JP2007266938A - Digital stream data communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology of simplifying data transmission between a transmission source of digital stream data and a data receiver via a network while ensuring the versatility and the protection of the copyright. <P>SOLUTION: In a digital data decryption system 100, a decryption circuit apparatus 200 is interposed between a host system 300 and the network NT in the case of receiving transmission of digital contents from a transmission sender DS. The decryption circuit apparatus 200 decrypts encrypted digital contents, transmits the decrypted digital contents to the host system 300 via a video stream interface 402, and transmits the encrypted digital contents to the host system 300 via a two-way bus 400. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to data communication involved in data communication by being interposed between a network serving as a transmission path for digital stream data and a data receiving device receiving data.

  In recent years, data transmission technology in a network has advanced, and a technology for transmitting digital data such as video and music in a compressed digital format via the network has been developed. For example, in a network standard called IEEE 1394, DTCP (Digital Transmission Content Protection) technology is adopted and copyright protection measures (content protection) of digital data are taken.

  The above-described IEEE 1394 lacks versatility because it is necessary to connect digital data transmission / reception devices with a dedicated transmission line, and therefore various attempts have been made to achieve both versatility and copyright protection ( For example, see Patent Document 1).

JP 2004-186812 A

  In this patent document, the versatility of data transmission is improved by using a wireless LAN as a data transport path and performing DTCP processing at each of the wireless data transmission source and reception destination.

  In addition, since the Internet using IP (Internet Protocol) technology for data transmission is highly versatile in data transmission, an approach for protecting the copyright on the Internet has been made, and data serving as a substitute for DTCP in IEEE 1394 is also used. Transfer has been proposed as DTCP-IP (Digital Transmission Content Protection over Internet Protocol). This DTCP-IP deploys the DTCP of the content protection standard mounted on the digital interface such as IEEE1394 on the IP network, and enables both versatility and copyright protection.

  However, in DTCP-IP based on IP technology, it is indispensable to support a high-level network protocol by a network control part for digital data stream transmission. Therefore, a digital device that receives digital data via the Internet requires a high-speed computation-compatible CPU and advanced operation software (OS) that can support advanced network protocols.

  In addition, on the digital device side receiving digital data via the Internet, not only is it compatible with the network protocol, but also decryption of encrypted data, key exchange for decryption and management, and communication partner device It is also necessary to manage certificates that prove validity. Management of keys and certificates requires a dedicated integrated circuit designed with security in mind, and also requires support by ROMized firmware that increases the difficulty of decryption. For this reason, it is necessary to provide firmware that cannot be decrypted and to implement a memory that can be accessed confidentially using a dedicated bus, which also contributes to the complexity of devices that handle digital stream data transmission. It was. Furthermore, since it is necessary to perform processing such as data decoding in cooperation with data transmission, it is inevitable that the system design is complicated in a device equipped with a CPU or OS that supports high-speed computation.

  An object of the present invention is to ensure versatility of data transmission with a simple configuration when digital stream data is transmitted via a network between a transmission source of digital stream data and a data receiving device of the data.

  In order to solve at least a part of such problems, the data communication circuit of the present invention receives a network serving as a transmission path for digital stream data (hereinafter referred to as DS data for the sake of simplicity) and DS data. In intervening between the data receiving device and involved in data communication between the network and the data receiving device, on the data receiving device side, a bidirectional bus connected to the data receiving device, A digital stream data transmission interface (hereinafter referred to as a DS data transmission interface for simplification of description) is provided, and a bidirectional data communication unit connected to the network is provided for the network. The bidirectional bus communicates data bidirectionally with the data receiving device. The DS data transmission interface transmits DS data to the data receiving device. That is, the data communication circuit of the present invention performs data communication with the data receiving device by two systems of the bidirectional bus and the DS data transmission interface. The bidirectional data communication unit achieves bidirectional data transmission between the data receiving device and the network via the bidirectional bus according to the protocol of the data receiving device. As a result, the data receiving device can issue a transmission request for encrypted DS data provided by the transmission source to the transmission source in accordance with its own protocol. It is transmitted to the source via the bus and network.

