the like. [0004] In particular, in recent years, recording devices and storage media for digitally recording information have been gaining popularity. By means of such digital recording devices and storage media, for example, it is possible to repeat recording and reproducing without deteriorating images and sounds, and thus problems, such as distribution of fraudulently copied contents through the Internet, and unauthorized copying of recording media such as a compact disc-recordable (CD-R) have been addressed. [0005] As a method for preventing such unauthorized use of contents, there is a system in which a key for decoding contents or encrypted contents is encrypted and distributed for enabling only specific authorized users or authorized devices to decode the distributed data. For example, a configuration adopting a hierarchical tree structure, which is an embodiment of the Broadcast Encryption scheme, is known. [0006] Processing of supplying encryption data such as encryption keys, using a hierarchical tree structure is described with reference to the attached drawings. [0007] A hierarchical tree structure shown in Fig. 1 uses a binary tree. The lowermost layer of the binary tree is called a leaf, and each of portions including an apex, each branch portion and the leaf is called a node. In the binary tree hierarchical tree structure shown in Fig. 1, the leaves are denoted by 8-15, and the nodes are denoted by 1-15, and further the root is denoted by 1. [0008] Information processing apparatus such as a player, a receiver as content utilization equipment are assigned to the leaves 8-15 in the binary tree hierarchical tree structure one by one. [0009] Moreover, node keys are assigned to the nodes (including the leaves) 1-15 of the tree one by one. The node keys assigned to the leaves 8-15 are sometimes called leaf keys. [0010] An information processing apparatus corresponding to each of the leaves is given node keys which are assigned to nodes in a path from the corresponding leaf to the root. In the configuration of Fig. 1, there are eight information processing apparatus assigned to the leaves 8-15 severally, and a node key is assigned to each of the nodes 1-15. An information processing apparatus 101 corresponding to the leaf 8 is given four node keys assigned to the nodes 1, 2, 4, 8. Moreover, an information processing apparatus 102 corresponding to the leaf 12 are given four node keys assigned to the nodes 1, 3, 6, 12. Each information processing apparatus keeps these node keys in storage safely. [0011] A method for transmitting the information which only a selected information processing apparatus can obtain, by means of a setting that involves the distribution processing of the node keys is described with reference to Fig. 2. For example, there is supposed a configuration, in which content such as specific music, image data encrypted to be an encrypted content is circulated in a state obtainable by everybody by means of a broadcast distribution or a recording medium such as a DVD storing the content, and a key (content key Kc) for decoding the encrypted content is provided only to a specific user, i.e. a user or an information processing apparatus having an authorized right of using the content. [0012] Suppose that an information processing apparatus assigned to the leaf 14 shown in Fig. 2 is excluded (revoked) as an unauthorized apparatus, and that the other information processing apparatuses are authorized information processing apparatuses. In this case, a ciphertext by which the information processing apparatus assigned to the leaf 14 cannot obtain the content key Kc, but the other information processing apparatuses can obtain the content key Kc, is generated, and the ciphertext is distributed through a network or by means of a recording medium storing the ciphertext. [0013] In this case, the content key may be encrypted for transmission by using node keys owned jointly by as many information processing apparatuses as possible, i.e., node keys located at the upper part of the tree, among node keys other than ones (marked X in Fig. 2) owned by the information processing apparatus to be revoked (excluded). [0014] In the example shown in Fig. 2, the node keys at the nodes 2, 6, 15 are used for enciphering the content key Kc to generate a set of ciphertexts to be provided. Namely, ciphertexts of E(NK2, Kc), E(NK6, Kc) and E(NKi5, Kc) are generated, and are provided while distributed through a network or stored in a recording medium. It should be noted that E (A, B) means data B encrypted by a key A. Moreover, NKn denotes an nth node key shown in the drawing. Consequently, the above formulae indicate a set of three ciphertexts including the encryption data E(NK2, Kc) produced by encrypting the content key Kc with a node key Nfo, the encryption data E(NKe, Kc) produced by encrypting the content key Kc with a node key NKe, and the encryption data E(NKis, Kc) produced by encrypting the content key Kc with a node key NKis. [0015] If the three ciphertexts are produced and then transmitted to all of the information processing apparatus through, e.g., a broadcast communication path, information processing apparatus not to be revoked (ones corresponding to the leaves 8-13 and 15 shown in Fig. 2) each can decode any of the ciphertexts with a node key owned by itself to obtain the content key Kc. However, the revoked (excluded) information processing apparatus corresponding to the leaf 14 does not hold any of the three node keys NK2, NK6 and NK15 applied to the three ciphertexts. Consequently, even if the information processing apparatus receives the ciphertexts, the apparatus cannot perform the decoding processing of the ciphertexts, and thus the apparatus cannot obtain the content key Kc. [0016] The above-mentioned Broadcast Encryption scheme is called a Complete Subtree scheme. If information is to be distributed using such a tree structure, there is a shortcoming such that the number of messages to be broadcast increases with increasing the number of information processing apparatuses (user equipment) corresponding to the leaves . As another shortcoming, key information such as node keys to be stored securely by each information processing apparatus (user equipment) is also increased. [0017] As techniques for resolving such shortcomings, a Subset Difference (SD) scheme and a Layered Subset Difference (LSD) scheme being a refinement of the former, have so far been proposed. The SD scheme is disclosed in, e.g., Non-Patent Document 1, and the LSD scheme is disclosed in, e.g., Non-Patent Document 2. [0018] In either of the schemes, supposing that the total number of receivers (users) of a Broadcast Encryption system is set to N and that the number of receivers which are to be excluded (revoked), i.e., which are unable to receive broadcast secret information is set to r, the number of broadcast messages equals 0 (r) , which is a number smaller than that in the above-mentioned Complete Subtree scheme and the like, and thus superior. [0019] However, the number of keys (labels) to be held by each receiver in its safe memory equals 0(log2N) in the SD scheme, and 0 (log1+eN) in the LSD scheme, where e is an arbitrary integer. This number of keys is larger than that in other schemes such as the Complete Subtree scheme, and thus its reduction has been a problem to be solved. It should be noted that throughout the present Description, the base of log is 2 unless otherwise mentioned. [Non-Patent Document 1] Advances in Cryptography -Crypto 2001, Lecture Notes in Computer Science 2139, Springer, 2001, pp.41-62 (D. Naor, M. Naor and J. Lotspiech, "Revocation and Tracing Schemes for Stateless Receivers") [Non-Patent Document 2] Advances in Cryptography -Crypto 2002, Lecture Notes in Computer Science 2442, Springer, 2002, pp.47-60 (D. Halevy and A. Schamir, "The LSD Broadcast Encryption Scheme") Disclosure of the Invention [Issue to be Solved by the Invention] [0020] The present invention has been made in view of such circumstances, and an object thereof is to provide an information processing method, a decryption processing method, information processing apparatus, and a computer program, which enable a reduction in amounts of secret information, such as labels, which receivers need to hold securely, and thus allowing efficient and secure information distribution when applying a one-way permutation tree based on a trap-door one-way permutation, described hereinafter, to the Subset Difference (SD) scheme and the Layered Subset Difference (LSD) scheme which are recognized as relatively efficient configurations in information distribution configurations adopting a hierarchical tree structure which is one embodiment of the Broadcast Encryption scheme. [Means for Solving the Issue] [0021] A first aspect of the present invention is an information processing method for generating a hierarchical tree applied to ciphertext supplying processing in which only specific selected equipment can per form decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing method being characterized by including: an intermediate label generating step of generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate labels; a label generating step of generating the labels corresponding to the special subsets by performing operation processing based on the intermediate labels, and further generating the labels not corresponding to the special subsets by the operation based on the generated labels; and a labels-for-supply determining step of determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which the label corresponding to the special subset can be calculated by operation processing. [0022] Furthermore, in an embodiment of the information processing method according to the present invention, the information processing method is characterized by further including a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys derived from the respective labels corresponding to the subsets, which are generated in the label generating step, for supplying to the receiver. [0023] Furthermore, in an embodiment of the information processing method according to the present invention, the label generating step is characterized by including a step of calculating the values of the labels corresponding to the special subsets by performing hash processing on the intermediate labels. [0024] Furthermore, in an embodiment of the information processing method according to the present invention, the label generating step is characterized by including a step of generating other labels by pseudo-random number generating processing performed on the values of the labels corresponding to the special subsets. [0025] Furthermore, in an embodiment of the information processing method according to the present invention, the intermediate label generating step is characterized by being a step of selecting a value x1EZ M randomly, in a hierarchical tree with 2N-1 nodes, calculating node-corresponding values x1 to X2N-1 in the hierarchical tree with 2N-1 nodes, by applying either of the following equations, to which an inverse permutation F"1 of a trap-door one-way permutation F is applied, while incrementing i by one up to i = 2 to 2N-1 using i as a counter, and further setting calculated values as the values of the intermediate labels (IL) from which the special subset-corresponding labels can be calculated: [Equation 5] (Equation Removed) where [i] represents the largest integer equal to i or less, and [Equation 6] (Equation Removed) where [i] represents the largest integer equal to i or less, where M, d are a modulus M and a secret exponent d as cryptographic parameters. [0026] Furthermore, in an embodiment of the information processing method according to the present invention, the special subset selected in the intermediate label generating step is characterized by being at least one of a first special subset and a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. [0027] Furthermore, in an embodiment of the information processing method according to the present invention, the labels-for-supply determining step is characterized by being a step of specifying one of the intermediate labels for supply to the receiver corresponding to the terminal node of the hierarchical tree as being an intermediate label corresponding to a lowermost one of subsets Si,j constituting the first special subset(s). [0028] Furthermore, in an embodiment of the information processing method according to the present invention, the intermediate label generating step is characterized by being a step of setting labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0029] Furthermore, in an embodiment of the information processing method according to the present invention, the intermediate label generating step is characterized by being a step of setting labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0030] Furthermore, a second aspect of the present invention is a decryption processing method for executing decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, and the decryption processing method is characterized by including: a ciphertext selecting step of selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; a label calculating step of calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; a step of generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and a decrypting step of executing the decrypting processing of the ciphertext by applying the generated subset key. [0031] Furthermore, in an embodiment of the decryption processing method according to the present invention, the label calculating step is characterized by including a step of calculating another intermediate label by executing a trap-door one-way permutation F on the intermediate label held. [0032] Furthermore, in an embodiment of the decryption processing method according to the present invention, the label calculating step is characterized by including a step of executing calculationof the label byperforminghashprocessing on the intermediate label held or the another intermediate label obtained by executing the trap-door one-way permutation F on the intermediate label held. [0033] Furthermore, in an embodiment of the decryption processing method according to the present invention, the label calculating step is characterized in that: the subset key to be applied to the ciphertext is a subset key calculable by the pseudo-random number generating processing based on a label corresponding to a first special subset or a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship between a node and a node the subsets Si, being defined as subsets that are obtained by excluding a subtree rooted at the node that is lower than the node from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. The label calculating step is further characterized by being a step of calculating the label corresponding to the special subset by performing operation processing on the intermediate label held, if the label corresponding to the special subset is not held. [0034] Furthermore, in an embodiment of the decryption processing method according to the present invention, the label calculating step is characterized by being a step of calculating a label corresponding to a special subset including nodes in a path from a node to which a receiver for executing the decrypting processing is assigned to a root in the hierarchical tree, by performing operation processing on the intermediate label held. [0035] Furthermore, a third aspect of the present invention is an information processing method for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, and the information processing method is characterized by including a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme to which a hierarchical tree is applied; wherein the subset keys to be applied in the ciphertext generating step are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and are set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label. [0036] Furthermore, in an embodiment of the information processing method according to the present invention, the information processing method is characterized by further including a subset key generating step of generating subset keys, wherein the subset key generating step is processing of generating the subset keys by pseudo-random number generating processing based on the labels (LABEL) respectively corresponding to the subsets. [0037] Furthermore, in an embodiment of the information processing method according to the present invention, the information processing method is characterized by further including a subset key generating step of generating subset keys, wherein the subset key