JP4812117B2 - Content encryption apparatus and program thereof, and content decryption apparatus and program thereof - Google Patents

Description

  The present invention relates to a content encryption device capable of partially encrypting digital content and a program thereof, and a content decryption device that decrypts and reproduces the partially encrypted digital content and a program thereof.

  In the so-called conditional access system (CAS), which broadcast programs in digital broadcasting are encrypted on the broadcaster side (transmission side) and the broadcast programs can be viewed only by limited viewers. Generally used by receivers that descramble (decode) scrambled (encrypted) broadcast programs (digital content, hereinafter referred to as content) based on key information generated by a viewer-specific security module (CAS card) Has been.

This content is generally encoded by MPEG-2 (Moving Picture Expert Group-2) and broadcast as a transport stream (TS).
In CAS, the payload part, which is the area of the data body of the packet (TS packet) constituting the transport stream, is encrypted, and this encryption can be decrypted only by the receiving apparatus with which a reception contract is made, The viewer can view the decoded video / audio.

On the other hand, in a receiving device that has not been subscribed to, since the encrypted transport stream cannot be decrypted, no video or the like is displayed. For example, a message such as “contract required” is displayed on the screen of the display device. Is displayed. This protects the copyright on the content.
However, in a receiving device that does not have a reception contract, since the viewer cannot see the video at all, the viewer's consciousness that he / she wants to view the video by making a reception contract may be impaired. Therefore, for the purpose of promoting content, it is desired to present a video (partial video, degraded video) that can be seen to some extent even in a receiving device that has not been subscribed to.

In response to such a request, as a method of protecting the copyright of the content and presenting a video that can be viewed to some extent to the viewer, in the MPEG-2 system, the video data as the content is rearranged in units of slices. A technique to be provided to a viewer is known (see Patent Document 1).
In this technique, a reception device stores a rearrangement pattern of slice positions, and based on the rearrangement pattern, restores the position of a slice of video data to reproduce the original content.
By using this technology, a receiving apparatus with a receiving contract can reproduce the original content as a normal video based on the rearrangement pattern acquired as a license. On the other hand, in a receiving apparatus that does not have a receiving contract, the content whose slice position has been changed is played back, so that it cannot be played back as a normal video.
Japanese Patent Laid-Open No. 10-229552

However, with the conventional technology for rearranging content in units of slices, an unauthorized person can illegally acquire the content itself whose slice position has been rearranged and tamper with it. For this reason, the conventional technology is not sufficient from the viewpoint of protecting the copyright of the content because an unauthorized person can restore the original content.
In addition, it is conceivable to partially encrypt the content slice for copyright protection, but the conventional receiving apparatus has the following problems.
That is, in the conventional receiving apparatus, it is good that the encrypted slice is decrypted and then decrypted by a decoder (encoding / decoding means), but since the license is not licensed, the encrypted slice is directly decoded by the decoder. In such a case, there is a problem that the decoder causes a malfunction due to an unknown code.

  The present invention has been made to solve the above-described problems, and allows a viewer who has not acquired a license to confirm the content of the content to some extent while protecting the copyright of the content. It is an object of the present invention to provide a content encryption device and its program capable of preventing malfunction of a receiving device (content decryption device), and a content decryption device and its program.

  The present invention has been developed to achieve the above object, and first, the content encryption device according to claim 1, the plurality of slices which are data forming a slice layer in the data structure of the digital content. A content encryption apparatus that partially encrypts the slice unit, comprising: a slice extraction unit, a slice encryption unit, a substitute slice generation unit, a multiplexing unit, and a license generation unit; did.

  According to such a configuration, the content encryption apparatus uses the slice extraction unit to extract the encryption target slice and the non-encryption from the digital content based on the predetermined encryption target information that identifies the slice to be encrypted. Separate the extracted slices and extract them. Here, the slice means MPEG-2, MPEG-4, H.264. H.264 / AVC data that forms a slice layer in the data structure of digital content encoded by an encoding method such as H.264 / AVC, and when decoded, has a predetermined width in the vertical direction in the screen (picture) This data is a band-like area.

Then, the content encryption apparatus generates an encrypted slice by encrypting the encryption target slice extracted by the slice extraction unit with the encryption key by the slice encryption unit. Note that, as the encryption key, for example, a key used in a common key encryption method or the like is used.
Then, the content encryption apparatus is a slice that includes a predetermined specific pattern that is encoded by the alternative slice generation unit using the same encoding method as that of the non-encrypted slice, and that is a substitute slice that serves as a substitute for the encrypted slice. Is generated. Since this substitute slice is encoded by the same encoding method as that of the non-encrypted slice, it can be used as a substitute for the encrypted slice in a content decrypting apparatus that cannot decode and decode the encrypted slice.

Then, the content encryption apparatus multiplexes the non-encrypted slice, the encrypted slice, and the substitute slice by the multiplexing unit.
Further, the content encryption apparatus generates a license including the encryption / decryption key corresponding to the encryption key and the encryption target information by the license generation unit. With this license, the content decrypting apparatus can recognize which slice is encrypted.

  The content encryption device according to claim 2 is the content encryption device according to claim 1, wherein the digital content is data encoded in units of macroblocks by a motion compensation prediction encoding method. The substitute slice generating means generates an I slice that is encoded data with a macroblock indicating a specific color, and skips a P slice and a B slice that are encoded data indicating a difference from a reference picture. It is configured to generate with a tomacro block.

  According to such a configuration, the content encryption apparatus uses the substitute slice generation unit to generate a macro that indicates a specific color (for example, gray) for a slice (I slice) that forms an I picture (an intra-frame encoded image). Create a substitute slice by block. Further, the content encryption apparatus uses the substitute slice generating means to convert the P picture (interframe forward prediction encoded image) or the slice (P, B slice) constituting the B picture (bidirectional predictive encoded image). On the other hand, a substitute slice is generated using a skipped macroblock. As a result, slices having no actual data are generated for the P slice and the B slice.

  Furthermore, the content encryption device according to claim 3 is the content encryption device according to claim 1, wherein the slice encryption unit includes an encryption unit and a code determination unit, and the encryption unit includes: When the prohibited code is included in the encrypted slice, the encrypted slice is re-encrypted and the number of times of encryption is added to the encrypted slice.

According to such a configuration, the content encryption apparatus encrypts the encryption target slice with the encryption key by the encryption unit of the slice encryption unit. Then, the content encryption apparatus determines whether or not the prohibition code is included in the encrypted slice encrypted by the encryption unit by the code determination unit. Re-encrypt the encrypted slice. The prohibition code is H.264. This is a specific byte sequence prohibited by the H.264 / AVC standard.
In this way, the forbidden code can be removed from the encrypted slice by performing re-encryption multiple times. Then, by adding the number of times of encryption to the encrypted slice, the content decryption apparatus can decrypt the encrypted slice into the original slice by performing decryption for the number of times of encryption.

  The content encryption device according to claim 4 is the content encryption device according to claim 1, wherein the slice includes a network header indicating header information of a network abstraction layer, and a slice indicating header information of the slice. The slice encryption unit is configured in the order of slice data indicating the header and the data of the slice, and the slice encryption unit converts each data of the network header and the slice header into the encryption target slice extracted by the slice extraction unit. Specific information extraction means for extracting as specific information for specifying the encryption target slice, encryption means for encrypting the slice header and the slice data of the encryption target slice, and encryption encrypted by the encryption means In the network header of the slice to be converted, the substitute slice is Encrypted slice recognition information setting means for setting recognition information indicating the presence, and the substitute slice generation means generates a slice including the specific pattern, and the specific pattern slice The slice header of the slice generated by the generation unit is set with the data of the slice header extracted by the specific information extraction unit, and the network header extracted by the specific information extraction unit is added to the encryption header. And a substitute slice recognition information setting unit that generates a substitute slice that serves as a substitute for the slice.

According to such a configuration, the content encryption apparatus sets recognition information indicating that a substitute slice exists in the network header of the encryption target slice by the encrypted slice recognition information setting unit. As a result, the content decrypting apparatus can recognize the encrypted slice obtained by encrypting the encryption target slice as a slice that is not subject to decryption when the license is not provided. Note that the recognition information may be any information that allows an unlicensed content decryption apparatus to recognize an encrypted slice as a slice that is not subject to decryption. For example, the recognition information is predetermined as a network abstraction layer standard. Use a code other than those listed.
In addition, the content encryption apparatus sets the network header of the encryption target slice to a slice including a predetermined specific pattern by the substitute slice recognition information setting unit. As a result, the slice (substitute slice) in which the network header is set becomes a slice that can be recognized in place of the encrypted slice in the content decryption apparatus.

  Furthermore, the content encryption device according to claim 5 is the content encryption device according to claim 1, wherein the slice includes a network header indicating header information of a network abstraction layer, and a slice indicating header information of the slice. The slice encryption unit is configured in the order of slice data indicating the header and the data of the slice, and the slice encryption unit converts each data of the network header and the slice header into the encryption target slice extracted by the slice extraction unit, Specific information extracting means for extracting as specific information for specifying the encryption target slice, encryption means for encrypting the slice data of the encryption target slice, and encryption target slice encrypted by the encryption means Recognition information indicating that the substitute slice exists in the slice header Encrypted slice recognition information setting means for setting, wherein the substitute slice generating means is generated by the specific pattern slice generating means for generating a slice including a predetermined specific pattern, and the specific pattern slice generating means Substitution as a substitute for the encrypted slice by setting the data of the slice header extracted by the specific information extraction means to the slice header of the slice and adding the network header extracted by the specific information extraction means And a substitute slice recognition information setting unit for generating a slice.