  The data communication circuit of the present invention performs authentication for descrambling with the transmission source by the authentication unit in preparation for transmission of the encrypted DS data that is encrypted and provided by the transmission source. In addition, when there is a transmission request for the encrypted DS data from the data receiving device side to the transmission source, the decryption unit transmits the encrypted DS data transmitted from the transmission source, Decoding is performed based on the authentication performed with the transmission source. The data communication circuit according to the present invention further includes a data transmission control unit, and the data transmission control unit transmits the encrypted DS data transmitted from the transmission source via the bidirectional bus to the data reception device. And the decrypted DS data is transmitted to the data receiving device via the DS data transmission interface.

  The data receiving device receives the encrypted DS data and the decrypted DS data, and confirms the reception of the encrypted DS data of the transmission source requested to the transmission source according to its own protocol. However, the decrypted DS data can be reproduced. In other words, the data receiving device only needs to issue a transmission request according to its own protocol and does not require decryption of the encrypted DS data that matches the transmission request. Can be simplified. On the other hand, with regard to copyright protection, the data communication circuit of the present invention performs authentication with a transmission source in preparation for transmission of encrypted DS data and decrypts the encrypted DS data based on the authentication. As a result, high reliability can be obtained for copyright protection.

  In addition to the data communication circuit, the present invention can be applied to a data reproduction device having the data communication circuit, a data receiving device, and a data reproduction device, and a data communication device that also performs data reproduction.

  Hereinafter, embodiments of the present invention will be described based on examples. FIG. 1 is a block diagram showing a schematic hardware configuration of the digital data decoding system 100, and FIG. 2 is a functional block diagram of the digital data decoding system 100.

  The digital data decoding system 100 according to the present embodiment is configured to receive DS data, for example, video stream data, from a digital data transmission source DS via a network NT and reproduce the video. In this case, digital data transmission is performed according to a file transfer protocol defined by the network NT. If the network NT is the Internet, the TCP / IP (Transmission Control Protocol / Internet Protocol) is used by using the HTTP protocol (Hyper Text Transfer Protocol). It is done according to.

  The digital data decoding system 100 includes a decoding circuit device 200 corresponding to the data communication circuit of the main part of the present invention, and a host system 300 that receives DS data from the network NT via the decoding circuit device 200. . The host system 300 includes a control unit 301 that performs various controls such as video stream data reception control and video playback control, a video playback unit 310, and an input source switching unit 311. The video reproduction unit 310 includes a video decoder 312, and the video decoder 312 receives the control signal from the control unit 301 and converts the DS data from the source switched by the input source switching unit 311 into the reproduction data of the video reproduction unit 310. Decode. The video reproduction means 310 can exemplify a television video apparatus as a specific device, and reproduces data decoded by the video decoder 312. As a source in this case, in addition to a decryption circuit device 200 to be described later, there is a DS data providing destination without copyright protection, for example, a data providing device using a tuner or IEEE1394. As DS data to be played back by the video playback means 310, for example, MPEG-TS (Motion Picture Expert Group-Transport Stream) data defined by IEEE 13818 can be used, and the video decoder 312 in this case is used. Uses an MPEG-2 decoder.

  The control unit 301 forms the basis of control of the host system 300, and includes a CPU 301a that executes logical operations, a ROM 301b that stores programs necessary for performing data transmission and the like described later, and temporary reading and writing of data. A hard disk controller 301d that controls the hard disk 301e, an external device controller 301f that controls the external device by transmitting data to the external device such as the video decoder 312 described above, and decoding that will be described later A communication port 301g is also provided to connect to the circuit device 200 and perform data transmission with the device. The CPU 301a, the ROM 301b, and the like cooperate to configure a host OS, which will be described later, and a content reproduction control unit 321 included therein.

  The decoding circuit device 200 is interposed between the host system 300 and the network NT and performs data transmission and data decoding described later. The decoding circuit device 200 constitutes a network layer and forms a MAC (Media Access control) layer 201 of the layer. A PHY (Physical layer) layer 202 is provided. A functional configuration of the decoding circuit device 200 will be described later.

  Next, a functional configuration of the host system 300 will be described. As shown in FIG. 2, the host OS of the host system 300 forms the backbone of the system in the host system 300 and controls the decoding circuit device 200 via a bidirectional bus 400 described later. The host OS includes content reproduction control means 321, video source switching means 322, and content selection means 323. The content reproduction control unit 321 performs reproduction control such as start / end / interruption of data reproduction in the video reproduction unit 310 based on a key operation or a mouse operation (not shown) by the user. The video source switching unit 322 selects a source that is connected to the input source switching unit 311 and can transfer data, and performs data transfer from the selected source. In this case, the source is selected based on a key operation and a mouse operation (not shown) by the user, and also based on the status of digital content acquisition via the bidirectional bus 400 described later. The content selection unit 323 is connected to the network NT to select a transmission source DS that transmits DS data, and to select a DS data provided by the selected transmission source DS. Based on the operation.