generating step includes: an intermediate label generating step of generating the intermediate labels corresponding to the special subsets based on an operation expression to which an inverse permutation F'1 of a trap-door one-way permutation Fusing xi£Z M, and a modulus M and a secret exponent d as cryptographic parameters is applied; a label generating step of generating labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and a step of calculating the subset keys by operation processing based on the labels. [0038] Furthermore, in an embodiment of the information processing method according to the present invention, the special subset selected in the intermediate label generating step is characterized by being at least one of a first special subset and a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset Si,<|> defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. [0039] Furthermore, in an embodiment of the information processing method according to the present invention, the intermediate label generating step is characterized by being a step of setting values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0040] Furthermore, in an embodiment of the information processing method according to the present invention, the intermediate label generating step is characterized by being a step of setting values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0041] Furthermore, a fourth aspect of the present invention is an information processing apparatus for generating a hierarchical tree applied to ciphertext supplying processing in which only specif ic selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, and the information processing apparatus is characterized by including: intermediate label generating means for generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allows to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate label; label generating means for generating the labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and labels-for-supply determining means for determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which label corresponding to the special subset can be calculated by operation processing. [0042] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the information processing apparatus is characterized by further including ciphertext generating means for generating ciphertexts by executing encryption processing while selectively applying subset keys derived from the respective labels corresponding to subsets, which are generated by the label generating means, for supplying to the receiver. [0043] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label generating means is characterized by being configured to calculate the values of the labels corresponding to the special subsets by performing hash processing on the intermediate labels. [0044] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label generating means is characterized by being configured to generate other labels by pseudo-random number generating processing performed on the values of the labels corresponding to the special subsets. [0045] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the intermediate label generating means is characterized by being configured to select a value xiez*M randomly, in a hierarchical tree with 2N-1 nodes, calculating node-corresponding values xi to X2N-1 in the hierarchical tree with 2N-1 nodes by applying either of the following equations, to which an inverse permutation F"1 of a trap-door one-way permutation F is applied, while incrementing i by one up to i = 2 to 2N-1 using i as a counter, and further set calculated values as the values of the intermediate labels (IL) from which the special subset-corresponding labels can be calculated: [Equation 7] (Equation Removed) where [_ J represents the largest integer equal to i or less, or [Equation 8] (Equation Removed) where L J represents the largest integer equal to i or less, where M, d are a modulus M and a secret exponent d as cryptographic parameters. [0046] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the special subset selected in the intermediate label generating means is characterized by being at least one of a first special subset and a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset Si,$ defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. [0047] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the labels-f or-supply determining means is characterized by being configured to specify one of the intermediate labels for supply to the receiver corresponding to the terminal node of the hierarchical tree as being an intermediate label corresponding to a lowermost one of subsets Si,j constituting the first special subset(s). [0048] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the intermediate label generating means is characterized by being configured to set labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0049] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the intermediate label generating means is characterized by being configured to set labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. [0050] Furthermore, a fifth aspect of the present invention is an information processing apparatus for executing decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, and the information processing apparatus is characterized by including: ciphertext selecting means for selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; label calculating means for calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; means for generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and decrypting means for executing the decrypting processing of the ciphertext by applying the generated subset key. [0051] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label calculating means is characterized by being configured to calculate another intermediate label by executing a trap-door one-way permutation F on the intermediate label held. [0052] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label calculating means is characterized by being configured to execute calculation of the label by performing hash process ing on the intermediate label held or the another intermediate label obtained by executing the trap-door one-way permutation F on the intermediate label held. [0053] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label generating means is characterized in that: the subset key to be applied to the ciphertext is a subset key calculable by the pseudo-random number generating processing based on a label corresponding to either a first special subset or a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship betwe.en a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset Si,4 defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. The label generating means is characterized by being configured to calculate the label corresponding to the special subset by operation processing on the intermediate label held, if the label corresponding to the special subset is not held. [0054] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label calculating means is characterized by being configured to calculate a label corresponding to a special subset including nodes in a path from a node to which a receiver for executing the decrypting processing is assigned to a root in the hierarchical tree, by performing operation processing on the intermediate label held. [0055] Furthermore, a sixth aspect of the present invention is an information processing apparatus for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, and the information processing apparatus is characterized by including: ciphertext generating means for generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme, to which a hierarchical tree is applied, wherein the subset keys to be applied in the ciphertext generating means are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label. [0056] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the information processing apparatus is characterized by further including subset key generatingmeans for generating the subset keys, wherein the subset key generating means is configured to generate the subset keys by pseudo-random number generating processing based on the labels (LABEL) respectively corresponding to the subsets. [0057] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the information processing apparatus is characterized by further including subset key generatingmeans for generating the subset keys, wherein the subset key generating means is configured to generate the intermediate labels corresponding to the special subsets based on an operation expression to which an inverse permutation F"1 of a trap-door one-way permutat ion F us ing x1EZ*M, and a modulus M and a secret exponent d as cryptographic parameters is applied, generate the labels corresponding to the special subsets by operation processing based on the intermediate labels, further generate labels not corresponding to the special subsets by an operation based on the generated labels, and calculate the subset keys by performing operation processing based on the generated labels. [0058] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the special subset is characterized by being at least one of a first special subset and a second special subset, the first special subset being one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree, the second special subset being a subset 81,4, defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. [0059] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the subset is characterized by being a subset set according to a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree. [0060] Furthermore, in an embodiment of the information processing apparatus according to the present invention, the subset is characterized by being a subset set according to a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree. [0061] Furthermore, a seventh aspect of the present invention is a computer program for generating a hierarchical tree applied to ciphertext supplying processing in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, and the computer program is characterized by including: an intermediate label generating step of generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allows to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate label; a label generating step of generating the labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and a labels-for-supply determining step of determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which label corresponding to the special subset can be calculatedby operation processing. [0062] An eighth aspect of the present invention is a computer program for executing decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, and the computer program is characterized by including: a ciphertext selecting step of selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; a label calculating step of calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; a step of generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and a decrypting step of executing the decrypting processing of the ciphertext by applying the generated subset key. [0063] Furthermore, a ninth aspect of the present invention is a computer program for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, and the computer program is characterized by including a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme to which a hierarchical tree is applied; wherein the subset keys to be applied in the ciphertext generating step are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and are set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label. [0064] It should be noted that the computer program of the present invention is a computer program that can be provided by a storage medium, s communication medium, e.g., a storage medium such as a CD or an FD, an MO, or a communication medium such as a network, provided in a computer-readable form to, e.g., a general-purpose computer system that can execute various program codes. By providing such a program in a computer-readable form, processing according to the program is realized on the computer system. [0065] Further objects, features and advantages of the present invention will become apparent from a more detailed description that is based on a later-described embodiment of the present invention and accompanying drawings. It should be noted that the system used in the present Description means a logical set configuration of a plurality of apparatus, and is not limited to one wherein apparatus each having its own configuration are grouped within the same enclosure. [Effects of the Invention] [0066] According to the configuration of the present invention, a one-way permutation tree based on a single trap-door one-way permutation is applied further to a Subset Difference (SD) scheme, and a Layered Subset Difference (LSD) scheme which are deemed to be relatively efficient configurations in information distribution configurations adopting a hierarchical tree structure being one embodiment of a Broadcast Encryption scheme, whereby amounts of information each receiver should hold safely can be reduced. [0067] Furthermore, in the configuration of the present invention, intermediate labels which are intermediate labels (IL) set as values from which values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on the SD scheme or the LSD scheme to which the hierarchical tree is applied, can be calculated by operation processing, and these intermediate labels have values from which values of other intermediate labels can be calculatedby applying a trap-door one-way permutation F based on a value of at least one intermediate label. Since it is configured such that a receiver is given, in addition to labels not corresponding to the special subsets, one intermediate label from which the labels corresponding to the special subsets can be derived, the number of labels supplied to the receiver in the conventional SD scheme or LSD scheme can be reduced. As to the reduced labels, the other intermediate labels can be calculated by executing the trap-door one-way permutation F on the intermediate label held by the receiver, whereby processing on all the subsets settable based on the conventional SD or LSD scheme can be performed. As a result of applying the configuration of the present invention, a reduction in amounts of information (labels) each receiver should hold can be realized. [Brief Description of Drawings] [0068] [Fig. 1] It is a view for illustrating a binary tree hierarchical tree structure. [Fig. 2] It is a view for illustrating a method by which the information obtainable only by selected information processing apparatus is transmitted in a binary tree hierarchical tree structure. [Fig. 3] It is a view for illustrating a hierarchical tree structure which is applied in a Complete Subtree (CS) scheme and in which each of nodes bifurcates. [Fig. 4] It is a view for illustrating node keys owned by a receiver assigned to a leaf, in the Complete Subtree (CS) scheme. [Fig. 5] It is a view for illustrating how secret information is selectively supplied only to nonrevoked receivers in the CS scheme. [Fig. 6] It is a view for illustrating the definition of a subset in a Subset Difference (3D) scheme. [Fig. 7] It is a view for illustrating the setting and configuration of labels in the Subset Difference (SD) scheme. [Fig. 8] It is a view for illustrating the setting of subsets in the Subset Difference (SD) scheme. [Fig. 9] It is a view showing labels to be held by each receiver given that the total number of receivers is set to N=16 in the SD scheme. [Fig. 10] It is a view for illustrating details of the labels to be held by each receiver in the SD scheme. [Fig. 11] It is a view for illustrating details of the labels to be held by each receiver in the SD scheme. [Fig. 12] It is a view for illustrating details of subsets to which a specific receiver u4 belongs, in the SD scheme. [Fig. 13] It is a view for illustrating the configuration of a one-way permutation tree. [Fig. 14] It is a flow diagram for illustrating an algorithm for setting 2N-1 node-corresponding values corresponding to nodes in the one-way permutation tree. [Fig. 15] It is a view for illustrating a node number setting example in which identifiers (numbers) are sequentially given to a root denoted by 1 and its lower nodes in terms of "breadth first order". [Fig. 16] It is a view for illustrating a configuration example of a first special subset SSp(yj,s(y) in which nodes bear a parent-child relationship. [Fig. 17] It is a view showing correspondence between the labels corresponding to special subsets and the values x1, x2, •••/ X2N-1 used as 2N-1 intermediate labels calculated by the algorithm illustrated with reference to Fig. 14. [Fig. 18] It is a view for illustrating correspondence between an intermediate label and a label in the subset corresponding to Fig. 16. [Fig. 19] It is a view for illustrating determining processing of labels for supply to a receiver. [Fig. 20] It is a flow diagram showing setup processing. [Fig. 21] It is a view showing subsets used to revoke receivers u5, ull, u!2 in a hierarchical tree configuration in which the total number of receivers is set to N=16. [Fig. 22] It is a view showing a flow for illustrating a procedure for information distributing processing. [Fig. 23] It is a view for illustrating a specific example of subset key deriving processing. [Fig. 24] It is a view showing a flowchart for illustrating a procedure executed by a receiver, as to subset key acquiring and ciphertext decrypting processing from reception of ciphertexts. [Fig. 25] It is a flow diagram for illustrating a detailed procedure for the subset key deriving processing by a receiver, in the SD scheme to which the one-way permutation tree is applied. [Fig. 26] It is a view for illustrating the configuration of an information processing apparatus for executing label determining processing, ciphertext generating processing. [Fig. 27] It is a view for illustrating the functional configuration of an information processing apparatus as a receiver for executing the ciphertext decrypting processing. [Fig. 28] It is a view showing a block diagram as a hardware configuration example of the information processing apparatus . [Fig. 29] It is a view for illustrating a Basic LSD scheme. [Fig. 30] It is a view for illustrating the number of labels to be held by each of receivers in the Basic LSD scheme. [Fig. 31] It is a view for illustrating a configuration for reducing the number of labels in the Basic LSD scheme using the one-way permutation tree. Best Modes for Carrying Out the Invention [0069] Below, details of an information processing method, a decryption processing method, an information processing apparatus, and a computer program are described with reference to the drawings. [0070] It should be noted that the description is given in accordance with the following items. 