According to this configuration, the content encryption apparatus sets the recognition information indicating that the substitute slice exists in the slice header of the encryption target slice by the encrypted slice recognition information setting unit. As a result, the content decrypting apparatus can recognize the encrypted slice obtained by encrypting the encryption target slice as a slice that is not subject to decryption when the license is not provided. Note that the recognition information only needs to be information that allows an encrypted slice to be recognized as a non-decryption slice in a content decrypting apparatus that does not have a license. For example, the frame number of the slice is set to a nonstandard value. Use the value.
Further, the content encryption apparatus sets the slice header of the encryption target slice to a slice including a predetermined specific pattern by the substitute slice recognition information setting unit. As a result, the slice (substitute slice) in which the slice header is set becomes a slice that can be recognized in place of the encrypted slice in the content decryption apparatus.

  The content encryption device according to claim 6 is the content encryption device according to claim 1, wherein the slice includes a network header indicating header information of a network abstraction layer, and a slice indicating header information of the slice. The slice encryption unit is configured in the order of slice data indicating the header and the data of the slice, and the slice encryption unit converts the slice header data into the encryption target slice in the encryption target slice extracted by the slice extraction unit. Specific information extracting means for extracting as specific information to be specified; and encryption means for encrypting the slice header and the slice data of the encryption target slice, wherein the substitute slice generating means has a predetermined specific pattern Specific pattern slice generation means for generating a slice including A substitute slice that generates a substitute slice to substitute for the encrypted slice by setting the slice header data extracted by the specific information extraction means in the slice header of the slice generated by the specific pattern slice generation means Recognition information setting means, and the multiplexing means inserts the substitute slice between the network header of the encryption target slice and the data encrypted by the encryption means.

  According to such a configuration, the content encryption apparatus adds a slice including a predetermined specific pattern next to the network header by the multiplexing unit, and then the slice header and slice data are encrypted. Encrypted content is generated by adding data. As a result, in a content decrypting apparatus that does not have a license, one slice (substitute slice) is recognized by the slice including the network header and the specific pattern that follows, and subsequent encrypted data is not recognized. become.

  Further, the content encryption device according to claim 7 is the content encryption device according to claim 6, wherein the multiplexing means is encrypted immediately before the data encrypted by the encryption means. In this configuration, a unique code for identifying the data is added.

  According to such a configuration, the content encryption apparatus adds a unique code immediately before the encrypted data. As a result, the content decrypting apparatus having a license can search for the position of the encrypted data by using the unique code in the encrypted content.

  Further, the content encryption program according to claim 8, the computer is configured to slice a plurality of slices, which are data forming a slice layer in the data structure of the digital content, in a slice unit. It is configured to function as an extraction unit, a slice encryption unit, a substitute slice generation unit, a multiplexing unit, and a license generation unit.

According to this configuration, the content encryption program uses the slice extraction unit to extract the encryption target slice and the non-encryption from the digital content based on the predetermined encryption target information that identifies the slice to be encrypted. Separate the extracted slices and extract them.
Then, the content encryption program generates an encrypted slice by encrypting the encryption target slice extracted by the slice extraction unit with the encryption key by the slice encryption unit.
The content encryption program is a slice that includes a predetermined specific pattern that is encoded by the alternative slice generation means in the same encoding method as that of the non-encrypted slice, and that is a substitute slice that substitutes for the encrypted slice. Is generated.
Then, the content encryption program multiplexes the non-encrypted slice, the encrypted slice, and the substitute slice by the multiplexing means. Further, the content encryption program generates a license including the encryption / decryption key corresponding to the encryption key and the encryption target information by the license generation unit.

  Furthermore, the content decryption device according to claim 9 is configured to transmit an encrypted slice partially encrypted in units of the slice in a plurality of slices that are data forming a slice layer in the data structure of the digital content. A content decrypting apparatus for decrypting encrypted content that is multiplexed by being added to a substitute slice including a predetermined specific pattern serving as a substitute for an encrypted slice, and encryption target information for specifying the encrypted slice; License storage means for storing a license including an encryption / decryption key for decrypting the encrypted slice, slice extraction means for sequentially extracting the slice from the encrypted content, and the slice extracted by the slice extraction means Whether or not the slice is a substitute slice, the encryption target included in the license A substitute slice determining means for determining based on the information, and a substitute for deleting a slice determined as a substitute slice by the substitute slice determining means when the license includes an encryption / decryption key corresponding to the encrypted slice A slice deletion unit, an encrypted slice decryption unit that encrypts and decrypts the encrypted slice added to the substitute slice deleted by the substitute slice deletion unit, and a code that is encrypted and decrypted by the encrypted slice decryption unit An encryption / decryption unit for decoding, and when the license does not include an encryption / decryption key corresponding to the encrypted slice, the encoding / decoding unit decodes the substitute slice.

According to such a configuration, when the license includes an encryption / decryption key corresponding to the encrypted slice, the content decryption apparatus deletes the substitute slice corresponding to the encrypted slice by the substitute slice deleting unit. Thereafter, the content decrypting apparatus reproduces the encrypted slice by decrypting the encrypted slice by the encrypted slice decrypting unit and performing the decryption by the code decrypting unit.
On the other hand, if the license does not include the encryption / decryption key corresponding to the encrypted slice, the content decrypting apparatus encodes / decrypts the substitute slice instead of the encrypted slice by the encoding / decoding means. As a result, when the encryption / decryption key corresponding to the encrypted slice is not provided, the content decryption apparatus presents the video with the image partially degraded by the substitute slice pattern.

  In addition, the content decryption program according to claim 10, in a plurality of slices which are data forming a slice layer in a data structure of digital content, an encrypted slice partially encrypted in units of the slice, Slice extracting means for sequentially extracting the slice from the encrypted content in order to decrypt the encrypted content that is multiplexed by being added to the substitute slice including a predetermined specific pattern as a substitute for the encrypted slice The substitute slice determining means for determining whether the slice extracted by the slice extracting means is the substitute slice based on encryption target information for specifying the encrypted slice included in the license, the license Contains an encryption / decryption key corresponding to the encrypted slice , A substitute slice deleting unit that deletes a slice that has been determined as a substitute slice by the substitute slice determining unit, and an encrypted slice decoding that decrypts the encrypted slice added to the substitute slice deleted by the substitute slice deleting unit Means for decoding the slice decrypted by the encrypted slice decrypting means, and when the license does not include an encryption / decryption key corresponding to the encrypted slice, the code decryption is performed. The means is configured to code-decode the substitute slice.

According to this configuration, when the license includes an encryption / decryption key corresponding to the encrypted slice, the content decryption program deletes the substitute slice corresponding to the encrypted slice by the substitute slice deleting unit. Thereafter, the content decrypting apparatus reproduces the encrypted slice by decrypting the encrypted slice by the encrypted slice decrypting unit and performing the decryption by the code decrypting unit.
On the other hand, when the license does not include the encryption / decryption key corresponding to the encrypted slice, the content decryption program encodes / decrypts the substitute slice instead of the encrypted slice by the encoder / decryptor.

  Furthermore, the content decryption device according to claim 11 is a content decryption device for decrypting the encrypted content generated by the content encryption device according to claim 4, wherein an encryption / decryption key for decrypting the encrypted slice is provided. License storage means for storing the included license, slice extraction means for sequentially extracting the slices from the encrypted content, and whether or not the slice extracted by the slice extraction means is a substitute slice. Substitute slice determination means for determining based on recognition information set in the added encrypted slice, and the substitute slice determination when the license includes an encryption / decryption key corresponding to the encrypted slice A substitute slice deleting means for deleting a slice determined as a substitute slice by the means, and this substitute An encrypted slice decrypting means for encrypting and decrypting the encrypted slice added to the substitute slice deleted by the slice deleting means, and a code decoding means for decoding and decoding the slice decrypted by the encrypted slice decrypting means, When the license does not include an encryption / decryption key corresponding to the encrypted slice, the encoding / decrypting means encodes / decodes the substitute slice.

  According to such a configuration, the content decryption apparatus determines whether or not there is a substitute slice based on the recognition information set in the encrypted slice added to the substitute slice. Thereby, the content decryption apparatus can determine whether or not the slice is a substitute slice based on the data of the encrypted content.

  A content decrypting device according to claim 12 is a content decrypting device for decrypting encrypted content generated by the content encrypting device according to claim 7, wherein the content decrypting device has an encryption / decryption key for decrypting an encrypted slice. License storage means for storing the included license, slice extraction means for sequentially extracting the slices from the encrypted content, and whether or not the slice extracted by the slice extraction means is a substitute slice. Substitute slice judging means for judging based on a unique code for specifying the added encrypted data, and the substitute slice when the license includes an encryption / decryption key corresponding to the encrypted slice A substitute slice deleting means for deleting a slice determined as a substitute slice by the judging means, and this substitute An encrypted slice decrypting means for encrypting and decrypting the encrypted slice added to the substitute slice deleted by the slice deleting means, and a code decoding means for decoding and decoding the slice decrypted by the encrypted slice decrypting means, When the license does not include an encryption / decryption key corresponding to the encrypted slice, the encoding / decrypting means encodes / decodes the substitute slice.

  According to such a configuration, the content decryption apparatus determines whether or not there is a substitute slice by using a unique code that specifies encrypted data added to the substitute slice. Thereby, the content decryption apparatus can determine whether or not the slice is a substitute slice based on the data of the encrypted content.

The present invention has the following excellent effects.
According to the invention described in claim 1, claim 4, claim 5, claim 6 or claim 8, the digital content can be partially encrypted. On the decryption side, even when the encryption key (encryption / decryption key) used for encryption is not acquired, it is possible to reproduce a degraded video in which only the unencrypted portion is restored. Thus, the viewer can partially confirm the content, and the viewer's willingness to purchase the content can be enhanced.
In addition, on the decryption side that does not have the encryption / decryption key, instead of the encrypted slice, the substitute slice encoded by the same encoding method as the non-encrypted slice is decoded. It is possible to prevent malfunctions due to the inclusion of codes that are not defined in. Thus, an existing decoder can be used in the content decrypting apparatus.