  The host OS includes a network protocol stack 331 and a network device driver 333 configured by the cooperation of the CPU 301a and the ROM 301b described above. The network protocol stack 331 has a UPnP (Universal Plug and Play) stack 332. Since the network device driver 333 is connected to the decoding circuit device 200 via the bidirectional bus 400, the decoding circuit device 200 forms a network layer and includes the MAC layer 201 and the PHY layer 202 of the layer. Since the network device driver 333 is mounted corresponding to the network layer configured by the decryption circuit device 200, the decryption circuit device 200 is recognized as a network interface by the host OS, and the host OS transmits and receives IP packets. Take on. That is, data transfer from the host OS of the host system 300 is performed to the decoding circuit device 200 via the network device driver 333 and the bidirectional bus 400 in accordance with the protocol defined by the network protocol stack 331. Therefore, the host OS can communicate with the transmission source DS using the existing network protocol via the existing network NT to which the decoding circuit device 200 is connected.

  The plug-n-play technology that the UPnP stack 332 of the network protocol stack 331 provides is mutually connected by connecting devices such as personal computers, peripheral devices, audio-visual devices (AV devices), telephones, and home appliances over a network. It is a technical specification proposed to meet. Therefore, the host system 300 having the host OS constituting the UPnP stack 332 acquires content information by the above plug and play technology of the UPnP stack 332 for the purpose of specifying the digital content (DS data) provided by the transmission source DS. can do. This is because the information of digital content (for example, video content) of the transmission source DS is exchanged with XML (extensible Markup Language) by exchanging with the transmission source DS of the SOAP (Simple Object Access Protocol) action issued by the UPnP stack 332. It means that the digital data decoding system 100 which is the transmission destination can receive it in a format.

  In this embodiment, assuming that the network NT is the Internet, the network protocol stack 331 implements the http protocol as its transmission protocol. Therefore, the network protocol stack 331 configured by the host OS issues http get, which is an http protocol communication command, in the session layer above the network layer, and sequentially acquires digital content (for example, stream data).

  The decoding circuit device 200 includes a bidirectional bus 400 having bidirectional data addresses and a video stream interface 402 (hereinafter referred to as video stream I / F 402) for transmitting video stream data such as MPEG-TS data. Bidirectional data transfer with the host system 300 via the bidirectional bus 400 and data transfer (video stream data transfer) from the decoding circuit device 200 to the host system 300 side via the video stream I / F 402 . Since the data transfer partner of the decoding circuit device 200 is the host system 300 having the above-described configuration, the bidirectional bus 400 includes, for example, a PCI bus (Peripheral Components Interconnect bus), a USB bus (Universal Serial Bus), IEEE1394, and the like. A bi-directional interface can be used. When the bidirectional bus 400 is used as the USB bus or IEEE1394 bidirectional interface, it is desirable to use a technique for performing data transmission by IP in accordance with the data transmission protocol of the host system 300. As the video stream I / F 402, an SPI (Stateful Packet Inspection) or an SSI (Server Side Include) bus can be used in consideration of MPEG-TS data transmission.

  The decryption circuit device 200 includes a protocol analysis extraction unit 203 and a key exchange unit 204 as an intermediate layer between the MAC layer 201 and the PHY layer 202 in the network layer. The decryption circuit device 200 includes a video transmission unit 230 involved in transmission of video stream data via the video stream I / F 402, a decryption unit 231, a decryption engine 232, and a program related to copyright protection measures. A storage internal ROM 233, a device certificate 234 stored in the ROM, and an encryption data storage internal RAM 235 are provided.

