JP2004072342A - Data stream recording device and method, and program for recording data stream - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data stream recording device, etc. constituted so that data stored in an encrypted state can be easily used on the outside. <P>SOLUTION: A PC-DTV board 3 acquires a data stream and encrypts a target part to be recorded out of the data stream by using an encryption key generated by itself and stored. The encrypted data stream is stored in a storage 2 for a recording/reproducing machine 1. In reproducing contents expressed by the data stream by the recording/reproducing machine 1, the machine 1 reads the encrypted data stream from the storage 2 and sends the read data stream to the PC-DTV board 3. The PC-DTV board 3 generates contents data by decrypting the encrypted data stream and returns the contents data to the machine 1. In moving the data stream, the PC-DTV board 3 decrypts the encrypted data stream, supplies the decrypted data stream to the outside, and erases the encryption key used for decryption. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a data stream recording device, a data stream recording method, and a program.
[0002]
[Prior art]
2. Description of the Related Art Digital broadcasting that broadcasts content such as images and sounds in the form of a data stream composed of a series of packets including data representing the content is used. Digitally broadcasted content can be stored in a storage device as data in digital format, and the data is unlikely to deteriorate during storage.
[0003]
For this reason, a technology for protecting rights such as copyright on digitally broadcasted content has been used. Specifically, there are a method of storing data representing contents after encrypting the data, and a method of storing data in a storage device protected from unauthorized access from the outside.
[0004]
[Problems to be solved by the invention]
However, if data is encrypted and stored, even if the data is encrypted and rewritten to an external recording medium, the data cannot be used. Therefore, unless the data can be decrypted externally, the data is used. The only way to do this is for the encrypted device to decrypt itself and play back the content itself. Therefore, it is almost impossible to transfer (move) the stored data to the outside of the encryption device in a usable state.
[0005]
The present invention has been made in view of the above situation, and provides a data stream recording apparatus and a data stream recording method for easily using externally stored data stored in an encrypted state. With the goal.
[0006]
[Means for Solving the Problems]
In order to achieve the above object, a data stream recording device according to a first aspect of the present invention includes:
First storage means having a first storage area for storing an encryption key;
Second storage means having a second storage area;
A data stream to be recorded representing data is obtained, the obtained data stream is encrypted using an encryption key stored in the first storage area, and the encrypted data stream is stored in the second storage area. Encrypting means for storing the data stream in the storage area; reading out the data stream to be moved from the second storage area; reading out the encryption key from the first storage area; Decrypting using the read encryption key, and decrypting means for outputting data represented by the decrypted data stream to an external device,
The first storage unit prevents access to the first storage area from a unit other than the encryption unit and the decryption unit;
It is characterized by the following.
[0007]
The encryption unit may include a unit that generates the encryption key and stores the encryption key in the first storage area, and the decryption unit includes the encryption key used for decrypting the data stream. A means for erasing a key from the first storage area may be provided.
[0008]
A data stream recording method according to a second aspect of the present invention includes:
Obtaining a data stream to be recorded representing data, encrypting the obtained data stream using an encryption key stored in a first storage area, and storing the encrypted data stream in a second storage area An encryption step to be stored in the
The data stream to be moved is read from the second storage area, the encryption key is read from the first storage area, and the read data stream is decrypted using the read encryption key. A decoding step of outputting the data represented by the decoded data stream to an external device;
Preventing the first storage area from receiving access other than the access in the encryption step and the decryption step.
It is characterized by the following.
[0009]
A program according to a third aspect of the present invention includes:
Computer
First storage means having a first storage area for storing an encryption key;
Second storage means having a second storage area;
A data stream to be recorded representing data is obtained, the obtained data stream is encrypted using an encryption key stored in the first storage area, and the encrypted data stream is stored in the second storage area. Encrypting means for storing the data stream in the storage area; reading out the data stream to be moved from the second storage area; reading out the encryption key from the first storage area; A program for functioning as decryption means for decrypting using the read encryption key and outputting data represented by the decrypted data stream to an external device,
The first storage unit prevents access to the first storage area from a unit other than the encryption unit and the decryption unit;
It is characterized by the following.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing a configuration of a digital broadcast recorder according to an embodiment of the present invention. As shown in the figure, the digital broadcast recorder includes a recording / reproducing machine 1, a recording / reproducing machine storage 2, and a PC-DTV board 3. The recording / reproducing machine storage 2 is connected to the recording / reproducing machine 1, and the PC-DTV board 3 is connected to the recording / reproducing machine 1 via a connection bus B. The connection bus B is composed of a USB (Universal Serial Bus).
