JP2003273894A - Bridge device and method for transmission - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a bridge device which can know the change of contents to be transmitted by a transmitter from a receiver, which receives data via the bridge device, and to provide a method for transmission. <P>SOLUTION: The bridge device 1 has a key number adding unit 5 for adding a key number an encrypted contents. The adding unit 5 adds the key number of a secret key, shared with the transmitter to the contents encrypted by a data encrypting unit 4. Since the key number is added to the contents, the receiver which receives the contents can recognize by itself the changes in the secrete key used, when the transmitter encrypt the contents. As a result, authentication for secret keys from unwanted receivers accompanying interruption of the reception due to a reception fault, such as noise or the like is prevented. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a bridge device and a transmission method for transmitting contents transmitted on a network to another network.

[0002]

2. Description of the Related Art At present, high-speed and multifunctional data transmission using digital transmission is rapidly spreading. In digital transmission, it is easy to falsify and copy the data (content) flowing on the transmission path, and a technology for protecting the content is required. DTC is one of the standardized technologies for that.
P (Digital Transmisson Cont
ent Protection) standard (http
p: // www. dtcp. com). This is I
It is a technology developed to protect digital synchronous packet data flowing on the EEE1394 high-speed serial bus from being tampered with or illegally copied, and its specifications are disclosed at the above URL. This technology has already been used when exchanging data between a Digital TV and a Digital VHS.

The DTCP standard is not limited to the IEEE 1394 high-speed serial bus, but it is not limited to USB (Universal).
It is about to be extended to a standard for transmission on another bus standard such as sal serial bus).

In DTCP, when the transmitting device stops transmitting the content and then restarts it, the transmitting device must change the key and then transmit. The receiving device can detect the stop of the content transmission, but cannot make a strict and accurate determination. Therefore, the key number (the key number that changes every time the content is transmitted) is AKE.
(Authentication & Key Exch
It was necessary to confirm with the age) command. In addition, when one content is received by multiple receiving devices,
In order to limit the number of content transmissions, the transmitting device records the number of receiving devices to authenticate, and if the number exceeds the limit (62), authentication cannot be performed. Therefore, the transmitting device determines the number of receiving devices to authenticate. It is counted by the request from.

When performing DTCP processing across different buses, the different buses are connected by a DTCP bridge device, and the processing is performed via the DTCP bridge apparatus. The DTCP bridge device has a type in which DTCP processing is directly performed between nodes on different buses, and a node on a different bus is D
It is classified into a TCP bridge device and a type of performing DTCP processing.

In the latter DTCP bridge device, when a plurality of receiving devices are bridged, the bridge device indicates to the transmitting device with the certification information that the device is a bridge and makes an authentication request. In the transmitting device,
If there is this information, even the authentication request from the same device is counted as the number of devices.

In the latter type of DTCP bridge device, when the bridge device receives data (content) from a transmitting device on a network and transmits the data to a plurality of receiving devices on another network, When the transmission from the transmitting device is interrupted and restarted, it is necessary to notify the receiving device.

The reason is as follows. If the transmission of data from the transmitting device is interrupted and the transmission of data from the bridge device to the receiving device is also interrupted, an authentication request will be received from a plurality of receiving devices on another network after the restart. If the interruption of the data transmission from the transmitting device is due to a disturbance such as noise, an authentication request from another network will occur each time. Therefore, it is possible to transmit an empty packet without interrupting the data transmission from the bridge device to the receiving device.

However, if the interruption of the data transmission from the transmitting device is not due to noise and the transmitting device intentionally interrupts the transmission of the content, it is necessary to make an authentication request. Moreover, in this case, the bridge device is not allowed to make an authentication request on behalf of the bridge device. Because, in this case, the bridge device needs to make multiple authentication requests (in order to correctly count the number of transmitting devices), but the first authentication request is accepted (due to the number limitation). The second authentication request may be rejected by the transmitting device (when the transmitting device has authenticated up to (number limit-1)). Therefore, the receiving device needs to make another authentication request.

[0010]

As described above, the receiving device receiving the data via the bridge device needs to know whether the content of the transmitting device has changed.

It is an object of the present invention to provide a bridge device and a transmission method by which a receiving device receiving data via the bridge device can know the change of the content transmitted from the transmitting device.

[0012]

In order to achieve the above object, a bridge device of the invention according to claim 1 receives a content transmitted on a network and decrypts the received content with a first secret key. In a bridge device for transmitting the content encrypted with the second secret key to another network after being encrypted, identification information for adding identification information for identifying the first secret key to the content encrypted with the second secret key It is characterized by having an addition means.

According to a second aspect of the present invention, in the bridge device according to the first aspect, the identification information adding means adds the key number of the first secret key to the content encrypted with the second secret key. Is characterized by.

The transmission method of the invention according to claim 3 is
In a transmission method in which a bridge device that receives content transmitted on a network decrypts it with a first secret key, then encrypts it with a second secret key and transmits it to another network, the bridge device uses a second secret key. It is characterized in that identification information for identifying the first secret key is added to the content encrypted with the key.