  The protocol analysis extraction unit 203 selectively analyzes a file transmission protocol and extracts video stream data such as MPEG-TS data transmitted according to the protocol. The decryption engine 232 includes a decryption circuit related to decryption of the encrypted data. The decryption unit 231 decrypts the video stream data extracted by the protocol analysis extraction unit 203 when the video stream data has been encrypted for copyright protection. The engine 232 is used to decrypt the encryption. The decryption engine 232 uses, as a decryption circuit, a decryption circuit that decrypts an AES (Advanced Encryption Standard) cipher defined as an encryption standard through an authentication key exchange, and a mathematical expression called an elliptic curve while adopting a public key cryptosystem. The decryption circuit of the elliptic curve encryption based on the special addition method defined by

  The video sending unit 230 sends the combined video stream data to the input source switching unit 311 of the host system 300 via the video stream interface 402. The key exchange unit 204 exchanges an authentication key necessary for decrypting the data by the decryption unit 231 with the transmission source DS that is an encryption source of the data, and the transmission source DS uses the encryption key. Earn the authentication key you had. That is, the decryption circuit device 200 performs key exchange (AKE: Authenticated Key) in accordance with, for example, the DH method (Diffie-Hellman key exchange method) when performing the authentication key exchange by the key exchange unit 204 prior to transmission of the encrypted video stream data. Exchanger) uses the discrete logarithm problem to transmit / receive the public information generated from the random number and the secret key to / from the transmission source DS instead of the secret key itself. Accordingly, the decryption circuit device 200 can share the authentication key with the transmission source DS, and holds the authentication key acquired from the transmission source DS in the internal RAM 235 for storing encrypted data.

  Such an AKE procedure is performed by DTCP-IP. The DTCP-IP exchanges authentication keys by the DH method based on the device certificate 234 stored and stored in the internal ROM 233 for storing programs. As described above, it is preferable to use the device certificate 234 at the time of key exchange, so that it can be authenticated that it is a legitimate decryption circuit device 200 that is not impersonated when viewed from the data transmission source DS side. The AKE operation is performed continuously from the time when the port and address of a transmission destination (data transmission source DS) included in Protocol Info, which will be described later, are registered in the decoding circuit device 200, and the transmission source that is the transmission destination. Attempted with DS. That is, since the authentication key is updated at regular time intervals to prevent spoofing of the authentication key after authentication, the decryption circuit device 200 continuously performs this AKE operation independently from the host system 300.

  As described above, in the digital data decryption system 100 of this embodiment, authentication key exchange / storage and storage are performed on the decryption circuit device 200 side, and the host OS of the host system 300 is not involved in these. The decryption circuit device 200 decrypts the data using the authentication key included in the http get after acquiring the authentication key by the AKE described above, and decrypts the combined data (video stream data). ) To the host system 300 side via the video stream I / F 402.

  On the other hand, the decryption circuit device 200 does not decrypt not only the normal UPnP communication but also the encrypted stream data, through the MAC layer 201 and the bidirectional bus 400 while being encrypted. To the host OS of the host system 300. That is, when the decryption circuit device 200 transmits data to the host system 300, if the data is encrypted data, the decryption circuit device 200 encrypts the decrypted data (video stream data) that has been decrypted as described above. The converted data (video stream data) is transmitted to the host system 300 via the video stream interface 402 for the former and the bidirectional bus 400 for the latter. Since the host system 300 does not have the authentication key and does not perform decryption as described above, the encrypted data (video stream data) is used as the source of the video source switching unit 322 configured by the host OS. Used for switching timing. In this case, the video stream data is communicated on the bidirectional bus 400, but the video stream data requiring copyright protection measures is merely communicated in an encrypted state. There will be no particular hindrance in terms of sex or copyright.

  Next, digital content (for example, video stream data) acquisition / playback procedures in the digital data decoding system 100 having the above-described configuration will be described. FIG. 3 is an explanatory diagram showing how digital content without encryption is acquired / reproduced and there is no problem in copyright protection, and encrypted digital content is acquired / reproduced from the viewpoint of copyright protection.

  First, acquisition / reproduction of digital content without encryption will be described. The host system 300 transmits data for requesting content information to the transmission source DS via the decoding circuit device 200 in order to obtain information on the specific content desired to be acquired / reproduced from the transmission source DS. This content information inquiry data is transmitted in accordance with a transmission protocol (http protocol) implemented in the network protocol stack 331, passes through the decoding circuit device 200 via the bidirectional bus 400, and reaches the transmission source DS. The transmission source DS receives the content information inquiry data and transmits response data for providing content information to the host system 300 via the decryption circuit device 200.