  According to the second aspect of the present invention, since the substitute slice is generated by the skipped macroblock, the code amount of the generated encrypted content can be suppressed.

  According to the invention described in claim 3, by repeating re-encryption, it is possible to generate an encrypted slice that does not include the prohibited code, and to add the re-encryption count to the encrypted slice. As a result, it is possible to prevent the decryption side from erroneously recognizing the encrypted slice by the prohibited code.

  According to the seventh aspect of the invention, by adding the code for specifying the encrypted data, the position of the encrypted data can be searched at high speed on the decryption side.

According to the invention of claim 9, claim 10, claim 11 or claim 12, when there is no license (encryption / decryption key), the decryption side includes a specific pattern instead of the encryption slice. Since the substitute slice is encoded and decoded and presented, the display of the encrypted slice can be unified with the pattern designated on the transmission side.
Furthermore, even if the encrypted slice contains a code undefined for the decoder (encoding / decoding means), an existing decoder (encoding / decoding means) is used to decode / decode the substitute slice instead of the encrypted slice. Can be used to decode the slice.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
Here, first, after describing the structure and the like of the slice, the embodiment of the present invention will be specifically described.

<About slices>
[Slice structure]
First, the structure of the content slice will be described. Note that the content is encoded in units of band-like regions (slices) having a predetermined width in the vertical direction and an arbitrary length in the horizontal direction for each time-series image (picture) constituting the video. It is assumed that it is encoded by a method. As encoding methods for performing encoding in units of slices, MPEG-2, MPEG-4, H.264, and the like are available. H.264 / AVC and the like exist here. H.264 / AVC is used.
This H. In H.264 / AVC, video as content is encoded in a six-layered structure including a sequence layer, a GOP (Group of Pictures) layer, a picture layer, a slice layer, a macroblock layer, and a block layer.

Here, the data structure of the slice layer will be described with reference to FIG. FIG. 2 is a data structure diagram showing a data structure of a slice layer in H.264 / AVC.
H. In the slice layer in H.264 / AVC, each slice is abstracted with a predetermined data structure (NAL unit) by a network abstraction layer (NAL) in consideration of distribution in a network or broadcast.
Specifically, as shown in FIG. In H.264 / AVC, slices in the slice layer are followed by NAL units of an access unit delimiter (AUD), a sequence parameter set (SPS), and a picture parameter set (PPS). Similarly, video data is encoded and stored in a VCL (Video Coding Layer) unit having the data structure of the NAL unit. This VCL unit includes types such as IDR (Instantaneous Decoding Refresh) and non_IDR (other than IDR).

This VCL unit is composed of a header portion (NAL unit header portion [network header]) H of NAL unit indicating header information of the network abstraction layer and a payload P (RBSP: Raw Byte Sequence Payload). The payload P stores a slice header SH indicating slice header information and slice data SD indicating slice data. If the slice data is less than the unique data length of the payload P, dummy data DD is stored. Further stored.
Here, in the header (NAL unit header portion) H, an identifier indicating the type (AUD, SPS, PPS, IDR, etc.) of the NAL unit is written. Also, the slice type, frame number, and the like are written in the slice header SH.

  Note that the slice type indicates whether the slice is an I slice (a slice that performs only intra-frame coding) or a P slice (a slice that performs intra-frame coding and inter-picture prediction coding using one reference picture). Or B slice (a slice for performing inter-picture coding and inter-picture prediction coding using one or two reference pictures). If the picture is an I picture, the picture is composed of I slices. When a picture is a P picture, the picture is basically composed of P slices, but a plurality of types of slices may be mixed in the picture. The frame number is a number for identifying a picture composed of the slice. For example, the frame number is a serial number from “0” to “255”.

[Relationship between slice and picture]
Next, with reference to FIG. 2 and FIG. 3, the relationship between slices and pictures (images) will be described. FIG. 2 is an explanatory diagram for explaining the relationship between slices and pictures. FIG. 3 is a diagram showing an example of displaying the contents of a video, where (a) is an original video, (b) is a display video in a content decryption apparatus for which a license has not been acquired, and (c) is a license acquired. The display image in the content decoding apparatus is shown.

As shown in FIG. An image (picture) that constitutes a video continuously in time series encoded in H.264 / AVC is configured by slices S (S _{1 to} S _N ) obtained by dividing the image into a plurality of portions in the vertical direction (vertical direction). In FIG. 2, the slice numbers are numbers sequentially attached in the picture, but are not particularly stored in the slice header SH (FIG. 1).
Thus, in a state where one picture is composed of a plurality of slices, for example, when only the odd-numbered slice of the original video in FIG. 3A is encrypted, the license includes an encryption key for decrypting the slice. In the state in which the image is not acquired, as shown in FIG. 3B, the odd-numbered slices are not reproduced normally and deteriorated. When the license is acquired, as shown in FIG. 3C, the encrypted odd-numbered slice is decrypted, and the same quality video as the original video in FIG. 3A is reproduced. It will be.

[About slice encryption]
Next, an outline of slice encryption in the present invention will be described.
In the content encryption device according to the present invention, digital content is partially encrypted in units of slices, and the encrypted slice (encrypted slice) cannot be decoded (encoded / decoded) as encoded data. For the reception device (content decryption device), a slice (substitution slice) including a specific pattern is multiplexed as a substitute slice of the encrypted slice.
As a result, in the content decryption apparatus that has acquired the encryption key as a license, the original content is normally reproduced. However, in the content decryption apparatus that has not acquired the encryption key, the encrypted slice is encoded. By encoding and decoding a slice of a specific pattern instead of decoding, the specific pattern is partially displayed during content reproduction.

In addition, since encrypted slices and substitute slices coexist in encrypted content, content substitute devices that do not have a license recognize encrypted slices as slices that are not subject to decryption, so that only substitute slices can be obtained. Can be decrypted.
Therefore, in the present invention, a method for recognizing an encrypted slice as a non-decryption slice (encryption method A) by changing the header of the NAL unit, and an encrypted slice by changing the slice header. Exemplifying a method for recognizing a slice that is not a decryption target (encryption method B) and a method for recognizing a slice that is not a decryption target by making the encrypted slice redundant data (encryption method C); To do.

Hereinafter, the configuration and operation of a content encryption apparatus for realizing three methods (encryption methods A, B, and C) with different encryption methods for encrypting content in units of slices will be described. In the following, a content encryption device using the encryption method A as the first embodiment, a content encryption device using the encryption method B as the second embodiment, and an encryption method as the third embodiment. Each of the content encryption apparatuses using C will be described.
Furthermore, a content decrypting apparatus that decrypts encrypted content will be described as a fourth embodiment.

<First Embodiment>
[Configuration of content encryption device]
First, the configuration of the content encryption apparatus according to the first embodiment will be described with reference to FIG. FIG. 4 is a functional block diagram showing the configuration of the content encryption apparatus according to the first embodiment of the present invention. The content encryption apparatus 1A shown in FIG. 4 generates encrypted content obtained by partially encrypting digital content in units of slices. The content encryption apparatus 1A also allows a content decryption apparatus that has not acquired a license to recognize an encrypted slice as a slice that is not a decryption target by changing the header of the NAL unit (encryption technique). A) is realized.

  Here, the content encryption apparatus 1A includes an encryption parameter generation unit 11, an encoding unit 12, a slice extraction unit 13, a slice encryption unit 14, a substitute slice generation unit 15, a multiplexing unit 16, and a license. And generating means 17.

  The encryption parameter generation unit 11 includes an encryption parameter (encryption key or the like) used when encrypting a slice, and an encryption / decryption parameter (an encryption / decryption key or the like corresponding to the encryption key) used when decrypting the encrypted slice. ) And. The generated encryption parameter is output to the slice encryption unit 14. Further, the generated encryption / decryption parameters are output to the license generation means 17.

Note that the number of encryption keys is not necessarily one. That is, the encryption parameter generation unit 11 may generate a plurality of encryption keys and associate different encryption keys with each slice.
Here, the encryption key has KeyID, which is identification information of the encryption key, and encryption key data used for encryption. In order to reduce the load on the playback-side device (content decryption device), this encryption key data is encrypted using, for example, DES (Data Encryption Standard) or AES (Advanced Encryption Standard), which are common key encryption methods. It is generated by an algorithm. In the following description, the encryption / decryption key and the encryption key are assumed to be the same.

The encoding means 12 encodes digital content (video signal) by a predetermined compression encoding method (motion compensation prediction encoding method). This compression encoding method is, for example, H.264. H.264 / AVC. The encoding unit 12 generates encoded content encoded in units of slices. This encoded content (encoded digital content) is output to the slice extracting means 13.
Note that the digital content to be encrypted is already H.264. In the case of content encoded by H.264 / AVC or the like, the encoding means 12 can be omitted from the configuration of the content encryption device 1A.

The slice extraction unit 13 separates a slice to be encrypted (encryption target slice) and a slice not to be encrypted (unencrypted slice) from the encoded content based on the encryption target information. To extract. Here, the encryption target information is information for specifying a slice to be encrypted, and includes, for example, a picture type (picture type), a slice type (slice type), a slice number (of the slice). Macroblock start position).
The slice extraction unit 13 outputs the encryption target slice to the slice encryption unit 14 and outputs the non-encrypted slice to the multiplexing unit 16.

  The slice encryption unit 14 encrypts a slice (encryption target slice) with an encryption key to generate an encrypted slice. Here, the slice encryption unit 14 includes a specific information extraction unit 14a, an encryption unit 14b, a code determination unit 14c, a counting unit 14d, and an encrypted slice recognition information setting unit 14e.

