JP2012191667A - Receiver - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a content distribution system capable of protecting copyright of content by confirming validity of a receiver in a limited reception method.SOLUTION: A content distribution system 1 is characterized in that confidential information for each predetermined group of receivers generated by an authentication information generator 10 is previously registered in the receiver 60 and a security module 70, and the security module 70 authenticates the receiver 60 by determining identity of the confidential information and identity with updated confidential information distributed from a content distribution device 20.

Description

  The present invention relates to a receiving apparatus that prevents unauthorized viewing of content in a conditional access system.

  Currently, broadcast programs in digital broadcasting are encrypted on the broadcaster side (transmission side), and so-called conditional access system (CAS) that enables viewing of the broadcast program only for limited viewers. In general, a receiving device that descrambles (decodes) a scrambled (encrypted) broadcast program (digital content, hereinafter referred to as content) using a security module (CAS card) unique to the receiving device is generally used ( (See Patent Document 1 and Non-Patent Document 1).

  This content is digital data, and when digital copying is performed, the content after copying is exactly the same data as the original content, and has the same image quality in the video. In this case, there is a concern that the content is illegally copied in a high quality state. Therefore, in the past, “one-generation copying is permitted” in which the broadcasting station allows copying of content only once by a copyright protection technology called DTCP (Digital Contents Control Protocol) defined by the Radio Industries Association. Copy control is performed by adding copy control information such as “copy not allowed” that does not permit copying at all, to the content, and using a CAS card to release scramble according to the copy control information.

  Conventionally, when the receiving device outputs (copies) content to the outside, it has a mechanism for performing copy control and scrambling by DTCP on the content, and for devices that have been certified to comply with this mechanism Only a CAS card was issued.

JP 2007-036625 A

"Access Control Method for Digital Broadcasting (ARIB STD-B25)" 4.1, Revised on June 5, 2003

  In the conventional conditional access system, it is assumed that the CAS card is issued to a receiving apparatus incorporating a mechanism for performing copy control and scrambling by DTCP. In the conventional conditional access system, since the CAS card has tamper resistance, confidential information for decrypting the content in the receiving device is written only in the CAS card. For this reason, even a CAS card issued to another receiving device can be used independently by another receiving device.

  In this way, if content can be decrypted using a CAS card issued to another receiving device, if a receiving device that does not have a mechanism such as DTCP is illegally manufactured, the receiving device also The content can be decrypted. For this reason, in the conventional conditional access system, it becomes possible to invalidate the limit on the number of copies by a receiving device that does not have a mechanism such as DTCP, and the copyright of the content cannot be properly protected. There is.

  The present invention has been made in view of the above problems, and a receiving apparatus capable of protecting the copyright of content by confirming the validity of the receiving apparatus in a conditional access system. The purpose is to provide.

  The present invention has been created to achieve the above object. First, the receiving device according to claim 1 associates a unique identifier for each predetermined group unit of the receiving device, and performs the reception. Secret information generating means for generating group unit secret information that is information for authenticating the authenticity of the device, and the same key as the key stored in the security module in the receiving device that performs reception control by the conditional access method And encrypting the group unit secret information to generate encrypted group unit secret information for registration in the receiving device, and when updating the group unit secret information, the identifier And update information combining means for generating group unit update information by combining the group unit secret information and the updated group unit secret information. A key generator for generating encryption key information by encrypting the key information with a work key in a conditional access method, and a key synthesizing unit for generating key information obtained by adding a scramble key to the group unit update information A content distribution device comprising: an information encryption unit; and a content encryption unit that generates encrypted content by encrypting the content with the scramble key; and a reception device that receives and reproduces the encrypted content. And receiving the key information transmitting means, the secret information storing means, the secret information transmitting means, the secret information authentication response means, the key receiving means, and the content decrypting means. It was set as the structure provided.

  In such a configuration, the reception device transmits the encryption key information generated by the content distribution device to the security module by the key information transmission unit. The encryption key information is used in the security module to determine the validity of the receiving device.

  Further, the receiving device stores in advance the group unit secret information and the encrypted group unit secret information generated by the authentication information generation device together with the identifier in the secret information storage unit. Then, the reception apparatus transmits the encrypted group unit secret information including the update information stored in the secret information storage unit to the security module together with the identifier by the secret information transmission unit. The encrypted group unit secret information is used in the security module to determine the validity of the receiving device.

  Further, the reception device generates response information by using the secret information authentication response unit as a key with respect to the challenge information for authentication transmitted from the security module using the group unit secret information stored in the secret information storage unit as a key, Send to the security module. As a result, the security module can perform authentication by the challenge (/ response) authentication method using the group unit secret information as a key.

  Then, the receiving device receives the scramble key output as a result of authentication based on the encrypted group unit secret information and the response information from the security module by the key receiving means. Then, the receiving device decrypts the encrypted content using the scramble key by the content decrypting means. As a result, the content can be decrypted only by the receiving device whose validity is authenticated.

  The receiving device according to claim 2 is information for authenticating the validity of the receiving device by associating a unique identifier for each predetermined group unit of the receiving device. Secret information generating means for generating group unit secret information that is secret information for registration, and when the group unit secret information is updated, the identifier, the group unit secret information, and the updated group unit secret information are An authentication information generating device comprising: update information combining means for generating combined group unit update information; key combination means for generating key information in which a scramble key is added to the group unit update information; Key information encryption means for generating encryption key information by encrypting the key information with a key, and encrypting content with the scramble key A content distribution device comprising: a content encryption unit that generates encrypted content, and a reception device that receives and reproduces the encrypted content, wherein the reception device is a key An information transmission unit, a secret information storage unit, a secret information authentication response unit, a key reception unit, and a content decryption unit are provided.

  In such a configuration, the reception device transmits the encryption key information generated by the content distribution device to the security module by the key information transmission unit. The encryption key information is used in the security module to determine the validity of the receiving device.

  Further, the receiving device stores the group unit secret information generated by the authentication information generating device together with the identifier in the secret information storage unit in advance. Then, the receiving device generates response information with the group unit secret information stored in the secret information storage means as a key for the challenge information for authentication transmitted from the security module by the secret information authentication response means, Send to the security module. As a result, the security module can perform authentication by the challenge authentication method using the group unit secret information as a key.

  Then, the receiving device receives a scramble key output as a result of authentication based on the response information from the security module by the key receiving means. Then, the receiving device decrypts the encrypted content using the scramble key by the content decrypting means. As a result, the content can be decrypted only by the receiving device whose validity is authenticated.

The present invention has the following excellent effects.
Conventionally, only the CAS card (security module) holds secret information for decrypting content. In the present invention, both the receiving device and the security module hold group unit secret information that becomes secret information. is doing. For this reason, according to the present invention, the security module can authenticate with the receiving device using the group unit secret information. This makes it possible to investigate which group (for example, model, manufacturer) of the information on the receiving device has been leaked even if the confidential information (group unit secret information) of the receiving device has been illegally leaked. Become.

  Furthermore, according to the present invention, even when the group unit secret information is leaked, the use of the content of the receiving apparatus having the leaked group unit secret information is invalidated by updating the group unit secret information. be able to. Accordingly, the present invention can prevent damage due to leakage of group unit secret information.

It is a block diagram which shows the structure of the content delivery system which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the authentication information generation server which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the content delivery server which concerns on embodiment of this invention. It is a block diagram which shows the structure of the receiver which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the security module which concerns on 1st Embodiment of this invention. It is a flowchart which shows the production | generation operation | movement of the manufacturer secret information in the authentication information production | generation server which concerns on 1st Embodiment of this invention. It is a flowchart which shows the authentication operation | movement using the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) which concerns on 1st Embodiment of this invention. It is a flowchart which shows the update authentication operation | movement of the maker secret information of the receiving device in the user terminal (receiving device and security module) which concerns on 1st Embodiment of this invention. It is a flowchart which shows use stop operation | movement of the receiver at the time of the maker secret information leaking in 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which restarts utilization of a receiver again after revocation operation | movement in 1st Embodiment of this invention. It is a block diagram which shows the whole structure of an unauthorized receiver identification system. It is a block diagram which shows the specific structure of the test module and manufacturer specific apparatus which comprise an unauthorized receiver specific system. It is a block diagram which shows the structure of the content delivery system which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the authentication information generation server in 2nd Embodiment of this invention. It is a block diagram which shows the structure of the receiver which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the security module which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the production | generation operation | movement of the maker secret information in the authentication information production | generation server of 2nd Embodiment of this invention. It is a flowchart which shows the authentication operation | movement using the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) which concerns on 2nd Embodiment of this invention. It is a flowchart which shows the update authentication operation | movement of the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) which concerns on 2nd Embodiment of this invention. It is a flowchart which shows use stop operation | movement of the receiver at the time of the maker secret information leaking in 2nd Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<< First Embodiment >>
[Content distribution system configuration]
First, the configuration of the content distribution system according to the first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration of a content distribution system according to the first embodiment of the present invention.

  The content distribution system 1 is a system that distributes content by a limited reception method, and authenticates the validity of the receiving device 60, thereby enabling the use (reproduction, copying, etc.) of the content in the receiving device 60. Is. Here, the content distribution system 1 includes an authentication information generation server 10, a content distribution server 20, a content server 30, and a transmission device 40 connected to a content distributor (hereinafter referred to as a provider) via an intranet N. And a system for distributing content to a user terminal 50 which is a terminal on the user side of the content via a broadcast wave W.

  The user terminal 50 includes a receiving device 60 and a security module 70 that is inserted into the receiving device 60 and used. Here, only one user terminal 50 is shown, but normally there are a plurality of user terminals 50 that are arranged in a general household.

  In addition to these configurations, the content distribution system 1 generates a configuration for realizing a conditional access method, for example, a key (scramble key, work key, etc.) for performing content encryption, decryption, and the like. A key generation server, a contract information generation server that generates contract information of a user who subscribes to view content, and the like are provided. However, since these configurations are common in the conditional access system, illustration and description are omitted.

  The authentication information generation server (authentication information generation device) 10 uses secret information (group unit secret information) corresponding to the reception device 60 as information for authenticating the reception device 60 of the user terminal 50 for each predetermined group unit. Is generated. The generated secret information is stored in advance in the receiving device 60 by the manufacturer of the receiving device 60 (hereinafter referred to as a manufacturer).

  The group unit secret information is information generated in a certain group unit for identifying the receiving device 60. For example, the group unit secret information may be generated as information for each model of the receiving device 60 or may be generated as information for each manufacturer that generates the receiving device 60. In the present embodiment, the group unit secret information is described as information (maker secret information) generated for each maker of the receiving device 60.

  The content distribution server (content distribution device) 20 encrypts the content and distributes it to the user terminal 50. Here, it is assumed that the content distribution server 20 transmits the encrypted content to the transmission device 40 via the intranet N. Here, the content distribution server 20 acquires the instructed content from the content server 30 when the content to be distributed is instructed.

  Further, when the content distribution server 20 is notified from the authentication information generation server 10 that the model-specific secret information (maker secret information) of the receiving device 60 has been updated, the content distribution server 20 encrypts the updated secret information. It is distributed to the user terminal 50 together with the content that has been converted.