  The transmission source DS defines, as content information providing data, information sufficient to specify the type of individual content (for example, the type of encrypted / unencrypted content, the type of content, etc.) in the UPnP AV architecture. It is included in Protocol Info and transmitted (response). Protocol Info is protocol information described in XML format, and can be transmitted and received between the transmission source DS and the host system 300 (host OS) via the decryption circuit device 200 by a SOAP action. Therefore, the host system 300 acquires content information through this Protocol Info by the host OS. Specifically, MIME (Multipurpose Internet Mail Extension) type of the content is registered in Protocol Info, and text (text), image (image), video (video) is added to Content-Type which is header information. Therefore, content information such as audio is included, so that content information is acquired. In this embodiment, since it conforms to DTCP-IP, Content-Type is described in accordance with this standard, and information that is content encrypted from the viewpoint of copyright protection is also included. The content information included in such Protocol Info is analyzed by an XML parser in the UPnP stack 332 of the host OS, and whether the content is encrypted stream data or non-encrypted stream data is also determined. Determined.

  Assume that the content inquired from the host system 300 based on the content information provision data from the transmission source DS is unencrypted content. For content income in this case, it is sufficient to specify the content for which income is desired and transmit the data for content acquisition to the transmission source DS. Therefore, the host system 300 issues http get for content income, and transmits it according to the http protocol by the network protocol stack 331. Since this http get passes through the decoding circuit device 200 via the bidirectional bus 400 and reaches the transmission source DS, the transmission source DS receives the http get and receives the corresponding digital content, for example, video stream data, The data is transmitted to the host system 300 via the decoding circuit device 200 according to the network protocol. That is, since the transmission content (for example, video stream data) from the transmission source DS is a non-encrypted content that is not subject to copyright protection, the decryption circuit device 200 performs the analysis by the protocol analysis extraction unit 203. Decryption is unnecessary, no data processing is performed, and the content is simply transmitted to the host system 300 via the bidirectional bus 400. Then, the host system 300 obtains the digital content thus transmitted, and if it is video stream data, it is played back by the video decoder 312 of the video playback means 310.

  Next, a case where the digital content for which the host system 300 desires income is an encrypted digital content will be described. Even in this case, the host system 300 transmits the data for requesting the content information to the transmission source DS via the decoding circuit device 200 as described above, and provides the content information from the transmission source DS. Receive response data. Then, the host system 300 determines from the analysis of Protocol Info by the XML parser in the UPnP stack 332 of the host OS that the digital content corresponding to the current content information query is encrypted stream data.

  During this Protocol Info analysis, the host system 300 acquires a network port and a transmission source address necessary for key exchange (AKE) for decryption, and for the decryption circuit device 200, the acquired network port and A transmission source address is set through the MAC layer 201 via the bidirectional bus 400. This address / port setting can be performed not only by direct communication from the host system 300 side through the bidirectional bus 400, but also by network device control via the network device driver 333. The decryption circuit device 200 returns the address / port setting completion to the host system 300.

  If the host system 300 determines that the digital content desired to be transmitted is encrypted, the video source switching unit 322 determines the input source of the input source switching unit 311 based on the determination, and the decryption circuit device 200 Switch to the video stream interface 402. As described above, there are a plurality of input sources such as a tuner connected to the input source switching unit 311. However, the input source is switched to the video stream interface 402 in preparation for playback of the encrypted content by switching the source based on the above determination. Therefore, if there is data transmission from the video stream interface 402, the data can be reproduced by the video decoder 312 of the video reproduction means 310.

  Following or in parallel with the above-described input source switching, the host system 300 specifies the desired content and receives data indicating content acquisition in order to receive transmission of the encrypted digital content. And an HTTP get including the transmission source address, and this is transmitted by the network protocol stack 331 to the decoding circuit device 200 in accordance with the http protocol. The decryption circuit device 200 that has received the http get via the bidirectional bus 400 prepares for transmission of the encrypted digital content and performs authentication for descrambling (decryption) with the transmission source DS. That is, the decryption circuit device 200 requests the transmission source DS to exchange an authentication key while transmitting an http get including the network port and the transmission source address to the transmission source DS. Specifically, the authentication key necessary for decrypting the data by the decryption means 231 is exchanged between the network port and the transmission source DS specified by the transmission source address by the key exchange means 204 described above, and the The transmission source DS shares the authentication key used for encryption. In this embodiment, since this key exchange (AKE) is a complete authentication, when requesting an authentication key from the decryption circuit device 200 to the transmission source DS, a random number is generated and a public key is transmitted with the device certificate 234 attached. Then, a random number is generated from the transmission source DS side, a device certificate of the transmission source DS is transmitted, and a signed message is exchanged. Through these procedures, an authentication key is shared.

