KR20070064081A - Safe apparatus and method for broadcasting contents - Google Patents

Abstract

An apparatus and a method for protecting broadcasting contents are provided to prevent contents such as broadcasting programs, which are stored in a storage unit, from being illegally used, thereby safely using the broadcasting programs. A key storing unit(251) stores a system key and a share key. A contents storing unit stores contents. An encoding and decoding unit(252) selectively uses the system key and the share to encode the stored contents and decode the reproduced contents. A contents managing unit(253) controls the decoding/encoding of the contents. The key storing unit and the contents storing unit have different memories. The system key and the share key are periodically updated.

Description

Safe apparatus and method for broadcasting contents

1 is a block diagram of a digital video system network according to an exemplary embodiment of the present invention.

2 is a detailed block diagram of a digital video system including a broadcast content protection device according to an embodiment of the present invention.

3 is a detailed block diagram of a digital video system including a broadcast content protection device according to another embodiment of the present invention.

4 is a flowchart illustrating a method for protecting broadcast content using a system unique key according to the present invention.

5 is a flowchart illustrating a content protection method according to mounting of a hard disk drive according to the present invention.

Figure 6 is a flow chart showing another example of the content protection method according to the mounting of the hard disk drive according to the present invention.

7 is a flowchart showing a broadcast content encryption method using a system unique key and a public key according to the present invention.

8 is a flowchart illustrating a method for decoding broadcast contents using a system unique key and a public key according to the present invention.

<Description of the symbols for the main parts of the drawings>

110,210 Tuner and Demodulator 120220 Stream Controller

Encoders and decoders 140,240 Playback devices

150,250 ... central processing unit 151,251 ... key storage

152,252 ... Password and Decryption Unit 153,253 ... Content Management Unit

254.254 ... network interface 160,260 ... mass storage

170,270 user interface

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a content protection device and method for protecting against illegal use of content such as a broadcast program stored in a storage device.

As the broadcasting has developed into the digital trend, the development of technology has provided digital television broadcasting services. Such digital broadcasting services include terrestrial or satellite digital television broadcasting, terrestrial or satellite digital multimedia broadcasting (DMB).

In order to make the best use of such digital broadcasting, most receivers are provided with a device capable of recording, or simultaneously recording and playing digital broadcast contents. Such a device is called a digital video recording system.

The digital video recorder system has a built-in mass storage device, which stores broadcast program content through real-time recording, scheduled recording, or external copying of the content.

The product family to which the digital video recording system is applied includes a set top box and a television with a built-in mass storage device. The content to be recorded may be, for example, a broadcast stream, and its format uses the MPEG-2 type.

In addition, high-definition (HD) broadcasting is stored in a large capacity per hour, and the trend of storing and playing back many programs to make the best use of the characteristics of the mass storage device. Due to the limited capacity of large storage devices, additional mass storage devices are being installed. Most mass storage devices are mounted on and off the system.

Recently, wired and wireless networks have been used to expand the usability of a narrow range of internal storage devices in the form of network file systems.

As described above, the problem of content protection has emerged as an important problem in an environment such as exchanging a mass storage device using a detachable method and transmitting content using a wired or wireless network.

Recently, Digital Rights Management (DRM) has been a hot issue between digital content providers and users, and the general return (public wave and airwaves) such as the North American FCC broadcast flag rule and the conditional access of the cable environment. Protection of program content in cable broadcasting is already mandatory or mandatory.

A first object of the present invention is to provide an apparatus and method for protecting contents for protecting and safe use of contents such as a broadcast program stored in a system.

It is a second object of the present invention to provide an apparatus and method for protecting contents by enabling encryption and decryption of contents using a unique key of a system.

It is a third object of the present invention to provide an apparatus and method for protecting a content that enable encryption and decryption of content using a public key for shareable content.

A fourth object of the present invention is to provide a content protection device and method for effectively managing the sharing authority and use of content by selectively using a unique key and a public key for the content.

Apparatus for protecting the content according to the present invention for achieving the above object,

Key storage means for storing a unique key and a public key unique to the system; Storage means for storing content; An encryption and decryption unit for encrypting the stored content by selectively using the system unique key or the public key and decrypting the reproduced content; And a content manager for controlling an encryption and decryption operation of the content.