1. Outline of Complete Subtree (CS) scheme 2. Outline of Subset Difference (SD) scheme 3. Configuration for reducing the number of labels in the SD scheme using a one-way permutation tree 4 . Method example for configuring a one-way permutation tree 5. Information distributing processing example to which the one-way permutation tree is applied 6. Outline of Basic Layered Subset Difference (Basic LSD) scheme 7. Configuration for reducing the number of labels in the Basic LSD scheme using the one-way permutation tree 8. Outline of General Layered Subset Difference (General LSD) scheme 9. Configuration for reducing the number of labels in the General LSD scheme using the one-way permutation tree [0071] [1. Outline of Complete Subtree (CS) scheme] First, a Complete Subtree (CS) scheme is outlined, which is known as the Broadcast Encryption scheme to which an existing hierarchical tree structure is applied. [0072] It should be noted that in the following description, it is supposed that the total number N of information processing apparatus (receivers) set so as to correspond to leaves of a hierarchical tree structure equals 2 to an nth power, for ease of description. Moreover, throughout the following description, the base of a function log is 2 in all instances. It should be noted that equipment assigned, to the leaves of the hierarchical tree structure may include various information processing apparatus, such as, e.g., PCs, portable terminals, as long as they are capable of executing decrypting processing of secret information, hereinafter described. Here, the equipment is referred to collectively as receivers. Furthermore, ciphertext distributing processing in the present invention is construed to include not only ciphertext supplying processing bymeans of communication via a communication network, but also processing of supplying ciphertexts stored in a recording medium. [0073] It should be noted that below-listed symbols are used in the following description. P (i) : The parent node of a node i, and its node number S(i) : The sibling node of the node i (i.e., a node different from the node i and having the same parent as the node i), and its node number LC(i): A child node on the left side of the node i, and its node number RC(i) : A child node on the right side of the node i, and its node number [0074] (1) Complete Subtree (CS) scheme The Complete Subtree (CS) scheme is basically equivalent to the configuration described in the Background Art section. As shown in Fig. 3, a binary tree in which each of nodes bifurcates is used as a hierarchical tree structure. Fig. 3 shows an example in which the number of receivers is N=16. The receivers are assigned to leaves of this binary tree (ul-u!6 in Fig. 3), respectively. Moreover, any node of the tree is used to represent "a set consisting of receivers assigned to leaves of a subtree rooted at the top of the node". A node i 201 in Fig. 3 represents a set consisting of the receivers u5 and u6. [0075] A key (node key) is defined for any configuration node of the binary tree shown in Fig. 3. Each receiver is given node keys assigned to nodes in a path from a leaf to which it is assigned to the root (apex) of the tree, and the receiver holds these node keys in a secure memory. The defining of the tree, the defining of the node keys, the assigning of the receivers, the distributing of the node keys and the like are per formed by a reliable management center called "Trusted Center (TC)". [0076] As shown in Fig. 4, sixteen receivers ul-u16 are assigned to the hierarchical tree, and there are thirty-one nodes 1-31. The receiver u4 is given five node keys assigned to the nodes 1, 2, 4, 9, 19. Namely, supposing that the total number of receivers is N, each receiver holds log N+l node keys. [0077] Referring to Fig. 5, how secret information (e.g., a content key for decrypting an encrypted content) is transmitted to nonrevoked receivers using this setting is described. It is supposed here that the management center (TC) is a transmitter of the secret information. Now, let receivers u2, ull, u!2 be receivers to be revoked. Namely, by excluding (revoking) the receivers u2, ull, u!2 as unauthorized equipment, only receivers other than these are enabled to receive the information securely, i.e., to perform decryption based on ciphertexts broadcast. [0078] When the management center (TC) transmits the secret information, the management center does not use, as encryption keys, node keys respectively assigned to nodes in paths from leaves to which the revoked receivers u2, ull, u!2 are assigned to the root of the tree, but generates and broadcasts a set of ciphertexts. [0079] The node keys respectively assigned to the leaves or nodes in the paths from the leaves to which the revoked receivers u2, ull, u!2 are assigned to the root of the tree are keys owned by these receivers to be revoked, and thus, if these keys are used, the revoked equipment can obtain the secret information. Therefore, the transmitter does not use these keys, butgenerates and broadcasts a set of ciphertexts. [0080] When the nodes in the paths from the leaves to which the revoked receivers u2, ull, u12 are assigned to the root of the tree, as well as the paths are excluded from the tree, one or more subtrees remain, which are, e.g., a subtree rooted at a node 5, and a subtree rooted at a node 12. [0081] The transmitter of the secret information transmits a set of ciphertexts into which the secret information is encrypted using node keys assigned to the nodes nearest to the roots of these subtrees, i.e., nodes 5, 7, 9, 12, 16 in the example shown in Fig. 5. For example, supposing that the secret information for transmission is a content key Kc to be applied to decryption of the encrypted content, and that the node keys assigned to the nodes 5, 7, 9, 12, 16 are NK5, NK7, NK9, NK12, NK16, the transmitter of the secret information generates a set of ciphertexts E(NK5, Kc), E(NK7, Kc) , E(NK9, Kc) , E(NK12, Kc) , E(NK16, Kc), and distributes the generated ciphertext set via a network or supplies a recording medium storing it. It should be noted that E(A, B) means data B encrypted by a key A. [0082] The above-mentioned set of ciphertexts cannot be decrypted only by the revoked receivers u2, ull, u!2, but can be decrypted by the other receivers. By generating and transmitting such a ciphertext set, efficient and secure transmission of secret information can be implemented. [0083] Each receiver can obtain the secret information by decrypting one of the transmitted ciphertexts which it can decrypt, i.e., one ciphertext encrypted using the node key corresponding to a node in a path from a leaf to which it is assigned to the root. In the above example, holding a node key for the node 9, the receiver u4 can decrypt the ciphertext E(NK9, Kc) encrypted using this key. In this way, there always be one ciphertext a nonrevoked receiver can decrypt in the ciphertext set. [0084] [2. Outline of Subset Difference (SD) scheme] As mentioned above, in the Complete Subtree (CS) scheme, each node of a hierarchical tree is used to represent "a set consisting of receivers assigned to leaves of a subtree rooted at the node". By contrast, in a Subset Difference (SD) scheme, two nodes i, j (where i is an ancestor node of j ) of a hierarchical tree are used to represent "a set obtained by subtracting (a set consisting of leaves of a subtree rooted at the node j) from (a set consisting of leaves of a subtree rooted at the node i)". [0085] For example, a set Si,j defined by a node i 231 and a node j 232 of Fig. 6 is obtained by subtracting u5, u6 from a set of receivers ul-u8. Namely, Si,j = {ul, u2, u3, u4, u7, u8}. Such a set is defined as to all the pairs of nodes i,j where the node i is an ancestor of the node j (i.e., the node j is not the same as the node i, and the node i exists in a path from the node j to the root). [0086] Any subset key SKi,j is set as a key corresponding to any subset Si, j. The subset key SKi, j is set as a key shared in common by the subset Si, j = {ul, u2, u3, u4, u7, u8 } obtained by excluding u5, u6 from the set of ul-u8, and by transmitting information in which the secret information is encrypted using the subset key SKi,j as an encryption key, decryption can be implemented only by the subset Si,j = {ul, u2, u3, u4, u7, u8 } , and thus u5, u6 can be revoked (excluded) . [0087] Under such a setting, the number of sets to which a single receiver belongs equals a number 0 (N) indicated by the following expression. [Equation 9] [0088] Therefore, when a key (subset key) is assigned to each of the sets (subsets) independently, each receiver need to hold 0(N) subset keys securely. However, the number of subset keys increases tremendously as the total number N of receivers increases, and consequently, it is actually difficult to have each equipment hold these tremendous amounts of information securely. [0089] To overcome this difficulty, the following technique has been devised in the Subset Difference (SD) scheme. Similarly to the above-mentioned Complete Subtree (CS) scheme, it is supposed that the management center (TC) performs the defining of a hierarchical tree, the defining of subsets, the defining and distributing of keys and the like. [0090] First, as shown in Fig. 7 (A) , the management center (TC) , paying attention to a certain internal node (i.e., a node which is not a leaf) i, randomly selects a C-bit value S by giving the node i a label LABELi. [0091] Next, as shown in Fig. 7 (B), LABELi = S is inputted to a C-bit-input 3C-bit-output pseudo-random number generator G. The output is divided into C-bit parts from the left (from the highest-order bit side) , and they are denoted as GL(S) , GM(S) , GR(S) , respectively. Then, a child node k on the left side of the node i shown in Fig. 7 (A) is given a label GL(S), and a child node on the right side of the node i is given a label GR(S) . [0092] Now, as to the node k being the child node on the left side of the node i in Fig. 7, given the node i being set as the initial point, a label LABELi,k of the node k is LABELi,k = GL(S) . Let this be T. Next, the label LABELi/)c of the node k, i.e., LABELi,k = GL(S) = T is inputted this time to the pseudo-random number generator G shown in Fig. 7 (B) , andGi,(T), GM(T) , GR(T) into which the output is divided as the C-bit parts from the left are set as follows. GL(T) = a label LABELi,Lc(k) of a child node LC(k) on the left side of the node k given the node i being the initial point GM(T) = a key (this is supposed to be a subset key SKi,k corresponding to a set Si,k) of the node k given the node i being the initial point GR(T) = a label LABELi/Rc(k) of a child node RC(k) on the right side of the node k given the node i being the initial point [0093] By repeating this processing, labels are produced, which correspond to all the nodes which are descendants of the node i given the node i being the initial point. It should be noted that according to the above-mentioned definition, any set Si,i is a null set, and when the node i is set as the initial point, a key for the node i is not needed. Thus, it should be reminded that GM(S) being the middle part of an output obtained by inputting any LABELj^ into the pseudo-random number generator G is not used. [0094] Let this be indicated using the example of Fig. 7 (A). The label S of the node i being the initial point is determined. GR(S) is the label of the child node on the right side of the node i given the node i being'the initial point. Furthermore, GL(GR(S)) obtained by inputting GR(S) into the pseudo-random number generator G is a label LABELi,j of a node j given the node i being the initial point. The processing of producing labels corresponding to all the nodes which are descendants of the node i given the node i being the initial point is performed on all the internal nodes i. [0095] These steps of the processing are performed by the management center (TC) at. the time of a system setup. The pseudo-random number generator (or a pseudo-random number generating function) G is specified and published by the management center (TC) . Thus, by using this, a receiver given the LABELi,j is enabled to calculate labels LABELi,n for all the nodes which are descendants of the node j given the node i being the initial point, and calculate subset keys SKi,n for the node j and its descendant nodes n given the node i being the initial point. [0096] As a result of such a setting, as shown in Fig. 8 (A), a certain receiver u needs to hold only labels of nodes a, b, c, which are nodes directly branching from nodes in a path from a leaf u to which the receiver is assigned to a node i given the node i being the initial point, as to any internal node i in a path from the leaf u to the root of a tree. [0097] Subset keys for these nodes a, b, c and their descendant nodes, given the node i being the initial point, can be produced. In Fig. 8 (A), by paying attention to the node i, there are three nodes a, b, c which are directly branching from the nodes in the path from u to i. Thus, the receiver u is given these three labels from the management center (TC) during its system setup and holds them. [0098] The leaf u can obtain a subset key SKi,a corresponding to a subset Si,a by processing with the pseudo-random number generator G based on a label LABELi,a of the node a. Namely, GM(LABELi,a) = SKi,a The subset Si,a is, as shown in Fig. 8 (a), a subset in which leaves of a subtree rooted at the node a are set as revoked equipment. Thus, the subset Si,a is a subset in which only leaves of a subtree rooted at the node i excluding the leaves of the subtree rooted at the node a are set as leaves to which information is to be distributed. [0099] Moreover, the leaf u can obtain a subset key SKi,b corresponding to a subset Si,b by processing with the pseudo-random number generator G based on a label LABELi,b of the node b. Namely, GM(LABELi,b) = SKi,b The subset Si,b is, as shown in Fig. 8 (b), a subset in which leaves of a subtree rooted at the node b are set as revoked equipment. Thus, the subset S±,b is a subset in which only leaves of a subtree rooted at the node i excluding the leaves of the subtree rooted at the node b are set as leaves to which information is to be distributed. [0100] Moreover, the leaf u can obtain a subset key SKi,c corresponding to a subset Si,c by