[0011]
The recording / reproducing machine 1 includes, for example, a processor including a CPU (Central Processing Unit), a memory including a RAM (Random Access Memory), a bus controller, a display device such as a liquid crystal panel, and a display device in accordance with instructions from the processor. A display unit consisting of a video circuit that controls the display of images by a computer, an audio output unit that consists of speakers and an audio amplifier, etc., and reproduces audio according to instructions from the processor, and a keyboard or mouse that follows the operation of the operator. An input for supplying data to the processor.
[0012]
The memory of the recording / reproducing machine 1 has a storage area serving as a work area of the processor of the recording / reproducing machine 1. The bus controller of the recording / reproducing machine 1 uses a DTCP (Digital Transmission Copy Protection) method via a connection bus B between the processor of the recording / reproducing machine 1 and a device other than the recording / reproducing machine 1. It consists of a control circuit for controlling the exchange.
In DTCP, one of a plurality of devices encrypts data and transmits the data via a bus, and the other acquires and decrypts the encrypted data. This is a technique to prevent the
[0013]
The recording / reproducing machine 1 reads out a broadcast recording / reproducing program stored in the recording / reproducing machine storage 2, and performs processing described later according to the broadcast recording / reproducing program.
[0014]
The recording / reproducing machine storage 2 is composed of a hard disk device or the like, and stores the broadcast recording / reproducing program described above in advance. Then, in accordance with the access from the recording / reproducing machine 1, the data supplied by the recording / reproducing machine 1 is stored, or the data stored therein is read and supplied to the recording / reproducing machine 1.
[0015]
As shown in FIG. 2, the PC-DTV board 3 includes a digital broadcast receiving unit 31, a bus controller 32, an internal memory 33, an encryption processing unit 34, and an output interface 35.
[0016]
The digital broadcast receiving unit 31 includes a demodulation circuit, and is connected to a bus controller 32 via an internal bus. The digital broadcast receiving unit 31 restores a TS (Transport Stream) packet constituting the data stream by inputting and demodulating a modulated wave representing a data stream digitally broadcasted from the outside, and encrypts the restored TS packet. It is supplied to the processing unit 34.
[0017]
The data stream represented by the modulated wave received by the digital broadcast receiving unit 31 represents an image, audio, or other content, and is configured by a plurality of continuous TS packets. The TS packet is a packet representing an image, audio, or other content, and includes a TS packet header and a payload section (adaptation / payload section) following the TS packet header.
[0018]
The payload portion is a portion including data representing the content. On the other hand, the TS packet header includes, in order from the beginning, a synchronization byte, TS error data, payload unit start indicator, transport priority data, PID (Program IDentifier), transport scramble control data, adaptation field control data, and continuity index. Including.
[0019]
Among these, the PID is data for identifying which content (for example, which image or sound is expressed) the payload portion of the TS packet including the PID itself.
[0020]
The bus controller 32 is composed of a logic circuit and the like, is connected to the recording / reproducing machine 1 via a connection bus B, and is connected to the digital broadcast receiving unit 31 and the encryption processing unit 34 via an internal bus. Have been.
The bus controller 32 mediates access between the recording / reproducing machine 1 and the encryption processing unit 34 according to the DTCP method. In addition, it also supplies a data stream from the digital broadcast receiving unit 31 to the encryption processing unit 34.
[0021]
The bus controller 32 substantially prevents the access even if the recording / reproducing machine 1 accesses the internal memory 33 or the encryption processing unit 34 without following the control of the broadcast recording / reproducing program.
[0022]
The internal memory 33 is composed of a nonvolatile memory such as a compact flash (registered trademark). The internal memory 33 stores the TS bank and the key vector in addition to the storage of the TS packet according to the processing described later.
[0023]
The key bank is data including a plurality of encryption keys used by the encryption processing unit 34 to perform encryption and decryption of a TS packet according to processing described later.
The key vector is data specifying an encryption key included in the key bank. The total number of key vectors is the same as the number of encryption keys included in the key bank, and the key vector and the encryption key included in the key bank are associated one-to-one. Functions as data for specifying an encryption key associated with each user.