Preferably, the key storing means and the content storing means are different memories. Preferably, the system unique key and the public key is characterized in that it is updated periodically.

Preferably, the encrypted content further includes information indicating a system unique key or a public key used for encryption and decryption.

Preferably, the storage means further comprises a discarded key set for prohibiting the use of a system unique key and / or a public key.

Content protection method according to the invention, the step of storing a unique key and a public key for each system; Encrypting the content stored in the storage means by using the stored unique key or public key; And decrypting the content played back from the storage means with a key used for encryption.

Preferably, the contents are recorded with identification information of the unique key or public key used for the encryption, and decrypted using the unique key or the public key indicated by the unique key or public key identification information.

Preferably, the unique key or public key identification information is characterized in that recorded in the metadata of the content.

Preferably, the content is characterized in that the broadcast content.

Preferably, the method further comprises the step of verifying whether the keys are used by using a discarded key set stored in a system for a unique key or a public key used for encrypting or decrypting the content.

Content protection method according to another embodiment of the present invention, the step of having a unique key or a public key in the system; When a new hard disk drive is installed in the system, classifying a key used for encryption among contents in the hard disk drive; If the key used for encryption is a unique key, the corresponding content is processed to be non-playable; if the key used for encryption is a public key, the corresponding content is characterized in that it comprises the step of processing to be playable.

Preferably, when the key identification information used for encryption recorded in the contents of the hard disk drive is public key identification information, the stored public key is decrypted using the stored public key.

Hereinafter, with reference to the accompanying drawings as follows.

1 is a block diagram showing a content protection device according to an embodiment of the present invention.

1, a plurality of digital video recording systems 101, 103, 105 and 107 connected by a network; The digital video recording system 101, 103, 105, 107 includes a built-in mass storage device (e.g., HDD) 102, 104, 106 for recording or storing broadcast content received from the system.

The digital video recording system 101, 103, 105, 107 may be connected to or mounted on a component that receives a broadcast, or mounted on a set top box that receives a broadcast. Accordingly, broadcast contents are recorded in the mass storage devices 102, 103, and 106. The recorded content is encrypted for rights protection and decrypted for playback of the encrypted content.

The encryption and decryption is performed by encrypting and decrypting content using a unique key and / or a public key stored in a system using an encryption algorithm. Here, the encryption and decryption algorithm uses a commonly used Advanced Encryption Standard (AES) or Data Encryption Standard (DES) encryption algorithm.

Here, DES is widely used as a method of encrypting data using a private key, and it is possible to use an enormous amount of encryption keys or more for DES. The key for each message given is chosen at random from this enormous amount of keys. Like other private key encryption methods, both sender and receiver must know and use the same private key.

DES applies a 56-bit long key to each 64-bit data block. This process can be run in several modes, involving 16 operations. Although DES is considered strong encryption, many companies use "triple DES", with three keys applied in a row.

DES was invented by IBM in 1977 and was adopted by the US Department of Defense. It is defined in the ANSI X3.92 and X3.106 standards and in the US Federal FIPS 46 and 81 standards. AES will be adopted as the next standard for DES.

In addition, the general mass storage device should be able to protect the contents in each system, and the contents to be protected in other video systems should be protected as the double storage device is removable. For example, after removing the mass storage device 102 from the first digital video recording system 101, and attaching it 102 'to the other fourth digital video recording system 107 as a new mass storage device 102'. In other words, the content should be processed as non-playable or playable according to the right to share the content.

2 is a block diagram illustrating a detailed configuration of a digital video recording system for content protection according to an embodiment of the present invention.

2, a tuner and demodulator 110 for receiving a broadcast signal from an arbitrary service medium and outputting digital data, a stream controller 120 for adjusting a transmission path of the demodulated data stream, Controlling the encoder and decoder 130 for decoding and encoding the data stream into A / V data and additional information, the video memory 131, the reproducing apparatus 140 for reproducing the decoded data, and each system part. A central processing unit 150 for storing the contents, a key storage unit 151 storing a system-specific key for protecting contents, an encryption / decrypting unit 152 for encrypting and decrypting in accordance with storing and reproducing the contents, and authority of the contents. The content management unit 153 manages overall for protection, the network interface unit 154 for network connection, the mass storage device 160 storing the content, and DVD recording and playback. The DVD loader 170 and the user interface (UI) 180 is configured to include.