  The content server 30 is a server that accumulates a plurality of contents and transmits requested contents via the intranet N. The content server 30 is, for example, a broadcast VTR device, and transmits content to be distributed as a broadcast program to the content distribution server 20.

  The transmission device 40 transmits the content (including updated secret information) transmitted from the content distribution server 20 via the broadcast wave W. Here, the transmission device 40 sequentially organizes the content transmitted from the content distribution server 20 in accordance with the organization of the broadcast program, and transmits it as a broadcast wave W of digital broadcasting. Here, the transmission device 40 transmits content by the broadcast wave W. However, the content requested by the user terminal 50 may be transmitted via a communication line such as an IP network. .

  The user terminal 50 is a user terminal that uses content, and includes a receiving device 60 and a security module 70.

  The receiving device 60 receives content distributed via the broadcast wave W and uses (plays back, copies, etc.) the content. The receiving device 60 inserts the security module 70 issued to the receiving device 60 into the inside, thereby performing limited reception of content that can be viewed or the like according to a contract. Note that secret information (maker secret information) for identifying a model is registered in the receiving device 60.

  The security module (CAS card) 70 authenticates with the receiving device 60 using manufacturer secret information registered in advance in the receiving device 60, and decrypts the encrypted content based on the authentication result. The key (scramble key) is output to the receiving device 60. The security module 70 is an IC card having tamper resistance, and is detachable from the receiving device 60.

As described above, the user terminal 50 performs authentication between the receiving device 60 and the security module 70, thereby preventing the content from being used by an unauthorized receiving device.
Hereinafter, each configuration of the authentication information generation server 10 and the content distribution server 20 that are devices on the provider side, which is a characteristic feature of the present invention, and a user terminal 50 (a receiving device 60 and a security module 70) that are users' devices ) Will be described sequentially.

(Configuration of authentication information generation server)
First, the configuration of the authentication information generation server will be described with reference to FIG. 2 (refer to FIG. 1 as appropriate). FIG. 2 is a block diagram showing the configuration of the authentication information generation server according to the first embodiment of the present invention. Here, the authentication information generation server 10 includes a secret / update information generation unit 11, a device key generation unit 12, an authentication information storage unit 13, an update information synthesis unit 14, an update information transmission unit 15, and a secret information. The encryption unit 16, the secret information output unit 17, and the device key output unit 18 are provided.

  The secret / update information generation means 11 generates maker secret information (group unit secret information) that is information for authenticating the validity of the receiving device 60 of the user terminal 50 and its update information. Here, the secret / update information generating unit 11 includes an identifier receiving unit 111, a secret information generating unit 112, and a revoke flag receiving unit 113.

  The identifier receiving unit 111 receives a manufacturer identifier (mid) that is an identifier for identifying the manufacturer (group) of the receiving device 60 by an input unit such as a keyboard (not shown). The received manufacturer identifier is output to the secret information generation unit 112 and is written and stored in the authentication information storage unit 13.

The secret information generating unit 112 generates maker secret information (Smid; group unit secret information) registered in the security module 70 and used as information for identifying the manufacturer in association with the maker identifier. Here, when the order in which the maker secret information is generated is specified, a number i indicating the order is added to the maker secret information Smid and expressed as Smid _i . The manufacturer secret information may be in the form of a numerical value, a character string, or the like as long as it is information for identifying the manufacturer. For example, the secret information generation unit 112 generates maker secret information at random using random numbers. The generated manufacturer secret information is written and stored in the authentication information storage means 13.

  The revoke flag receiving means 113 is a revoke flag (r_mid) indicating an instruction as to whether or not to stop (invalidate) the operation of the receiving apparatus 60 corresponding to the maker identifier by an input means such as a keyboard (not shown). ). The revoke flag is a flag indicating that the leaked manufacturer secret information is invalidated when the manufacturer secret information is leaked and an unauthorized receiving device is manufactured. For example, if the manufacturer secret information of a certain manufacturer is to be revoked as the recall period, the revoke flag is set to the value “1”. If the recall period is ended and the revocation is to be canceled, the revoke flag is set to the value “0”. The revocation flag received by the revocation flag receiving means 113 is written and stored in the authentication information storage means 13 in association with the manufacturer identifier.

  The device key generation means 12 generates a device key (Kd) that is a key for decrypting the encrypted manufacturer secret information in the security module 70. The device key may be a key generated by a common encryption key generation algorithm. For example, the device key generation means 12 is a device that uses an algorithm such as DES (Data Encryption Standard) or AES (Advanced Encryption Standard). Generate a key. The generated device key is written and stored in the authentication information storage unit 13.

  The generated device key is registered in common in all the security modules 70, and is written in the security module 70 in advance at the manufacturing stage by the manufacturer of the security module 70.

  The authentication information storage means 13 stores authentication information for authenticating the receiving device 60, and is a general storage device such as a hard disk. Here, the authentication information storage means 13 stores, as authentication information, a manufacturer identifier, manufacturer secret information associated with the manufacturer identifier, and a revoke flag, and further stores a device key. deep.

The update information synthesizing unit 14 synthesizes the authentication information stored in the authentication information storage unit 13 as information (maker update information; group unit update information) for distribution to the receiving device 60 via the broadcast wave. Is. Here, the update information synthesizing unit 14 refers to the revoke flag stored in the authentication information storage unit 13 and generates the manufacturer update information by reading and synthesizing the manufacturer identifier (mid) and the manufacturer secret information (Smid). To do. When the revocation flag is “0”, the update information combining unit 14 generates manufacturer update information (Mup = (mid, Smid _i )) by combining the manufacturer identifier and one manufacturer secret information Smid _i. To do. Further, when the revocation flag is “1”, the update information combining unit 14 combines the manufacturer identifier, the old manufacturer identification information Smid _i−1, and the new manufacturer identification information Smid _i , so that the manufacturer update information (Mup = (Mid, Smid _i-1 , Smid _i )). Note that a plurality (Mup _{0 to} Mup _n ) of manufacturer update information (Mup) is generated for each manufacturer (model) that needs to be updated, that is, for each manufacturer identifier. The generated manufacturer update information is output to the update information transmission means 15.

  The update information transmitting unit 15 transmits the manufacturer update information (Mup) generated by the update information combining unit 14 to the content distribution server 20. The manufacturer update information transmitted to the content distribution server 20 is transmitted to the receiving device 60 via the broadcast wave W.

The secret information encryption unit 16 encrypts the manufacturer secret information (Smid _i ) stored in the authentication information storage unit 13 with the device key (Kd) for each manufacturer identifier (mid). That is, the secret information encryption means 16 obtains encrypted manufacturer secret information (ESmid _i ; encrypted group unit secret information) corresponding to the manufacturer identifier (mid), ESmid _i = ENC (Smid _i , Kd) (where ENC (A, b) indicates that the data a is encrypted with the key b). The generated encrypted manufacturer secret information (ESmid _i ) and the original manufacturer secret information (Smid _i ) are output to the secret information output means 17 in association with the manufacturer identifier (mid). Here, when specifying the order in which the encrypted maker secret information is generated, a number i indicating the order associated with the maker secret information Smid is added to the encrypted maker secret information ESmid, and expressed as ESmid _i. And

The secret information output means 17 outputs the encrypted maker secret information (ESmid _i ) encrypted by the secret information encryption means 16 and the maker secret information (Smid _i ) for each maker identifier (mid). is there. The encrypted manufacturer secret information (ESmid _i ) and the manufacturer secret information (Smid _i ) are registered in advance in the receiving device 60 manufactured by the manufacturer for each manufacturer corresponding to the manufacturer identifier (mid).

  The device key output means 18 reads and outputs the device key (Kd) stored in the authentication information storage means 13. The device key (Kd) is registered in advance in the security module 70 by the manufacturer (distribution company, manufacturing company) of the security module 70.

  By configuring the authentication information generation server 10 in this way, the authentication information generation server 10 can generate different manufacturer secret information for each manufacturer (model). This makes it possible to perform authentication between the manufacturer secret information registered in advance in the receiving apparatus 60 and the manufacturer secret information distributed to the receiving apparatus 60 via the content distribution server 20.

(Content distribution server configuration)
Next, the configuration of the content distribution server will be described with reference to FIG. 3 (refer to FIG. 1 as appropriate). FIG. 3 is a block diagram showing the configuration of the content distribution server according to the embodiment of the present invention. Here, the content distribution server 20 includes a content encryption unit 21, an update information reception unit 22, a key synthesis unit 23, a key information encryption unit 24, a public information synthesis unit 25, and a public information transmission unit 26. It is equipped with.

  The content encryption unit 21 inputs content from a content server (broadcast VTR device or the like) 30 and encrypts it using a scramble key Ks generated by a key generation server or the like (not shown). This encrypted content (encrypted content) is output to the public information synthesis means 25.

  The update information receiving unit 22 receives manufacturer update information (Mup) transmitted from the authentication information generation server 10. The received manufacturer update information is output to the key synthesis means 23.

The key synthesizing unit 23 generates key information in which the scramble key (Ks) is added (synthesized) to the manufacturer update information (Mup) received by the update information receiving unit 22. For example, when there are a plurality (Mup _{0 to} Mup _n ) of manufacturer update information Mup received by the update information receiving unit 22 as many as necessary, the key synthesizing unit 23 includes a scramble key (Ks), By connecting a plurality of manufacturer update information (Mup _{0 to} Mup _n ) in series as in (Ks‖Mup ₀ ‖ ... ‖Mup _n ) (where “‖” indicates concatenation), the key information is obtained. Generate. The generated key information is output to the key information encryption unit 24.

  The key information encryption unit 24 encrypts the key information generated by the key synthesis unit 23 using a work key Kw generated by a key generation server or the like (not shown). The encrypted key information (encrypted key information) is output to the public information combining unit 25.

  The public information synthesizing unit 25 concatenates the key information (encrypted key information) encrypted by the key information encrypting unit 24 to the content encrypted by the content encrypting unit 21 (encrypted content), multiplexes, etc. The public information added (synthesized) by is generated. The public information generated by the public information synthesizing unit 25 is output to the public information transmitting unit 26.

The public information transmission unit 26 transmits the public information generated by the public information synthesis unit 25 to the user terminal 50. The public information output from the public information transmission unit 26 is distributed to the user terminal 50 by the broadcast wave W via the transmission device 40.
By configuring the content distribution server 20 in this way, the content distribution server 20 distributes manufacturer update information (Mup), which is update information, to the user terminal 50 together with the content when the manufacturer secret information is updated. be able to.

(User terminal configuration)
Next, the configuration of the user terminal will be described with reference to FIG. 4 and FIG. In the following, description will be made separately for a receiving device that constitutes a user terminal and a security module that is installed in the receiving device.