[0024]
The encryption processing unit 34 includes, for example, a processor such as a CPU, a volatile memory such as a RAM, and a non-volatile memory such as a ROM. The volatile memory and the non-volatile memory of the encryption processing unit 34 are connected to the processor of the encryption processing unit 34. Further, the processor of the encryption processing unit 34 is connected to the bus controller 32.
[0025]
The non-volatile memory of the cryptographic processing unit 34 previously stores a program for controlling a process to be described later, which is executed by the cryptographic processing unit 34, and the processor of the cryptographic processing unit 34 reads out the program from the non-volatile memory. The process is performed by executing. The storage area of the volatile memory of the cryptographic processing unit 34 functions as a work area of the processor of the cryptographic processing unit 34.
[0026]
The output interface 35 includes a logic circuit and the like, and is connected to the encryption processing unit 34 via an internal bus. The output interface 35 performs the function of an IEEE (Institute of Electrical and Electronic Engineers) 1394 interface, and provides access between the cryptographic processing unit 34 and an external device in accordance with the IEEE 1394 standard and the above-described DTCP. Mediate by technique.
[0027]
(motion)
Next, the operation of the digital broadcast recorder will be described.
FIG. 3 is a flowchart showing a process of recording a data stream.
FIG. 4 is a flowchart showing the process of content reproduction.
FIG. 5 is a flowchart showing the process of moving the data stream.
[0028]
(Record data stream)
When the modulated wave representing the data stream is supplied to the digital broadcast receiving unit 31 of the PC-DTV board 3, the digital broadcast receiving unit 31 restores the data stream by demodulating the modulated wave. Then, the restored data stream is supplied to the encryption processing unit 34.
[0029]
On the other hand, when the recording / reproducing machine 1 acquires a recording instruction from the outside in accordance with an operation of an operator, for example, the broadcast recording / reproducing program is read from the recording / reproducing machine storage 2 and executed in response to the instruction.
When the recording / reproducing machine 1 executing the broadcast recording / reproducing program obtains data (for example, PID) specifying the content to be stored according to the operation of the operator, the recording / reproducing machine 1 transmits the data to the connection bus B and the bus controller. The data is supplied to the cryptographic processing unit 34 via the control unit 32 (FIG. 3, step S101).
[0030]
When the processor of the encryption processing unit 34 is supplied with the data stream from the digital broadcast receiving unit 31 (that is, when the TS packets are sequentially supplied), the processor is first included in the TS packet supplied from the digital broadcast receiving unit 31. The PID is specified, and it is determined whether the specified PID indicates the content to be stored (step S102). This determination may be made, for example, based on data supplied from the recording / reproducing machine 1 and specifying data to be stored.
[0031]
When determining that the PID does not indicate the content to be stored, the encryption processing unit 34 discards the TS packet including the PID (step S103). On the other hand, when determining that the content indicates the content to be stored, the encryption processing unit 34 encrypts the payload portion of the TS packet including the PID (step S104).
[0032]
Note that the encryption processing unit 34 generates an encryption key used to encrypt the payload portion of the TS packet and a key vector indicating the encryption key, and encrypts the payload portion using the newly generated encryption key. It is assumed that this encryption key is written in the internal memory 33. Further, the encryption processing unit 34 uses the same encryption key to encrypt the payload of each TS packet belonging to the same data stream.
[0033]
Then, the encryption processing unit 34 attaches a key vector indicating an encryption key used for performing the encryption to the TS packet whose payload has been encrypted, and supplies the TS packet to the recording / reproducing machine 1 (step S105). ).
[0034]
When the TS packet having the payload portion encrypted is supplied to the recording / reproducing machine 1, the recording / reproducing machine 1 accesses the recording / reproducing machine storage 2 under the control of the broadcast recording / reproducing program, and transmits the TS packet. Then, it is stored in the storage area of the recording / playback machine storage 2 together with the key vector attached to the TS packet (step S106).
[0035]
Note that the recording / reproducing machine 1 specifically has a form in which TS packets representing the same content are associated with each other (for example, in such a form that these TS packets are stored in the same file). The file containing the TS packet may be stored in the storage 2 for the recording / reproducing machine. Further, when TS packets whose payload portions are encrypted using the same encryption key are associated with each other, one key vector indicating this encryption key is added to a set of these TS packets. Is enough.
[0036]
(Play content)
On the other hand, for example, when the recording / reproducing machine 1 obtains a content reproduction instruction from the outside in accordance with an operation of the operator, the broadcast recording / reproduction program is read from the recording / reproduction machine storage 2 and executed in response to the instruction. .