The specific information extracting unit 14a extracts information (slice specifying information) for specifying the encryption target slice from the encryption target slice. The specific information extraction unit 14a extracts the data of the header H (see FIG. 1) of the NAL unit and the data of the slice header SH (see FIG. 1) from the encryption target slice.
This slice specifying information (NAL unit header data, slice header data) is output to the substitute slice generating means 15.

The encryption unit 14b encrypts the encryption target slice with the encryption key generated by the encryption parameter generation unit 11. Here, the encryption unit 14b encrypts the slice header and the slice data excluding the header of the NAL unit.
Note that the encryption unit 14b normally encrypts the slice extracted by the slice extraction unit 13 (encryption target slice). However, according to an instruction from the code determination unit 14c, the encryption unit 14b can also encrypt an already encrypted slice. Re-encrypt. The encrypted slice (encrypted slice) is output to the code determination unit 14c. In addition, the encryption unit 14b notifies the counting unit 14d that the slice has been encrypted.

The code determination unit 14c analyzes the data code of the encrypted slice and determines whether there is a prohibited code. Here, the prohibition code is a code defined as a unique code that has special meaning as an encoded code. The start code of the NAL unit in H.264 / AVC.
The code determination unit 14c instructs the encryption unit 14b to perform re-encryption when a prohibited code is included in the data code of the encrypted slice. As a result, the encrypted slice is composed of a data code that does not include a prohibition code (such as a start code).
Then, the code determination unit 14c outputs the generated encrypted slice to the encrypted slice recognition information setting unit 14e when the prohibition code is not included in the data code of the encrypted slice.

  The counting means 14d counts the number of times of encryption based on the notification from the encryption means 14b. The number of times of encryption indicates the number of times (the number of times of decryption) the decryption device (content decryption device) decrypts the encrypted slice with the encryption / decryption key. Therefore, the counting unit 14 d outputs the number of times of encryption to the license generation unit 17.

  In order for the encrypted slice recognition information setting unit 14e to cause the content decrypting apparatus that does not have the function of decrypting (encoding / decoding) the encrypted slice to recognize that the encrypted slice is a non-decryption slice, that fact Is set in the encrypted slice. The encrypted slice (substitute slice) in which the recognition information is set is output to the multiplexing unit 16. The recognition information is not particularly limited as long as the content decrypting apparatus that does not have the function of decrypting the encrypted slice recognizes the encrypted slice as a slice that is not a decryption target.

Here, the encrypted slice recognition information setting unit 14e sets a code other than the type of the NAL unit in the header of the NAL unit as the recognition information.
That is, the encrypted slice recognition information setting unit 14e sets the NAL unit type (nal_unit_type) of the header of the NAL unit to Reserved (nal_unit_type = 23).
As a result, the encrypted slice is recognized as a slice that is not subject to decryption in a content decrypting apparatus that does not have a license. In addition, since the content decrypting apparatus having a license can recognize which slice is the slice to be encrypted by the license, the encrypted slice can be recognized as the slice to be decrypted.

  The substitute slice generating means 15 generates a slice including a predetermined specific pattern as a slice (substitute slice) that is used as a substitute for the encrypted slice. Here, the substitute slice generating unit 15 includes a specific pattern slice generating unit 15a and a substitute slice recognition information setting unit 15b.

The specific pattern slice generation unit 15a generates a slice including a predetermined specific pattern. For example, the specific pattern slice generation unit 15a generates a slice whose display color is gray as the specific pattern.
At this time, when the slice type of the encrypted slice is an I slice, the specific pattern slice generation unit 15a generates a slice with a macroblock indicating a specific color (here, gray).
Further, when the slice type of the encrypted slice is a P slice or a B slice, the specific pattern slice generation unit 15a generates each slice with a skipped macroblock, for example.

  Here, with reference to FIG. 9 (refer to FIG. 4 as appropriate), the data structure of the slice generated by the specific pattern slice generation means 15a will be described in detail. FIG. 9 is a diagram illustrating a data structure of a slice, where (a) illustrates an I slice, (b) illustrates a P slice, and (c) illustrates a B slice data structure.

When generating the I slice, the specific pattern slice generating unit 15a generates a slice by configuring a macro block as shown in FIG. In FIG. 9A, “I_16 × 16_2_0_0”, “I_16 × 16_1_0_0”, and “I_16 × 16_0_0_0” The type name of the macroblock in H.264 / AVC is shown. “Intra_chroma_pred_mode”, “mb_qp_delta”, and “coeff_token” indicate macroblock parameters, respectively.
Thus, it is possible to generate a slice in which the display pattern shows one color (here, gray) with the minimum data amount.

In addition, when generating the P slice or the B slice, the specific pattern slice generation unit 15a generates a P slice by configuring a macroblock as illustrated in FIG. 9B, as illustrated in FIG. 9C. B slices are generated by constructing macroblocks. In FIG. 9B and FIG. 9C, “P_Skip” and “B_Skip” The model name of the skipped macroblock in H.264 / AVC is shown. Further, “mb_skip_run” indicates a parameter indicating how many skipped macroblocks are continuously arranged.
As a result, H. In H.264 / AVC, it is possible to generate a macroblock by interpolating from an I slice on the decoding side without adding a macroblock having actual data as a P slice and a B slice. The amount can be reduced.
Returning to FIG. 4, the description of the configuration of the content encryption device 1A will be continued.

  The substitute slice recognition information setting unit 15b embeds recognition information in the slice so that the slice generated by the specific pattern slice generation unit 15a is recognized as a substitute slice in the playback side device (content decoding device). . The substitute slice in which the recognition information is embedded is output to the multiplexing unit 16.

  Here, the substitute slice recognition information setting unit 15b embeds the slice header data output from the slice encryption unit 14 in the slice header of the slice generated by the specific pattern slice generation unit 15a. As a result, the substitute slice is recognized as a normal slice (unencrypted slice) in the content decryption apparatus. For example, the substitute slice recognition information setting unit 15b sets the frame number and slice type of the slice header output from the slice encryption unit 14 as the recognition information as slice header data.

  The multiplexing unit 16 multiplexes the unencrypted slice extracted by the slice extraction unit 13, the encrypted slice generated by the slice encryption unit 14, and the substitute slice generated by the substitute slice generation unit 15. Thus, the encrypted content that is partially encrypted is generated. Here, the multiplexing unit 16 generates the encrypted content by inserting the substitute slice before the encrypted slice.

Here, since the NAL units for the substitute slice increase, In an encoding scheme such as H.264 / AVC, the multiplexing means 16 corrects the PES packet length of the PES header to be increased by the substitute slice after reconstructing the PES packet. However, when the original PES packet length is “0”, the correction is not performed because the PES packet length is not used.
Furthermore, the multiplexing means 16 also reconstructs TS packets as the amount of data increases. As a result, H. Encrypted content conforming to an encoding method such as H.264 / AVC is generated.

The license generation unit 17 includes the encryption / decryption parameter (encryption / decryption key corresponding to the encryption key) generated by the encryption parameter generation unit 11, the number of encryptions counted by the counting unit 14d of the slice encryption unit 14, and the encryption The license is generated based on the information to be activated.
The license generated by the license generation means 17 is distributed to the content decrypting apparatus with which the reception contract is made via a broadcast wave, a network, or the like.
Note that the license generation unit 17 may generate a plurality of licenses having different numbers of encryption / decryption keys for the encrypted content. Accordingly, it is possible to control the degree of video viewing in the content decrypting apparatus according to the type of license.

  Here, the contents of the license (license file) generated by the license generating means 17 will be described with reference to FIG. FIG. 10 is a data structure diagram showing an example of the contents of a license file. As shown in FIG. 10, in the license file, each element is given a meaning by the following tag.

The area indicated by the tag with the tag name “Key” includes identification information of the encryption / decryption key and encryption key data. Here, a plurality of identification information “000” and the like and encryption key data “112233” and the like are described in association with each other.
The area indicated by the tag with the tag name “Cipher” includes the type of cipher method (CipherType) and the like. Here, the encryption method type is “A”.
In the area indicated by the tag with the tag name “CipherXXX”, the picture number (Picture) to which the slice identified by “XXX” belongs, the slice number (Slice), and the identification information of the encryption key that encrypted the slice ( KeyID) and the number of times the slice has been encrypted (encryption count: Count).
For example, the tag with the tag name “Cipher000” indicates that the picture number is “0”, the slice number is “0”, the identification information of the encryption key is “001”, and the number of times of encryption is “1”.

As described above, the content encryption apparatus 1A generates partially encrypted content by changing whether or not the content encoded in units of slices is encrypted in units of slices. be able to.
Further, the content encryption apparatus 1A can make the content decryption apparatus without a license recognize the encrypted slice as a slice not to be decrypted by changing the header of the NAL unit. As a result, in a content decrypting apparatus that cannot decode and encrypt the encrypted slice as it is, the substitute slice can be displayed instead of the encrypted slice, and malfunction of the content decrypting apparatus can be prevented.
The content encryption apparatus 1A can be realized by operating a general computer by a program (content encryption program) that functions as each of the above-described units.

[Operation of content encryption device]
Next, the operation of the content encryption device according to the first embodiment will be described with reference to FIG. FIG. 5 is a flowchart showing the operation of the content encryption apparatus according to the first embodiment of the present invention.
Further, here, the contents of data processing performed by the content encryption device 1A will be specifically described with reference to FIGS. 6 and 7 as appropriate in accordance with the operation of the content encryption device 1A. 6 and 7 are schematic views schematically showing the contents of data processing of the content encryption apparatus according to the first embodiment of the present invention.

  First, the content encryption apparatus 1A uses the encryption parameter generation unit 11 to encrypt an encryption parameter (encryption key or the like) used when encrypting a slice and an encryption / decryption parameter (when used to decrypt the encrypted slice). An encryption / decryption key corresponding to the encryption key) is generated (step S1).