[Configuration of receiving device in user terminal]
First, the configuration of the receiving device 60 in the user terminal 50 will be described with reference to FIG. 4 (refer to FIG. 1 as appropriate). FIG. 4 is a block diagram showing the configuration of the receiving apparatus according to the first embodiment of the present invention. Here, the receiving device 60 includes a public information receiving unit 61, a public information separating unit 62, a key receiving unit 63, a content decrypting unit 64, a key information transmitting unit 65, a manufacturer secret information storage unit 66, and a manufacturer. Information transmitting means 67 and secret information authentication response means 68 are provided.

  The public information receiving means 61 receives public information distributed via the broadcast wave W. The received public information is output to the public information separating means 62.

  The public information separating unit 62 separates the encrypted content and the encryption key information from the public information received by the public information receiving unit 61. The separated encrypted content is output to the content decrypting unit 64, and the separated encrypted key information is output to the key information transmitting unit 65.

  The key receiving unit 63 receives the scramble key (Ks) transmitted from the security module 70. The received scramble key is output to the content decryption means 64.

  The content decrypting unit 64 decrypts the encrypted content separated by the public information separating unit 62 with the scramble key received by the key receiving unit 63. The decrypted content is output to a display device (not shown). If the scramble key is not transmitted from the security module 70, the content decrypting means 64 cannot decrypt the encrypted content and outputs a message to that effect to the display device or the like.

  The key information transmission unit 65 transmits the encryption key information separated by the public information separation unit 62 to the security module 70.

The manufacturer secret information storage means (secret information storage means) 66 includes the manufacturer secret information (Smid; group unit secret information) generated by the authentication information generation server 10 and the encrypted manufacturer secret information (ESmid; encrypted group unit secret information). Is stored in advance together with a manufacturer identifier (mid), and is a general storage device such as a hard disk. Note that the manufacturer secret information and the encrypted manufacturer secret information ESmid stored in the manufacturer secret information storage unit 66 are not generated when the authentication information generation server 10 generates them. When specifying, a number j indicating the order is added and expressed as Smid _j and ESmid _j .

The manufacturer information transmission means (secret information transmission means) 67 transmits the manufacturer identifier and encrypted manufacturer secret information stored in the manufacturer secret information storage means 66 to the security module 70 as manufacturer information. That is, the maker information transmitting unit 67 includes maker information (Imid = (mid, ESmid) composed of the maker identifier (mid) stored in the maker secret information storage unit 66 and the encrypted maker secret information (ESmid _j ). _j )) to the security module 70. By transmitting this manufacturer information to the security module 70, it is confirmed in the security module 70 whether or not the manufacturer secret information correctly updated in the receiving device 60 is stored.

  The secret information authentication response means 68 performs authentication with the security module 70 and responds to an authentication request from the security module 70. Here, the secret information authentication response unit 68 includes an authentication challenge reception unit 681, an authentication response generation unit 682, and an authentication response transmission unit 683.

  The authentication challenge receiving unit 681 receives manufacturer authentication challenge information (CHmid) transmitted from the security module 70. This manufacturer authentication challenge information is information generated inside the security module 70. The received manufacturer authentication challenge information is output to the authentication response generation means 682.

  The authentication response generating means 682 generates manufacturer authentication response information that is a response to the manufacturer authentication challenge information received by the authentication challenge receiving means 681 using the manufacturer secret information stored in the manufacturer secret information storage means 66. It is.

Note that the maker authentication response information may be generated by the same method as the security module 70 (authentication response determination unit 754 (FIG. 5)). For example, the authentication response generation means 682 uses the manufacturer authentication challenge information (CHmid), the manufacturer secret information (Smid _j ), and the same hash function Hash () used in the security module 70 to obtain the manufacturer authentication response information ( ECHmid) is generated as ECHmid = Hash (CHmid, Smid _j ).

In addition, for example, the authentication response generation unit 682 encrypts the manufacturer authentication challenge information (CHmid) using the manufacturer secret information (Smid _j ) as an encryption key and the manufacturer authentication response information (ECHmid) by a common key encryption method. ) May be generated as ECHmid = ENC (CHmid, Smid _j ) (where ENC (a, b) indicates that data a is encrypted with key b).
The manufacturer authentication response information generated by the authentication response generation unit 682 is output to the authentication response transmission unit 683.

The authentication response transmission unit 683 transmits the manufacturer authentication response information generated by the authentication response generation unit 682 to the security module 70.
By configuring the receiving device 60 in this way, the receiving device 60 can perform authentication with the security module 70 using the manufacturer secret information.

[Configuration of security module in user terminal]
Next, the configuration of the security module 70 in the user terminal 50 will be described with reference to FIG. 5 (refer to FIG. 1 as appropriate). FIG. 5 is a block diagram showing the configuration of the security module according to the first embodiment of the present invention. Here, the security module 70 includes a key / update information extraction unit 71, an update information confirmation unit 72, a device key storage unit 73, a manufacturer information storage unit 74, a secret information authentication confirmation unit 75, and a key transmission control unit. 76.

The key / update information extraction unit 71 uses the scramble key (Ks) for decrypting the encrypted content from the encryption key information transmitted from the receiving device 60 and the manufacturer update information (Mup = (mid, Smid _i ), or Mup = (mid, Smid _i−1 , Smid _i )) is separated and extracted. Here, the key / update information extraction unit 71 includes a key information reception unit 711, a key information decryption unit 712, and a key information separation unit 713.

  The key information receiving unit 711 receives the encryption key information transmitted from the receiving device 60. The received encryption key information is output to the key information decryption means 712. This encryption key information is information that is distributed via the broadcast wave W and received by the receiving device 60.

  The key information decrypting unit 712 decrypts the encryption key information received by the key information receiving unit 711 with the work key (Kw). The key information obtained by decrypting the encrypted key information is output to the key information separation unit 713. The work key (Kw) for decrypting the encryption key information is the same as the work key used in the conventional limited reception method, and is stored in a semiconductor memory or the like not shown. To do.

The key information separation unit 713 separates the key information decrypted by the key information decryption unit 712 into individual information. Here, the key information separation unit 713 includes the scramble key (Ks), the manufacturer update information (Mup = (mid, Smid), or Mup = (mid, Smid _i−1 , Smid _i )). To separate. Note that the key information separation unit 713 separates and extracts only the manufacturer update information having the same manufacturer identifier as the manufacturer identifier (mid) stored in the manufacturer information storage unit 74. Further, the key information separation unit 713 separates the separated manufacturer update information Mup into a manufacturer identifier mid and manufacturer secret information (Smid _i or (Smid _i−1 , Smid _i )). The separated scramble key (Ks) is output to the key transmission control means 76. The separated manufacturer secret information (first group unit secret information: Smid _i or (Smid _i−1 , Smid _i )) is output to the update information confirmation unit 72. The separated manufacturer identifier (mid) and manufacturer secret information (Smid _i or (Smid _i−1 , Smid _i )) are written and stored in the manufacturer information storage means 74.

  The update information confirmation unit 72 confirms the identity between the manufacturer secret information included in the manufacturer information transmitted from the receiving apparatus 60 and the manufacturer secret information separated and extracted by the key / update information extraction unit 71. Here, the update information confirmation unit 72 includes a manufacturer information reception unit 721, an identifier separation unit 722, a secret information decryption unit 723, and an update information determination unit 724.

The manufacturer information receiving unit (secret information receiving unit) 721 receives the manufacturer information (Imid = (mid, ESmid _j )) transmitted from the receiving device 60. The received manufacturer information is output to the identifier separation unit 722.

The identifier separating unit 722 separates the manufacturer identifier (mid) and the encrypted manufacturer secret information (ESmid _j ) from the manufacturer information (Imid = (mid, ESmid _j )) received by the manufacturer information receiving unit 721. . The separated manufacturer identifier (mid) is written and stored in the manufacturer information storage means 74. The separated encrypted manufacturer secret information (ESmid _j ) is output to the secret information decryption means 723.

The secret information decryption unit 723 decrypts the encrypted manufacturer secret information (ESmid _j ) separated by the identifier separation unit 722 with the device key (Kd) stored in the device key storage unit 73. The decrypted manufacturer secret information (second group unit secret information: Smid _j ) is written and stored in the manufacturer information storage means 74.

The update information determination unit 724 includes the manufacturer secret information (Smid _i or (Smid _i-1 , Smid _i )) separated and extracted by the key / update information extraction unit 71 (key information separation unit 713) and the secret information decryption. It is determined whether or not the manufacturer secret information (Smid _j ) decrypted by the means 723 and stored in the manufacturer information storage means 74 matches. The manufacturer secret information separated and extracted by the key / update information extraction means 71 has two types, (Smid _i ) and (Smid _i−1 , Smid _i ). When the manufacturer secret information is the former (Smid _i ), the update information determination unit 724 decodes the manufacturer secret information (Smid _i ) and the secret information decryption unit 723 and stores the manufacturer secret information stored in the manufacturer information storage unit 74. It is determined whether (Smid _j ) matches. On the other hand, when the manufacturer secret information is the latter (Smid _i-1 , Smid _i ), the update information determination unit 724 stores either of the manufacturer secret information (Smid _i-1 , Smid _i ) in the manufacturer information storage unit 74. It is determined whether or not it matches the manufacturer secret information (Smid _j ). If the manufacturer secret information matches, the update information determination unit 724 outputs an instruction to permit transmission of the scramble key to the key transmission control unit 76. If not, the update information determination unit 724 instructs to not allow transmission of the scramble key. Is output to the key transmission control means 76.

Here, the manufacturer secret information (Smid _i or (Smid _i-1 , Smid _i )) separated and extracted by the key information separation unit 713 of the key / update information extraction unit 71 is distributed via the broadcast wave W. The manufacturer secret information (Smid _j ) extracted from the encryption key information included in the public information and decrypted by the secret information decryption means 723 and stored in the manufacturer information storage means 74 is received in advance. It is extracted from the manufacturer information registered in the device 60. As a result, the transmission of the scramble key can be stopped with respect to the receiving device 60 that does not hold the same manufacturer secret information.

  The device key storage unit 73 stores in advance the device key generated by the device key generation unit 12 (FIG. 2) of the authentication information generation server 10, and is a general storage medium such as a semiconductor memory. . It is assumed that this device key is written in advance in the manufacturing stage of the security module 70.

The maker information storage means (second secret information storage means) 74 is the maker secret information (first group unit secret information: Smid _i or (Smid _i-1 , Smid _i ) separated and extracted by the key / update information extraction means 71. _i ); group unit secret information) and maker secret information (second group unit secret information: Smid _j ) decrypted by the secret information decryption unit 723 of the update information confirmation unit 72, It is a general storage medium. That is, the manufacturer information storage unit 74 associates the manufacturer identifier (mid) output from the receiving device 60 with the manufacturer secret information (Smid _j ) output from the receiving device 60 and decrypted, and the content. The manufacturer secret information (Smid _i-1 , Smid _i ) distributed as public information from the distribution server 20 and stored is stored in response to the update.

  The secret information authentication confirmation unit 75 performs authentication with the receiving device 60, requests authentication of the receiving device 60, and performs authentication according to the response. The secret information authentication confirmation unit 75 performs authentication by a challenge / response authentication method. Here, the secret information authentication confirmation unit 75 includes an authentication challenge generation unit 751, an authentication challenge transmission unit 752, an authentication response reception unit 753, and an authentication response determination unit 754.