processing with the pseudo-random number generator G based on a label LABELi,c of the node c. Namely, GM(LABELi,c) = SKi/c The subset Si,c is, as shown in Fig. 8 (c) , a subset in which the node c (leaf c) is set as revoked equipment. Thus, the subset Si,c is a subset in which only leaves of a subtree rooted at the node i excluding the leaf c are set as leaves to which information is to be distributed. [0101] In addition to these three configurations, there can be various other configurations for revoking leaves except the leaf u in the hierarchical tree in which i is set as the initial point. For example, if only a leaf d 251 of Fig. 8 (a) is to be revoked, it is required to set a subset Si,d, and apply a subset key SKi,d. However, a key corresponding to any node, leaf, i.e., a subset key can be generated by pseudo-random number generating processing based on a higher rank label. Therefore, the leaf u can generate the subset key SKi,d for revocation of the leaf d 251 based on the label LABELi,a of the node a held by the leaf u. [0102]This applies similarly to the other subset configurations . As shown in Fig. 8 (A), as to any internal node i in the path from the leaf to which the certain receiver u is assigned to the root of the tree, the certain receiver u may have to hold only the labels of the nodes a, b, c, which are nodes directly branching from the nodes in the path from this leaf u to i, given the node i being the initial point. [0103] Fig. 9 is a view showing labels to be held by each of receivers if the total number of receivers is set to N=16. Now, let a receiver u4 be considered. Each of internal nodes 1, 2, 4, 9 in a path to the root 1 from a node 19 being a leaf to which it is assigned is the initial point (node i) . If the node 1 is set as the initial point, nodes directly branching from the nodes in the path from the node 19 to the node 1 are four nodes 3, 5, 8, 18, and thus the receiver u4 holds four labels, namely, LABEL1,3, LABEL1,5, LABEL1,8, LABEL1,18 [0104] Similarly, if the node 2 is set as the initial point, the receiver u4 holds three labels LABEL2/is [0105] If the node 4 is set as the initial point, the receiver u4 holds two labels LABEL.4,8, LABEL4,18 [0106] If the node 9 is set as the initial point, the receiver u4 holds one label LABEL9,is [0107] Moreover, the receiver u4 holds one label which corresponds to a set (this is denoted as a subset Si/(|)) used in a special case where there is no receiver to be revoked and thus including all the receivers. [0108] Namely, LABELs which u4 holds in the configuration of Fig. 9 can be rearranged as follows. Four labels, which are j =3, 5, 8, 18 for i = 1 Three labels, which are j = 5, 8, 18 for i = 2 Two labels, which are j = 8, 18 for i = 4 One label, which is j = 18 for i = 9 One LABEL for the case of no revocation Thus, there are eleven labels overall. [0109] Here, to give consistency to the description, it is arranged such that u4 has the label corresponding to the subset Si,$. However, instead of the label, it may otherwise be arranged such that u4 directly holds a subset key corresponding to the subset S1,,Φ [0110] As mentioned above, as to any internal node in a leaf-to-root path, each receiver need to hold as many labels as heights of the internal nodes, plus one special label . Thus, given the number of transmitters/receivers being N, the number of labels each receiver holds equals a number obtained by calculation with the following expression. [Equation 10] [0111] Each receiver holds the number of labels indicated by the above expression, and can produce a necessary subset key by using the published pseudo-random number generating function G. The receiver need to hold these labels securely. [0112] [3. Configuration for reducing the number of labels in the SD scheme using a one-way permutation tree] Next, a configuration for reducing the number of labels in the Subset Difference (SD) scheme using a one-way permutation tree according to the present invention is described. Observing the above-mentioned Subset Difference (SD) scheme, one can understand the following. [0113] Namely, there are cases where labels LABELi,j are (A) given directly to the receiver by the management center (TC) , and (B) derived from a label other than those by the receiver using the pseudo-random number generator G. However, as to any label for which the nodes i and j bear a parent-child relationship (having a distance of 1, i.e., being continuous in hierarchy) , the above case (B) does not exist, and there can exist only the case (A) where the labels LABELi,j are given directly to the receiver by the management center (TC) . [0114] The reason therefor is as follows. Namely, in order for a certain receiver to produce the LABELi, j using the pseudo-random number generator G, the receiver need to know a LABELi,* produced by using a node k which is an ancestor of the node j . However, since the nodes i, j bear a parent-child relationship, there exists no such node k which is an ancestor of the node j and a descendant of the node i, nor is any receiver given the LABELi,k. [0115] A description is given with reference to a configuration example of Fig. 10. A LABEL2,s is given directly to a receiver u4 by the management center (TC), but not given directly to a receiver u5. The receiver u5 calculates, from a LABELa,4 given by the management center (TC) , GL (LABEL2,4) .using the pseudo-random number generator G to derive the LABEL2,s- [0116] By contrast, as shown in Fig. 11, a LABEL2,s in which a node 2 and a node 5 bear a parent-child relationship is given directly to receivers ul, u2, u3, u4 belonging to a subset 82,5. Since receivers other than these do not belong to that set, they cannot derive the LABEL2,s even by calculation. Namely, such a label is only given directly to the receivers by the management center (TS), and is never derived by using the pseudo-random number generator G. [0117] Moreover, in the SD scheme, when a certain node i is the parent node of two different nodes j, k, and the node j is the parent node of a node n different from them, one can see that a receiver belonging to any subset Sj,n always belong to any subset Si,k. [0118] For example, as shown in Fig. 12, a receiver U4 belonging to a subset 89,13 also belongs to any of subsets 84,3, 82,5, 81,3. Namely, 89,is = {u4} S4/8 = {u3, u4} 82,5 = {ul, u2, u3, u4} 81,3 = {ul, u2, u3, u4, u5, u6, u7, u8} [0119] Moreover, a receiver u3, which is other than the receiver u4 belonging to the subset 84,8 also belongs to any of the subsets 82, $r 81,3. [0120] In the present invention, the number of labels to be held by a receiver is reduced by applying a tree structure for keys to which a trap-door one-way permutation is applied, i.e., by applying a one-way permutation tree, to any label LABELi,j in which the nodes i and j bear a parent-child relationship and to the label LABELi,,], corresponding to the subset Si, being a set used in the special case where there is no receiver to be revoked and thus including all the receivers. [0121] In the above-mentioned Subset Difference (SD) scheme, each receiver holds a total of log N labels LABELi,j for each of which a node i and a node j bear a parent-child relationship, one for each internal node in a path from a leaf to which the receiver is assigned to the root of a tree. In the present invention, by applying a one-way permutation tree, it is set such that a total of log N+l labels, which are these labels LABELi,j plus the label LABEL1,Φ corresponding to the subset S1, Φ being a set used in the special case where there is no receiver to be revoked and thus including all the receivers, can be derived from a single value, whereby the number of labels to be held by the receiver is reduced. [0122] In the original SD scheme, as already described with reference to Fig. 9, the receiver u4 needed to hold a total of eleven labels securely. Namely, four labels, which are j = 3, 5, 8, 18 for i = 1 LABEL1,3 LABEL1,5 LABEL1,8 LABEL1,18, three labels, which are j = 5, 8, 18 for i = 2 LABEL2,8 LABEL2,18, two labels, which are j = 8, 18 for i = 4 LABEL4,8, LABEL418, one label, which is j = 18 for i = 9 LABEL9,18, and one LABEL for the case of no revocation LABEL1,Φ, By applying the configuration of the present invention, the receiver need to hold the following labels, i.e., the labels in each of which the nodes i , j bear a parent-child relationship, namely, LABEL1,3f LABEL2,5, LABEL4,8, LABEL9,18, and also, the LABEL for the case of no revocation The receiver need to store the labels of the original SD scheme. In the present invention, by applying a one-way permutation tree, it is set such that a total of log N+l labels, which are these labels and the label LABEL1,Φ corresponding to the subset S1,Φ being a set used in the special case where there is no receiver to be revoked and thus including all the receivers , can be derived from a single value, whereby the number of labels to be held by the receiver is reduced. [0123] It should be noted that the term "trap-door one-way permutation" means permutation processing y = F(x) in which it is simple to calculate y fromx, but it is difficult to perform a reverse calculation. Namely, processing of calculating x from y can be performed only by one who knows a certain piece of secret information (trap door) , but it is difficult (almost impossible) for one who does not know this secret information (trap door) to perform the processing. [0124] [4 . Configuration example of a one-way permutation tree] Below, an information distribution configuration is described, which is based on a hierarchical tree configuration using a one-way permutation tree according to the pres.ent invention. It should be noted that the term "one-way permutation tree" used in the present Description is not a generic termbut is a term used for the description of the present invention, and thus a term that defines a tree structure having a certain feature, [0125] The definition of the term "one-way permutation tree" is described. A complete binary tree with N leaves is defined as follows to be a one-way permutation tree. As shown in Fig. 13, if the root being the highest rank node is set to 1, and further nodes subsequent thereto are given node numbers 2, 3, ••-, 2N-1 sequentially from the left as to higher-rank ones in terms of "breadth first order", a value xi (i = 1, 2, —, 2N-1) is set as a value corresponding to a node i, i.e., a node-corresponding value, and a tree structure in which the following expression is established as to i = 1, 2, •••, 2N-1 is defined as a one-way permutation tree. [Equation 11] (Equation Removed) where |_/J represents the largest integer equal to i or less. In the above expression, F"1 is the inverse permutation of a trap-door one-way permutation F. It should be noted that RSA cryptography is named as an example of the trap-door one-way permutation. The RSA cryptography is a cryptosystem which uses (Public) Permutation F = xe mod M 52 (Secret) Inverse permutation F-1 = xd mod M while using a modulus M, a public exponent e, a secret exponent d as parameters. The explanation of the RSA cryptography is introduced in, e.g., A. J. Menezes, P.C. van Oorschot and S.A. Vanstone, "Handbook of Applied Cryptography, " CRC Press, 1996. [0126] Moreover, as another example, the one-way permutation tree may be defined as a tree structure to which a one-way function h, such as a hash function, is applied, instead of the above expression (Formula 1) . Namely, as a tree structure in which the following expression is established may be a one-way permutation tree. [Equation 12] (Equation Removed) where [i] represents the largest integer equal to i or less. The function h is a function for producing an output having a certain length to an input of an arbitrary length. It is a function y = H (x) in which y can be calculated from x easily, but its reverse calculation is difficult. Such a function is called a one-way function or hash function, including typically known ones such as MD4, MD5, and SHA-1 producing a 160-bit output. These functions are also introduced in the above-referred "Handbook of Applied Cryptography". [0127] A setting relationship among the node-corresponding value xi set so as to correspond to any configuration node i of the one-way permutation tree, an operation (f) corresponding to the permutation F applied to the calculation of each node-corresponding value, and an operation (f-1) corresponding to the inverse permutation F'1 is such as shown in Fig. 13, when indicated diagrammatically. [0128] As shown in the drawing, from a value of a certain node, a value of its parent node can be calculated by the operation f using a forward permutation F of the trap-door one-way permutation, and reversely, from a value of a certain node, a value of a child node thereof can be calculated by the operation f_1 using the inverse permutation F-1. It should be reminded here that the inverse permutation can actually be performed only by one who knows the trap door (secrecy) , and is difficult for one who does not know it to perform. [0129] Using the RSA cryptography, which is one of the trap-door one-way permutations, an algorithm for producing the one-way permutation tree which is a binary tree with N leaves is described with reference to Fig. 14. [0130] First, in step S101, a number xieZ*M is randomly selected. It should be noted that xiEZ*M means that x1 is the generator of a cyclic group Z*M. [0131] Next, in steps S102-S105, a node-corresponding value xi is calculated according to the following expression (Formula 3), while incrementing i by 1 up to i = 2, •••, 2N-1 using i as a counter. [Equation 13] (Equation Removed) where [i] represents the largest integer equal to i or less. [0132] The above expression (Formula 3) is equivalent to performing the operation f-1 equivalent to the inverse permutation in Fig. 13 sequentially from the higher nodes. [0133] In steps S102-S105, when the node-corresponding value xi has been calculated according to the above expression (Formula 3), while incrementing i by 1 up to i = 2, •••, 2N-1 using i as a counter, the algorithm ends in step S106 by outputting 2N-1 numbers xi, xz, —, X2u-i, each having IM I bits. Each value Xi equals a value corresponding to a node i of the one-way permutation tree, i.e., a node-corresponding value. It should be reminded here that the total number of nodes of a complete binary tree with N leaves is 2N-1. [0134] It should be noted that the operation of calculating the node-corresponding values, applied to step S103 in the processing flow shown in Fig. 14 may otherwise be configured to be executed by applying the hash function h, and thus applying the following expression (Formula 4). [Equation 14] (Equation Removed) where [i] represents the largest integer equal to i or less. (Formula 4) [0135] [5. Information distributing processing example to which the one-way permutation tree is applied] Next, an information distributing processing example to which the above-mentioned one-way permutation tree is applied is described. Below, a description is given sequentially as to (5-1) Setup processing (5-2) Information distributing processing (5-3) Receiving and decrypting processing [0136] (5-1) Setup processing Setup processing is performed only once at the time of start-up of a system. Information distributing, and receiving and decrypting processing is thereafter executed every time information to be transmitted occurs. For example, the latter processing is repeated every time content-stored recording media, such as DVD disks having a new content stored therein, are created and distributed to users, or every time an encrypted content is distributed via the Internet. [0137] The setup processing is executed by the following steps 1-4. Each of the steps is described. [0138] a. Step 1 First, the management center (TC) defines a hierarchical tree which is a binary tree with N leaves. It should be noted that this hierarchical tree is different from the above-mentioned one-way permutation tree. An identifier corresponding to any node in the hierarchical tree is set as k (k = 1, 2, —, 2N-1) . However, the root is set to 1, and as to its lower nodes, the identifiers (numbers) are given sequentially in terms of breadth first order. Namely, setting of node numbers (y) such as shown in Fig. 15 is performed. As a result of this processing, the node numbers y = 1 to 2N-1 are set to the respective nodes in the binary tree. [0139] Receivers um (m=l, 2, —, N) are assigned to the respective leaves of the tree. In the example of Fig. 15, sixteen receivers ul-u16 are assigned to the node numbers y = 16 to 31. [0140] Next, as to any internal node i (i = 1, 2, •••, 