  That is, the decryption circuit device 200 performs the key exchange (AKE) by the key exchange means 204 with complete authentication prior to transmission of the encrypted video stream data, and as described above, the DH method (Diffie-Hellman key exchange). The transmission / reception DS transmits / receives public information (device certificate, signed message) generated from a random number using a discrete logarithm problem and a secret key. Along with this, the decryption circuit device 200 shares the authentication key with the transmission source DS and holds the acquired authentication key in the internal RAM 235 for storing encrypted data.

  When such key exchange (AKE) is completed, the transmission source DS transmits the encrypted digital content to the decryption circuit device 200. Therefore, the decryption circuit device 200 transmits the encrypted digital content received by the protocol analysis extraction means. Analysis is performed according to 203. At this time, the protocol analysis / extraction means 203 selectively analyzes the file transmission protocol as described above and transmits encrypted digital content (for example, MPEG-TS which is encrypted video stream data) transmitted according to the protocol. Data). In this case, whether or not the stream data is encrypted depends on the address and port set in advance between the host system 300 and the decryption circuit device 200 according to the current communication performed with the transmission source DS. It can be recognized by whether it is communication.

  The decryption circuit device 200 then decrypts the extracted encrypted digital content (encrypted MPEG-TS data) using the decryption engine 232, and the decrypted MPEG-TS data includes a video stream. The data is transmitted to the input source switching unit 311 of the host system 300 via the interface 402. Along with the transmission of the decrypted MPEG-TS data, the encrypted MPEG-TS data is also transmitted to the network device driver 333 of the host system 300 via the bidirectional bus 400 as the encrypted MPEG-TS data. . Therefore, the host system 300 reproduces the decoded MPEG-TS data received through the video stream interface 402 by the video decoder 312 of the video reproduction means 310.

  As described above, in the digital data decryption system 100 of the present embodiment, the host system 300 is self-installed in the host OS when transmitting / reproducing encrypted digital content (encrypted MPEG-TS data). The decryption circuit device 200 is responsible for all the decryption of the encrypted digital content (encrypted MPEG-TS data). In addition, the decrypted digital content (decoded MPEG-TS data) is transmitted from the decoding circuit device 200 side to the host system 300 via the video stream interface 402, so that the decrypted digital content is transmitted. The content (decoded MPEG-TS data) is reproduced by the host system 300.

  For this reason, since the host system 300 does not need to decrypt the encrypted digital content (encrypted MPEG-TS data), the versatility is enhanced and the system design can be simplified. On the other hand, with regard to copyright protection, the decryption circuit device 200 authenticates with the transmission source DS in preparation for transmission of encrypted digital content (encrypted MPEG-TS data), and has been encrypted based on the authentication. Since digital content (encrypted MPEG-TS data) is decrypted, copyright protection measures can be taken with high reliability. In this case, the transmission type of the encrypted digital content and the reproduction thereof are not limited to the video content such as MPEG-TS data. For example, even in the case of encrypted digital content such as still images and audio, the transmission request / reproduction is decrypted by the decryption circuit device 200 and the data remains encrypted as in the case of encrypted MPEG-TS data. Data transmission via the bidirectional bus 400 and data transmission via the video stream interface 402 of the decoded data.

  In addition, when receiving data transmission from the transmission source DS, the host OS of the host system 300 transmits unencrypted data if the transmission source DS transmits unencrypted data that does not require copyright protection. Even if it is encrypted data for copyright protection received via the bidirectional bus 400, the data is received via the bidirectional bus 400 without being encrypted. Moreover, the host OS does not need to change the control of the data transmission request depending on the necessity of copyright protection even when such a data transmission request is made. Therefore, since it is possible to control with almost the same procedure without distinguishing between the unencrypted data and the encrypted data, the system design of the host OS for the construction of the content selection means 323 and the like is advanced, and the design load is reduced To do. In addition, the memory capacity for storing the program can be reduced, which is preferable.