  The authentication challenge generation means 751 generates manufacturer authentication challenge information (CHmid), which is challenge information in the challenge / response authentication method that is transmitted to the receiving device 60. Here, the authentication challenge generation means 751 uses a randomly generated random number as manufacturer authentication challenge information. The generated manufacturer authentication challenge information is output to the authentication challenge transmission unit 752 and the authentication response determination unit 754.

  The authentication challenge transmitting unit 752 transmits the manufacturer authentication challenge information generated by the authentication challenge generating unit 751 to the receiving device 60. A response (maker authentication response information) to the manufacturer authentication challenge information is generated in the receiving device 60.

  The authentication response receiving unit 753 receives manufacturer authentication response information transmitted from the receiving device 60. The received manufacturer authentication response information is output to the authentication response determination unit 754.

  The authentication response determination unit 754 determines whether or not the manufacturer authentication response information received by the authentication response reception unit 753 matches the one generated by the manufacturer authentication challenge information generated by the authentication challenge generation unit 751. It is.

For example, when the authentication response generation unit 682 (FIG. 4) of the receiving device 60 generates the manufacturer authentication response information (ECHmid) using a hash function, the authentication response determination unit 754 is generated by the authentication challenge generation unit 751. The manufacturer authentication challenge information (CHmid) and the manufacturer secret information (Smid _i or (Smid _i-1 , Smid _i )) separated by the key / update information extraction unit 71 and stored in the manufacturer information storage unit 74 Is calculated by the same hash function Hash () as the authentication response generation means 682 and compared with the maker authentication response information (ECHmid) to determine whether or not the values are the same.

The manufacturer secret information separated and extracted by the key / update information extraction means 71 has two types, (Smid _i ) and (Smid _i−1 , Smid _i ). When the manufacturer secret information is the former (Smid _i ), the authentication response determination unit 754 uses the hash function Hash () for the manufacturer authentication challenge information (CHmid) and the manufacturer secret information (Smid _i ) generated by the authentication challenge generation unit 751. To determine whether it is the same value as the manufacturer authentication response information (ECHmid). On the other hand, when the manufacturer secret information is the latter (Smid _i−1 , Smid _i ), the authentication response determination unit 754 calculates the manufacturer authentication challenge information (CHmid) and the manufacturer secret information (Smid _i ) by using the hash function Hash (). Any one of the obtained value and the value obtained by calculating the manufacturer authentication challenge information (CHmid) and the manufacturer secret information (Smid _i-1 ) by the hash function Hash () is the same as the manufacturer authentication response information (ECHmid). In this case, it is determined that the values are the same.

  For example, when the authentication response generation unit 682 (FIG. 4) of the receiving device 60 generates the manufacturer authentication response information (ECHmid) by the common key encryption method, the authentication response determination unit 754 includes the authentication challenge generation unit. The maker authentication response information (ECHmid ′) is generated by encrypting the maker authentication challenge information (CHmid) generated in 751 with the maker secret information (Smid) stored in the maker information storage unit 74. Then, the authentication response determination unit 754 compares the maker authentication response information (ECHmid ′) with the maker authentication response information (ECHmid) received by the authentication response reception unit 753, and determines whether or not they are the same value. To do.

Also in this case, when the manufacturer secret information is Smid _i , the authentication response determination unit 754 encrypts the manufacturer authentication challenge information (CHmid) generated by the authentication challenge generation unit 751 with the manufacturer secret information (Smid _i ). Manufacturer authentication response information (ECHmid _i ) is generated, and it is determined whether the value is the same as the manufacturer authentication response information (ECHmid). On the other hand, when the manufacturer secret information is (Smid _i-1 , Smid _i ), the authentication response determination unit 754 generates the manufacturer authentication challenge information (CHmid) by encrypting it with the manufacturer secret information (Smid _i-1 ). Either the manufacturer authentication response information (ECHmid _i-1 ) or the manufacturer authentication response information (ECHmid _i ) generated by encrypting the manufacturer authentication challenge information (CHmid) with the manufacturer secret information (Smid _i ) When it is the same as the manufacturer authentication response information (ECHmid), it is determined that the values are the same.

  The authentication response determination unit 754 gives an instruction to permit transmission of the scramble key when the identity (that is, corresponding) between the maker authentication challenge information and the maker authentication response information is confirmed. When the identity is not confirmed, an instruction not to permit transmission of the scramble key is output to the key transmission control means 76.

The key transmission control unit 76 controls whether or not to output the scramble key extracted by the key / update information extraction unit 71 to the receiving device 60. Here, the key transmission control means 76 permits the transmission of the scramble key from both the update information confirmation means 72 (update information determination means 724) and the secret information authentication confirmation means 75 (authentication response determination means 754). Only when the instruction is received, the scramble key is output to the receiving device 60.
By configuring the security module 70 in this manner, the security module 70 can perform authentication with the receiving device 60 using the manufacturer secret information.

  As described above, by configuring the content distribution system 1, authentication can be performed between the receiving device 60 and the security module 70 based on the manufacturer secret information. Use can be prevented. In addition, since the manufacturer secret information can be updated with the manufacturer secret information distributed via the broadcast wave W in the security module 70, for example, when the manufacturer secret information is illegally obtained and the receiving device is manufactured. Even so, by updating the maker secret information, unauthorized use of the content in the unauthorized receiving device can be stopped.

[Operation of content distribution system]
Next, the operation of the content distribution system according to the first embodiment of the present invention will be described with reference to FIGS. In the following, maker secret information generation operation of the authentication information generation server, user terminal (receiver and security module) authentication operation using maker secret information, maker secret information update authentication operation, reception of leaked maker secret information The use stop operation (revocation operation) of the apparatus will be described sequentially.

(Authentication information generation server maker secret information generation operation)
First, with reference to FIG. 6 (refer to FIG. 2 as appropriate), the generation operation of the manufacturer secret information in the authentication information generation server will be described. FIG. 6 is a flowchart showing an operation for generating manufacturer secret information in the authentication information generation server according to the first embodiment of the present invention. It is assumed that the device key (Kd) for encrypting the maker secret information is generated in advance by the device key generation unit 12 and written in the authentication information storage unit 13. It is assumed that the device key is read from the authentication information storage unit 13 and output by the device key output unit 18.

  First, the authentication information generation server 10 uses the identifier receiving unit 111 of the secret / update information generating unit 11 to identify the manufacturer of the receiving device 60 from the outside using an input unit (not shown) such as a keyboard. Is written into the authentication information storage means 13 (step S1).

Then, the authentication information generation server 10 uses the secret information generation unit 112 of the secret / update information generation unit 11 to randomly generate the manufacturer secret information (Smid _i ) with a random number in association with the manufacturer identifier received in step S1. And it writes in the information storage means 13 for authentication (step S2).

Thereafter, the authentication information generation server 10 uses the secret information encrypting means 16, the manufacturer secret information (Smid _i), by encrypting with the device key (Kd), to generate an encrypted manufacturer secret information (ESMID _i) (Step S3). Then, the authentication information generation server 10 uses the secret information output means 17, and the generated encrypted manufacturer secret information (ESMID _i) in step S3, and outputs the manufacturer secret information (Smid _i) to be its original (step S4).
Through the above operation, the authentication information generation server 10 can generate different manufacturer secret information (encrypted manufacturer secret information) for each manufacturer (model).

(User terminal authentication using manufacturer secret information)
Next, referring to FIG. 7 (refer to FIG. 4 and FIG. 5 as appropriate), the authentication operation of the user terminal using the manufacturer secret information will be described. FIG. 7 is a flowchart showing an authentication operation using the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) according to the first embodiment of the present invention. This operation is performed when the authentication of the receiving device 60 is newly performed, for example, when the security module 70 is connected to the receiving device 60 for the first time by newly purchasing the user terminal 50 or the like. Further, in order to perform this authentication, it is assumed that manufacturer secret information is periodically added to public information distributed via broadcast waves.

  First, the receiving device 60 transmits the manufacturer information (Imid = (mid, ESmid)) stored in the manufacturer secret information storage unit 66 to the security module 70 by the manufacturer information transmission unit 67 (step S10).

On the other hand, the security module 70 receives the manufacturer information (Imid = (mid, ESmid)) transmitted from the receiving device 60 by the manufacturer information receiving unit 721 of the update information confirmation unit 72 (step S11). Then, the security module 70 separates the manufacturer identifier (mid) from the manufacturer information by the identifier separating unit 722 and stores it in the manufacturer information storage unit 74 (step S12). Furthermore, the security module 70, the secret information decrypting unit 723, the encrypted manufacturer secret information (ESmid: ESmid _j) By decoding the, manufacturer secret information (Smid: Smid _j) acquires (step S13), and manufacturer information It memorize | stores in the memory | storage means 74 (step S14).

  Next, the receiving device 60 receives the public information distributed via the broadcast wave by the public information receiving means 61 (step S20). Then, the receiving device 60 separates the content (encrypted content) and the encryption key information included in the public information by the public information separating unit 62 (step S21). Then, the receiving device 60 transmits the separated encryption key information to the security module 70 by the key information transmitting unit 65 (step S22).

The security module 70 receives the encryption key information transmitted from the receiving device 60 by the key information receiving unit 711 of the key / update information extracting unit 71 (step S23). Then, the security module 70 decrypts the received encryption key information with the work key Kw by the key information decryption unit 712, and converts the decrypted key information into a scramble key (Ks) by the key information separation unit 713. Then, it is separated into manufacturer secret information (Smid ′: Smid _i) or (Smid _i−1 , Smid _i ) (step S24).

The security module 70 receives the manufacturer secret information (Smid _j ) decrypted by the secret information decryption unit 723 and stored in the manufacturer information storage unit 74 by the update information determination unit 724 of the update information confirmation unit 72. The manufacturer secret information (Smid ′: Smid _i or (Smid _i−1 , Smid _i )) is compared (step S25). In this step S25, when the maker secret information Smid ′ is (Smid _i ), the update information determination means 724 is decrypted by the maker secret information (Smid _i ) and the secret information decryption means 723, and the maker information storage means 74 It is determined whether or not the maker secret information (Smid _j ) stored in the table matches. On the other hand, when the manufacturer secret information Smid ′ is (Smid _i−1 , Smid _i ), the update information determination unit 724 stores either of the manufacturer secret information (Smid _i−1 , Smid _i ) in the manufacturer information storage unit 74. It is determined whether or not it matches the manufacturer secret information (Smid _j ).

  If the manufacturer secret information is not the same (No in step S25), the security module 70 stops the output of the scramble key to the receiving device 60 by the key transmission control means 76 (step S38). On the other hand, when the manufacturer secret information is the same (Yes in step S25), the security module 70 executes the authentication operation after step S30.

  That is, the security module 70 generates maker authentication challenge information (CHmid), which is challenge information in the challenge / response authentication method, by the authentication challenge generation means 751 of the secret information authentication confirmation means 75 (step S30). Then, the security module 70 transmits the manufacturer authentication challenge information (CHmid) generated in step S30 to the receiving device 60 by the authentication challenge transmitting unit 752 (step S31).

