JP2004234641A - Method for authenticating contents file producer, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method and program for authenticating a contents file producer, which offers a predetermined service at a mobile device side only for the contents file produced with the use of a genuine contents production tool, in a service providing a multimedia contents file for the mobile device (for example, a mobile phone). <P>SOLUTION: At a contents production side, encryption processing 3 is executed on contents, for example, a music source 1 using a certain hardware key 2 or secret information, to obtain a contents file 4. At the mobile device side, the contents file 4 is downloaded and is temporarily held in a file storage part 11. An inspection part 12 inspects whether the downloaded contents file 4 has been produced with the use of the proper production tool. If it is authenticated, the contents file is registered in a registration part 13, and is provided to users. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

  The present invention provides a multimedia content file providing service for a mobile phone, in which a mobile phone provides a predetermined service only to a content file created using a legitimate content creation tool. The present invention relates to a file creator's authentication method and its program.

  As this type of conventional technology, there is a digital signature technology for determining whether or not there is falsification of transmitted content, for example, a contract, and as another conventional technology, the other party is authenticated between the sender and the receiver, that is, the sender side is correct. There is a challenge-response procedure to verify whether you have a private key.

  FIG. 8 shows an outline of this challenge response procedure. As shown in FIG. 8, the receiving side generates a random number value, and transmits the random number value to the transmitting side (challenge code transmission). The receiving side and the transmitting side perform some kind of calculation (hash calculation) using the secret key based on the random number value, and the transmitting side transmits the result of the hash calculation to the receiving side (response code transmission). The receiving side compares the received value with the value obtained by its own hash calculation, and if they match, determines that the transmitting side has the correct secret key.

As a document related to the above-mentioned conventional technology, there is, for example, Japanese Patent Application Laid-Open No. 2002-334173 entitled “Content distribution method and server and terminal and computer program used for the method”.
JP-A-2002-334173

  However, the above-described conventional technology requires communication between the sender and the receiver for authentication of the other party, but in the content distribution service, direct communication between the content creator and the receiver is required. Is unrealistic.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a multimedia content file providing service for a mobile device (for example, a mobile phone) in which a predetermined service is provided on the mobile device side only for a content file created using a valid content creation tool. The present invention provides a content file creator authentication method and a program for providing a content file creator.

  Another object of the present invention is to detect a content file created by using an unauthorized content creation tool, for example, a content file created by using a pirated tool, and to detect a predetermined content in the mobile device for the content file. An object of the present invention is to provide a content file creator authentication method and a program that do not provide services.

  Still another object of the present invention is to provide a content file creator authentication method and a program that do not require communication between a sender and a receiver to authenticate a content file created using a legitimate content creation tool. Is to provide.

  In order to achieve the above object, the present invention is characterized in that the transmitting side includes means for encrypting content data with a content file creation tool to create a content file, and means for distributing the content file. There is. The receiving side also includes a file storage unit that stores the acquired content file, and a verification unit that verifies whether the content file stored in the file storage unit is created by a valid content file creation tool. And a registration unit for registering a content file determined to be valid for the verification.

  Further, the content file producing side extracts the partial data from the content file and gives a digital signature to the partial data, and the mobile device side extracts the same partial data as the partial data from the received content file, Another feature is that the digital signature is verified and a predetermined service is provided to the content file determined to be valid.

  According to these features, the content file creator can be authenticated on the mobile device side, so that the mobile device provides a predetermined service only to a content file created using a legitimate content creation tool. Will be able to do it.

  The present invention also includes a step of partially extracting data at a predetermined position from a data portion of a content file without a signature, a step of applying a hash function to the extracted data, and a step of obtaining a hash value. To provide a program for producing a content file, comprising the steps of: encrypting a hash value with a secret key and attaching the hash value to a header portion of the content file; and attaching a public key and a public key certificate to the header portion. There is a second feature in the above point.

  According to this feature, a content file having data that can be authenticated by a content file creator can be provided with a small calculation amount.

  The present invention also includes a step of determining whether or not a received content file has a digital signature, a step of authenticating a public key certificate using a root certificate if the digital signature is present, and a step of performing authentication. Decrypting the authentication data encrypted with the secret key using the public key to obtain a first hash value; and determining predetermined partial data from the data portion of the received content file. Extracting, applying a hash function to the partial data to calculate a second hash value, and determining whether the first and second hash values match. Providing a predetermined service, and, in the case of a mismatch, not providing the predetermined service. There are other features in that so as to provide yl author authentication program.