  Further, it is sufficient that the host OS has an advanced protocol stack such as a UPnP stack and an XML parser necessary for data transmission with the transmission source DS, and the decoding circuit device 200 needs to include these network protocol stacks. There is no. Therefore, the system design on the decoding circuit device 200 side can be simplified accordingly. In addition, even if the upper layer protocol implemented in the network device driver 333 of the host OS is changed, the protocol of the digital content to be decoded, for example, the MPEG-TS data which is video stream data is not changed. The decoding circuit device 200 does not need to correspond to the upper layer protocol change. Therefore, also from this point, simplification of the entire system design can be achieved.

  In addition, since the device certificate 234 at the time of key exchange in the AKE procedure is stored in the program storage internal ROM 233, reading of the device certificate 234 from the outside can be suppressed. Further, the key exchange process in the AKE procedure can be implemented on the firmware stored in the program storage internal ROM 233 of the decryption circuit device 200, so that it is difficult for the third party to decrypt the algorithm. As a result, access from a third party becomes difficult, which is preferable in terms of securing confidentiality.

  As mentioned above, although the Example of this invention was described, this invention is not restricted to above-described embodiment, In the range which does not deviate from the summary, it is possible to implement in various aspects. For example, in this embodiment, the MAC layer 201 and the PHY layer 202 of the network are configured by the bidirectional bus 400 of the decoding circuit device 200, but it is also possible to cover up to the transport layer. In this case, the network device driver 333 of the host OS only needs to be able to execute socket support such as WinSock (Windows Sockets; Windows is a registered trademark) or BSD (Berkeley Software Distribution) socket.

  Further, the data transmission protocol implemented in the network protocol stack 331 of the host OS has been described as the http protocol. However, the present invention is not limited to this, and data transmission such as rtp (Real-time Transport Protocol) or ftp (File Transfer Protocol) is used. Protocols can also be used.

  In addition, the key exchange in the AKE procedure is a public key exchange method based on the DH method. However, the present invention is not limited to this, and a method in which each authentication key is held in advance between the decryption circuit device 200 and the transmission source DS, or a memory Various key sharing methods such as a key exchange method through mailing of a medium, handing over, etc., a key exchange method through password input, and a key exchange method using a proximity recognition ID by short-range communication such as infrared rays can be used.

  In addition, although the bidirectional bus 400 and the video stream interface 402 are used in combination between the decoding circuit device 200 and the host system 300, the dedicated bus and the video stream interface 402 capable of bidirectional data communication are provided. Alternatively, a dedicated bus that is not specialized for video can be used instead of the video stream interface 402, and the dedicated bus and the bidirectional bus 400 can be used together. A network may be used as the bidirectional bus 400. In this case, the decryption circuit device 200 can be implemented as a network hub or router that decrypts an encrypted video stream. For example, when the decryption circuit device 200 is used as such a network hub or router, it is desirable to perform encryption between the video stream interface 402 and a video decoder that receives data transmission via the interface. For setting addresses and ports to the decryption circuit device 200, for example, a service using UPnP Internet Gateway Device can be extended and used.

  Furthermore, digital data can also be reproduced on the decoding circuit device 200 side. FIG. 4 is an explanatory view showing a modification of the decoding circuit device 200 having a video reproduction function. As shown in FIG. 4, the decoding circuit device 200 includes video reproduction means for receiving data transmission from the video stream interface 402 separately from the host system 300, and the digital content decrypted by the decoding circuit device 200 itself (decrypted). MPEG-TS data). In this way, the result of decryption by the decryption circuit device 200 can be confirmed without using the host system 300. In this case, the data transmission to the video reproduction means of the decoding circuit device 200 itself preferably uses a transmission path with high secrecy of transmission of video / audio / control signals such as HDMI (High-Definition Multimedia Interface).

2 is a block diagram illustrating a schematic hardware configuration of a digital data decoding system 100. FIG. 2 is a functional block diagram of the digital data decoding system 100. FIG. It is explanatory drawing which shows the mode of acquisition / reproduction | regeneration of the digital content which is not used for encryption, since there is no problem in copyright protection, and the digital content encrypted from the viewpoint of copyright protection. It is explanatory drawing which shows the modification of the decoding circuit apparatus 200 which also has a video reproduction function.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Digital data decoding system 200 ... Decryption circuit device 201 ... MAC layer 202 ... PHY layer 203 ... Protocol analysis extraction means 204 ... Key exchange means 230 ... Video transmission means 231 ... Decryption means 232 ... Decryption engine 233 ... Internal ROM for program storage
234 ... Device certificate 235 ... Internal RAM for storing encrypted data
300 ... Host system 301 ... Control unit 301a ... CPU
301b ROM
301c ... RAM
301e: Hard disk 301d: Hard disk controller 301f: External device controller 301g ... Communication port 310 ... Video playback means 311 ... Input source switching means 312 ... Video decoder 321 ... Content playback control means 322 ... Video source switching means 323 ... Content selection means 331 ... Network protocol stack 332 ... UPnP stack 333 ... Network device driver 400 ... Bidirectional bus 402 ... Video stream interface 402 ... Video stream interface (I / F)
DS ... Transmission source NT ... Network