[0037]
The recording / reproducing machine 1 that executes the broadcast recording / reproducing program, according to the operation of the operator, stores information indicating the TS packet representing the content to be reproduced (for example, the file name of the file storing the TS packet, When the address of the stored storage area is acquired, the TS packet indicated by this information is read out from the recording / reproducing machine storage 2 together with the key vector attached to the TS packet (FIG. 4, step S201).
[0038]
Next, the recording / reproducing machine 1 transmits the read TS packet (and the key vector) to the encryption processing unit 34 via the bus B and the bus controller 32 of the PC-DTV board 3 under the control of the broadcast recording / reproducing program. Supply (Step S202).
[0039]
When supplied with the TS packets representing the content to be reproduced, the encryption processing unit 34 specifies the key vectors attached to these TS packets, and accesses the internal memory 33 with the encryption key specified by the key vectors. Then, the data is read from the key bank (step S203).
[0040]
Next, the encryption processing unit 34 decrypts the payload portion of each TS packet supplied from the recording / reproducing machine 1 using the encryption key read from the key bank (Step S204). Then, content data is generated by decoding the image or audio represented by the payload portion of each decoded TS packet, and the content data is supplied to the recording / reproducing machine 1 (step S205).
[0041]
Upon receiving the content data from the encryption processing unit 34, the recording / reproducing machine 1 reproduces the content represented by the content data (step S206). Specifically, for example, the image represented by the content data is displayed on its own display device, or the sound represented by the content data is reproduced.
[0042]
(Move data stream)
Further, for example, when the recording / reproducing machine 1 acquires an instruction to move the data stream from the outside according to the operation of the operator, the broadcast recording / reproducing program is read from the recording / reproducing machine storage 2 in response to the instruction. Execute.
[0043]
When the recording / reproducing machine 1 that executes the broadcast recording / reproducing program acquires information indicating a TS packet indicating the content to be moved according to an operation of an operator, the TS packet indicated by the information is attached to the TS packet. It is read out from the recording / playback machine storage 2 together with the key vector, and is supplied to the encryption processing unit 34 in the same manner as when the content playback is instructed (FIG. 5, step S301).
[0044]
When supplied with the TS packets representing the contents to be moved, the encryption processing unit 34 decrypts the payload portions of these TS packets in the same manner as the above-described procedure for reproducing the contents (step S302). ).
On the other hand, the encryption processing unit 34 deletes the encryption key used for decrypting the payload from the storage area of the internal memory 33 (Step S303).
[0045]
Next, the encryption processing unit 34 generates content data by decoding an image or a sound represented by the payload portion of each decrypted TS packet. Then, the content data is supplied via the output interface 35 to an external device connected to the output interface 35 via the IEEE 1394 interface (step S304).
[0046]
The digital broadcast recorder that performs the above-described operation encrypts a data stream to be recorded and stores the encrypted data stream in the storage 2 for the recording / reproducing machine. The digital broadcast recorder itself generates an encryption key necessary for decrypting the data stream, and stores the encryption key in a storage area where external access is substantially impossible.
For this reason, for example, even if the storage 2 for the recording / reproduction machine is separated and the content is reproduced on the basis of the encrypted data stream stored in the storage 2 for the recording / reproduction machine using an external computer or the like, the content is reproduced Can not. As a result, the content is protected.
[0047]
On the other hand, the encrypted data stream is decrypted by the digital broadcast recorder itself, and is used for content reproduction by the digital broadcast recorder itself or output to the outside according to a user's instruction. When the decrypted data stream is output to the outside, the encryption key used for encrypting and decrypting the data stream is deleted.
[0048]
The configuration of the digital broadcast recorder is not limited to the above.
For example, the encryption processing unit 34 does not necessarily need to generate a new encryption key every time the payload of a TS packet is encrypted. Therefore, the manufacturer of the PC-DTV board 3 may store the encryption key and the key vector in the internal memory 33 in advance, and the encryption processing unit 34 may use the previously stored encryption key for encryption. . Further, the encryption key used for the decryption need not always be deleted.
[0049]
The data stream to be recorded does not necessarily need to be composed of the above-described set of TS packets. In this digital broadcast recorder, it is not necessary to encrypt the data stream for each packet. For example, the entire data representing the same content may be encrypted collectively.