  On the other hand, the receiving device 60 receives the manufacturer authentication challenge information (CHmid) transmitted from the security module 70 by the authentication challenge receiving unit 681 of the secret information authentication response unit 68 (step S32).

Then, the receiving device 60 receives the manufacturer authentication response from the manufacturer authentication challenge information (CHmid) received by the authentication response generation unit 682 and the manufacturer secret information (Smid _j ) stored in the manufacturer secret information storage unit 66. Information (ECHmid _j ) is generated (step S33). Then, the receiving device 60 transmits the manufacturer authentication response information (ECHmid _j ) generated in step S33 to the security module 70 by the authentication response transmitting unit 683 (step S34).

The security module 70 receives the maker authentication response information (ECHmid _j ) transmitted from the receiving device 60 by the authentication response receiving unit 753 of the secret information authentication confirmation unit 75 (step S35).

Thereafter, the security module 70 uses the authentication response determination unit 754 to decrypt the manufacturer authentication challenge information (CHmid) generated in step S30 and the secret information decryption unit 723, and stores the manufacturer secret stored in the manufacturer information storage unit 74. From the information (Smid _j ), an operation (Hash (CHmid, Smid _j )) is performed by the same hash function Hash () as that of the receiving device 60, and manufacturer authentication challenge information (ECHmid that should be generated by the regular receiving device 60. ') Is generated (step S36).

Then, the security module 70 compares the maker authentication response information (ECHmid: ECHmid _j ) received in step S35 with the maker authentication challenge information (ECHmid ′) generated in step S36 by the authentication response determination unit 754. (Step S37).

Here, if the two pieces of information (ECHmid, ECHmid ′) are not the same (No in step S37), the security module 70 stops the output of the scramble key to the receiver 60 by the key transmission control means 76 (step S38). . On the other hand, if both pieces of information are the same (Yes in step S37), the security module 70 outputs the scramble key to the receiving device 60 by the key transmission control means 76 (step S39).
With the above operation, the user terminal 50 can perform authentication between the receiving device 60 and the security module 70 based on the manufacturer secret information.

(Manufacturer confidential information update authentication operation)
Next, referring to FIG. 8 (refer to FIGS. 4 and 5 as appropriate), the update authentication operation of the manufacturer secret information will be described. FIG. 8 is a flowchart showing the update authentication operation of the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) according to the first embodiment of the present invention. This operation is an operation of authenticating the receiving device 60 when new manufacturer secret information is transmitted through a broadcast wave and the manufacturer secret information is updated. In addition, in order to perform this authentication, update information is periodically added to public information distributed via broadcast waves.

  First, the receiving device 60 receives the public information distributed via the broadcast wave by the public information receiving means 61 (step S20). Then, the receiving device 60 separates the content (encrypted content) and the encryption key information included in the public information by the public information separating unit 62 (step S21). Then, the receiving device 60 transmits the encryption key information separated in step S21 to the security module 70 by the key information transmitting unit 65 (step S22).

  On the other hand, the security module 70 receives the encryption key information transmitted from the receiving device 60 by the key information receiving unit 711 of the key / update information extracting unit 71 (step S23).

  Then, the security module 70 decrypts the encryption key information received in step S23 with the work key Kw by the key information decryption means 712 of the key / update information extraction means 71, and decrypts it with the key information separation means 713. The key information is separated into a scramble key (Ks) and manufacturer update information (Mup) (step S24). Further, the security module 70 acquires the manufacturer identifier (mid) stored in the manufacturer information storage unit 74 by the key information separation unit 713, and the manufacturer update information corresponding to the manufacturer identifier (mid) in the decrypted key information. It is determined whether or not there is (step S25).

Here, when the manufacturer update information corresponding to the manufacturer identifier (mid) does not exist (No in step S25), the security module 70 ends the update authentication operation. On the other hand, when there is manufacturer update information corresponding to the manufacturer identifier (mid) (Yes in step S25), the security module 70 uses the key information separation unit 713 to update the manufacturer secret information (Smid: Smid _i , Alternatively, (Smid _i-1 , Smid _i )) is separated (step S26).

Then, the security module 70 is separated by the update information determination unit 724 by the key / update information extraction unit 71 and stored in the manufacturer information storage unit 74 (Smid ′: Smid _j , or (Smid _j-1 , Smid _j )) is acquired and compared with the manufacturer secret information (Smid) stored in the manufacturer information storage means 74 separated in step S26 (step S28).

If the manufacturer secret information is the same (No in step S28), the security module 70 ends the update authentication operation. On the other hand, if the manufacturer secret information is not the same (Yes in step S28), the security module 70 writes the manufacturer secret information (Smid) separated in step S26 into the manufacturer information storage unit 74 by the update information determination unit 724, Store (update) (step S29).
Then, the security module 70 performs the authentication operation after step S30A on the receiving device 60. In FIG. 8, step S30A indicates the same operation as steps S30 to S37 in FIG.

  With the above operation, the user terminal 50 can perform authentication between the receiving device 60 and the security module 70 based on the update information of the manufacturer secret information. In addition, this makes it possible to stop the use of content in the receiving device 60 in which correct update information is not registered.

  In FIG. 8, it is determined whether or not to update the manufacturer secret information stored in the manufacturer information storage means 74 by determining whether or not the manufacturer secret information is the same. A method may be used. For example, when the update information synthesis means 14 of the authentication information generation server 10 (see FIG. 2) generates the manufacturer update information (Mup), the update flag (u_flg) is added to the manufacturer update information (Mup = (mid, Smid)). ) May be generated as manufacturer update information with an update flag (Mup = (mid, u_flg, Smid)). In this case, for example, when u_flg = 1, the update information determination unit 724 updates the content of the manufacturer information storage unit 74 and performs subsequent authentication. When u_flg = 0, the update information determination unit 724 does not update the contents of the manufacturer information storage unit 74 and perform subsequent authentication. This eliminates the need for the update information determination unit 724 to acquire the manufacturer secret information from the manufacturer information storage unit 74 many times.

(Revocation operation)
Next, with reference to FIG. 9 and FIG. 10, the use stop operation (revocation operation) of the receiving apparatus when the manufacturer secret information is leaked will be described. Here, the revoke operation is performed as a preparation stage (recall operation) of the manufacturer as a preparatory stage before the use stop operation of the receiving device, and when the recall period ends, the receiving device is not recalled. The operation to stop the use (operation at the end of the recall period) will be described. Note that the identification of the receiving device when the manufacturer secret information is leaked can be performed in the unauthorized receiving device identifying system. This unauthorized receiving device specifying system will be described later.

(Revocation operation 1: Recall operation)
First, the recall operation will be described with reference to FIG. 9 (see FIGS. 2 and 3 as appropriate). FIG. 9 is a flowchart showing an operation at the time of recall of the manufacturer as a preparation stage before performing the use stop operation of the receiving apparatus when the manufacturer secret information is leaked in the first embodiment of the present invention.

  First, the authentication information generation server 10 receives the manufacturer identifier (mid) of the receiving device specified as an unauthorized receiving device by the identifier receiving unit 111 of the secret / update information generating unit 11, and the secret / update information generating unit The revocation flag reception means 113 of 11 receives a revocation flag (r_mid = 1: revocation instruction) indicating that the use of the receiving apparatus is to be stopped (step S50).

Then, the authentication information generation server 10 determines whether or not the instruction input in step S50 is a revoke instruction by the update information synthesis unit 14 (step S51). When the revocation instruction is issued, that is, when the revocation flag is set to “1” (Yes in step S51), the authentication information generation server 10 includes the secret information generation unit 112 of the secret / update information generation unit 11. Thus, the manufacturer secret information (Smid _i ) is newly generated at random using a random number in association with the manufacturer identifier received in step S50, and is written in the authentication information storage unit 13 in association with the manufacturer identifier (step S52). ).

Further, the authentication information generation server 10 uses the secret information encryption unit 16 to convert the maker secret information (Smid _i ) stored in the authentication information storage unit 13 for each maker identifier (mid) into a device key (Kd). The encrypted manufacturer secret information (ESmid _i ) is generated by encrypting with (Step S53).

Then, the authentication information generation server 10 uses the secret information output means 17, maker secret information stored in the authentication information storage means 13 and (Smid _i), the encrypted manufacturer secret information generated in step S53 (ESMID _i ) Is output (step S54). The manufacturer secret information and the encrypted manufacturer secret information output in step S54 are information passed to the manufacturer. Then, the manufacturer writes the manufacturer secret information and the encrypted manufacturer secret information in the manufacturer secret information storage unit 66 (see FIG. 4) of the revoked receiving device by means such as recall.

Then, the authentication information generation server 10 uses the update information synthesizing unit 14 to update the manufacturer identifier (mid) stored in the authentication information storage unit 13, the manufacturer secret information (Smid _i−1 ) currently used, and a new one. The generated maker secret information (Smid _i ) is read and combined to generate maker update information (Mup = (mid, Smid _i−1 , Smid _i )) (step S55). Then, the authentication information generation server 10 transmits the manufacturer update information generated in step S55 to the content distribution server 20 by the update information transmission unit 15 (step S56).

  On the other hand, the content distribution server 20 receives the manufacturer update information (Mup) transmitted from the authentication information generation server 10 by the update information receiving means 22 (step S57). Then, the content distribution server 20 generates key information obtained by synthesizing the scramble key (Ks) and the manufacturer update information (Mup) received in step S57 by the key synthesizing unit 23 (step S58).

  Then, the content distribution server 20 encrypts the key information generated in step S58 with the work key (Kw) by the key information encryption unit 24 (step S59). Further, the content distribution server 20 generates public information by synthesizing the key information encrypted in step S58 with the encrypted content by the public information synthesizing unit 25 (step S60). Thereafter, the content distribution server 20 distributes the public information generated in step S60 to the user terminal 50 via the broadcast wave by the public information transmitting unit 26 (step S61).

Thereafter, the manufacturer secret information of the security module 70 is updated by the operations in steps S20 to S29 in FIG. As a result, the security module 70 performs the authentication described with reference to FIG. 7 with the receiving device 60, and when the receiving device 60 stores the old manufacturer secret information (Smid _i-1 ), or a new one is obtained by recall. Even if the manufacturer secret information (Smid _i ) is stored, the authentication is successful. That is, at this stage, even the receiving device 60 having only the old manufacturer secret information (Smid _i-1 ) succeeds in authentication.

(Revocation operation 2: Operation at the end of the recall period)
Next, referring to FIG. 10 (refer to FIG. 2 and FIG. 3 as appropriate), the use stop operation (revocation operation) of the receiving apparatus that has not been recalled due to the end of the recall period will be described. FIG. 10 is a flowchart showing an operation of stopping the use of a receiving apparatus that has not been recalled due to the end of the recall period in the first embodiment of the present invention.

  First, the authentication information generation server 10 receives the manufacturer identifier (mid) of the receiving apparatus that resumes the use of the content by the identifier reception unit 111 of the secret / update information generation unit 11 and revokes the secret / update information generation unit 11. The flag receiving unit 113 receives a revoke flag (r_mid = 0: revocation cancellation instruction) indicating that the recall period of the receiving device is ended and the use of the receiving device that has not been recalled is stopped (step S70). ).