Referring to the accompanying drawings, a content protection device according to an embodiment of the present invention configured as described above is as follows.

Referring to FIG. 2, the digital video recording system 100 performs broadcast reception and recording, and may play back through the playback device 140 connected to the system.

First, the tuner and demodulator 110 tunes the received broadcast signal, demodulates the tuned broadcast signal in a reverse manner of modulating the broadcast signal, and converts the converted broadcast signal into a digital data stream. The tuner and demodulator 110 are operated under the control of the central processing unit (CPU) 150.

The stream controller 120 outputs an output data stream from the tuner and the demodulator 110 to the mass storage device 160 under the control of the CPU 150 through the system bus 10 to be stored or stored in a demultiplexer (not shown). And output to the decoder (130).

In addition, the stream controller 120 outputs and reproduces a data stream input from the mass storage device 160 through the system bus to the demultiplexer and the decoder 130 under the control of the CPU 14. Here, the demultiplexing unit multiplexes and transmits audio, video and additional information at the transmitting side, and thus extracts audio, video and additional information by demultiplexing at the receiving side. In addition, the decoder 130 operates as, for example, an MPEG decoder, which operates as an MPEG decoder because digital broadcasting supports the MPEG method.

The encoder and decoder 130 is an MPEG-type encoder and decoder. When the system plays back the system, the encoder and decoder 130 decode and use the MPEG decoder. However, the encoder and decoder 130 encodes and transmits the encoded encoder to the encoder. In addition, the video memory 131 serves as a buffer when encoding at the encoder and the decoder.

The playback device 140 includes a display unit and a speaker to reproduce broadcast content.

The central processing unit 150 controls each unit of the system in order to control operations such as receiving, storing, and reproducing broadcast signals.

The key storage unit 151 is a semiconductor memory, which may be configured as an EEPROM, and stores a system unique key.

Here, the system unique key is data unique to each system and has the property of distinguishing each system. The system unique key is composed of 128 bits or 192 bits according to the characteristics of the AES or DES encryption algorithm. Used as a key for encryption algorithms.

Such system unique keys are preferably installed at the time of manufacture of system hardware in order to make them different from system to system. In addition, when the system unique key is duplicated, the system unique key can be updated as its own hardware identification information.

The encryption and decryption unit 152 includes (or uses) an AES or DES encryption algorithm, encrypts the stored content using the system unique key, and decrypts the reproduced content using the system unique key. do.

In other words, when the content stored in the mass storage device (eg, HDD) 160 is prohibited from retransmission or distribution requiring protection or not allowed to be shared by any unauthorized user, the system unique key is used. Will be encrypted. In addition, when encrypting, a contents sharing descriptor (CSD) is recorded in the metadata of the content.

The content information is divided into metadata (broadcast information, system management information, etc.) and content audio / video data about the content, and the content sharing descriptor is recorded in the metadata to protect the content. This content sharing descriptor is recorded as a code indicating an encryption key.

In addition, the encryption and decryption operation may be implemented in software or hardware or a combination of hardware and software, and the encryption and decryption unit may be applied in a packet unit of a stream or a block unit composed of any number of consecutive packets. can do. It is also possible to freely select and change the system unique key or public key used for encryption and decryption while the system is in use.

The content manager 153 performs the encryption control of the content stored in the mass storage device 160 using the system unique key and controls the decryption to play the content stored in the mass storage device 160.

In addition, the mass storage device 160 stores content, and the content is broadcast content, such as audio and video, additional information, user data, and the like. Such content is encrypted and stored when stored, and decrypted when restored.

The DVD loader 170 is a device for recording and reproducing data on a DVD medium. The present invention is not limited to the DVD loader, but is a device capable of recording and playing disc media such as DVD or BD as a normal disc loader. . Such a DVD loader can be used to record and reproduce broadcast streams. Accordingly, in order to protect contents, encryption and decryption are performed not only for a mass storage device but also for a disk medium such as a DVD and a blue layer disk (BD).