The transmission method of the invention according to claim 4 is
In claim 3, the identification information is a key number of the first secret key.

The transmission method of the invention according to claim 5 is
Receiving the content transmitted from the transmitting device on the network, the content received by the bridge device is decrypted with the first secret key, and then the content encrypted with the second secret key is transmitted to the receiving device on another network. In the transmission method, when the bridge device adds the same key identification information as before the stop when the bridge device resumes the reception after the reception is stopped, the receiving device re-authenticates the second secret key. Characterized by not being.

The transmission method of the invention according to claim 6 is
Receiving the content transmitted from the transmitting device on the network, the content received by the bridge device is decrypted with the first secret key, and then the content encrypted with the second secret key is transmitted to the receiving device on another network. In the transmission method, when the bridge device adds the key identification information different from that before the stop when the bridge device resumes the reception after the reception is stopped, the receiving device re-authenticates the second secret key. Is characterized by.

With such a configuration, it is possible to provide a bridge device and a transmission method by which a receiving device receiving data via the bridge device can know the change of the content transmitted from the transmitting device.

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below.
A description will be given with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the bridge device of the present invention. The bridge device 1 includes a first network interface (network I / F) 2 for receiving from a transmitting device on the network,
A data decryption unit 3 that decrypts the content received by the first secret key shared with the transmission device, and the content decrypted by this decryption unit 3 is on a network different from that of the transmission device and receives the content transmitted from the bridge device. The data encryption unit 4 is provided for encryption using the second secret key shared by the receiving device and the bridge device 1. This second secret key is the one that the receiving device and the bridge device 1 authenticate and share.

The bridge device 1 also comprises a key number adding section 5 for adding a key number to the encrypted content.
The key number addition unit 5 adds the key number of the first secret key shared with the transmitting device to the content encrypted by the data encryption unit 4. Since this key number is added to the content, the receiving device receiving this can recognize the change of the secret key of the content by itself. As a result, it is possible to prevent authentication of the private key from an unnecessary receiving device due to reception interruption due to reception failure such as noise. This key number has a one-to-one correspondence with the private key and may be information that can identify the private key, or may be sufficient information to identify the private key even if it is not one-to-one.

Further, the bridge device 1 includes a second network interface (network I / F) 6 for transmitting the content to which the key number is added to the receiving device.

FIG. 2 is a block diagram showing a schematic configuration of a network in which the bridge device 1 is used. The bridge device 1 receives the content transmitted from the transmission device 7 provided in the network A, adds the key number after the decryption and the encryption as described above, and adds the key number to the network A.
The content is transmitted to the receiving device 8 provided in the network B different from the above.

An example of the data format transmitted from the bridge device 1 to the receiving device 8 is shown in FIG. FIG. 3 shows 139
4 Isochronous packets to 802.11a
An example of a frame format in the case of being carried in a packet and transmitted will be shown. In the figure, the contents of each area of the data format are as follows. (1) Frame Co
"ntrol" is frame-related information such as frame type identification, presence or absence of subsequent fragments, and retransmission frame identification.
(2) Duration ID is the total time of all sequences related to frame transmission, or an ID number assigned to each station from the access point. (3)
Add1 is the destination address. (4) Add2 is the source address. (5) Add3 and Add4 are addresses used when relaying between access points. (6) SEQ C
trl is a management number for fragmentation and order control. (7) Frame Body is payload data to be transmitted. (8) Data Type is a type of packet data, and in this example, "1394 Isochronous
Packet ". (9) Key No is Frame Bo
The key number embedded in dy. (10) Frame Bo
dy is content data to be transmitted. (11) FCS is a data check field.

Next, the operation of the bridge device of the present invention will be described with reference to FIGS. 4 and 5. FIG. 4 is a flowchart explaining the normal operation. As shown in FIG. 4 (a),
The bridge device 1 receives the content from the transmitting device 7 on the network A. The content is protected by DTCP, and the transmitting device 7 and the bridge device 1 share the secret key A_kx1. The bridge device 1 decrypts the encrypted and transmitted content with the shared secret key A_Kx1.

The bridge device 1 encrypts the decrypted content and transmits it to the receiving device 8 on another network B. The encryption uses the secret key B_kx1 which is shared by the bridge device 1 and the receiving device 8 after being authenticated. At the time of transmitting the encrypted content, in the bridge device 1, not only the packet of the encrypted content but also the key number A of the secret key A_kx1 indicated as Key No in FIG.
_K1 is added and transmitted. The secret key A_kx1 and the key number A_k1 have a one-to-one correspondence, and the key number A_k1 can identify the secret key A_kx1.

The receiving device 8 decrypts the received content using the secret key B_kx1 for sharing with the bridge device 1.

Next, as shown in FIG. 4B, the transmitting device 7
When the transmission of the content from the above is stopped, the bridge device 1 stops the transmission to the receiving device 8 on the network B.

After that, as shown in FIG. 4C, when the transmission of the content from the transmitting device 7 is resumed and the bridge device resumes the reception, the bridge device 1 confirms the key number transmitted by the transmitting device 7. If it has been changed, re-authenticate. New common secret key A_k obtained as a result of re-authentication
The key number A_k2 of x2 is embedded in the packet to be transmitted to the receiving device 8 on the network B, and is transmitted together with the content data.