Then, the authentication information generation server 10 determines whether or not the instruction input in step S70 is a revocation cancellation instruction by the update information synthesis unit 14 (step S71). If there is a revocation cancellation instruction, that is, if the revocation flag is set to “0” (Yes in step S71), the authentication information generation server 10 uses the update information synthesis unit 14 to perform authentication information storage unit. The manufacturer identifier (mid) and the latest manufacturer secret information (Smid _i ) stored in 13 are read out and synthesized to generate manufacturer update information Mup = (mid, Smid _i ) (step S72). Then, the authentication information generation server 10 transmits the manufacturer update information generated in step S72 to the content distribution server 20 by the update information transmission unit 15 (step S73).

  On the other hand, the content distribution server 20 distributes the public information including the manufacturer update information to the receiving device 60 through the broadcast wave by the operations of steps S74 to S78. As a result, the manufacturer secret information of the security module 70 is updated. The operations in steps S74 to S78 are the same as the operations in steps S57 to S61 described with reference to FIG.

  Thereafter, the manufacturer secret information of the security module 70 is updated by the operations in steps S20 to S29 in FIG. On the other hand, since the receiving device 60 has been updated with the same manufacturer secret information, the authentication is successful in the operation of FIG. 7, the scramble key is output from the security module 70 to the receiving device 60, and the recall is performed. As for the received receiver, authentication is successful and normal operation is performed. On the other hand, for a receiving device that has not been recalled, since the receiving device can only have old manufacturer secret information, the authentication fails due to a difference in manufacturer secret information, so that a scramble key from the security module 70 to the receiving device 60 is obtained. Is stopped, and the use of the content is stopped in the unauthorized receiving device.

[Unauthorized receiving device identification system]
Next, with reference to FIG. 11, the configuration of an unauthorized receiving device specifying system for specifying the manufacturer (model) of an unauthorized manufactured receiving device in the content distribution system 1 (see FIG. 1) will be described. FIG. 11 is a block diagram showing the overall configuration of the unauthorized receiving device specifying system.

  As illustrated in FIG. 11, the unauthorized receiving device specifying system 2 is a system for specifying a receiving device that has been illegally manufactured by connecting to the receiving device 60. Here, the unauthorized receiving device specifying system 2 includes a test module 80 and a manufacturer specifying device 90.

  The test module 80 is inserted into the receiving device 60 instead of the security module 70 (see FIG. 1), and acquires manufacturer authentication response information generated by the receiving device 60.

  The manufacturer specifying device (group specifying device) 90 specifies the manufacturer (model) of the receiving device 60 based on the manufacturer authentication response information acquired by the test module 80.

  Hereinafter, the configuration of the test module 80 and the manufacturer specifying device 90 will be described with reference to FIG. FIG. 12 is a block diagram illustrating a specific configuration of the test module and the manufacturer specifying device that constitute the unauthorized receiving device specifying system.

(Test module configuration)
First, the configuration of the test module 80 will be described with reference to FIG. Here, the test module 80 includes an authentication challenge input unit 81, an authentication challenge transmission unit 82, an authentication response reception unit 83, and an authentication response output unit 84.

  The authentication challenge input means 81 inputs manufacturer authentication challenge information output from the manufacturer specifying device 90. The inputted maker authentication challenge information is output to the authentication challenge transmission means 82.

  The authentication challenge transmitting unit 82 transmits the manufacturer authentication challenge information input by the authentication challenge input unit 81 to the receiving device 60. As a result, in the receiving device 60, the manufacturer authentication response information is generated by the secret information authentication response means 68 (see FIG. 4).

  The authentication response receiving unit 83 receives manufacturer authentication response information from the receiving device 60. The received manufacturer authentication response information is output to the authentication response output means 84.

  The authentication response output unit 84 outputs the manufacturer authentication response information received by the authentication response receiving unit 83 to the manufacturer specifying device 90.

  As described above, the test module 80 outputs the maker authentication challenge information to the receiving device 60 performed in the secret information authentication confirming means 75 (see FIG. 5) of the security module 70 and the maker authentication response information from the receiving device 60. Simulate the input. As a result, the manufacturer authentication response information generated by the receiving device 60 can be collected by the manufacturer specifying device 90.

(Configuration of manufacturer specific device)
Next, the configuration of the manufacturer specifying device 90 will be described with reference to FIG. Here, the manufacturer specifying device 90 includes a response information collecting unit 91, a response information acquiring unit 92, a response information storage unit 93, and a manufacturer searching unit 94.

  The response information collection unit 91 inputs a manufacturer identifier and manufacturer authentication challenge information from the outside, and collects manufacturer authentication response information corresponding to the manufacturer authentication challenge information for each manufacturer (model). The manufacturer authentication challenge information is the same as that generated by the authentication challenge generating means 751 of the security module 70 described in FIG. 5, but here, a predetermined value unique to the manufacturer (model) is used. And Thus, unique manufacturer authentication response information can be collected with respect to unique manufacturer authentication challenge information. Here, the response information collection unit 91 includes a mode switching unit 911.

  The mode switching unit 911 switches the operation of the response information collection unit 91 based on an instruction (mode) input from the outside. Here, the operation modes include “response collection mode” and “manufacturer search mode”.

  This “response collection mode” is a mode for collecting manufacturer authentication response information generated by the regular receiving device 60. In addition, the “manufacturer search mode” is performed by comparing the manufacturer authentication response information generated by the unauthorized receiving device 60 with the manufacturer authentication response information generated by the authorized receiving device 60 that has already been collected. This is a mode for searching whether an unauthorized receiving device 60 is manufactured based on the information of the (model).

  Here, when “response collection mode” is set as the mode, the response information collection unit 91 outputs the input maker authentication challenge information to the response information acquisition unit 92. Then, the response information collection unit 91 writes the manufacturer authentication response information input from the response information acquisition unit 92 in the response information storage unit 93 in association with the manufacturer identifier. As a result, the manufacturer authentication response information generated by the regular receiving device 60 is collected.

  When “manufacturer search mode” is set as the mode, the response information collection unit 91 outputs the input maker authentication challenge information to the response information acquisition unit 92. Then, the response information collection unit 91 outputs the manufacturer authentication response information input from the response information acquisition unit 92 to the manufacturer search unit 94. As a result, the manufacturer (manufacturer identifier) of the unauthorized receiving device 60 is specified by the manufacturer search means 94, which will be described later.

  The response information acquisition unit 92 performs an interface between the response information collection unit 91 and the test module 80. Here, the response information acquisition unit 92 includes an authentication challenge output unit 921 and an authentication response input unit 922.

  The authentication challenge output unit 921 outputs the manufacturer authentication challenge information input from the response information collection unit 91 to the test module 80.

  The authentication response input unit 922 inputs manufacturer authentication response information from the test module 80. The input maker authentication response information is output to the response information collecting unit 91.

  The response information storage unit 93 stores the manufacturer authentication response information collected by the response information collection unit 91 in association with the manufacturer identifier, and is a general storage device such as a hard disk.

  The manufacturer search means 94 compares the manufacturer authentication response information input from the response information collection means 91 with the manufacturer authentication response information stored in the response information storage means 93, and the manufacturer corresponding to the same manufacturer authentication response information. The identifier is searched for as a manufacturer (model) used as an unauthorized receiving device. By generating maker update information corresponding to the search result (maker identifier) by the authentication information generation server 10 (see FIG. 2), it becomes possible to revoke an unauthorized receiving device.

  In this example, the manufacturer specifying device 90 has a function of collecting manufacturer authentication response information from a legitimate receiving device. However, for each manufacturer (model), the manufacturer authentication response to the manufacturer authentication challenge information in advance. Can be stored in the response information storage means 93 in advance, and the operation in the “response collection mode” can be omitted.

<< Second Embodiment >>
[Content distribution system configuration]
Next, the configuration of the content distribution system according to the second embodiment of the present invention will be described with reference to FIG. FIG. 13 is a block diagram showing a configuration of a content distribution system according to the second embodiment of the present invention.

  The configuration of the content distribution system 1B is basically a system that distributes content by a conditional access method, similarly to the content distribution system 1 described in FIG. 1, and authenticates the validity of the receiving device 60B. The content can be used (reproduced, copied, etc.) in the receiving device 60B. Note that the functions of the authentication information generation server 10 and the user terminal (user terminal 50) are different between the content distribution system 1 and the content distribution system 1B.

  The content distribution system 1B in the receiving device 60 described with reference to FIG. 4 indicates which manufacturer the receiving device 60 belongs to by using the security module 70 based on the manufacturer information (manufacturer identifier, encrypted manufacturer secret information). However, the receiving apparatus 60B does not perform the notification. Instead, the security module 70B holds manufacturer information of all manufacturers.

  Hereinafter, the authentication information generation server 10B different from the content distribution system 1, and the receiving device 60B and the security module 70B constituting the user terminal 50B will be described.

(Configuration of authentication information generation server)
First, the configuration of the authentication information generation server will be described with reference to FIG. 14 (refer to FIG. 13 as appropriate). FIG. 14 is a block diagram showing the configuration of the authentication information generation server in the second embodiment of the present invention. Here, the authentication information generation server 10B includes secret / update information generation means 11, authentication information storage means 13, update information synthesis means 14, update information transmission means 15, and secret information output means 17B. ing. The configuration other than the secret information output unit 17B is the same as that of the authentication information generation server 10 described in FIG.

The secret information output means 17B outputs the manufacturer secret information (Smid _i ) stored in the authentication information storage means 13 for each manufacturer identifier (mid). The manufacturer secret information (Smid _i ) is registered in advance in the receiving device 60B manufactured by the manufacturer for each manufacturer corresponding to the manufacturer identifier (mid).

(User terminal configuration)
Next, the configuration of the user terminal 50B will be described with reference to FIG. 15 and FIG.
[Configuration of receiving device in user terminal]
First, the configuration of the receiving device 60B in the user terminal 50B will be described with reference to FIG. FIG. 15 is a block diagram showing a configuration of a receiving apparatus according to the second embodiment of the present invention. Here, the receiving device 60B includes a public information receiving unit 61, a public information separating unit 62, a key receiving unit 63, a content decrypting unit 64, a key information transmitting unit 65, a manufacturer secret information storage unit 66, and a secret. Information authentication response means 68B. This receiving device 60B is configured by omitting the manufacturer information transmitting means 67 from the configuration of the receiving device 60 (FIG. 4) and replacing the secret information authentication response means 68 with the secret information authentication response means 68B whose function is changed. Yes. Other configurations are the same as those of the receiving device 60 described in FIG.

  The secret information authentication response means 68B performs authentication with the security module 70B and responds to an authentication request from the security module 70B. Here, the secret information authentication response unit 68B includes an authentication challenge reception unit 681, an authentication response generation unit 682B, and an authentication response transmission unit 683. The configuration other than the authentication response generation unit 682B is the same as the configuration of the secret information authentication response unit 68 described with reference to FIG.