2N-1) , any subset Si,j corresponding to any node j, which is a descendant of the node i is defined. Moreover, of all the above-defined subsets Si,j, any in which the nodes i and j bear a parent-child relationship is denoted as a first special subset (Special Subset) SSi,j. It should be reminded here that each node of the tree excluding the root has the only one parent node, and thus that j, which takes n = 2, 3, 2N-1, is used only once as j in a SSi,j. Additionally, a second special subset SS'i,^ used where there is no receiver to be revoked and thus including all the receivers, is also defined. [0141] b. Step 2 The management center (TC) generates a modulus M, a public exponent e, a secret exponent d, which are parameters of the RSA cryptography, and publish the modulus M and the public exponent e. It is supposed here that the size of the modulus Mis e bits. For example, IM I bits = 1024 bits . Additionally, the management center selects and publishes a pseudo-random number generator G and a hash function H which outputs C bits (e.g., 128 bits) . The pseudo-random number generator G is the pseudo-random number generator G described with reference to Fig. 7 above, which outputs a 3C-bit pseudo-random number from a C-bit input, and is thus similar to the pseudo-random number generator applied in the above-mentioned SD scheme and explained in the literature by Noar et al. [0142] Next, by inputting the number of leaves = N, the modulus M, the secret exponent d, which are parameters of the RSA cryptography, the management center (TC) generates the one-way permutation tree being a binary tree with N leaves, according to the algorithm described with reference to the flow of Fig. 14 above, to calculate the value xi corresponding to each node i. Note here that either of the above-mentioned expressions (Formula 3) and (Formula 4) is applied in calculating the value xi corresponding to each node i. [0143] The management center (TC) sets the value xi determined in the above-mentioned processing as an intermediate label IL as data for generating the second special subset SS'i, used where there is no receiver to be revoked and thus including all the receivers. Namely, I L1, Φ = x1 [0144] The label of the second special subset SS'1,Φ is set as a LABELi,4,, and the LABEL1,Φ is supposed to be a value obtained by hash processing (H) the above-mentioned IL1,Φ Namely, LABEL1Φ = H(IL1,Φ) [0145] Furthermore, as to labels corresponding to the first special subsets SSi,j in each of which the nodes i and j bear a parent-child relationship, among all the subsets Si,j, intermediate labels ILi, j as their generator data are determined as follows. Namely, a value xy (y = 2, 3, —, 2N-1) excluding the root-corresponding value xi among the values xi to X2u-i set as the values corresponding to the nodes 1 to 2N-1 by the above-mentioned processing (see Fig. 14) is set as an intermediate label ILp{y),s(y) corresponding to a first special subset SSp(y),s(y) specified by the sibling node and the parent node of a node y. Namely, Xy = ILp(y),S(y) where P (y) is the parent node of the node y, and S (y) is the sibling node of the node y. [0146] A specific example is shown in Fig. 16. In Fig. 16, xy as a node-corresponding value is assigned to a node y 301. It shouldbe noted that all the node-corresponding values including xy are values satisfying the above-mentioned -expression (Formula 1), and thus (Formula Removed) [0147] The parent node of the node y 301 is a P(y) 302, and its sibling node is a S (y) 303. The first special subset SSP(y),s(y) specified by the sibling node S (y) 303 and the parent node P (y) 302 of the node y 301 is a subset SSp(y),s(y) 310 shown in Fig. 16. [0148] At this time, a label corresponding to the subset SSP(y),S(y) is a LABELP(y)/S(y}, and the LABELP(y),s(y) is set as a hashed value based on the intermediate label ILp(y),s(y) (this equals the node-corresponding value xy of the node y 301). Namely, LABELp(y) ,S(y) = H (ILp(y) ,S(y) ) The above-mentioned expression is equivalent to LABELp(y) ,s(y) = H(xy) [0149] When indicated by a general expression, a label LABELi,j corresponding to any first special subset SSi,j (where j = 2, 3, •••, 2N-1 as mentioned above) in which the nodes i and j bear a parent-child relationship, among all the subsets Si,j, takes a hashed value based on the corresponding intermediate label ILi,j. Namely, it is calculated as LABELifj = H(ILifj) [0150] It should be noted that, as mentioned above, the label LABEL1-Φ of the second special subset SS'1,Φ used where there is no receiver to be revoked and thus including all the receivers can also be calculated by hash processing (H) the corresponding intermediate label IL1,Φ. Namely, LABELi/4, = H(IL1,Φ) [0151] It should be noted that although the example in which hash processing is applied to the intermediate label-based label calculating processing has been described in the present embodiment, it may alternatively be configured to apply operation processing other than hash processing, provided that the processing is preferably based on a one-way function. [0152] In step 2, the management center executes processing of setting (a) the label LABELi, of the second special subset SS'ij, used where there is no receiver to be revoked and thus corresponding to the entire tree including all the receivers, and (b) a label LABELi,j. corresponding to any first special subset SSi,j (where j = 2, 3, -, 2N-1 as mentioned above) in which the nodes i and j bear a parent-child relationship, i.e., the labels corresponding to the special subsets mentioned in (a), (b) above respectively as the hashed value of the intermediate label IL1,Φ , the hashed value of any intermediate label IL1,Φ [0153] It should be noted that the value of each intermediate label is a node-corresponding value xi, which is a value calculated according to the algorithm described with reference to Fig. 14above, and thus a value satisfying the above-mentioned expression (Formula 3 or Formula 4). Namely, (Formula Removed) [0154] A processing example is shown in Fig. 17, for setting a node-corresponding value xi as an intermediate label (IL) , which is data for generating (a) the label LABELIL1,Φ of the second special subset SS1,Φused where there is no receiver to be revoked and thus corresponding to the entire tree including all the receivers, and (b) the label LABELi,j corresponding to any first special subset SSi,j (where j = 2, 3, —, 2N-1 as mentioned above) in which the nodes i and j bear a parent-child relationship. [0155] In Fig. 17, [i xk j] represents Xk = ILi,j where i is an ancestor of j. For example, [1 x3 2] represents X3 = ILl,2 [0156] In this way, the node-corresponding values xi are set as the values corresponding to the intermediate labels from which the labels of the above-mentioned first special subsets SSi.-j, and second special subset SS'1,IL1,Φ can be calculated. [0157] The management center (TC) calculates the hashed values based on the set intermediate labels, to determine (a) the label LABEL1,Φ of the second special subset SS'1,Φ used where there is no receiver to be revoked and thus corresponding to the entire tree including all the receivers, and (b) the label LABELi,j corresponding to any first special subset SSi,j (where j = 2, 3, •••, 2N-1 as mentioned above) in which the nodes i and j bear a parent-child relationship. [0158] A specific example corresponding to Fig. 16 described above is shown in Fig. 18. Let the node y 301 be given a node number 8 as shown in the drawing. A node-corresponding value X8 is assigned to the node y 301. The parent node of the node y 301 is the P(y) 302 with a node number 4, and the node number of its siblingnodeS (y) 303 is 9. The first special subset SSp(y), sty) specified by the sibling node S (y) 303 and the parent node P (y) 302 of the node y 301 is a subset SS4,g 310 shown in Fig. 16. At this time, an intermediate label as data for generating a label corresponding to the subset 884,9 310 is X8 = ILP(y),S(y) [0159] The label corresponding to the subset SS4,9 310 is a LABEL,4 9, and the LABEL4, 9 is set as a hashed value based on the intermediate label IL4,9 (this equals the node-corresponding value xa of the node y 301) . Namely, LABEL4,9 = H(IL4,9) The above expression is equivalent to LABEL4/9 = H(x8) [0160] As mentioned above, the management center determines in step 2, (a) the label LABELi,^ of the second special subset SS'i, used where there is no receiver to be revoked and thus corresponding to the entire tree including all the receivers, and (b) the label LABELi,j corresponding to any first special subset SSi,j (where j = 2, 3, ••-, 2N-1 as mentioned above) in which the nodes i and j bear a parent-child relationship. Each of the labels is calculated as the hashed value of an intermediate label being equal to its node-corresponding value . [0161] c. Step 3 Next, the management center (TC) inputs the label LABELi,j of a first special subset SSi,j in which the nodes i and j bear a parent-child relationship, into the pseudo-random number generator G, to obtain labels LABELi,Lc = ((ILi,2)e - h(3)) mod M - (Formula 11) ILi,4, = ((ILi,3)e - h(2)} mod M - (Formula 12) for either of the intermediate label ILi,2 and ILi,3. [0212] Specific intermediate label acquiring processing executed by a receiver is described with reference to Fig. 21. A receiver u4 assigned to a leaf 19 holds an intermediate label ILg,18. By an operation using the modulus M, the public exponent e in the RSA cryptography as the published parameters, and a node number i, an intermediate label IL4,8 of a subset S4,8 determined by the parent node 4 and the sibling node 8 of a node 9 can be obtained as IL4,8 = ((IL9,18)e - 19) mod M [0213] Similarly, an intermediate label IL2,5 of a subset S 2,5 determined by the parent node 2 and the sibling node 5 of the node 4 can be obtained as IL2,s = ( (IL4,8)e - 9) mod M [0214] By repeating this processing, the receiver u4 can obtain IL1,3 and IL1Φ. [0215] As in the above way, once the intermediate labels ILi,k corresponding to any subset Si,k has been derived, the receiver obtains a label LABELi,k as LABELi(k = H(ILi,k) [0216] Then, as described with reference to Fig. 7 above, the label LABELi,j of a necessary subset Si,j is obtained using the pseudo-random number generator G, and a subset key SKi,j for that subset is obtained by SKi j = GM(LABELi,j) to decrypt the ciphertext using this subset key SKi,j. [0217] A specific example of subset key deriving processing is described with reference to Fig. 23. As shown in Fig. 23, let it be supposed that receivers u2, ull, u12 are revoked, and that ciphertexts encrypted using subset keys corresponding to a subset 82,17 and a subset 83,13 are distributed by broadcasting. [0218] A receiver u4 holds six labels LABELi,s, LABELi,e, LABEL1,18, LABEL2,s, LABEL,2,iB, LABEL,},is, and one intermediate label IL9,18 from which IL1,1Φ, IL1,3, IL2,5, IL4,8 can be derived. The receiver u4 corresponds to (A) mentioned above. Namely, the receiver u4 directly holds, for a subset S2,17, the label LABEL2,e using a node 8 which is an ancestor of a node 17, and thus, by applying the pseudo-random number generator G to this label as many times as required, the receiver u4 can obtain a subset key SK2,n. [0219] Moreover, under the same setting, a receiver u5 holds six labels LABEL1,4, LABEL1,11, LABEL1,21, LABEL2,11, LABEL2,21, LABEL5,21, and one intermediate label ILio,zi from which ILi,$, ILi,3, 11*2,4, IL5,11 can be derived. The receiver u5 corresponds to (B) mentioned above. Namely, the receiver u5 does not directly hold any label LABELg,k using a node k which is an ancestor of the node 17, for the subset 82,17. For this reason, the intermediate label IL2,4 corresponding to the node 4, which is an ancestor of the node 17, is derived first from the intermediate label IL1o, 21 which it holds, using the above-mentioned technique, and then the label LABEL2,4 is obtained, after which by applying the pseudo-random number generator G to this label as many times as required, the subset key SK2/17 can be obtained. [0220] If there is no receiver to be revoked at all and thus the second special subset SS'1,Φ is used as the subset, a receiver um obtains the intermediate label IL1,Φ by the above-mentioned processing, andusing this intermediate label, the label LABELi,1,Φ is calculated as label LABEL1,Φ = H(IL1Φ) and this is then inputted to the pseudo-random number generator G, to obtain C bits in the middle of its output. Namely, the subset key SKi,$ corresponding to the subset Si,$ is obtained by SK1Φ, = GM(LABEL1,Φ,) and this is used for decrypting the ciphertext. [0221] A procedure for the subset key acquiring and decrypting processing from reception of ciphertexts which is executed by a receiver is described. [0222] First, in step 401, the receiver determines one of a plurality of ciphertexts it will decrypt, from a ciphertext set consisting of the plurality of ciphertexts. This is processing of extracting a ciphertext encrypted by a subset key which it can generate. Here, the fact that the receiver cannot determine a ciphertext it should decrypt means that the receiver is revoked. This ciphertext selecting processing is executed based on, e.g., the subset specifying information conveyed together with the ciphertexts. [0223] Once the ciphertext has been determined, the receiver derives the subset key used for encrypting that ciphertext, using the above-mentioned technique, in step S402. [0224] Adetailedprocedure for the subset key derivingprocessing is described with reference to Fig. 25. First, in step S501, a receiver urn determines whether or not the node j of the subset Si,j corresponding to any subset key SKi,j to be obtained for application to the ciphertext decrypting processing (A) is a descendant of a node k for which the receiver directly has a label LABELi,k (a case where j = k is included) or (B) matches with a node k which is one of the child nodes of the node i and which is a node not existing in a path from a leaf n to which the receiver is assigned to the root (i.e., the sibling node of the child node of the node i existing in the path), or is a descendant thereof (i.e., the node j is a descendant of the configuration node k of any first subset SSi,k among the subsets for which the receiver um is given labels in the SD scheme). It should be noted that if there is no receiver to be revoked and thus the subset key SK1,Φ for the second special subset SS'1,Φ is used for encrypting secret information, the node j is deemed to be (B). [0225] In the case of (A) , the processing proceeds to step S503, where a necessary subset key is obtained by applying the pseudo-random number generator G as many time as required based on a label owned, by the receiver. In the case of (B) , the processing proceeds to step S504, where a necessary intermediate label corresponding to a special subset is calculated by applying the above-mentioned expression (Formula 5) or (Formula 6) based on the intermediate label ILp(n),s(n) • Furthermore, in step S505, a label LABEL corresponding to that subset is calculated by performing hash processing on the calculated intermediate label, and in step S506, the necessary subset key is obtained by applying the pseudo-random number generator G based on the label calculated in step S506. [0226] Returning to the flow of Fig. 24, the receiver having derived the subset key by the above-mentioned processing, decrypts, in step S404, the ciphertext selected from the ciphertext set in step S402, using the subset key, to obtain secret information transmitted. The secret information is a content key for decrypting an encrypted content of a television broadcasting system. In this case, the receiver receives the encrypted content, and decrypts it using the content key for output. [0227] Next, referring to Figs. 26, 27, the functional configuration is described of an information processing apparatus for executing the label setting processing, the ciphertext generating processing, and an information processing apparatus as a receiver for executing the ciphertext decrypting processing. [0228] First, referring to Fig. 26, the configuration of an information processing apparatus for executing the label setting processing, the ciphertext generating processing is described. An information processing apparatus 410 has an intermediate label and label generating means 411, a labels-for-supply determining means 412, a ciphertext generating means 413, a ciphertext supplying means 414. [0229] The information processing apparatus 410 is an information processing apparatus for generating a hierarchical tree applied to the ciphertext supplying processing in which only specific