The user interface unit 180 may include a remote controller, a key input unit, a touch input, or the like, and is a device for transmitting a user's command to the system.

The network interface unit 154 is a device for network communication by wire or wirelessly with another system or device (for example, a PC) connected to a network. This allows updating of a key used for encryption, for example, a system unique key. In this case, the user may update after notifying the user in advance or periodically.

The content protection operation in such a system is described as follows.

When the content manager 153 stores the broadcast content in the mass storage device 160, the content manager 153 encrypts the content using a system unique key stored in the key storage unit 151 using an encryption unit. This operation is similarly performed for content recording.

In addition, when the content manager 153 tries to play the content stored in the mass storage device 160, the content management unit 153 decrypts the content using the system unique key stored in the key storage unit 151 using the decoder. This operation is performed every time the content is played.

Since the mass storage device 160 is detachable / removable, when any user removes the mass storage device 160 from the currently installed system and attaches it to another system, the content protection function is not provided in the other system. The system unique key and the system unique key encrypting the contents of the newly installed mass storage device are compared. In this case, since the system unique keys are different from each other, the newly installed mass storage device is initialized to make contents unavailable.

In addition, the content management unit 153 uses a content sharing descriptor (CSD) of each content to check the use rights of each content, etc. The content sharing descriptor 153 includes a description of the right to share and use of the content. Doing. This descriptor information can be used to determine whether the content is encrypted with a system unique key.

That is, when the content is encrypted with the system unique key, information that is encrypted with any unique key, that is, the content sharing descriptor (CSD) is recorded in the metadata of the content. When decrypting or mounting to another system, the content sharing descriptor may be used to identify a key used to decrypt the content. If two or more keys are provided for encryption on the system, the content sharing descriptor can be highly utilized.

In addition, by updating the system unique key, a duplicate of the system unique key can be detected, thereby preventing the same system unique key from being used.

3 is a block diagram showing a content protection device according to another embodiment of the present invention. Duplicate description of the same parts as in FIG. 2 will be omitted.

3 stores the system unique key and the public key in the key storage unit 151. In order to protect the rights of the content, a system unique key is used to encrypt and decrypt the content as shown in FIG. 2.

In addition, the system public key encrypts the content that can be used publicly, that is, a content that is not a problem for copyright and does not have any restrictions, such as random retransmission, distribution, and sharing, and decrypts the system public key when the system public key is reproduced. In this case, the system public key may partially restrict the user, and it is preferable to use the system public key as the system public key when classifying the use for the purpose of a system or a specific group unit within a company connected to the company network.

When the content encrypted with the public key is installed in a network or another system, the content can be decrypted and played back using the public key stored in the system, and then encrypted again. Alternatively, the content encrypted with the public key may be decrypted again with the system unique key.

Therefore, when the content is stored, it can be automatically encrypted with the system unique key or the public key according to the characteristics of the content. Here, paid contents or copyrighted contents among the contents may be automatically encrypted with a system unique key, and broadcast contents such as a general entertainment program may be automatically encrypted with a public key. Alternatively, the content manufacturer may encrypt the content requested by the system with a unique key.

It may also require the user to make a choice about the use of a system unique or public key. For example, an interface may be implemented on the screen of the display unit using an OSD (On Screen Display) to allow a user to select whether to encrypt with a system unique key or a public key.

After checking the shared descriptor (CSD) of the content, the content manager 253 may check whether the content is encrypted with a system unique key or a public key. To this end, a content sharing descriptor (CSD) is recorded in the content, and the content sharing descriptor is recorded in the metadata of the content as a code for indicating a system unique key or a public key. For example, the content sharing descriptor is recorded as 0xFF when encrypted with the system unique key and 0x00 when encrypted with the public key. Accordingly, after the content sharing descriptor is obtained when decrypting the content, the content sharing descriptor can be decrypted using the system unique key or the public key stored in the key storage unit 151 according to the obtained information.