  The authentication response generating means 682B generates manufacturer authentication response information that is a response to the manufacturer authentication challenge information received by the authentication challenge receiving means 681, using the manufacturer secret information stored in the manufacturer secret information storage means 66. It is. In addition, a manufacturer identifier is added to the manufacturer authentication response information generated by the authentication response generation unit 682B. Hereinafter, the maker authentication response information to which the maker identifier is added is referred to as identifier-added maker authentication response information.

  The generation of the manufacturer authentication response is the same as the secret information authentication response means 68 described in FIG. 4. For example, the authentication response generation means 682B includes the manufacturer authentication challenge information (CHmid), the manufacturer secret information (Smid), Manufacturer authentication response information (ECHmid) is generated as ECHmid = Hash (CHmid, Smid) using the same hash function Hash () used in the security module 70B.

  Further, for example, the authentication response generation unit 682B encrypts the maker authentication challenge information (CHmid) by using the maker secret information (Smid) as an encryption key by the common key encryption method, thereby making the maker authentication response information (ECHmid). May be generated as ECHmid = ENC (CHmid, Smid) (where ENC (a, b) indicates that data a is encrypted with key b).

  Then, the authentication response generation means 682B adds the manufacturer identifier (mid) stored in the manufacturer secret information storage means 66 to the manufacturer authentication response information (ECHmid), and adds the identifier-attached manufacturer authentication response information (RESmid) to the RESmid. = (Mid, ECHmid).

The identifier-added manufacturer authentication response information generated by the authentication response generation unit 682B is output to the authentication response transmission unit 683.
Thus, the manufacturer authentication response information transmitted from the receiving device 60B to the security module 70B is information with the manufacturer identifier added.

[Configuration of security module in user terminal]
Next, the configuration of the security module 70B in the user terminal 50B will be described with reference to FIG. FIG. 16 is a block diagram showing a configuration of a security module according to the second embodiment of the present invention. Here, the security module 70B includes key / update information extraction means 71B, manufacturer information storage means 74, secret information authentication confirmation means 75B, and key transmission control means 76B. The security module 70B omits the update information confirmation unit 72 and the device key storage unit 73 from the configuration of the security module 70 (FIG. 5), and the key / update information extraction unit 71, the secret information authentication confirmation unit 75, and the key transmission control unit. 76 is configured in place of the key / update information extraction means 71B, secret information authentication confirmation means 75B, and key transmission control means 76B whose functions are changed.

The key / update information extraction unit 71B includes a scramble key (Ks) for decrypting the encrypted content from the encryption key information transmitted from the receiving device 60B, manufacturer update information (Mup = (mid, Smid _i ), or Mup = (mid, Smid _i−1 , Smid _i )) is separated and extracted. Here, the key / update information extraction unit 71 includes a key information reception unit 711, a key information decryption unit 712, and a key information separation unit 713B. Note that the key / update information extracting unit 71B is different from the key information separating unit 713 described with reference to FIG. 5 only in the function of the key information separating unit 713B.

The key information separation unit 713B separates the key information decrypted by the key information decryption unit 712 into individual information. Here, the key information separation means 713B converts the key information into a scramble key (Ks) and manufacturer update information (Mup = (mid, Smid _i ) or Mup = (mid, Smid _i−1 , Smid _i )). And to separate. The separated scramble key Ks is output to the key transmission control means 76B.

  The key information separation unit 713B also displays the manufacturer update information Mup when the same manufacturer identifier as the manufacturer identifier mid included in the separated manufacturer update information (Mup) exists in the manufacturer information storage unit 74. It is overwritten and saved in the manufacturer information storage means 74. If the same manufacturer identifier does not exist in the manufacturer information storage unit 74, the manufacturer update information Mup is additionally stored in the manufacturer information storage unit 74.

  The secret information authentication confirmation unit 75B performs authentication with the receiving device 60B, requests authentication of the receiving device 60B, and performs authentication according to the response. This secret information authentication confirmation means 75B performs authentication by a challenge / response authentication method. Here, the secret information authentication confirmation unit 75B includes an authentication challenge generation unit 751, an authentication challenge transmission unit 752, an authentication response reception unit 753, and an authentication response determination unit 754B. The secret information authentication confirmation unit 75B is different in the authentication response determination unit 754B from the authentication response determination unit 754 described with reference to FIG.

  The authentication response determination unit 754B is generated by the manufacturer authentication response information generated by the authentication challenge generation unit 751 from the manufacturer authentication response information (maker authentication response information with identifier) received by the authentication response reception unit 753. Whether or not.

  For example, in the authentication response generation means 682B (FIG. 15) of the receiving device 60B, when the hash-generated maker authentication response information (RESmid) with identifier is generated by a function, the determination is performed according to the following procedure.

First, the authentication response determination unit 754B includes the manufacturer secret information (Smid _i or (Smid _i− ) corresponding to the manufacturer identifier (mid) included in the manufacturer authentication response information with identifier (RESmid = (mid, ECHmid)). ₁ , Smid _i )) from the maker information storage unit 74 and using the same hash function Hash () as the authentication response generation unit 682 B using the maker authentication challenge information (CHmid) generated by the authentication challenge generation unit 751. , Maker authentication response information (ECHmid _i or (ECHmid _i-1 , ECHmid _i )) is generated as ECHmid = Hash (CHmid, Smid _i ) and ECHmid _i-1 = Hash (CHmid, Smid _i-1 ) To do.

The authentication response determination unit 754B then generates the manufacturer authentication response information (ECHmid _i or (ECHmid _i-1 , ECHmid _i )) and the manufacturer authentication response information with identifier received by the authentication response receiving unit 753. The maker authentication response information (ECHmid) included in (RESmid = (mid, ECHmid)) is compared to determine whether or not the values are the same.

In this case, the generated manufacturer authentication response information includes two types of (ECHmid _i ) and (ECHmid _i−1 , ECHmid _i ). When the manufacturer authentication response information is the former (ECHmid _i ), the authentication response determination unit 754B compares the generated manufacturer authentication response information (ECHmid _i ) with the received manufacturer authentication response information (ECHmid _i ), and the same value is obtained. It is determined whether or not. On the other hand, when the maker authentication response information is the latter (ECHmid _i-1 , ECHmid _i ), the authentication response determination unit 754B generates two maker authentication response information (ECHmid _i-1 , ECHmid _i ) and The received manufacturer authentication response information (ECHmid _i-1 , ECHmid _i ) is compared to determine whether or not they are the same value, and if both are the same, it is determined that they are the same value To do.

  Further, for example, when the manufacturer response response information (ECHmid) is generated by the common key encryption method in the authentication response generation unit 682B (FIG. 15) of the reception device 60B, the determination is performed according to the following procedure.

  First, the authentication response determination unit 754B uses the manufacturer authentication challenge information (CHmid) generated by the authentication challenge generation unit 751 as the manufacturer identifier (RESmid = (mid, ECHmid)) included in the manufacturer authentication response information with identifier (RESmid = (mid, ECHmid)). The manufacturer authentication response information (ECHmid) is generated by encrypting with the manufacturer secret information (Smid) stored in the manufacturer information storage unit 74 in correspondence with (mid).

  The authentication response determination unit 754B then generates the manufacturer authentication response information (ECHmid), and the manufacturer authentication response information (ECHmid) included in the identifier-added manufacturer authentication response information (RESmid = (mid, ECHmid)). Are compared to determine whether the values are the same.

Also in this case, when the maker authentication response information is ECHmid _i , the authentication response determination unit 754B compares the generated maker authentication response information (ECHmid _i ) with the received maker authentication response information (ECHmid _i ). It is determined whether it is a value. On the other hand, when the maker authentication response information is (ECHmid _i-1 , ECHmid _i ), the authentication response determination unit 754B performs the two maker authentication response information (ECHmid _i-1 and ECHmid _i ), respectively, The received manufacturer authentication response information (ECHmid _i-1 , ECHmid _i ) is compared, and it is determined whether or not they are the same value. If either one is the same, it is determined that they are the same value. .

  When the identity of the manufacturer authentication challenge information and the manufacturer authentication response information is confirmed, the authentication response determination unit 754B outputs an instruction to permit the transmission of the scramble key to the key transmission control unit 76B. If not confirmed, an instruction not to permit transmission of the scramble key is output to the key transmission control means 76B.

  The key transmission control means 76B controls whether or not to output the scramble key extracted by the key / update information extraction means 71B to the receiving device 60B. Here, the key transmission control means 76B outputs the scramble key to the receiving device 60B only when receiving an instruction from the secret information authentication confirmation means 75B (authentication response determination means 754B) to permit transmission of the scramble key. To do.

[Operation of content distribution system]
Next, with reference to FIGS. 17-20, operation | movement of the content delivery system which concerns on 2nd Embodiment of this invention is demonstrated. In the following, maker secret information generation operation of the authentication information generation server, user terminal (receiver and security module) authentication operation using maker secret information, maker secret information update authentication operation, reception of leaked maker secret information The use stop operation (revocation operation) of the apparatus will be described sequentially.

(Authentication information generation server maker secret information generation operation)
First, with reference to FIG. 17 (refer to FIG. 14 as appropriate), the generation operation of the manufacturer secret information in the authentication information generation server will be described. FIG. 17 is a flowchart showing a maker secret information generation operation in the authentication information generation server according to the second embodiment of the present invention.

  First, the authentication information generation server 10B uses the identifier receiving unit 111 of the secret / update information generating unit 11B to identify the manufacturer of the receiving device 60B from the outside using an input unit (not shown) such as a keyboard. Is written into the authentication information storage means 13 (step S1).

Then, the authentication information generation server 10B generates maker secret information (Smid _i ) at random using random numbers in association with the maker identifier received in step S1, by the secret information generation unit 112 of the secret / update information generation unit 11B. And it writes in the information storage means 13 for authentication (step S2).

Then, the authentication information generation server 10B outputs the manufacturer secret information (Smid _i ) generated in step S2 by the secret information output means 17B (step S4B).
Through the above operation, the authentication information generation server 10B can generate different manufacturer secret information (encrypted manufacturer secret information) for each manufacturer (model).

(User terminal authentication using manufacturer secret information)
Next, referring to FIG. 18 (refer to FIG. 15 and FIG. 16 as appropriate), the authentication operation of the user terminal using the manufacturer secret information will be described. FIG. 18 is a flowchart showing an authentication operation using the manufacturer secret information of the receiving device in the user terminal (receiving device and security module) according to the second embodiment of the present invention. In this operation, in the authentication operation in the first embodiment described with reference to FIG. 7, there is no longer a step of transmitting and decrypting the manufacturer secret information from the receiving device to the security module, and a method for generating data of the manufacturer authentication response Is only different. Here, the same operations as those described in FIG. 7 are denoted by the same step numbers, and the description thereof is omitted.