[0050]
Further, the connection bus B is not necessarily limited to the USB, and may be a bus conforming to an arbitrary standard. Therefore, the connection bus B may be, for example, a bus compliant with the IEEE 1394 standard. The bus controller 32 may be any as long as it mediates data exchange conforming to the standard to which the connection bus B conforms.
[0051]
Further, the bus controller of the recording / reproducing machine 1 and the output interface 35 of the PC-DTV board 3 do not necessarily have to exchange data by the DTCP method. However, the transmission of data on the connection bus B and the transmission of data between the output interface 35 and an external device are desirably performed in a state where the data to be transmitted is encrypted.
[0052]
The embodiment of the present invention has been described above, but the data stream device according to the present invention can be realized using a general computer system without using a dedicated system.
For example, from a medium (CD-ROM, MO, flexible disk, etc.) storing a program for causing a personal computer having an expansion bus to execute the operations of the above-described recording / reproducing machine 1 and the recording / reproducing machine storage 2 The above-described processing is performed by installing a program from a medium storing a program for executing the operation of the PC-DTV board 3 in a microcomputer attached to an expansion bus of the personal computer. Can be configured.
[0053]
Further, for example, these programs may be posted on a bulletin board (BBS) of a communication line and distributed via the communication line. Further, a carrier wave is modulated by a signal representing these programs, and the obtained modulation is obtained. A device that transmits a wave and receives the modulated wave may demodulate the modulated wave and restore these programs.
Then, by starting the program and executing it under the control of the OS in the same manner as other application programs, the above-described processing can be executed.
[0054]
When the OS shares a part of the processing, or when the OS constitutes a part of one component of the present invention, the program excluding the part is stored in the recording medium. You may. Also in this case, in the present invention, it is assumed that the recording medium stores a program for executing each function or step executed by the computer.
[0055]
【The invention's effect】
As described above, according to the present invention, a data stream recording device and a data stream recording method for easily using externally stored data stored in an encrypted state are realized.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a digital broadcast recorder according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration of a PC-DTV board.
FIG. 3 is a flowchart illustrating a process of recording a data stream.
FIG. 4 is a flowchart showing processing of content reproduction.
FIG. 5 is a flowchart showing a process of moving a data stream.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Recording / playback machine 2 Storage / playback machine storage 3 PC-DTV board 31 Digital broadcast receiving unit 32 Bus controller 33 Internal memory 34 Encryption processing unit 35 Output interface B Connection bus

Claims (4)

First storage means having a first storage area for storing an encryption key;
Second storage means having a second storage area;
A data stream to be recorded representing data is obtained, the obtained data stream is encrypted using an encryption key stored in the first storage area, and the encrypted data stream is stored in the second storage area. Encrypting means for storing the data stream in the storage area; reading out the data stream to be moved from the second storage area; reading out the encryption key from the first storage area; Decrypting using the read encryption key, and decrypting means for outputting data represented by the decrypted data stream to an external device,
The first storage unit prevents access to the first storage area from a unit other than the encryption unit and the decryption unit;
A data stream recording device, characterized in that: The encryption unit includes a unit that generates the encryption key and stores the encryption key in the first storage area.
The decrypting means includes means for deleting the encryption key used for decrypting the data stream from the first storage area.
The data stream recording device according to claim 1, wherein: Obtaining a data stream to be recorded representing data, encrypting the obtained data stream using an encryption key stored in a first storage area, and storing the encrypted data stream in a second storage area An encryption step to be stored in the
The data stream to be moved is read from the second storage area, the encryption key is read from the first storage area, and the read data stream is decrypted using the read encryption key. A decoding step of outputting the data represented by the decoded data stream to an external device;
Preventing the first storage area from receiving access other than the access in the encryption step and the decryption step.
A data stream recording method, characterized in that: Computer
First storage means having a first storage area for storing an encryption key;
Second storage means having a second storage area;
A data stream to be recorded representing data is obtained, the obtained data stream is encrypted using an encryption key stored in the first storage area, and the encrypted data stream is stored in the second storage area. Encrypting means for storing the data stream in the storage area; reading out the data stream to be moved from the second storage area; reading out the encryption key from the first storage area; A program for functioning as decryption means for decrypting using the read encryption key and outputting data represented by the decrypted data stream to an external device,
The first storage unit prevents access to the first storage area from a unit other than the encryption unit and the decryption unit;
A program characterized by the following.

Images