On the other hand, the mass storage device (160, 260) shown in Figures 2 and 3 of the present invention is to store the discarded key set (RKS). In the discarded key set (RKS), the system-specific keys that are discarded or expired are received from a key management server or a manufacturer and stored. Here, the revoked key set serves as an authentication means for the system unique key.

The content managers 153 and 253 compare the system-specific keys stored in the key storage units 151 and 251 using the discarded key set. At this time, if the system unique key exists in the discarded key set, the corresponding key is no longer available, and contents encrypted with the system unique key cannot be reproduced. That is, when the system-specific key stored in the key storage unit 153 and 253 in the system exists in the discarded key set, all contents of the mass storage device 160 and 260 cannot be reproduced.

In addition, when a new hard disk drive is purchased and installed in a system, a discarded key set (or list) is received from a manufacturer and stored in a storage medium (eg, HDD, portable storage medium). If a hard disk drive is installed in the system that does not have the discarded key set (RKS) installed, the hard disk drive will be initialized. Afterwards, recording of the content or the like becomes possible.

When the hard disk drive is detached and stored in another system without storing the discarded key set, the system also inspects the discarded key set, and if there is no discarded key set, the content management unit 153 or 253 Initialize the hard disk drive.

The revoked key set also includes a validity period. The discarded key set expired after the expiration date is treated the same as a system in which the discarded key set is not installed as described above.

The discarded key set may be automatically updated through the network interface unit 154 or 254 or updated after the user downloads it to the Internet. In addition, if the system shared key is stolen, duplicated, or lost to other users, the manufacturer or system unique key management server can be reported as a system management number, thereby updating and managing the list of discarded keys.

In addition, the present invention can be managed by including not only the system unique key but also the system public key in the discarded key set. In other words, when the public key existing in the company's computer network expires, it is automatically included as a management target, so that the contents on the network vulnerable to security can be secured.

4 is a flowchart illustrating a method of protecting contents using a system unique key according to an embodiment of the present invention.

4, the system is driven (S101) and it is checked whether the content is stored or reproduced (S102, S105). Here, if the content is stored (S102), the content is encrypted using the system unique key (S103), and the encrypted content is stored (S104). Such an operation may be equally used for storing, recording, and the like of content.

If the content is played back (S105), the content is decrypted using the system unique key (S106), and the decrypted content is played back (S107). If the content is not stored or reproduced, other functions are performed (S108).

5 is another example of a content protection method using a system unique key according to the present invention.

Referring to FIG. 5, the content protection system is driven (S111) and the system checks whether a new hard disk drive is installed (S112). When the new hard disk drive is mounted as a result of the check, whether the content in the hard disk drive is encrypted. It will be confirmed (S113). As a result of the check, if the content is encrypted, it is checked from the shared descriptor of the content whether it is encrypted with a system unique key (S114) or with a public key (S116). At this time, if the content is encrypted with the system unique key, the content is treated as non-playable (S115). Since the unique keys of the system are different from each other, the corresponding contents in the hard disk drive may be made impossible to play, or the hard disk drive may be initialized.

If the content is encrypted with the public key, the content is reproducible (S117). In other words, the public key is a key used in common and can be decrypted with the public key currently stored in the key storage unit of the system, so that the contents can be played back.

However, content that is not encrypted, content that is not encrypted with a system unique key or a public key, is processed as a content cannot be reproduced by the system (S118).

As described above, when the hard disk drive of the user system is removed and then mounted on another system, the content protection function of the other system operates to process the content in the hard disk drive as playable or non-playable.

6 is a flowchart illustrating a content protection method according to mounting of a mass storage device according to the present invention.

Referring to FIG. 6, when the system is driven (S121), after checking whether a new hard disk drive is installed (S122), when the new hard disk drive is confirmed to be installed, a discarded key set exists in the hard disk drive. It is checked whether (S123). If the discarded key set exists, it is again checked whether the information is within the valid period (S124). If it is within the valid period, it is checked whether the same key as the system unique key exists (S125).

In this case, if a system unique key does not exist in the discarded key set, the contents of the hard disk drive may be used (S127).

However, if the new hard disk drive does not exist in the discarded key set, the validity period is out, or the system unique key exists in the discarded key list, the contents of the hard disk drive are treated as non-playable (S126). That is, all contents in the hard disk drive are treated as non-playable.