  After the operations in steps S20 to S24 and steps S30 to S32, the receiving device 60B uses the authentication response generation unit 682B to store the manufacturer authentication challenge information (CHmid) and the manufacturer secret stored in the manufacturer secret information storage unit 66. From the information (Smid) and the manufacturer identifier (mid), maker authentication response information with a manufacturer identifier (authentication response information with identifier: RESmid) is generated as RESmid = (mid, ECHmid (= Hash (CHmid, Smid))). (Step S33B).

  Then, the receiving device 60B uses the authentication response transmitting unit 683 to transmit the manufacturer authentication response information with the manufacturer identifier generated in step S33B (maker authentication response information with identifier: RESmid) to the security module 70B (step S34B).

  The security module 70B receives the identifier-added manufacturer authentication response information (RESmid) transmitted from the receiving device 60B by the authentication response receiving unit 753 (step S35B).

Thereafter, the security module 70B uses the authentication response determination unit 754B to make the manufacturer secret information (Smid: Smid _i ) corresponding to the manufacturer identifier (mid) included in the identifier-added manufacturer authentication response information (RESmid = (mid, ECHmid)). Alternatively, (Smid _i−1 , Smid _i ) is read from the maker information storage unit 74, and the receiving device 60B is obtained from the maker authentication challenge information (CHmid) generated in step S30 and the read maker secret information (Smid). (Hash (CHmid, Smid _i ) and Hash (CHmid, Smid _i-1 )) by the same hash function Hash () and maker authentication challenge information that should be generated by the regular receiving device 60B ( ECHmid ') (Step S36B).

Then, the security module 70B uses the authentication response determination unit 754B to make the manufacturer authentication response information (ECHmid) included in the manufacturer authentication response information with identifier (RESmid) received in step S35B and the manufacturer generated in step S36B. The authentication response information (ECHmid ′) is compared (step S37B). If the manufacturer authentication response information is (ECHmid _i ) in step S37B, the authentication response determination unit 754B uses the generated manufacturer authentication response information (ECHmid _i ) and the received manufacturer authentication response information (ECHmid _i ). Comparison is made to determine whether or not the values are the same. On the other hand, when the maker authentication response information is (ECHmid _i-1 , ECHmid _i ), the authentication response determination unit 754B performs the two maker authentication response information (ECHmid _i-1 and ECHmid _i ), respectively, The received manufacturer authentication response information (ECHmid _i-1 , ECHmid _i ) is compared, and it is determined whether or not they are the same value. If either one is the same, it is determined that they are the same value. . The operation after step S38 is the same as the operation described in FIG.
With the above operation, the user terminal 50B can perform authentication between the receiving device 60B and the security module 70B based on the manufacturer secret information.

(Manufacturer confidential information update authentication operation)
Next, referring to FIG. 19 (refer to FIG. 15 and FIG. 16 as appropriate), the update authentication operation of the manufacturer secret information will be described. FIG. 19 is a flowchart showing the manufacturer secret information update authentication operation of the receiving device in the user terminal (receiving device and security module) according to the second embodiment of the present invention. Since this operation is the same as part of the update authentication operation in the first embodiment described with reference to FIG. 8, the same operation is given the same step number and the description thereof is omitted.

  Similarly to the operation described in FIG. 8, the receiving device 60B separates the encryption key information from the public information distributed via the broadcast wave and transmits it to the security module 70B in steps S20 to S22.

  The security module 70B receives the encryption key information transmitted from the receiving device 60B by the key information receiving unit 711 of the key / update information extracting unit 71B (step S23). The security module 70B decrypts the encrypted key information received in step S23 with the work key Kw by the key information decryption unit 712 of the key / update information extraction unit 71B, and decrypts the encrypted key information with the key information separation unit 713B. The scramble key (Ks) and the manufacturer update information (Mup) are separated from the key information (step S24), and the manufacturer update information is further separated into the manufacturer identifier (mid) and the manufacturer secret information (Smid) ( Step S25). Further, the security module 70B uses the key information decryption means 712 to write the maker secret information (Smid) separated in step S25 in association with the maker identifier (mid) into the maker information storage means 74 and store (update) it (step). S26). Thereafter, the authentication operation after security module 70B and step S30B is performed on receiving device 60B. In FIG. 19, step S30B shows the same operation as steps S30 to S37B in FIG.

  With the above operation, the user terminal 50B can perform authentication between the receiving device 60B and the security module 70B based on the manufacturer secret information. In addition, this makes it possible to stop the use of content in the receiving device 60B whose manufacturer secret information has not been updated.

(Revocation operation)
Next, with reference to FIG. 20 and FIG. 10, the use stop operation (revocation operation) of the receiving apparatus when the manufacturer secret information is leaked will be described. Note that the identification of the receiving device when the manufacturer secret information is leaked can be performed in the unauthorized receiving device identifying system described with reference to FIG.

(Revocation operation 1: Recall operation)
First, with reference to FIG. 20 (appropriately FIG. 14), an operation (recall operation) at the time of recall of the manufacturer as a preparation stage before performing the use stop operation of the receiving apparatus will be described. FIG. 20 is a flowchart showing an operation at the time of recall of the manufacturer as a preparation stage before performing the use stop operation of the receiving device when the manufacturer secret information is leaked in the second embodiment of the present invention.

  The revocation operation shown in FIG. 20 omits step S53 and replaces step S54 with step S54B with respect to the revocation operation of the content distribution system 1 (FIG. 1) of the first embodiment shown in FIG. The point is different.

That is, in this step S54B, the authentication information generation server 10B reads and synthesizes the manufacturer identifier (mid) and the manufacturer secret information (Smid _i ) stored in the authentication information storage means 13 by the secret information output means 17B. Manufacturer update information (Mup = (mid, Smid _i )) is generated.

  Thereafter, the manufacturer update information (Mup) including the manufacturer secret information (Smid) is distributed as public information to the user terminal 50B via the broadcast wave by the operations from step S57 to S61.

Then, the manufacturer secret information of the security module 70B is updated by the operations in steps S20 to S26 of FIG. Further, the security module 70B performs the authentication operation after step S30B in FIG. 19 on the receiving device 60B. Accordingly, the security module 70B performs the authentication described with reference to FIG. 18 with the receiving device 60B, and when the receiving device stores the old manufacturer secret information (Smid _i-1 ), or a new manufacturer by recalling. Even if the secret information (Smid _i ) is stored, the authentication is successful. That is, at this stage, even the receiving device 60B having only the old manufacturer secret information (Smid _i-1 ) succeeds in authentication.

(Revocation operation 2: Operation at the end of the recall period)
When the recall period ends, the operation of stopping the use of the receiving device that has not been recalled (the operation at the end of the recall period) is the same as the operation of the first embodiment of the present invention described in FIG. Therefore, explanation is omitted.

  As described above, according to the present invention, since the receivers 60 and 60B and the security modules 70 and 70B can perform authentication based on the manufacturer secret information, it is possible to specify an illegally manufactured receiver. At the same time, it is possible to stop the use of the content of the receiving device that has been fraudulent. Thus, the present invention can appropriately protect the copyright of the content.

1 Content Distribution System 10 Authentication Information Generation Server (Authentication Information Generation Device)
DESCRIPTION OF SYMBOLS 11 Secret / update information generation means 12 Device key generation means 13 Authentication information storage means 14 Update information composition means 15 Update information transmission means 16 Secret information encryption means 17 Secret information output means 18 Device key output means 20 Content distribution server (content Distribution device)
DESCRIPTION OF SYMBOLS 21 Content encryption means 22 Update information reception means 23 Key composition means 24 Key information encryption means 25 Public information composition means 26 Public information transmission means 30 Content server 40 Transmission apparatus 50 User terminal 60 Reception apparatus 61 Public information reception means 62 Publication Information separating means 63 Key receiving means 64 Content decrypting means 65 Key information transmitting means 66 Manufacturer secret information storage means (secret information storage means)
67 Manufacturer information transmission means (secret information transmission means)
68 Secret information authentication response means 681 Authentication challenge reception means 682 Authentication response generation means 683 Authentication response transmission means 70 Security module 71 Key / update information extraction means 711 Key information reception means 712 Key information decryption means 713 Key information separation means 72 Update information confirmation Means 721 Manufacturer information receiving means (secret information receiving means)
722 Secret information decryption means 723 Update information separation means 724 Update information determination means 73 Device key storage means 74 Manufacturer information storage means (second secret information storage means)
75 Secret information authentication confirmation means 751 Authentication challenge generation means 752 Authentication challenge transmission means 753 Authentication response reception means 754 Authentication response determination means 76 Key transmission control means

Claims (2)

A secret information generating means for generating a group unit secret information as information for authenticating the validity of the receiving device by associating a unique identifier for each predetermined group unit of the receiving device; Encrypting the group unit secret information with the same key as the key stored in the security module in the receiving device that performs control generates encrypted group unit secret information for registration in the receiving device A secret information encryption unit, and an update information combining unit that generates group unit update information by combining the identifier, the group unit secret information, and the updated group unit secret information when the group unit secret information is updated. And an authentication information generating apparatus comprising: a key synthesizing unit that generates key information obtained by adding a scramble key to the group unit update information. And key information encryption means for generating encryption key information by encrypting the key information with a work key in a conditional access method, and content for generating encrypted content by encrypting content with the scramble key A content distribution apparatus comprising: an encryption unit; and a reception apparatus that receives and reproduces the encrypted content.
Key information transmission means for transmitting the encryption key information generated by the content distribution device to the security module;
Secret information storage means for storing in advance the group unit secret information and the encrypted group unit secret information generated by the authentication information generation apparatus together with an identifier;
Secret information transmitting means for transmitting the encrypted group unit secret information stored in the secret information storage means together with an identifier to the security module;
In response to authentication challenge information transmitted from the security module, secret information authentication response means for generating response information using the group unit secret information stored in the secret information storage means as a key and transmitting the response information to the security module When,
Key receiving means for receiving a scramble key output as a result of authentication based on the encrypted group unit secret information and the response information from the security module;
Content decrypting means for decrypting the encrypted content using the scramble key received by the key receiving means;
A receiving apparatus comprising: Group unit confidential information that is information for authenticating the validity of the receiving device by associating a unique identifier for each predetermined group unit of the receiving device, and is secret information for registering in the receiving device And update information composition for generating group unit update information by combining the identifier, the group unit secret information and the updated group unit secret information when the group unit secret information is updated. An authentication information generating device comprising: means; key synthesizing means for generating key information obtained by adding a scramble key to the group unit update information; Generating encrypted content by encrypting the content with the key information encryption means for generating the encryption key information and the scramble key A content encryption unit, and content delivery apparatus having a, a said receiving device in a content distribution system having a receiving apparatus for receiving and reproducing the encrypted content,
Key information transmission means for transmitting the encryption key information generated by the content distribution device to the security module;
Secret information storage means for storing in advance the group unit secret information generated by the authentication information generating apparatus together with an identifier;
In response to authentication challenge information transmitted from the security module, secret information authentication response means for generating response information using the group unit secret information stored in the secret information storage means as a key and transmitting the response information to the security module When,
Key receiving means for receiving a scramble key output as a result of authentication based on the response information from the security module;
Content decrypting means for decrypting the encrypted content using the scramble key received by the key receiving means;
A receiving apparatus comprising:

Images