The receiving device 8 confirms the key number embedded in the received content and recognizes that the secret key of the content is different from the previous one because it is different from before the transmission of the content was stopped. In this case, the receiving device makes an authentication request again to the bridge device 1, obtains a new secret key, and decrypts the content using the obtained secret key.

Next, the operation when the bridge device 1 cannot receive the content from the transmitting device 7 due to some cause such as noise will be described with reference to FIG. As shown in FIG. 5A, as in FIG. 4A, the bridge device 1 receives the content from the transmission device 7 on the network A. The content is protected by DTCP, and the transmitting device 7 and the bridge device 1 have a private key A_kx1.
To share. Private key A shared by the bridge device 1
_Kx1 decrypts the encrypted and transmitted content.

The bridge device 1 encrypts the decrypted content and sends it to the receiving device 8 on another network B. The encryption uses the secret key B_kx1 which is shared by the bridge device 1 and the receiving device 8 after being authenticated. When transmitting the encrypted content, the bridge device 1 does not only transmit the encrypted content packet but also the secret key A_k.
The key number A_k1 of x1 is added and transmitted. The secret key A_kx1 and the key number A_k1 have a one-to-one correspondence.

The receiving device 8 decrypts the received content using the secret key B_kx1 for sharing with the bridge device 1.

Next, as shown in FIG. 5B, when the bridge device 1 cannot receive the content transmitted from the transmitting device 7 due to some cause such as noise, the bridge device 1 will be on the network B. The transmission to the receiving device 8 is stopped.

After that, as shown in FIG. 5C, when the bridge device 1 resumes receiving the content transmitted from the transmitting device 7, the bridge device 1 confirms the key number transmitted by the transmitting device 7. To do. When the key number transmitted by the transmitter 7 is the same as before the transmission of the content was stopped, the bridge device 1 does not re-authenticate. Then, the bridge device 1 has the same key number A_kx as before the stop of the content transmission.
1 is transmitted to the receiving device 8 on the network B together with the content data.

The receiving device 8 recognizes that the key number embedded in the content received from the bridge device 1 is the same as the key number before the stop of the transmission of the content, and as a result, the content transmitted at the time of restarting the reception is the same as before the stop. Can be recognized as the same content. No new authentication request is made for the same content, and the number of receivers 8 of the transmitter 7 is not updated.

As described above, the bridge device 1 is the transmitter device 7.
And the key number obtained by the authentication together with the content, the receiving device 8
The receiving device 8 can recognize the change of the secret key of the transmitted content by confirming this key number.

The bridging device of the present invention can be applied not only when bridging a wired network and a wireless network, but also when bridging a wireless network and a wireless network.

[0038]

According to the invention described in detail above, there is provided a bridge device and a transmission method by which a receiving device receiving data via the bridge device can know the change of the content transmitted from the transmitting device. It is possible.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a bridge device according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a network worm in which a bridge device according to an embodiment of the present invention is used.

FIG. 3 is a schematic diagram showing an example of a format of content transmitted by the bridge device according to the embodiment of the present invention.

FIG. 4 is a flowchart showing the operation of the bridge device of FIG.

5 is a flowchart showing another operation of the bridge device of FIG.

[Explanation of symbols]

1 ... Bridge device, 2 ... First network I / F, 3 ... Data decoding unit, 4 ... Data encryption part, 5 ... Key number addition section, 6 ... second network I / F, 7 ... Transmitting device, 8 ... Receiving device

Claims (6)

[Claims] 1. A bridge device for receiving content transmitted on a network, decrypting the received content with a first secret key, and then transmitting the content encrypted with a second secret key to another network. A bridge device comprising: identification information adding means for adding identification information for identifying the first secret key to the content encrypted with the second secret key. 2. The bridge device according to claim 1, wherein the identification information adding means adds the key number of the first secret key to the content encrypted with the second secret key. 3. A transmission method in which a bridge device receiving content transmitted on a network decrypts it with a first secret key, then encrypts it with a second secret key and transmits it to another network. Is added with the identification information for identifying the first secret key to the content encrypted by the second secret key. 4. The transmission method according to claim 3, wherein the identification information is a key number of the first secret key. 5. A content received by a bridge device, which has received content transmitted from a transmitting device on a network, is decrypted with a first secret key and then encrypted with a second secret key, and the content is encrypted on another network. In the transmission method of transmitting to the receiving device of No. 2, when the bridge device adds the same key identification information as before the stop when the bridge device resumes the reception after the reception is stopped,
A transmission method characterized by not recertifying the private key of. 6. A content received by a bridge device, which has received content transmitted from a transmission device on a network, is decrypted with a first secret key and then encrypted with a second secret key, and the content is encrypted on another network. In the transmission method of transmitting to the receiving device, the receiving device adds the key identification information different from that before the stop when the bridge device resumes the reception after the reception is stopped.
A transmission method characterized by performing re-authentication of the private key of.