  According to this feature, on the mobile device side, it can be verified whether or not the received content file is created by a legitimate content file creation tool without communicating with the content file creation side, And the verification can be provided with a small amount of calculation.

  Further, according to the present invention, the content file creator side attaches the authentication data created by the information that only the content file creator can know to the content file, and the mobile device side acquires the authentication data in the acquired content file. Another feature is that it is verified whether or not the content file is provided, and when the verification is established, a predetermined service is provided to the content file.

  According to this feature, the mobile device can provide a predetermined service only to a valid content file. Further, the mobile device can verify whether or not the received content file is created by a legitimate content file creation tool without communicating with the content file creation side.

  According to the present invention, a predetermined service can be provided only for a content file created using a legitimate content creation tool. Conversely, providing a predetermined service to a content file created using an unauthorized content creation tool, for example, a content file created using a pirated tool can be prevented.

  Further, since the digital signature is performed on the partial data of the content file, the digital signature can be performed with a small amount of calculation. Alternatively, without using a digital signature, the validity of a content file can be determined using authentication data created based on information that can be known only by a content file creator.

  Further, the mobile device can verify whether or not the content file is created by a legitimate content file creation tool without communicating with the content file creation side.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a schematic system diagram of a multimedia content file providing service for mobile phones to which the present invention is applied.

  On the content file transmission side (production side), a certain hardware key 2 (secret information possessed only by the production side) is applied to the content data, for example, the music source 1, to perform an encryption process 3 to obtain a content file 4. . That is, the transmitting side (producing side) encrypts the content data with its own content file producing tool and creates the content file 4.

  On the other hand, on the receiving side (mobile device side), the content file 4 is downloaded and temporarily stored in the file storage unit 11. The verification unit 12 verifies whether or not the downloaded content file has been produced by a valid production tool. If it is verified that the content file has been produced by the valid production tool, the verification unit 12 outputs the content file 4 The information is registered in the registration unit 13 and provided to the user. For example, a function of reproducing the music source 1 is provided to the user. On the other hand, if the verification unit 12 does not verify that the downloaded content file has been produced by a valid production tool, the content file 4 is not provided to the user.

  Next, a first embodiment of the present invention will be described. In a normal digital signature, a hash value is calculated for the entire content data, and a signature value is obtained by encrypting the hash value with a secret key. This is to ensure that the content data has not been tampered with anywhere.

  On the other hand, in the first embodiment of the present invention, it is ensured that the creator of the content file has a legitimate private key, or the content file producing tool has a legitimate private key. The purpose is to certify that the content data itself is correct, that is, whether the content data itself has been falsified, in other words, the authenticity of the entire content data is not a concern.

  First, a method of the encryption processing executed in the encryption processing 3 will be described. The provided content data includes video data, audio data, video / audio data, and the like in addition to the music source 1.

  As shown in FIG. 2, partial data A1, A2, A3,... Are extracted from the content data A, and a hash value is calculated by applying a hash function thereto. Next, authentication data obtained by digitally signing the hash value using a secret key is obtained.

  Next, the authentication data is embedded in an appropriate storage location of the header portion shown in FIG. 3, that is, in an appropriate field (atom). FIG. 3 shows an example of the format of the content file 4. The content file 4 includes a header portion and a data portion. Also, the public key paired with the secret key is embedded in the atom. Further, a public key certificate for authenticating the validity of the public key is embedded in the atom. This public key certificate is a certificate authenticated by a root certificate held inside the mobile phone.

  Here, the positions of the data A1, A2, A3,... Extracted from the data portion are determined in advance between the production side and the mobile phone. For example, it is determined in advance that the data is 1 kbytes from the beginning of the data or that data is extracted every 10 bytes, one byte at a time, until the total is 5 kbytes.

  FIG. 4 is a flowchart illustrating a program or operation on the production side (transmission side). In step S1, a content file without a signature, for example, the music source 1 is created. In step S2, data (for example, the data A1, A2, A3) is partially extracted from the data portion. In step S3, a hash function is applied to the extracted data to obtain a hash value. In step S4, the hash value is encrypted with a secret key to create authentication data to which a digital signature has been added. Embed in Atom. In step S5, the public key paired with the secret key is also embedded in the atom, and a public key certificate for authenticating the validity of the public key is also embedded in the atom. In step S6, upload to the server.