Claims (3)

A data communication circuit that is interposed between a network serving as a transmission path for digital stream data and a data receiving device that receives provision of the digital stream data, and that is involved in data communication between the network and the data receiving device. And
A bidirectional bus connected to the data receiving device and bi-directionally communicating data with the data receiving device;
A digital stream data transmission interface connected to the data receiving device and transmitting digital stream data to the data receiving device;
A bidirectional data communication unit that is connected to the network and achieves bidirectional data transmission between the data receiving device and the network via the bidirectional bus according to a protocol of the data receiving device;
In preparation for transmission of encrypted digital stream data provided by the transmission source of the digital stream data encrypted, an authentication unit that performs authentication for decryption with the transmission source,
When there is a transmission request for the encrypted digital stream data from the data receiving device side to the transmission source, the transmission source receives the transmission of the encrypted digital stream data transmitted from the transmission source. A decryption unit that decrypts the encrypted digital stream data based on the authentication performed between
The encrypted digital stream data transmitted from the transmission source is transmitted to the data receiving device via the bidirectional bus, and the decrypted digital stream data is transmitted via the digital stream data transmission interface. A data communication circuit comprising: a data transmission control unit for transmitting to the data receiving device. A data reproduction device for reproducing the digital stream data received from a digital stream data transmission source via a network serving as a data transmission path,
A data receiving device receiving the digital stream data;
A data reproducing device for reproducing the digital stream data;
A data communication circuit involved in data communication between the network and the data receiving device,
The data communication circuit includes:
A bidirectional bus connected to the data receiving device and bi-directionally communicating data with the data receiving device;
A digital stream data transmission interface connected to the data reproduction device and transmitting digital stream data to the data reproduction device;
A bidirectional data communication unit that is connected to the network and achieves bidirectional data transmission between the data receiving device and the network via the bidirectional bus according to a protocol of the data receiving device;
In preparation for transmission of encrypted digital stream data provided by the transmission source of the digital stream data encrypted, an authentication unit that performs authentication for decryption with the transmission source,
When there is a transmission request for the encrypted digital stream data from the data receiving device side to the transmission source, the transmission source receives the transmission of the encrypted digital stream data transmitted from the transmission source. A decryption unit that decrypts the encrypted digital stream data based on the authentication performed between
The encrypted digital stream data transmitted from the transmission source is transmitted to the data receiving device via the bidirectional bus, and the decrypted digital stream data is transmitted via the digital stream data transmission interface. A data reproduction apparatus comprising: a data transmission control unit that transmits to the data reproduction device. A data communication device that is interposed between a network serving as a transmission path for digital stream data and a data receiving device that receives provision of the digital stream data, and that is involved in data communication between the network and the data receiving device. And
A data reproducing unit for reproducing the digital stream data;
A bidirectional bus connected to the data receiving device and bi-directionally communicating data with the data receiving device;
A digital stream data transmission interface connected to the data reproduction unit and transmitting digital stream data to the data receiving device;
A bidirectional data communication unit that is connected to the network and achieves bidirectional data transmission between the data receiving device and the network via the bidirectional bus according to a protocol of the data receiving device;
In preparation for transmission of encrypted digital stream data provided by the transmission source of the digital stream data encrypted, an authentication unit that performs authentication for decryption with the transmission source,
When there is a transmission request for the encrypted digital stream data from the data receiving device side to the transmission source, the transmission source receives the transmission of the encrypted digital stream data transmitted from the transmission source. A decryption unit that decrypts the encrypted digital stream data based on the authentication performed between
The encrypted digital stream data transmitted from the transmission source is transmitted to the data receiving device via the bidirectional bus, and the decrypted digital stream data is transmitted via the digital stream data transmission interface. A data communication device comprising: a data transmission control unit that transmits to the data reproduction unit.

Images