7 is a flowchart illustrating a content encryption method using a system unique key and a public key according to another embodiment of the present invention.

Referring to FIG. 7, when the system is driven (S131) and content is stored (S132), an encryption key is selected (S133). At this time, the encryption key selection is automatically performed according to the content, and may have an option for the user to select if necessary.

In addition, an encryption key is selected and the encryption key is checked whether a system unique key (S134) or a public key is selected (S137). When the system unique key is selected, content encryption is performed using the system unique key (S135), and the encrypted key is encrypted. The content is stored (S136). When the public key is selected, content encryption is performed using the public key and stored (S137, S138).

However, if the key for encryption is not selected, the content is stored as non-playback (S139).

8 is a flowchart illustrating a content decryption method using a system shared key and a public key in the present invention.

Referring to FIG. 8, if there is a content playback request (S141), the sharing descriptor of the content is checked (S142). As a result of the check, if the content is encrypted with the system unique key (S143), the content is decrypted using the system unique key (S144), and the content is reproduced (S145). However, if the shared descriptor confirms that the content is encrypted with the public key (S146), the content is decrypted using the public key stored in the key storage unit (S147), and the decrypted content is reproduced (S145).

If there is no key information or no shared descriptor information in the content sharing descriptor, the content is not reproduced (S48).

As described above, the present invention can encrypt the broadcast content stored in the system with a system-specific unique key or select and encrypt a system unique key and a shared key that can be shared, thereby providing reliability for content protection and use. Can be.

The digital video system may be equipped with only a simple recording device, and may be applied to digital TV sets, set-top boxes, and the like. The digital video system may be effectively implemented in response to the North American Broadcasting Rule (FCC Brocast flag rule) and cable environment certification (CA / CP) channels. Can be. In addition, powerful content protection can be performed for attaching and detaching mass storage devices.

So far, the present invention has been described with reference to the preferred embodiments, and those skilled in the art to which the present invention pertains to the detailed description of the present invention and other forms of embodiments within the essential technical scope of the present invention. Could be implemented. Here, the essential technical scope of the present invention is shown in the claims, and all differences within the equivalent range will be construed as being included in the present invention.

As described above, according to the apparatus and method for protecting contents according to the present invention, by encrypting using a system unique key, the contents that can be used in the system can be protected from other systems.

In addition, by selectively using a system unique key and a public key to encrypt, there is an effect that can protect the content to be protected and the content that can be shared in the system.

The present invention is applied to a broadcast product using a mass storage device, thereby effectively protecting the right to use broadcast content.

Claims (12)

Key storage means for storing a system unique key and a public key; Storage means for storing content; An encryption and decryption unit for encrypting the stored content by selectively using the system unique key or the public key and decrypting the reproduced content; And a content manager for controlling an encryption and decryption operation of the content. The method of claim 1, And the key storage means and the content storage means are different memories. The method of claim 1, And the system unique key and the public key are periodically updated. The method of claim 1, And the encrypted content further includes information indicating a system unique key or a public key used for encryption and decryption. The method of claim 1, The storage means further includes a discarded key set for prohibiting the use of a system unique key and / or a public key. Storing a system unique key and a public key; Encrypting the content stored in the storage means by using the stored unique key or public key; And decrypting the content reproduced from said storage means with a key used for said encryption. The method of claim 6, And the identification information of the unique key or the public key used for the encryption is decrypted in the content and decrypted using the unique key or the public key indicated by the unique key or the public key identification information. The method of claim 7, wherein The unique key or public key identification information is recorded in the metadata of the content. The method of claim 5, And the content is broadcast content. The method of claim 5, And verifying the use of the keys using a discarded key set stored in a system on a unique key or a public key used for encrypting or decrypting the content. Storing a unique key and a public key in the system; When a new hard disk drive is installed in the system, classifying a key used for encryption among contents in the hard disk drive; If the key used for encryption is a unique key, process the content as non-playable; and if the key used for encryption is a public key, process the content as playable. The method of claim 11, And if the key identification information used for encryption recorded on the content in the hard disk drive is the public key identification information, decrypting the content using the stored public key.

Images