  Next, a program or process on the mobile phone side (mobile device side) will be described with reference to FIG. The mobile phone verifies the digital signature. In step S11, it is determined whether or not the content file downloaded from the server has a signature. That is, it is verified whether or not the authentication data is included in the header. If there is a signature, the process proceeds to step S12, and the public key certificate in the content file (see FIG. 3) is authenticated using the root certificate in the mobile phone. If there is no signature in the content file, the process proceeds to step S18, and the predetermined service is not provided.

  If the authentication in step S12 is correct, the process proceeds to step S13, and using this public key, the authentication data encrypted with the secret key is decrypted to obtain a hash value. That is, the hash value calculated on the production side (transmission side) is extracted. If the authentication in step S12 is incorrect, the process is stopped. In step S14, predetermined partial data at the same position as the production side, that is, partial data shared with the production side (for example, the data A1, A2, A3) is extracted from the data portion of the content file. Then, in step S15, a hash function is calculated by applying a hash function to the extracted partial data.

  In step S16, it is determined whether or not the hash values obtained in steps S13 and S15 match. If they match, the digital signature has been verified. If the determination in step S16 is affirmative, the process proceeds to step S17, where a predetermined service, for example, audio reproduction is performed. On the other hand, if they do not match, it means that the digital signature has not been verified, and the process proceeds to step S18, where the predetermined service is not performed.

  According to the above-described first embodiment, since the digital signature is performed on the partial data of the content file, the digital signature can be performed with a small amount of calculation.

  Further, the mobile device can verify whether or not the content file is created by a legitimate content file creation tool without communicating with the content file creation side. Also, a predetermined service can be provided only for a content file created using a legitimate content creation tool. Conversely, providing a predetermined service to a content file created using an unauthorized content creation tool, for example, a content file created using a pirated tool can be prevented.

  Next, a second embodiment of the present invention will be described with reference to FIGS. In this embodiment, the mobile device verifies whether the received content file is created using a legitimate content creation tool, and converts the received content file into a content file created using a legitimate content creation tool. Only a predetermined service is provided for the service. In this embodiment, the processing is performed without using a digital signature.

  With reference to FIG. 6, the process on the transmission side (production side) of the content file will be described. First, the transmitting side has in advance secret information 21 and an arithmetic expression 22 that can be known only by the content file creator, and the secret information 21 and the arithmetic expression 22 are stored on the receiving side (mobile device side). It is assumed that it is stored in advance in a means (not shown). For example, it is assumed that prior to shipment of the mobile device, the secret information 21 and the arithmetic expression 22 are stored in a memory of the mobile device such as a mobile phone in advance by a manufacturer of the mobile device.

  As shown in FIG. 6, the transmitting side performs a predetermined operation (for example, a scramble operation) on the content data B such as a music source using the secret information 21 using the arithmetic expression 22 and performs authentication. Get data. Next, the authentication data is stored in the header of the content file 23, and the content file 23 is distributed to a mobile device such as a mobile phone.

Next, the operation of the mobile device such as a mobile phone will be described with reference to the flowchart of FIG.
The mobile device receives or downloads the content file and stores the content file in the file storage unit 11 (see FIG. 1). Next, in step S21, it is determined whether or not authentication data exists in the header of the content file. If the determination is negative, the process proceeds to step S26 to perform processing for not providing a predetermined service.

  On the other hand, if the determination in step S21 is affirmative, the process proceeds to step S22, where the authentication data is extracted from the header of the content file. Next, the process proceeds to step S23, where a predetermined operation is performed on the data in the content file using the secret information and the operation formula stored in advance to generate authentication data. In step S24, it is determined whether or not the authentication data extracted in step S22 matches the authentication data generated in step S23. If the determination is affirmative, that is, if the authentication data matches, the process proceeds to step S25 to provide a predetermined service. I do. On the other hand, if the determination is negative, the process proceeds to step S26.

  According to the second embodiment, it is possible to verify whether or not the content file is created by using a legitimate content creation tool without using a digital signature. Only the predetermined service can be provided. Further, the mobile device can verify whether or not the received content file is created by a legitimate content file creation tool without communicating with the content file creation side.

  In each of the above embodiments, the program or operation according to the present invention has been described with reference to the flowcharts of FIGS. 4, 5, and 7, but these processes are provided on the content file producing side and the mobile device side. It can be executed by a computer or a microcomputer (CPU). It is clear that these procedures can be variously modified without departing from the spirit of the present invention.

FIG. 1 is a block diagram illustrating a schematic system configuration of the present invention. FIG. 3 is an explanatory diagram of an example of a digital signature according to the first embodiment of the present invention. FIG. 3 is an explanatory diagram illustrating a configuration example of a content file. 5 is a flowchart illustrating a content file production program. It is a flowchart which shows the content file creator authentication program of a mobile device. It is an explanatory view of an example of authentication data addition in a 2nd embodiment of the present invention. 5 is a flowchart illustrating a content file creator authentication program on the mobile device side. It is a figure which shows the conventional challenge response procedure.