selected equipment except excluded (revoked) equipment can perform decryption by applying the Broadcast Encryption scheme based on a hierarchical tree configuration. The intermediate label and label generating means 411 sets, as a hashed value based on an intermediate label, a value of a label corresponding to a special subset, among labels (LABEL) respectively corresponding to the subsets set based on the SD (Subset Difference) scheme to which the hierarchical tree is applied. As a hash function, MD4 or MD5, or SHA-1, or the like may be applicable. [0230] The special subset selected by the intermediate label and label generating means 411 is at least either of A first special subset which is among subsets Si,j each of which is defined by excluding a subtree rooted at a node j lower than a node i from a subtree rooted at the node i in the hierarchical tree, and in which the nodes i and j bear a direct descendant parent-child relationship in the hierarchical tree, and the second special subset, which is a subset SSi,Φ, defined as an entire-tree set including all the leaves in the hierarchical tree and thus rooted at the root. [0231] The intermediate label and label generating means 411 generates, as node-corresponding values of a one-way permutation tree, intermediate labels which enable the labels corresponding to the special subsets, among the labels (LABEL) respectively corresponding to the subsets set based on the SD (Subset Difference) scheme, to be derived using the hash function H. [0232] Specifically, N values xN-X2N-i are determined according to the algorithm described with reference to the flow of Fig. 14 above, to set them as intermediate labels. Namely, in a hierarchical tree having a binary tree configuration with N terminal nodes, first, a number xieZ*M is randomly selected, and a node-corresponding value xi is calculated according to the above-mentioned expression (Formulas) or (Formula 4) , while incrementing i by 1 using i as a counter, to determine the N values XN-X2N-1, and these node-corresponding values x± are set as the intermediate labels from which the labels of the above-mentioned first special subset SSi,j and second special subset SS'1,Φ, can be calculated. [0233] Furthermore, the labels of the special subsets are calculated by the hash processing based on the intermediate labels. Thereafter, by the operation in which the pseudo-random number generator G is applied to these labels corresponding to the special subsets, the labels respectively corresponding to the subsets are sequentially calculated. These are the processing which has been described with reference to Fig. 20 above. [0234] The labels-for-supply determining means 412 executes processing of determining labels for supply to a receiver corresponding to each of the terminal nodes of the hierarchical tree. The labels-for-supply determining means 412 determines special subset non-corresponding labels which do not correspond to the special subsets, and one intermediate label corresponding to the special subsets, as the labels for supply to the receiver. [0235] Specific processing by the labels-for-supply determining means 412 is as follows . First, the labels LABELi, j of the subsets Si,j each of which initiates at any internal node i in a path m (path-m) from a leaf to which a receiver urn is assigned to the root, and each of which corresponds to a node j directly branching from nodes in a path from this leaf to i, and the label LABELi,1,Φ corresponding to the subset SS' i1,Φ used where there is no receiver to be revoked and thus corresponding to the entire tree including all the receivers are set as the tentatively selected labels . Then, from these tentatively selected labels, the special subset non-corresponding labels which do not correspond to the special subsets are selected as the labels for supply. Furthermore, one intermediate label is selected, from which the labels corresponding to the special subsets can be calculated. These are determined as the final labels for supply to the receiver urn. [0236] The ciphertext generating means 413 executes encryption processing by selectively applying subset keys derivable from the labels generated by the intermediate label and label generating means 411, to generate ciphertexts . The ciphertext supplying means 414 supplies the thus generated ciphertexts through a network or a medium storing them. [0237] Next, referring to Fig. 27, the functional configuration of an information processing apparatus as a receiver for executing the ciphertext decrypting processing is described. [0238] An information processing apparatus 420 as a receiver for executing the ciphertext decrypting processing has a ciphertext selecting means 421, a label calculating means 422, a subset key generating means 423, a decrypting means 424, a label memory 425. [0239] The information processing apparatus 420 as a receiver for executing the ciphertext decrypting processing is an information processing apparatus 420 for executing the decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to the subsets set based on the SD (Subset Difference) scheme, which is the Broadcast Encryption scheme based on a hierarchical tree configuration. The ciphertext selecting means 421 selects, from the ciphertexts for processing, a ciphertext generated by applying a subset key derivable by the pseudo-random number generating processing based on the label calculable from a label held in its label memory 425 or from the intermediate label which it holds. [0240] The label calculating means 422 executes, if the subset key applied to the ciphertext is not a subset key derivable by the pseudo-random number generating processing based on the label held, the operation processing based on the intermediate label ILp(n),s stored in the label memory 425. Furthermore, by performing hash processing on the calculated intermediate label, a label LABEL corresponding to that subset is calculated. [0242] The subset key generating means 423 obtains the necessary subset key by applying the pseudo-random number generator G based on the label stored in the label memory 425 or the label LABEL calculated from the intermediate label by the label calculating means 422. [0243] The decrypting means 242 executes the ciphertext decrypting processing based on the subset key calculated by the subset key generating means 423. [0244] In Fig. 28, there is shown a hardware configuration example of an information processing apparatus for executing the label setting processing, the ciphertext generating processing, and an information processing apparatus 500 as a receiver for executing the ciphertext decrypting processing. Blocks enclosed by dotted lines in the drawing are not necessarily equipped. For example, a media interface 507 is equipped if the receiver 500 is an optical disk player or the like. An input/output interface 503 is equipped if the receiver 500 exchanges information with other equipment or receives signals through an antenna. What matters is a secure storage unit 504, in which the labels given by the management center (TC) during the setup phase can be kept in storage securely. [0245] The information processing apparatus 500 includes, as shown in Fig. 28, a controller 501, an operation unit 502, the input/output interface 503, the secure storage unit 504, amainstorage unit 505, a display device 506, the media interface 507. [0246] The controller 501 includes, e.g., a CPU having a function of a control unit for executing data processing in accordance with a computer program. The operation unit 502 functions as an exclusive operation unit and an encryption processing unit for, e.g., generating encryption keys, generating random numbers, and performing encryption processing. The unit 502 executes the label and intermediate label calculating processing, the subset key calculating processing based on labels. Furthermore, if the information processing apparatus 500 is an information processing apparatus as a receiver, the unit 502 executes the ciphertext decrypting processing based on subset keys. [0247] The input/output interface 503 is an interface dealing with data input from input means such as a keyboard, a mouse, data output to an external output apparatus, data transmission/reception processing via a network. [0248] If the information processing apparatus 500 is an information processing apparatus as a receiver, the secure storage unit 504 stores data to be held safely or confidentially, such as , e.g., labels, intermediate labels, various IDs given by the management center (TC) during the setup phase. [0249] The secure storage unit 504 stores, e.g., one intermediate label from which labels (LABEL) corresponding to special subsets selected from subsets can be generated, and labels (LABEL) not corresponding to the special subsets. [0250] If the information processing apparatus 500 is an information processing apparatus as a receiver, the labels generated based on the intermediate label stored in the secure storage unit 504 are the labels (LABEL) corresponding to the special subsets, which specifically are the labels corresponding to the following subsets (a) a first special subset which is among subsets Si,j each of which is defined by excluding a subtree rooted at a node j lower than a node i from a subtree rooted at the node i in a hierarchical tree, and in which the nodes i and j bear a direct descendant parent-child relationship in the hierarchical tree, and (b) the second special subset, which is a subset Si,* defined as an entire-tree set including all the leaves in the hierarchical tree and thus rooted at the root. [0251] The main storage unit 505 is a memory area used for, e.g., a data processing program executed by the controller 501, temporarily stored processing parameters, a working area for program execution, and the like. The secure storage unit 504 and the main storage unit 505 are memories including, e.g., a RAM, a ROM and the like. The display device 506 is used for outputting decrypted contents and the like. The media interface 507 provides a read/write function for media such as a CD, a DVD, an MD. [0252] [6. Outline of Basic Layered Subset Difference (Basic LSD) scheme] Next, a Basic Layered Subset Difference (Basic LSD) scheme is outlined. [0253] In the Non-Patent Document 2 (Advances in Cryptography -Crypto 2002, Lecture Notes in Computer Science 2442, Springer, 2002, pp.47-60 (D. Halevy and A. Schamir, "The LSD Broadcast Encryption Scheme")) referred to in the above-mentioned Background Art section, a Layered Subset Difference scheme obtained by improving the SD scheme is proposed. The LSD scheme includes a Basic scheme and a General scheme which is an extension of the Basic scheme. Here, the Basic scheme is described. [0254] The LSD scheme is an extension of the SD scheme, in which the concept of layers is added to the SD scheme. In a tree structure of the SD scheme, a specific height is defined as a special level (Special Level) . While there is only one kind of a Special Level in the Basic LSD scheme, a plurality of Special Levels with varying degrees of importance are used in the General LSD scheme. [0255] Now, for ease of description, let log1/2N be an integer. In the Basic LSD scheme, as shown in Fig. 29, among the levels from the root to leaves of a tree, levels occurring every log1/2N including a root level and a leaf level are determined to be Special Levels. A hierarchical portion interposed between two adjacent Special Levels (including the Special Levels at both ends) is called a layer. In the example of Fig. 29, the root level, a level including a node k, and the leaf level are Special Levels, and the root level, a level including a node i, and the level including the node k form a single layer. Moreover, the level including the node k, a level including a node j , and the level including the leaves form another layer. [0256] In the Basic LSD scheme, among subsets Si,j defined in the SD scheme, only those satisfying at least one of conditions (1) the node i and the node j belong to the same layer, and (2) the node i is at a Special Level, are defined. By so doing, part of the subsets used in the SD scheme are not defined in the Basic LSD scheme. However, such subsets can be represented by the union of at most two subsets defined in the Basic LSD scheme. For example, in the example of Fig. 29, a subset Si,j is not defined in the Basic LSD scheme, but can be represented as Si,j = Si,k U Sk,j using a node (node k) on the Special Level nearest to the node i in a path from the node i to the node j. [0257] Namely, instead of one ciphertext encrypted using a subset key SKi,k corresponding to a subset Si,k in the SD scheme, in the Basic LSD scheme, two ciphertexts encrypted using subset keys SKi,k and SKk,j corresponding to subsets Si,k and Sk,j are transmitted. [0258] As a result of this technique, the number of ciphertexts to be transmitted increases only two times that in the SD scheme, while the number of labels held by each receiver can be reduced compared with that in the above-mentioned SD scheme. [0259] The number of labels held by each receiver in the SD scheme has been described with reference to Fig. 9 above. Now, the number of labels held by each receiver in the Basic LSD scheme under the same setting is described with reference to Fig. 30. A receiver u4 in Fig. 30 may only have to hold labels LABELi,j for cases where both i, j belong to the same layer or where i is at a Special Level. Namely, the labels held by the receiver u4 are LABEL1,3, LABEL1,5 LABEL1,8 LABEL1,18, LABEL2,5, LABEL4,8, LABEL,},is, LABELg,18. Furthermore, similarly to the SD scheme, the receiver also needs to hold a special label used where there is no receiver to be revoked. [0260] When the total number of receivers is set to N, the total number of labels which each receiver need to hold can be obtained as follows. First, the number of labels per layer equals a number obtained by calculation using the following expression, since there are as many nodes j as the heights of i within the layer once the node i has been determined. [Equation 16] (Ewuation Removed) [0261] Since there are log1/2N layers in the hierarchical tree, the number of labels per layer of the entire hierarchical tree equals a number obtained by calculation using the following expression. [Equation 17] (Equation Removed) [0262] Next, let the case where the node i is at a Special Level be considered. Since there are as many nodes j as the heights of i in the entire hierarchical tree, the number of labels in the entire hierarchical tree including any node i being at a Special Level equals a number obtained by calculation using the following expression. [Equation 18] (Equation Removed) [0263] Now that the labels for the nodes i being at a Special Level and for nodes j belonging to the same layer have been counted doubly, these labels need to be subtracted. Since there are log1/2N such combinations per layer, there are log N such combinations overall . When the special label for the case where there is no receiver to be revoked is added to them, the total number of labels each receiver holds in the Basic LSD scheme equals a number given by the following expression. [Equation 19] [Equation Removed] [0264] [7. Configuration for reducing the number of labels in the Basic LSD scheme using the one-way permutation tree] Next, a configuration for reducing the number of labels in the Basic LSD scheme using the one-way permutation tree is described. In the present invention based on the above-mentioned SD scheme, the number of labels owned by each receiver is reduced by the receiver having only one specific intermediate label from which the intermediate labels ILi,j for obtaining the labels LABELi,j of subsets Si,j in each of which the node i is the parent of the node j can be derived. This technique can be applied similarly to the Basic LSD scheme. [0265] A specific configuration method is substantially the same as that of the above-mentioned embodiment of the present invention. However, if a node i is not at a Special Level when the management center (TC) successively produces the labels LABELi,j using the pseudo-random number generator G during setup, any label for which a node lower than a Special Level that is immediately below i is j is not used. Consequently, generation of labels can be stopped at that Special Level. Moreover, when the management center distributes the generated labels to each receiver, only labels satisfying the above-mentioned conditions are generated, and thus the management center has to distribute such labels only. [0266] As a setting similar to what has been described with reference to Fig. 30, a specific