Further, the content encryption apparatus 1A generates encoded content by encoding digital content input from the outside by the encoding means 12 (step S2).
Then, the content encryption apparatus 1A uses the encoded content generated in step S2 based on the encryption target information (picture type, slice type, slice number, etc.) input from the outside by the slice extraction unit 13. A slice to be encrypted (encryption target slice) and a slice that is not to be encrypted (non-encrypted slice) are separated and extracted (step S3).
Specifically, for example, when the encryption target information is the picture type “IDR”, the slice type “I”, and the slice number “1”, the slice extracting unit 13 sets the condition as shown in FIG. Is extracted as an encryption target slice.

Thereafter, the content encryption apparatus 1A extracts the slice specifying information for specifying the encryption target slice from the encryption target slice by the specification information extracting unit 14a of the slice encryption unit 14 (step S4).
Specifically, the specific information extraction unit 14a extracts IDR NAL unit header data and slice header data (for example, frame number) as slice specific information, as shown in FIG. 6B. To do.

Then, the content encryption apparatus 1A generates an encrypted slice by encrypting the encryption target slice with the encryption key generated in step S1 by the encryption unit 14b of the slice encryption unit 14 (step S5). ).
Specifically, as shown in FIG. 6C, the encryption unit 14b encrypts the entire slice after the slice header excluding the header of the NAL unit.
In step S5, the content encryption apparatus 1A determines whether or not a prohibited code (start code or the like) is included in the encrypted slice by the code determination unit 14c. The encrypted slice is re-encrypted by the encryption unit 14b.

Then, the content encryption device 1A encrypts the encrypted slice encrypted in step S5 with respect to the content decryption device that does not have the decryption function of the encrypted slice by the encrypted slice recognition information setting unit 14e. The recognition information for recognizing the slice as a slice not to be decoded is embedded (step S6).
Specifically, the encrypted slice recognition information setting unit 14e sets the NAL unit type (nal_unit_type) described in the header of the NAL unit to Reserved (nal_unit_type = 23), as shown in FIG. 7D. .

  Then, the content encryption apparatus 1A generates a slice including a predetermined specific pattern (gray pattern) by the specific pattern slice generation unit 15a of the substitute slice generation unit 15 (step S7).

Further, the content encryption apparatus 1A generates a substitute slice by embedding the slice specifying information extracted in step S4 into the slice generated in step S7 by the substitute slice recognition information setting unit 15b (step S8).
Specifically, as shown in FIG. 7E, the substitute slice recognition information setting unit 15b embeds the slice header data extracted in FIG. 6B in the slice header.
Further, as shown in FIG. 7F, the substitute slice recognition information setting unit 15b embeds the header data of the NAL unit extracted in FIG. 6B in the header of the NAL unit of the slice. As a result, the slice becomes a substitute slice of the encrypted slice having the configuration of the NAL unit.

Thereafter, the content encryption apparatus 1A uses the multiplexing unit 16 to extract the unencrypted slice extracted in step S3, the encrypted slice in which the recognition information is embedded in step S6, and the substitute slice generated in step S8. Are multiplexed (step S9).
Specifically, as shown in FIG. 7G, the multiplexing unit 16 inserts a substitute slice having a NAL unit configuration before the encrypted slice.

Furthermore, the content encryption apparatus 1A reconstructs the PES packet by the multiplexing unit 16 and reconstructs the TS packet (step S10).
Further, the multiplexing unit 16 reconstructs the TS packet by dividing the data into a fixed-length TS packet size as the data amount increases.
Then, the content encryption apparatus 1A generates a license by the license generation unit 17 (step S11).

With the above operation, the content encryption apparatus 1A can generate encrypted content that is partially encrypted in units of slices.
In the generated encrypted content, the substitute slice and the encrypted slice coexist. However, since the header of the NAL unit of the encrypted slice has been changed, the content decryption apparatus that does not have a license cannot recognize the encrypted slice and displays a substitute slice. On the other hand, since the content decrypting apparatus having a license can recognize the encrypted slice, the video can be normally displayed by decrypting the encrypted slice without using the substitute slice. Further, since the substitute slice is not encrypted data, a malfunction does not occur even in a conventional decoder (encoding / decoding means).

The configuration and operation of the content encryption apparatus 1A that implements the encryption method A have been described above, but the present invention is not limited to this.
For example, here, the license generation means 17 is configured to include the number of encryptions in the license, but the number of encryptions may be added as data after the encryption slice. That is, as shown in FIG. 8, one byte of data indicating the number of encryptions is added after the encrypted NAL unit (Reserved [nal_unit_type = 23]). In this case, for example, “1” is set in the first bit of the number of times of encryption so that the number of times of encryption does not become a prohibited code such as a start code.

Although an example in which the license file is configured in units of pictures has been described here, the license file may be configured in accordance with the type of slice instead of in units of pictures.
For example, a license file may be configured as shown in FIG.
In the example of FIG. 11, in the region _{L 1,} the type of encryption method and (Cipher Type), which describes the information of the picture to be encrypted (IDR, Non-IDR). Here, the encryption method type is “A”, and the encryption target picture is both IDR and Non-IDR (other than IDR).

Further, in the region _{L 2,} and the identification information of the decryption key (Key Canada), describe the cipher key data (Value). A plurality of identification information and encryption key data may be described.
Also, the area _{L 3,} the slice type of the slice to be encrypted and (Type), a slice number (Num), describe the identification information decryption key (Key Canada) for that slice.
By generating a license in this way, the amount of license data can be reduced as compared to the case of generating a license for each picture.

Second Embodiment
[Configuration of content encryption device]
Next, the configuration of the content encryption apparatus according to the second embodiment will be described with reference to FIG. FIG. 12 is a functional block diagram showing the configuration of the content encryption apparatus according to the second embodiment of the present invention. The content encryption device 1B shown in FIG. 12 generates encrypted content obtained by partially encrypting digital content in units of slices. Further, the content encryption apparatus 1B uses a technique (encryption technique B) for recognizing an encrypted slice as a non-decryption slice by changing a slice header with respect to a content decryption apparatus without a license. It has been realized.

Here, the content encryption apparatus 1B includes an encryption parameter generation unit 11, an encoding unit 12, a slice extraction unit 13, a slice encryption unit 14B, a substitute slice generation unit 15, a multiplexing unit 16, and a license. And generating means 17B.
Since the configuration other than the slice encryption unit 14B and the license generation unit 17B is the same as that of the content encryption device 1A described with reference to FIG. 4, the same reference numerals are given and description thereof is omitted.

  The slice encryption unit 14B encrypts a slice (encryption target slice) with an encryption key. Here, the slice encryption unit 14B includes a specific information extraction unit 14a, an encryption unit 14Bb, a code determination unit 14c, a counting unit 14d, and an encrypted slice recognition information setting unit 14Be.

  Since the specific information extraction unit 14a, the code determination unit 14c, and the counting unit 14d have the same configuration as that of the content encryption device 1A described with reference to FIG. Here, the specific information extracting unit 14a outputs the slice specific information to the substitute slice generating unit 15 and the license generating unit 17B.

The encryption unit 14Bb encrypts the encryption target slice with the encryption key generated by the encryption parameter generation unit 11. Here, the encryption unit 14Bb encrypts slice data after the slice header of the encryption target slice. Note that since the slice header and the slice data may cross a byte boundary, the encryption unit 14Bb performs encryption from the beginning of the byte boundary of the slice data. The encrypted slice encrypted by the encryption unit 14Bb is output to the code determination unit 14c.
The encryption unit 14Bb has the same function as the encryption unit 14b (FIG. 4) in that re-encryption is performed in accordance with an instruction from the code determination unit 14c.

  The encrypted slice recognition information setting unit 14Be causes the content decrypting apparatus that does not have the decryption function of the encrypted slice to recognize that the encrypted slice is a non-decryption slice. Is set to the encrypted slice. The encrypted slice (substitute slice) in which the recognition information is set is output to the multiplexing unit 16.

Here, the encrypted slice recognition information setting unit 14Be sets the recognition information in the slice header data. For example, a value (for example, “257”) larger than the maximum value (for example, “256”) of the frame number is set in the frame number area of the slice header.
In addition to the frame number, the recognition information may be, for example, adding “10” to a value that is not normally used, for example, a value of the slice type, for example.
As a result, the encrypted slice is recognized as a slice that is not subject to decryption in a content decrypting apparatus that does not have a license.

  Note that slice headers (frame numbers and the like) are different within a picture, and it is necessary to reset slice headers (frame numbers and the like) to original values in a content decoding apparatus having a license. Therefore, the encrypted slice recognition information setting unit 14Be notifies the license generation unit 17B of information necessary for resetting (resetting information). Here, the encrypted slice recognition information setting unit 14Be notifies the license generation unit 17B of the pre-change frame number, the post-change frame number, and the NAL unit type of the encrypted slice as reset information.

  The license generation unit 17B includes the encryption / decryption parameter (encryption / decryption key corresponding to the encryption key) generated by the encryption parameter generation unit 11, the number of encryptions counted by the counting unit 14d of the slice encryption unit 14B, The license is generated based on the reset information notified from the encrypted slice recognition information setting unit 14Be and the encryption target information.

  FIG. 16 shows an example of the contents of the license (license file) generated by the license generation means 17B. As shown in FIG. 16, the license generated by the license generation unit 17B is basically the same as that described in FIG. 10, but for each picture, the frame number (p_frame_num) before the change, The difference is that the frame number (e_frame_num) and the type (e_frame_num_type) of the NAL unit of the encrypted slice are set. As a result, in the content decryption apparatus, it is possible to reset the slice header (frame number or the like) to the original value.