Explanation of reference numerals

1 ... Music source, 2 ... Hardware key, 3 ... Encryption processing, 4 ... Content file, 11 ... File storage unit, 12 ... Verification unit, 13 ... Registration Department.

Claims (16)

Means for encrypting content data with a content file creation tool and creating a content file;
Means for distributing the content file. A file storage unit for storing the acquired content files,
A verification unit that verifies whether the content file stored in the file storage unit is created by a valid content file creation tool,
A registration unit for registering the content file whose verification is determined to be valid,
A content file creator authentication method for providing a predetermined service to the content file registered in the registration unit. The transmitting side includes means for encrypting content data with a content file production tool, creating a content file, and means for distributing the content file.
The receiving side, a file storage unit that stores the obtained content file, a verification unit that verifies whether the content file stored in the file storage unit is created by a legitimate content file creation tool, A registration unit for registering the content file whose verification is determined to be valid,
A content file creator authentication method for providing a predetermined service to the content file registered in the registration unit. On the mobile device side, the previously notified partial data is extracted from the acquired content file, the digital signature is verified using the partial data, and for the content file for which the verification is determined to be valid, A content file creator authentication method that provides a predetermined service. The transmitting side extracts the partial data from the content file, attaches a digital signature to the partial data,
The mobile device extracts the same partial data as the partial data from the acquired content file, verifies the digital signature, and provides a predetermined service to the content file for which the verification is determined to be valid. Content file creator authentication method. In the content file creator authentication method according to claim 5,
A content file creator authentication method in which a method of extracting partial data from the content file is shared between the transmission side and the mobile device side. In the content file creator authentication method according to claim 5 or 6,
The content file has a structure having a header portion and a data portion, extracts partial data from the data portion, applies a digital signature to the data, and stores the digital signature in a storage location provided in the header portion. File creator authentication method. In the content file creator authentication method according to claim 7,
A content file creator authentication method in which a public key and a public key certificate corresponding to a digital signature are added to the header. Partially extracting data at a predetermined position from the data portion of the unsigned content file;
Obtaining a hash value by applying a hash function to the extracted data;
Encrypting the hash value with a secret key and adding the hash value to the header of the content file;
Assigning a public key and a public key certificate to the header section. Determining whether the received content file has a digital signature;
Authenticating the public key certificate using the root certificate if the digital signature is present;
When the authentication is performed, using the public key, decrypt the authentication data encrypted with the secret key, and obtain a first hash value;
Extracting predetermined partial data from the data portion of the received content file;
Applying a hash function to the partial data to calculate a second hash value;
Determining whether the first and second hash values match;
A content file creator authentication program for a mobile device, comprising the steps of: providing a predetermined service if they match, and not providing the predetermined service if they do not match. On the mobile device side, verify whether or not the acquired content file is provided with authentication data created by information that can only be known by the content file creator,
A content file creator authentication method for providing a predetermined service to the content file when the verification is successful. The content file creator authentication method according to claim 11,
The information that only the content file creator can know is secret information and an arithmetic expression, and the mobile device generates authentication data from the acquired content file using the secret information and the arithmetic expression, and A content file creator authentication method, wherein the verification is performed by comparing with authentication data given to the content file creator. The content file creator gives the content file the authentication data created based on information that only the content file creator can know,
The mobile device verifies whether or not the authentication data has been added to the acquired content file, and, if the verification is successful, provides a predetermined service to the content file. File creator authentication method. 14. The content file creator authentication method according to claim 13,
The information that only the content file creator can know is secret information and an arithmetic expression, and the mobile device generates authentication data from the acquired content file using the secret information and the arithmetic expression, and A content file creator authentication method, wherein the verification is performed by comparing with authentication data given to the content file creator. In the content file creator authentication method according to claim 13 or 14,
A content file creator authentication method, wherein the mobile device stores in advance information that only the content file creator can know. Determining whether the received content file is provided with authentication data;
When the authentication data is provided, performing a predetermined operation on the content file using secret information that can only be known by the content file creator, and generating authentication data;
Determining whether or not the authentication data given to the received content file matches the generated authentication data;
A content file creator authentication program for a mobile device, comprising the steps of: providing a predetermined service if they match, and not providing the predetermined service if they do not match.

Images