configuration example for reducing the number of labels in the Basic LSD scheme using the one-way permutation tree is described with reference to Fig. 31. In the Basic LSD scheme, the number of labels a receiver u4 holds should be nine overall, which are LABELi,3, LABELi.s, LABEL1,8, LABEL1,18, LABEL2,5, LABEL4,8, LABEL4,18, LABEL9,18, plus one special label used where there is no receiver to be revoked. By contrast, as in the present invention, when it is designed such that the receiver holds one intermediate label ILg,i8 from which the intermediate labels ILi,j and the IL1Φ, respectively corresponding to the special subsets used where nodes i, j bear a parent-child relationship and where there is no receiver to be revoked can be derived, the receiver may only have to hold five labels overall, which are four labels LABELi,s, LABELi,s, LABEL1,18, LABEL4,18, and one intermediate label IL9,18. [0267] The number of labels which can be reduced by the present invention given the total number of receivers being N is considered. In a Basic LSD scheme to which the present invention is not applied, how many labels LABELi,j, in each of which the nodes i, j bear a parent-child relationship, should be held by each receiver is considered. [0268] When the nodes i, j bear a parent-child relationship, the following three cases can be considered. (A) The node i is at a Special Level. (B) The node j is at a Special Level. (C) Neither the node i nor the node j is at a Special Level. If the nodes i, j bear a parent-child relationship (i.e., they are adjacent to each other) in any of the above cases, iandj belong to the same layer. Namely, the subset Si, j satisfies either condition required to be defined in the Basic LSD scheme. Namely, such subsets are defined and used in the Basic LSD scheme, and thus a receiver needs to hold the LABELi,j corresponding thereto. [0269] For a certain receiver, such nodes i, j are determined as follows. Namely, there are so many such nodes i, j as to cover the height of a tree given that the total number of nodes i in the tree equals the height of the tree (i.e., all the nodes in a path from a leaf to which the receiver is assigned to the root, excluding the leaves), and once i has been determined, only one j is determined (the node which is a child of i and which does not exist in the path) . Thus, there exist so many nodes i, j as to cover the height of the tree, i.e., log N nodes if J-[0270] By designing such that these log N labels and one special label are generated from one intermediate label using the present invention, the number of labels held by a receiver can be reduced by log N+l - 1 = log N [0271] As mentioned above, the total number of labels a receiver holds in the Basic LSD scheme was log3/2N+l and thus, by applying the present invention, this can be reduced to log3/2N - log N+l [0272] [8. Outline of General Layered Subset Difference (General LSD) scheme] Next, a General Layered Subset Difference (General LSD) scheme is outlined. [0273] While one kind of a Special Level is used in the Basic LSD, a plurality of Special Levels having different degrees of importance are used in the General LSD scheme. [0274] Similarly to what is proposed in the literature proposing the LSD scheme, in a hierarchical tree, a path from the root to a node j via a node i is considered as a single graph. The root and the node j of the tree are the end points. Nodes of the tree are nodes of the graph. One of the nodes other than the end points is the node i. In this graph, each node is represented by its distance from the root. This distance is represented as a d digit number in base b (where b = (log1/dN) ) . For example, the root is represented as 0 ... 00. A node next thereto (a child node of the root in the hierarchical tree structure) is represented as 0 ... 01. [0275] A subset Si,j is considered to be the final change from any node i to any node j, in combinations of defined transformations (changes from one node to another) . A defined transformation represents a defined subset, and individual changes required for the final transition indicate defined subsets required to represent the subset Si, j in terms of segments . As disclosed in the original literature, when nodes i, ki, k2, •", kd-i/ j exist in a path of a tree in this order, a subset Si,j in the SD scheme is indicated by the following expression in the General LSD scheme. [Equation 20] [Equation Removed} [0276] Namely, the subset Si,j in the SD scheme is represented by the union of at most d subsets in the General LSD scheme. [0277] In the General LSD scheme, when a node i is represented as x a 0 (where a is the rightmost nonzero digits, x is a sequence of arbitrary digits, and 0 is a sequence of zeros), all changes of i to j if j is represented either by x + l 0 0, or x a ' y (where a' >a, and y is a sequence of arbitrary digits of the same length as x} are defined. Namely, the subset Si,j being represented by any such i,j pair is defined. [0278] In the above way, a level represented by two-digit numbers ending (at the rightmost) with 0 when d = 2 in the General LSD scheme is considered as a Special Level in the Basic LSD scheme. In the General LSD scheme, the number of rightmost trailing zeros in the representation of a node i determines the degree of importance of that level, and a node j could be any node (including nodes at both ends) from i+1 to a first node having a higher degree of importance than i. Under such a setting, let i and j be that i = 825917, j = 864563. Then, a change from i to j, i.e., the subset Si,j in the SD scheme can be represented as four transformations defined in the General LSD scheme, i.e., 825917 -> 825920 -> 826000 -> 830000 -> 864563. [0279] Namely, supposing that k1 = 825920, k2 = 826000, k3 = 830000, then the subset Si,j is indicated by the following expression. Namely, [Equation 20] [Equation Removed] [0280] In order to transmit secret information to receivers belonging to the above-mentioned subsets Si,j of the SD scheme, four ciphertexts encrypted by subset keys corresponding to subsets indicated by the following expression are transmitted. [Equation 21] (Equation Removed) [0281] The number of labels to be held by each receiver in the General LSD scheme decreases with increasing parameter d, to finally obtain O(log1+EN) where s = 1/d. Also, at this time, the upper limit of the number of ciphertexts to be transmitted is d(2r - 1) For details, reference should be made to the above-mentioned literature. [0282] [9. Configuration for reducing the number of labels in the General LSD scheme using the one-way permutation tree] Next, a configuration for reducing the number of labels in the General LSD scheme using the one-way permutation tree is described. The above-mentioned technique for reducing the number of labels held by a receiver, using the one-way permutation tree in the Basic LSD scheme, can also be applied to the General LSD scheme. Specifically, the Basic LSD scheme and the General LSD scheme differ only in their conditions to be satisfied by any defined subset, but they do not differ as far as the one-way permutation tree is used. [0283] Also in the General LSD scheme, a receiver um needs to hold a label LABELi,j corresponding to any subset Si,j in which the nodes i, j bear aparent-child relationship, among the labels defined in the SD scheme and given to the receiver. The reason is that even if i takes any value, a change to a node j (i.e., i+1) which is a child thereof falls under the above-mentioned condition for a defined transformation. Namely, similarly to the Basic LSD scheme, for a certain receiver, there are log N labels in which nodes i, j bear a parent-child relationship, among the labels to be held by the receiver. By designing such that these labels and the special label are produced from one intermediate label, a reduction of as many as log N labels can be implemented. The number of labels to be held by each receiver in the original General LSD scheme was 0(log1+EN) (where s is an arbitrary integer) , and thus, log N labels can be reduced therefrom. [0284] Originally, the number of labels which each receiver should hold in the General LSD scheme is set to a number smaller than that in the SD scheme or in the Basic LSD scheme. From this setting, a number of labels similar to the number in the SD scheme or in the Basic LSD scheme can further be subtracted, and thus, in this sense, the effect of reduction is further significant. [0285] The present invention has been described in great detail with reference to specific embodiments in the foregoing. However, it is obvious that those skilled in the art can make modifications to or substitutions for the embodiment without departing from the scope and spirit of the present invention. Namely, the present invention has been disclosed by way of examples, and thus should not be construed in a restrictive sense. In order to judge the scope and spirit of the present invention, the appended claims should be taken into consideration. [0286] It should be noted that a series of processing described in the Description can be performed by hardware, or software, or a configuration having both combined. In a case of performing the processing depending on software, the processing can be performed by installing a program having recorded processing sequences therein to a memory within a computer incorporated into dedicated hardware, for execution, or by installing the programinto a general-purpose computer that can perform various processing, for execution. [0287] For example, the program can be recorded on a hard disk and a ROM (Read Only Memory) as recording media beforehand. Alternatively, the program can be stored (recorded) temporarily or permanently on a removable recording medium, such as a flexible disk, a CD-ROM (Compact Disc Read Only Memory) , a MO (Magneto optical) disc, a DVD (Digital Versatile Disc), a magnetic disk, a semiconductor memory. Such a removable recording medium can be provided as so-called package software . [0288] It should be noted that the program can be installed to the computer from a removable recording medium such as mentioned above, and additionally, through wireless transmission to the computer fronxa download site, wired transmission to the computer via a network such as a LAN (Local Area Network) , the Internet to allow the computer to receive the thus transmitted program for installation in a storage medium such as a hard disk incorporated therein. [0289] It should be noted that the various processing described in the Description is performed not only time-sequentially according to the description, but also parallelly or individually according to the processing capacity of an apparatus that performs processing, or as necessary. Further, the system used in the present Description means a logical set configuration of a plurality of apparatus, and is not limited to one wherein apparatus each having its own configuration are grouped within the same enclosure. Industrial Applicability [0290] According to the configuration of the present invention, a one-way permutation tree based on a single trap-door one-way permutation is applied further to a Subset Difference (SD) scheme, and a Layered Subset Difference (LSD) scheme which are deemed to be relatively efficient configurations in information distribution configurations adopting a hierarchical tree structure being one embodiment of a Broadcast Encryption scheme, whereby amounts of information each receiver should hold safely can be reduced. [0291] Furthermore, in the configuration of the present invention, intermediate labels which are intermediate labels (IL) set as values from which values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on the SD scheme or the LSD scheme to which the hierarchical tree is applied, can be calculated by operation processing, and these intermediate labels have values from which values of other intermediate labels can be calculated by applying a trap-door one-way permutation F based on a value of at least one intermediate label. Since it is configured such that a receiver is given, in addition to labels not corresponding to the special subsets, one intermediate label from which the labels corresponding to the special subsets can be derived, the number of labels supplied to the receiver in the conventional SD scheme or LSD scheme can be reduced. As to the reduced labels, the other intermediate labels can be calculated by executing the trap-door one-way permutation F on the intermediate label held by the receiver, whereby processing on all the subsets set table based on the conventional SD or LSD scheme can be performed. As a result of applying the configuration of the present invention, a reduction in amounts of information (labels) each receiver should hold can be realized. Claims 1. An information processing method for generating a hierarchical tree applied to ciphertext supplying processing in which only specif ic selected equipment can per form decrypt ion using a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing method being characterized by comprising: an intermediate label generating step of generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allows to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate label; a label generating step of generating the labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and a labels-for-supply determining step of determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which label corresponding to the special subset can be calculated by operation processing. 2. The information processing method according to Claim 1, characterized by further comprising: a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys derived from the respective labels corresponding to the subsets, which are generated in the label generating step, for supplying to the receiver. 3. The information processing method according to Claim 1, characterized in that: the label generating step includes a step of calculating the values of the labels corresponding to the special subsets by performing hash processing on the intermediate labels. 4. The information processing method according to Claim 1, characterized in that: the label generating step includes a step of generating other labels by pseudo-random number generating processing performed on the values of the labels corresponding to the special subsets. 5. The information processing method according to Claim 1, characterized in that: the intermediate label generating step is a step of selecting a value xieZ M randomly, in a hierarchical tree with 2N-1 nodes, calculating node-corresponding values x1 to X2N-1 in the hierarchical tree with 2N-1 nodes, by applying either of the following equations, to which an inverse permutation F"1 of a trap-door one-way permutation F is applied, while incrementing i by one up to i = 2 to 2N-1 using i as a counter, and further setting calculated values as the values of the intermediate labels (IL) from which the special subset-corresponding labels can be calculated: [Equation 1] (Equation Removed) where[i] represents the largest integer equal to i or less, or [Equation 2] (Equation Removed) where[i] represents the largest integer equal to i or less, where M, d are a modulus M and a secret exponent d as cryptographic parameters. 6. The information processing method according to Claim 1, characterized in that: the special subset selected in the intermediate label generating step is at least one of a first special subset and a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at a node j that is lower than a node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset S1,Φ defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. 7. The information processing method according to Claim 1, characterized in that: the labels-for-supply determining step is a step of specifying one of the intermediate labels for supply to the receiver corresponding to the terminal node of the hierarchical tree as being an intermediate label corresponding to a lowermost one of subsets S±,j constituting the first special subset(s). 