As described above, the content encryption apparatus 1B can recognize the encrypted slice as a non-decryption slice by changing the slice header with respect to the content decryption apparatus without a license. . As a result, in a content decrypting apparatus that cannot decode and encrypt the encrypted slice as it is, the substitute slice can be displayed instead of the encrypted slice, and malfunction of the content decrypting apparatus can be prevented.
The content encryption apparatus 1B can be realized by operating a general computer by a program (content encryption program) that functions as each of the above-described units.

[Operation of content encryption device]
Next, the operation of the content encryption apparatus according to the second embodiment will be described with reference to FIG. FIG. 13 is a flowchart showing the operation of the content encryption apparatus according to the second embodiment of the present invention.
Here, the contents of the data processing performed by the content encryption device 1B will be specifically described with reference to FIGS. 14 and 15 as appropriate in accordance with the operation of the content encryption device 1B. 14 and 15 are schematic views schematically showing part of the data processing contents of the content encryption apparatus according to the second embodiment of the present invention.
Note that the same operations as those of the content encryption apparatus 1A described with reference to FIG. 14 and FIG. 15 will be described only with respect to differences from FIG. 6 and FIG.

After the operation of step S4, the content encryption apparatus 1B encrypts the encryption slice by encrypting the encryption target slice with the encryption key generated in step S1 by the encryption unit 14Bb of the slice encryption unit 14B. Generate (step S5B).
Specifically, the encryption unit 14Bb encrypts the slice excluding the slice header as shown in FIG. At this time, the encryption unit 14Bb performs encryption from the beginning of the byte boundary of the slice data.
In step S5B, the content encryption apparatus 1B determines whether or not a prohibited code (start code or the like) is included in the encrypted slice by the code determination unit 14c. The encryption slice is re-encrypted by the encryption unit 14Bb.

Then, the content encryption apparatus 1B adds an encrypted slice to the content decryption apparatus that does not have a slice decryption function in the encrypted slice encrypted in step S5B by the encrypted slice recognition information setting unit 14Be. The recognition information for recognizing that the slice is not a decoding target is embedded (step S6B).
Specifically, the encrypted slice recognition information setting unit 14Be sets a value (for example, “257”) larger than the maximum value (for example, “256”) of the frame number, as shown in FIG. Set to the frame number area.
Then, the operation | movement of step S7-S10 is performed.

  The content encryption device 1B then resets the license generation unit 17B including the encryption / decryption parameter generated in step S1, the number of encryptions counted in step S5B, and the recognition information embedded in step S6B. A license is generated based on the information and the encryption target information (step S11B).

With the above operation, the content encryption device 1B can generate encrypted content that is partially encrypted in units of slices.
In the generated encrypted content, the slice header of the encrypted slice is changed. For this reason, a content decrypting apparatus that does not have a license recognizes an encrypted slice as a slice that is not subject to decryption.
The configuration and operation of the content encryption device 1B that implements the encryption method B have been described above, but the present invention is not limited to this. For example, as described with reference to FIG. 8, the number of encryptions may be added after the encryption slice.

<Third Embodiment>
[Configuration of content encryption device]
Next, the configuration of the content encryption apparatus according to the third embodiment will be described with reference to FIG. FIG. 17 is a functional block diagram showing the configuration of the content encryption apparatus according to the third embodiment of the present invention. The content encryption apparatus 1C shown in FIG. 17 generates encrypted content obtained by partially encrypting digital content in units of slices. In addition, the content encryption apparatus 1C allows a content decryption apparatus without a license to recognize an encrypted slice as a slice not to be decrypted by making the encrypted slice redundant data (encryption). Method C) is realized.

Here, the content encryption apparatus 1C, encryption parameter generation means 11, encoding means 12, slice extraction means 13, slice encryption means 14C, substitute slice generation means 15, multiplexing means 16C, and license generation And means 17.
Since the configuration other than the slice encryption unit 14C and the multiplexing unit 16C is the same as the configuration of the content encryption device 1A described with reference to FIG.

  The slice encryption unit 14C encrypts a slice (encryption target slice) with an encryption key. Here, the slice encryption unit 14C includes a specific information extraction unit 14Ca, an encryption unit 14b, a code determination unit 14c, and a counting unit 14d.

Since the configuration other than the specific information extracting unit 14Ca is the same as that of the content encryption device 1A described with reference to FIG. 4, the same reference numerals are given and description thereof is omitted. Further, the slice encryption unit 14C omits the configuration of the encrypted slice recognition information setting unit 14e from the slice encryption unit 14 of the content encryption apparatus 1A described with reference to FIG.
Here, it is assumed that the code determination unit 14c outputs the encrypted slice to the multiplexing unit 16C.

The specific information extraction unit 14Ca extracts information (slice specification information) for specifying the encryption target slice from the encryption target slice. The specific information extracting unit 14a extracts the data of the slice header SH (see FIG. 1) from the encryption target slice. The specific information extracting unit 14Ca is different from the specific information extracting unit 14a described in FIG. 4 in that it does not extract the header data of the NAL unit.
This slice specifying information (slice header data) is output to the substitute slice generating means 15.

The multiplexing unit 16C multiplexes the unencrypted slice extracted by the slice extraction unit 13, the encrypted slice generated by the slice encryption unit 14C, and the substitute slice generated by the substitute slice generation unit 15. Thus, the encrypted content that is partially encrypted is generated.
Here, the multiplexing unit 16C inserts a substitute slice between the header of the unencrypted NAL unit of the encrypted slice and the encrypted slice header. As a result, the substitute slice has the header of the NAL unit of the encrypted slice, and becomes a substitute for the encrypted slice. On the other hand, the encrypted slice data does not have the structure of the NAL unit, and thus becomes a meaningless redundant slice.

As described above, the content encryption apparatus 1C recognizes that the encrypted slice is a non-decryption slice by making the encrypted slice redundant data with respect to the content decryption apparatus without a license. Can be made. As a result, in a content decrypting apparatus that cannot decode and encrypt the encrypted slice as it is, the substitute slice can be displayed instead of the encrypted slice, and malfunction of the content decrypting apparatus can be prevented.
The content encryption apparatus 1C can be realized by operating a general computer with a program (content encryption program) that functions as each of the above-described units.

[Operation of content encryption device]
Next, the operation of the content encryption apparatus according to the third embodiment will be described with reference to FIG. 18 (refer to FIG. 17 as appropriate for the configuration). FIG. 18 is a flowchart showing the operation of the content encryption apparatus according to the third embodiment of the present invention.

Further, here, the contents of the data processing performed by the content encryption device 1C will be specifically described with reference to FIGS. 19 and 20 as appropriate in accordance with the operation of the content encryption device 1C. 19 and 20 are schematic views schematically showing part of the data processing content of the content encryption apparatus according to the third embodiment of the present invention.
Note that the same operations as those of the content encryption apparatus 1A described with reference to FIG. 19 and FIG. 20 will be described only with respect to differences from FIG. 6 and FIG.

After step S3, the content encryption apparatus 1C extracts slice specification information (slice header data) for specifying the encryption target slice from the encryption target slice by the specification information extraction unit 14Ca (step S4C).
After executing the operations of steps S5 and S7, the content encryption apparatus 1C embeds the slice identification information extracted in step S4C into the slice generated in step S7 by the substitute slice recognition information setting unit 15b. To generate a substitute slice (step S8C).

Thereafter, the content encryption apparatus 1C multiplexes the non-encrypted slice extracted in step S3, the encrypted slice encrypted in step S5, and the substitute slice generated in step 8C by the multiplexing unit 16C. (Step S9C).
Specifically, the multiplexing means 16C inserts a substitute slice between the encrypted NAL unit header of the encrypted slice and the encrypted data, as shown in FIG. 20 (g). To do. As a result, the encrypted data becomes redundant data (redundant slice) that cannot be recognized as a NAL unit.

  Note that the multiplexing means 16C may add a redundant slice start code indicating the head of the redundant slice before the redundant slice, as shown in FIG. This redundant slice start code is a unique code, for example, “0x000000BB” to distinguish it from other codes. This makes it possible to detect redundant slices at high speed on the playback side.

Thereafter, by executing the operations of steps S10 and S11, the content encryption device 1C can generate encrypted content partially encrypted in slice units.
Further, since the generated encrypted content is a redundant slice, a content decrypting apparatus that does not have a license recognizes the encrypted slice as a slice that is not subject to decryption.

<Fourth embodiment>
[Configuration of content decryption device]
Next, with reference to FIG. 22, the structure of the content decryption apparatus according to the fourth embodiment will be described. FIG. 22 is a functional block diagram showing the configuration of the content decryption apparatus according to the fourth embodiment of the present invention. The content decryption apparatus 2 shown in FIG. 22 converts the encrypted content generated by the content encryption apparatus 1A (see FIG. 4) (encrypted content generated by the encryption method A) into the content encryption apparatus 1A (FIG. 4) and decrypting based on the license generated.

  Here, the content decoding device 2 includes a license storage unit 21, a license determination unit 22, a slice extraction unit 23, a slice decoding unit 24, and a code decoding unit 25.

  The license storage unit 21 stores a license and is a tamper-resistant module such as an IC card. Note that the license may be input via a recording medium by input means (not shown) or may be acquired via a network.

The license determination unit 22 determines (searches) whether the license corresponding to the input encrypted content is stored (obtained) in the license storage unit 21, thereby determining the output destination of the encrypted content. It is to switch.
Here, the license determining unit 22 outputs the encrypted content to the slice extracting unit 23 when a license corresponding to the input encrypted content is acquired, and when the license is not acquired, the license determining unit 22 outputs the encrypted content. The data is output to the code decoding means 25.
Note that the license determination unit 22 may determine whether a license has been acquired for encrypted content stored in advance in a content storage unit (not shown).

  The slice extracting unit 23 extracts a slice for each picture from the encrypted content for which it is determined that the license is acquired by the license determining unit 22. The extracted slice is output to the slice decoding unit 24.