8. The information processing method according to any of Claims 1 to 7, characterized in that: the intermediate label generating step is a step of setting labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 9. The information processing method according to any of Claims 1 to 7, characterized in that: the intermediate label generating step is a step of setting labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 10. A decryption processing method for executing decrypting processing of ciphertexts encryptedby subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, the decryption processing method being characterized by comprising: a ciphertext selecting step of selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; a label calculating step of calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; a step of generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and a decrypting step of executing the decrypting processing of the ciphertext by applying the generated subset key. 11. The decryption processing method according to Claim 10, characterized in that: the label calculating step includes a step of calculating another intermediate label by executing a trap-door one-way permutation F on the intermediate label held. 12. The decryption processing method according to Claim 10, characterized in that: the label calculating step includes a step of executing calculation of the label by performing hash processing on the intermediate label held or the another intermediate label obtained by executing the trap-door one-way permutation F on the intermediate label held. 13. The decryption processing method according to Claim 10, characterized in that: in the label calculating step, the subset key to be applied to the ciphertext is a subset key calculable by the pseudo-random number generating processing based on a label corresponding to either a first special subset and a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset S1,Φ defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top; and the label calculating step is a step of calculating the label corresponding to the special subset by performing operation processing on the intermediate label held if the label corresponding to the special subset is not held. 14. The decryption processing method according to Claim 10, characterized in that: the label calculating step is a step of calculating a label corresponding to a special subset including nodes in a path from a node to which a receiver for executing the decrypting processing is assigned to a root in the hierarchical tree, by performing operation processing on the intermediate label held. 15 . An information processing method for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing method being characterized by comprising: a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme to which a hierarchical tree is applied; wherein the subset keys to be applied in the ciphertext generating step are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and are set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label. 16. The information processing method according to Claim 15, characterized by further comprising: a subset key generating step of generating subset keys, wherein the subset key generating step is processing of generating the subset keys by pseudo-random number generating processing based on the labels (LABEL) respectively corresponding to the subsets. 17. The information processing method according to Claim 15, characterized by further comprising: a subset key generating step of generating subset keys, wherein the subset key generating step includes: an intermediate label generating step of generating the intermediate labels corresponding to the special subsets based on an operation expression to which an inverse permutation F-1 of a trap-door one-way permutation F using x1eZ*M, and a modulus M and a secret exponent d as cryptographic parameters are applied; a label generating step of generating labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and a step of calculating the subset keys by operation processing based on the labels. 18. The information processing method according to Claim 17, characterized in that: the special subset selected in the intermediate label generating step is at least one of a first special subset and a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset S1,Φ, defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. 19. The information processing method according to Claim 18, characterized in that: the intermediate label generating step is a step of setting values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 20. The information processing method according to Claim 18, characterized in that: the intermediate label generating step is a step of setting values of labels corresponding to selected part of special subsets, among labels (LABEL) corresponding to subsets set based on a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 21. An information processing apparatus for generating a hierarchical tree applied to ciphertext supplying processing in which only specific selected equipment canperform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing apparatus being characterized by comprising: intermediate label generating means for generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allows to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate label; label generating means for generating the labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and labels-for-supply determining means for determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which label corresponding to the special subset can be calculated by operation processing. 22. The information processing apparatus according to Claim 21, characterized by further comprising: ciphertext generating means for generating ciphertexts by executing encryption processing while selectively applying subset keys derived from the respective labels corresponding to subsets, which are generated by the label generating means, for supplying to the receiver. 23. The information processing apparatus according to Claim 21, characterized in that: the label generating means is configured to calculate the values of the labels corresponding to the special subsets by performing hash processing on the intermediate labels. 24. The information processing apparatus according to Claim 21, characterized in that: the label generating means is configured to generate other labels by pseudo-random number generating processing performed on the values of the labels corresponding to the special subsets. 25. The information processing apparatus according to Claim 21, characterized in that: the intermediate label generating means is configured to select a value x1eZ*M randomly, in a hierarchical tree with 2N-1 nodes, calculating node-corresponding values x1 to X2N-1 in the hierarchical tree with 2N-1 nodes by applying either of the following equations, to which an inverse permutation F"1 of a trap-door one-way permutation F is applied, while incrementing i by one up to i = 2 to 2N-1 using i as a counter, and further set calculated values as the values of the intermediate labels (IL) from which the special subset-corresponding labels can be calculated: [Equation 3] (Equation Removed) where[i] represents the largest integer equal to i or less, or [Equation 4] (Equation Removed) where |_ J represents the largest integer equal to i or less, where M, d are a modulus M and a secret exponent d as cryptographic parameters. 26. The information processing apparatus according to Claim 21, characterized in that: the special subset selected by the intermediate label generating means is at least one of a first special subset and a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset S1,Φ defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. 27. The information processing apparatus according to Claim 21, characterized in that: the labels-for-supply determining means is configured to specify one of the intermediate labels for supply to the receiver corresponding to the terminal node of the hierarchical tree as being an intermediate label corresponding to a lowermost one of subsets Si,j constituting the first special subset(s). 28. The information processing apparatus according to any of Claims 21 to 27, characterized in that: the intermediate label generating means is configured to set labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 29. The information processing apparatus according to any of Claims 21 to 27, characterized in that: the intermediate label generating means is configured to set labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets set in accordance with a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree, as values calculable from the intermediate labels (IL) corresponding to the special subsets. 30. An information processing apparatus for executing decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing apparatus being characterized by comprising: ciphertext selecting means for selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; label calculating means for calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; means for generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and decrypting means for executing the decrypting processing of the ciphertext by applying the generated subset key. 31. The information processing apparatus according to Claim 30, characterized in that: the label calculating means is configured to calculate another intermediate label by executing a trap-door one-way permutation F on the intermediate label held. 32. The information processing apparatus according to Claim 30, characterized in that: the label calculating means is configured to execute calculation of the label by performing hash processing on the intermediate label held or the another intermediate label obtained by executing the trap-door one-way permutation F on the intermediate label held. 33. The information processing apparatus according to Claim 30, characterized in that: in the label generating means, the subset key to be applied to the ciphertext is a subset key calculable by the pseudo-random number generating processing based on a label corresponding to either a first special subset or a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset Si, defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top; and the label calculating means is configured to calculate the label corresponding to the special subset by operation processing on the intermediate label held, if the label corresponding to the special subset is not held. 34. The information processing apparatus according to Claim 30, characterized in that: the label calculating means is configured to calculate a label corresponding to a special subset including nodes in a path from a node to which a receiver for executing the decrypting processing is assigned to a root in the hierarchical tree, by performing operation processing on the intermediate label held. 35. An information processing apparatus for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the information processing apparatus being characterized by comprising: ciphertext generating means 'for generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme, to which a hierarchical tree is applied, wherein the subset keys to be applied in the ciphertext generating means are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label. 36. The information processing apparatus according to Claim 35, characterized by further comprising: subset key generating means for generating the subset keys, wherein the subset key generating means is configured to generate the subset keys by pseudo-random number generating processing based on the labels (LABEL) respectively corresponding to the subsets. 37. The information processing apparatus according to Claim 35, characterized by further comprising: subset key generatingmeans for generating the subset keys, wherein the subset key generating means is configured to generate the intermediate labels corresponding to the special subsets based on an operation expression to which an inverse permutation F"1 of a trap-door one-way permutation F using x1eZ M, and a modulus M and a secret exponent d as cryptographic parameters are applied, generate the labels corresponding to the special subsets by operation processing based on the intermediate labels, further generate labels not corresponding to the special subsets by an operation based on the generated labels, and calculate the subset keys by performing operation processing based on the generated labels . 38. The information processing apparatus according to Claim 35, characterized in that: the special subsets include at least one of a first special subset and a second special subset; the first special subset is one of subsets Si,j and having a direct descendant parent-child relationship between a node i and a node j, the subsets Si,j being defined as subsets that are obtained by excluding a subtree rooted at the node j that is lower than the node i from a subtree rooted at the node i in the hierarchical tree; and the second special subset is a subset Si,^ defined as an entire-tree set having a root including all leaves of the hierarchical tree as a top. 39. The information processing apparatus according to Claim 35, characterized in that: the subset is a subset set according to a Basic LSD (Basic Layered Subset Difference) scheme having a subset management configuration based on layers separated by a single Special Level set in the hierarchical tree. 40. The information processing apparatus according to Claim 35, characterized in that: the subset is a subset set according to a General LSD (General Layered Subset Difference) scheme having a subset management configuration based on layers separated by a plurality of Special Levels set in the hierarchical tree. 41. A computer program for generating a hierarchical tree applied to ciphertext supplying processing in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the computer program being characterized by comprising: an intermediate label generating step of generating intermediate labels (IL), which are defined as having values that allow to calculate, by operation processing, values of labels corresponding to selected part of special subsets, among labels (LABEL) respectively corresponding to subsets based on a SD (Subset Difference) scheme to which the hierarchical tree is applied, and that allows to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one of the intermediate label; a label generating step of generating the labels corresponding to the special subsets by operation processing based on the intermediate labels, and further generating labels not corresponding to the special subsets by an operation based on the generated labels; and a labels-for-supply determining step of determining labels for supply to receivers corresponding to terminal nodes of the hierarchical tree, the labels including a special subset-noncorresponding label that does not corresponding to the special subset, and an intermediate label from which label corresponding to the special subset can be calculated by operation processing. 42. A computer program for executing decrypting processing of ciphertexts encrypted by subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on a hierarchical tree configuration, the computer program being characterized by comprising: a ciphertext selecting step of selecting a ciphertext generated by applying a subset key derivable by pseudo-random number generating processing based on a label held therein or a label calculable from an intermediate label held therein, from the ciphertexts; a label calculating step of calculating a label corresponding to a special subset by executing operation processing on the intermediate label held if the subset key to be applied to the ciphertext cannot be derived by the pseudo-random number generating processing based on the label held; a step of generating the subset key by the pseudo-random number generating processing based on the label held or the label calculated; and a decrypting step of executing the decrypting processing of the ciphertext by applying the generated subset key. 43. A computer program for executing generating processing of ciphertexts in which only specific selected equipment can perform decryption using a Broadcast Encryption scheme based on a hierarchical tree configuration, the computer program characterized by comprising: a ciphertext generating step of generating ciphertexts by executing encryption processing while selectively applying subset keys respectively corresponding to subsets set based on a SD (Subset Difference) scheme to which a hierarchical tree is applied; wherein the subset keys to be applied in the ciphertext generating step are subset keys calculable from the labels (LABEL) respectively corresponding to the subsets, and are set such that values of labels corresponding to selected part of special subsets can be calculated by operation processing based on intermediate labels (IL) and that the intermediate labels allow to calculate values of other intermediate labels by applying a trap-door one-way permutation F based on a value of at least one intermediate label.