  The slice decryption unit 24 decrypts an encrypted slice among the slices extracted by the slice extraction unit 23 based on the license. Here, the slice decryption unit 24 includes a substitute slice determination unit 24a, a substitute slice deletion unit 24b, and an encrypted slice decryption unit 24c.

  The substitute slice determining unit 24a determines whether or not the slice extracted by the slice extracting unit 23 is a substitute slice based on the encryption target information that identifies the encrypted slice included in the license. . Here, since the substitute slice is a substitute for the encrypted slice, the substitute slice determination unit 24a uses the substitute target slice as a substitute slice based on the encryption target information. Judge that there is. The determination result is output to the substitute slice deleting unit 24b.

The substitute slice deleting unit 24b is configured to delete a slice that has been determined as a substitute slice by the substitute slice determining unit 24a when an encryption / decryption key corresponding to the encrypted slice is included in the license.
That is, the substitute slice deleting unit 24b deletes the slice extracted as the substitute slice when the slice extracted by the slice extracting unit 23 is the slice to be encrypted and the encryption key is acquired. In this case, the substitute slice deleting unit 24b outputs the subsequent slice (encrypted slice) to the encrypted slice decrypting unit 24c.

The substitute slice deleting unit 24b outputs the substitute slice as it is to the code decoding unit 25 when the slice is a slice to be encrypted and an encryption key is not acquired. Even when the slice is not a slice to be encrypted, the slice is output to the encoding / decoding means 25 as it is.
As a result, even if a license is acquired, it is possible to control whether or not to display a substitute slice depending on the contents of the license (the presence or absence of an encryption key).

  The encrypted slice decryption unit 24 c decrypts (encrypts and decrypts) the encrypted slice based on the license (encryption key) stored in the license storage unit 21. The encrypted slice decrypting unit 24c decrypts the encrypted slice by the number of times of encryption when there are a plurality of times of encryption described in the license. As a result, the original slice is decoded. The decoded slice is output to the code decoding means 25.

  The encoding / decoding means 25 decodes (encodes and decodes) encoded data of an unencrypted slice or a substitute slice included in the encrypted content, or a slice from which the encryption is decrypted. This code decoding means 25 outputs the reproduction content (video signal) which is display data which can be viewed by decoding the encoded data of each slice. The code decoding means 25 is, for example, H.264. This is a general decoder in H.264 / AVC.

As described above, the content decryption apparatus 2 can decrypt the encrypted content encrypted in units of slices based on the license.
Further, when the license is not acquired, the content decryption apparatus 2 can present the encrypted slice portion with the same pattern (same color) because the substitute slice is encoded / decoded.
The content decrypting apparatus 2 can be realized by operating a general computer by a program that functions as each of the above-described units. This program (content decryption program) can be distributed via a communication line, or can be written on a recording medium such as a CD-ROM for distribution.

  In the above, one embodiment of the content decrypting device that decrypts the encrypted content generated by the encryption method A has been described. However, the content decrypting device 2 is the encryption generated by the encryption method B (content encrypting device 1B). It is also possible to configure as a content decrypting device that decrypts encrypted content or encrypted content generated by the encryption method C (content encrypting device 1C).

When decrypting the encrypted content generated by the encryption method B, the content decrypting apparatus 2 uses the substitute slice deleting unit 24b to determine the frame number before the change described in the license stored in the license storage unit 21, With reference to the frame number after change and the NAL unit type of the encrypted slice, it is determined whether or not the slice is a substitute slice. Accordingly, the substitute slice deleting unit 24b can delete the substitute slice based on the license.
Note that the substitute slice deleting unit 24b resets the frame number of the corresponding encrypted slice to the frame number before the change described in the license after deleting the substitute slice. As a result, the encrypted slices are decrypted in order as normal slices.

  In addition, when decrypting the encrypted content generated by the encryption method C, the content decryption device 2 recognizes the slice to be encrypted based on the license in the substitute slice deleting unit 24b, and includes the header of the NAL unit. The data part of the NAL unit added at the back is deleted. As a result, the substitute slice is deleted and the redundant slice is connected immediately after the header of the NAL unit, so that the redundant slice is recognized as an encrypted slice.

  Here, the content decryption apparatus 2 determines whether or not the slice extracted by the slice extracting unit 23 is a substitute slice based on the encryption target information in the substitute slice determining unit 24a. The encrypted content generated by the encryption method A or the encryption method C can determine whether or not the slice is a substitute slice in addition to the information to be encrypted.

  For example, for an encrypted slice of the encrypted content generated by the encryption method A, a code (recognition information) other than the type of the NAL unit is included in the NAL unit header by the encrypted slice recognition information setting unit 14e (see FIG. 4). ), For example, Reserved (nal_unit_type = 23) is set (see FIG. 7D). Therefore, when the substitute slice determination unit 24a recognizes that the type of the NAL unit of the slice extracted by the slice extraction unit 23 is recognition information (Reserved), the content decryption apparatus 2 concerned NAL unit (encrypted slice). Is determined as a substitute slice. In this case, the license storage means 21 does not need to store the encryption target information as a license.

  When a redundant slice start code (unique code) is added to the encrypted slice (redundant slice) of the encrypted content generated by the encryption method C (see FIG. 21), the substitute slice determining unit 24a When a unique code is recognized, the slice to which the redundant slice is added is determined as a substitute slice. Even in this case, the license storage unit 21 does not need to store the encryption target information as a license.

[Operation of content decryption device]
Next, the operation of the content decrypting apparatus according to the fourth embodiment will be described with reference to FIG. 23 (refer to FIG. 22 as appropriate for the configuration). FIG. 23 is a flowchart showing the operation of the content decryption apparatus according to the fourth embodiment of the present invention. Here, it is assumed that the license is stored in the license storage unit 21 in advance.

First, the content decryption apparatus 2 determines whether the license corresponding to the input encrypted content is stored (acquired) in the license storage unit 21 by the license determination unit 22 (step S21). .
If the license has not been acquired (No in step S21), the content decrypting apparatus 2 advances the operation to step S27.

On the other hand, when the license has been acquired (Yes in step S21), the content decryption apparatus 2 extracts a slice for each picture from the encrypted content by the slice extraction unit 23 (step S22).
Then, the content decryption apparatus 2 uses the substitute slice determination unit 24a of the slice decryption unit 24 to determine whether the slice is a slice to be encrypted based on the license (step S23).

Here, when it is determined that the slice is a slice to be encrypted (Yes in step S23), the substitute slice deleting unit 24b determines whether or not the encryption key corresponding to the slice is included in the license ( Step S24).
If the license includes the encryption key corresponding to the slice (Yes in step S24), the substitute slice deleting unit 24b deletes the slice (substitute slice) (step S25).

Then, the content decryption apparatus 2 decrypts the encrypted slice based on the license (encryption key) by the encrypted slice decryption unit 24c (step S26), and proceeds to step S27.
On the other hand, when the encryption key corresponding to the slice is not included in the license (No in step S24), the substitute slice deleting unit 24b outputs the slice (substitute slice) to the code decoding unit 25, and the content decoding apparatus 2 Advances the operation to step S27.

If it is determined that the slice is not an encryption target slice (No in step S23), the substitute slice deleting unit 24b outputs the slice to the code decoding unit 25 as it is, and the content decrypting apparatus 2 operates in step S27. To proceed.
Then, the content decoding apparatus 2 decodes (code-decodes) the encoded data of the slice by the code decoding means 25 (step S27).

  With the above operation, the content decrypting apparatus 2 can decrypt the encrypted content partially encrypted in units of slices based on the license. If the license has not been acquired, or even if the license has been acquired, if the encryption key for each slice has not been acquired, the content decryption device 2 partially degrades the encrypted content Can be played as a video.

It is a data structure figure which shows the data structure of a slice layer. It is explanatory drawing for demonstrating the relationship between a slice and a picture. It is a figure which shows the example which displayed the content of the image, (a) is an original image, (b) is the display image in the content decoding apparatus which has not acquired the license, (c) is the content decoding which has acquired the license The display image in the apparatus is shown. It is a functional block diagram which shows the structure of the content encryption apparatus which concerns on 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the content encryption apparatus which concerns on 1st Embodiment of this invention. It is the schematic diagram (1/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 1st Embodiment of this invention. It is the schematic diagram (2/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 1st Embodiment of this invention. It is the schematic diagram which showed typically the other content of the data processing of the content encryption apparatus which concerns on 1st Embodiment of this invention. It is a figure which shows the data structure of a slice, (a) is I slice, (b) is P slice, (c) has shown the data structure of B slice, respectively. It is a data structure figure which shows the example of the content of the license file which the content encryption apparatus which concerns on 1st Embodiment of this invention produces | generates. It is a data structure figure which shows the other example of the content of the license file which the content encryption apparatus which concerns on 1st Embodiment of this invention produces | generates. It is a functional block diagram which shows the structure of the content encryption apparatus which concerns on 2nd Embodiment of this invention. It is a flowchart which shows operation | movement of the content encryption apparatus which concerns on 2nd Embodiment of this invention. It is the schematic diagram (1/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 2nd Embodiment of this invention. It is the schematic diagram (2/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 2nd Embodiment of this invention. It is a data structure figure which shows the example of the content of the license file which the content encryption apparatus concerning 2nd Embodiment of this invention produces | generates. It is a functional block diagram which shows the structure of the content encryption apparatus which concerns on 3rd Embodiment of this invention. It is a flowchart which shows operation | movement of the content encryption apparatus which concerns on 3rd Embodiment of this invention. It is the schematic diagram (1/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 3rd Embodiment of this invention. It is the schematic diagram (2/2) which showed typically the content of the data processing of the content encryption apparatus which concerns on 3rd Embodiment of this invention. It is the schematic diagram which showed typically the other content of the data processing of the content encryption apparatus which concerns on 3rd Embodiment of this invention. It is a functional block diagram which shows the structure of the content decoding apparatus which concerns on 4th Embodiment of this invention. It is a flowchart which shows operation | movement of the content decoding apparatus which concerns on 4th Embodiment of this invention.

Explanation of symbols

1A, 1B, 1C Content encryption apparatus 11 Encryption parameter generation means 12 Encoding means 13 Slice extraction means 14 Slice encryption means 14a Specific information extraction means 14b Encryption means 14c Code determination means 14d Counting means 14e Encryption slice recognition information setting Means 15 Substitute slice generation means 15a Specific pattern slice generation means 15b Substitute slice recognition information setting means 16 Multiplexing means 17 License generation means

Claims (12)

A content encryption apparatus that partially encrypts a plurality of slices, which are data forming a slice layer in a data structure of digital content, in units of the slices,
Based on predetermined encryption target information for specifying a slice to be encrypted, slice extraction means for separating and extracting an encryption target slice and a non-encrypted slice from the digital content;
A slice encryption unit that generates an encrypted slice by encrypting the encryption target slice extracted by the slice extraction unit with an encryption key;
A substitute slice generating means for generating a substitute slice that is a substitute for the encrypted slice, which is a slice including a predetermined specific pattern encoded by the same encoding method as the non-encrypted slice;
Multiplexing means for multiplexing the non-encrypted slice, the encrypted slice, and the substitute slice;
A license generating means for generating a license including an encryption / decryption key corresponding to the encryption key and the encryption target information;
A content encryption apparatus comprising: The digital content is data encoded in units of macroblocks by a motion compensated predictive encoding method,
The substitute slice generating means generates an I slice that is encoded data with a macroblock indicating a specific color, and skips a P slice and a B slice that are encoded data indicating a difference from a reference destination picture. The content encryption apparatus according to claim 1, wherein the content encryption apparatus is generated in blocks. The slice encryption means includes
Encryption means for encrypting the encryption target slice with the encryption key;
Code determination means for determining whether or not a predetermined prohibited code is included in the encrypted slice encrypted by the encryption means,
The encryption means re-encrypts the encrypted slice and adds the number of times of encryption to the encrypted slice when the prohibited code is included in the encrypted slice. The content encryption device described in 1. The slice is composed of a network header indicating header information of the network abstraction layer, a slice header indicating header information of the slice, and slice data indicating data of the slice.
The slice encryption means includes
In the encryption target slice extracted by the slice extraction means, specific information extraction means for extracting each data of the network header and the slice header as specific information for specifying the encryption target slice;
Encryption means for encrypting the slice header and the slice data of the encryption target slice;
An encrypted slice recognition information setting means for setting recognition information indicating that the substitute slice exists in the network header of the encryption target slice encrypted by the encryption means,
The substitute slice generation means includes:
Specific pattern slice generating means for generating a slice including the specific pattern;
By setting the data of the slice header extracted by the specific information extracting unit to the slice header of the slice generated by the specific pattern slice generating unit, and adding the network header extracted by the specific information extracting unit , Substitute slice recognition information setting means for generating substitute slices to substitute for the encrypted slices;
The content encryption apparatus according to claim 1, further comprising: The slice is composed of a network header indicating header information of the network abstraction layer, a slice header indicating header information of the slice, and slice data indicating data of the slice.
The slice encryption means includes
In the encryption target slice extracted by the slice extraction means, specific information extraction means for extracting each data of the network header and the slice header as specific information for specifying the encryption target slice;
Encryption means for encrypting the slice data of the slice to be encrypted;
Encrypted slice recognition information setting means for setting recognition information indicating that the substitute slice exists in the slice header of the encryption target slice encrypted by the encryption means,
The substitute slice generation means includes:
Specific pattern slice generating means for generating a slice including the specific pattern;
By setting the data of the slice header extracted by the specific information extracting unit to the slice header of the slice generated by the specific pattern slice generating unit, and adding the network header extracted by the specific information extracting unit , Substitute slice recognition information setting means for generating substitute slices to substitute for the encrypted slices;
The content encryption apparatus according to claim 1, further comprising: The slice is composed of a network header indicating header information of the network abstraction layer, a slice header indicating header information of the slice, and slice data indicating data of the slice.
The slice encryption means includes
In the encryption target slice extracted by the slice extraction means, specific information extraction means for extracting the data of the slice header as specific information for specifying the encryption target slice;
Encryption means for encrypting the slice header and the slice data of the encryption target slice,
The substitute slice generation means includes:
Specific pattern slice generating means for generating a slice including the specific pattern;
A substitute slice that generates a substitute slice to substitute for the encrypted slice by setting the data of the slice header extracted by the specific information extraction means in the slice header of the slice generated by the specific pattern slice generation means Recognition information setting means,
The content encryption according to claim 1, wherein the multiplexing means inserts the substitute slice between a network header of the slice to be encrypted and the data encrypted by the encryption means. apparatus.   7. The content encryption according to claim 6, wherein the multiplexing means adds a unique code for specifying the encrypted data immediately before the data encrypted by the encryption means. Device. In order to partially encrypt a plurality of slices, which are data forming a slice layer in the data structure of digital content, in units of the slices,
A slice extracting means for separating and extracting an encryption target slice and a non-encrypted slice from the digital content based on predetermined encryption target information for identifying a slice to be encrypted;
A slice encryption unit that generates an encrypted slice by encrypting the encryption target slice extracted by the slice extraction unit with an encryption key;
Substitute slice generating means for generating a substitute slice that is a substitute for the encrypted slice, which is a slice including a predetermined specific pattern encoded by the same encoding method as the non-encrypted slice,
Multiplexing means for multiplexing the non-encrypted slice, the encrypted slice, and the substitute slice;
A license generating means for generating a license including an encryption / decryption key corresponding to the encryption key and the encryption target information;
A content encryption program characterized by functioning as: In a plurality of slices that are data forming a slice layer in the data structure of the digital content, an encrypted slice partially encrypted in units of the slice includes a predetermined specific pattern that substitutes for the encrypted slice. A content decrypting device that decrypts the encrypted content multiplexed by adding to the substitute slice,
License storage means for storing a license including encryption target information for identifying the encrypted slice and an encryption / decryption key for decrypting the encrypted slice;
Slice extracting means for sequentially extracting the slices from the encrypted content;
Substitute slice determination means for determining whether the slice extracted by the slice extraction means is the substitute slice, based on the encryption target information included in the license;
When the license includes an encryption / decryption key corresponding to the encrypted slice, a substitute slice deleting unit that deletes the slice determined as the substitute slice by the substitute slice determining unit;
Encrypted slice decrypting means for encrypting and decrypting the encrypted slice added to the substitute slice deleted by the substitute slice deleting means;
Coding / decoding means for coding / decoding the slice decrypted by the encrypted slice decrypting means,
The content decryption apparatus, wherein the encryption / decryption means decodes and substitutes the substitute slice when the license does not include an encryption / decryption key corresponding to the encrypted slice. In a plurality of slices that are data forming a slice layer in the data structure of the digital content, an encrypted slice partially encrypted in units of the slice includes a predetermined specific pattern that substitutes for the encrypted slice. In order to decrypt the encrypted content that was added to the substitute slice and decrypted,
Slice extraction means for sequentially extracting the slices from the encrypted content;
Substitute slice determination means for determining whether or not the slice extracted by the slice extraction means is the substitute slice, based on encryption target information that identifies the encryption slice included in the license,
When the license includes an encryption / decryption key corresponding to the encrypted slice, a substitute slice deleting unit that deletes the slice determined as the substitute slice by the substitute slice determining unit;
Encrypted slice decrypting means for decrypting the encrypted slice added to the substitute slice deleted by the substitute slice deleting means;
Function as an encoding / decoding means for decoding / decoding the slice decrypted by the encrypted slice decoding means,
The content decryption program, wherein when the license does not include an encryption / decryption key corresponding to the encrypted slice, the encoding / decoding unit decodes / decodes the substitute slice. A content decryption device for decrypting encrypted content generated by the content encryption device according to claim 4,
A license storage means for storing a license including an encryption / decryption key for decrypting the encrypted slice;
Slice extracting means for sequentially extracting the slices from the encrypted content;
A substitute slice determination unit that determines whether or not the slice extracted by the slice extraction unit is a substitute slice, based on the recognition information set in the encrypted slice added to the substitute slice;
When the license includes an encryption / decryption key corresponding to the encrypted slice, a substitute slice deleting unit that deletes the slice determined as the substitute slice by the substitute slice determining unit;
Encrypted slice decrypting means for encrypting and decrypting the encrypted slice added to the substitute slice deleted by the substitute slice deleting means;
Coding / decoding means for coding / decoding the slice decrypted by the encrypted slice decrypting means,
The content decryption apparatus, wherein the encryption / decryption means decodes and substitutes the substitute slice when the license does not include an encryption / decryption key corresponding to the encrypted slice. A content decryption device for decrypting encrypted content generated by the content encryption device according to claim 7,
A license storage means for storing a license including an encryption / decryption key for decrypting the encrypted slice;
Slice extracting means for sequentially extracting the slices from the encrypted content;
A substitute slice determination unit that determines whether the slice extracted by the slice extraction unit is a substitute slice based on a unique code that identifies encrypted data added to the substitute slice; and
When the license includes an encryption / decryption key corresponding to the encrypted slice, a substitute slice deleting unit that deletes the slice determined as the substitute slice by the substitute slice determining unit;
Encrypted slice decrypting means for encrypting and decrypting the encrypted slice added to the substitute slice deleted by the substitute slice deleting means;
Coding / decoding means for coding / decoding the slice decrypted by the encrypted slice decrypting means,
The content decryption apparatus, wherein the encryption / decryption means decodes and substitutes the substitute slice when the license does not include an encryption / decryption key corresponding to the encrypted slice.

Images