JP2007018365A - Information recording medium taking into consideration starting conditions of regeneration management described by declarative language, and regeneration apparatus thereof, method for reproducing - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a structure which verifies easily that an application has not been forged/altered by a malicious third party, when documents transition to HTML file on a content server over the Internet has occurred, in introducing the regeneration management environment by the application newly described in HTML and script by BD-ROM for image data. <P>SOLUTION: A filename which constitutes an application on the content server, each file which carries hash value description are arranged on the content server. By having a BD player acquire this file, in advance, and verify it with a means, such as a signature, when the transition to the application on this contents server occurs, it can verify it easily, for a short period of time, based on the filename and the hash value which are indicated by the above file in the validity of the configuration file of application. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information recording medium on which video data is recorded, such as a BD-ROM, and a playback apparatus and playback method thereof, and more particularly to an improvement in the case of introducing a programming environment to the development of content including video data and a program.

  A typical information recording medium on which video data is recorded is a DVD (hereinafter referred to as SD-DVD or simply DVD). Hereinafter, a conventional DVD will be described.

  FIG. 1 is a diagram showing the structure of an SD-DVD. As shown in the lower part of FIG. 1, a logical address space is provided on the DVD disc from lead-in to lead-out, and the volume information of the file system is recorded from the head of the logical address space, followed by video / audio, etc. Application data is recorded.

  A file system is ISO9660 or UDF (Universal Disc Format), and is a mechanism for expressing data on a disk in units called directories or files. Even in the case of a personal computer (PC) that is used daily, data recorded on a hard disk in a directory or file structure is expressed on the computer by passing through a file system called FAT or NTFS, thereby improving usability. In the case of SD-DVD, both UDF and ISO9660 are used (sometimes referred to as “UDF bridge” together), and data is read by either UDF or ISO9660 file system drivers (DVDs handled here are This is a ROM disk for package media, and is physically unwritable).

  Data recorded on the DVD can be viewed as a directory or file as shown in the upper left of FIG. 1 through the UDF bridge. A directory called “VIDEO_TS” is placed directly under the root directory (“ROOT” in the figure), and DVD application data is recorded therein. Application data is recorded as a plurality of files, and the main files are as follows.

VIDEO_TS. IFO disc playback control information file VTS_01_0. IFO video title set # 1 playback control information file VTS_01_0. VOB video title set # 1 stream file. . . . .

  There are two types of extensions. “IFO” is a file in which reproduction control information is recorded, and “VOB” is a file in which an MPEG stream that is AV data is recorded. The playback control information is information for realizing interactivity (technology for dynamically changing playback in accordance with user operations) adopted by DVD, information attached to titles and AV streams such as metadata. And so on. In DVD, generally, reproduction control information is sometimes referred to as navigation information.

  The playback control information file includes “VIDEO_TS.IFO” for managing the entire disc and individual video title sets (multiple titles for DVD, in other words, different movies and different versions of movies can be recorded on one disc. There is “VTS — 01 — 0.IFO” which is reproduction control information for each. Here, “01” in the file name body indicates the number of the video title set. For example, in the case of the video title set # 2, “VTS — 02 — 0.IFO”.

  The upper right part of FIG. 1 is a DVD navigation space in the DVD application layer, which is a logical structure space in which the above-described reproduction control information is expanded. Information in “VIDEO_TS.IFO” is stored in the DVD navigation space as VMGI (VIDEO Manager Information), “VTS — 01 — 0.IFO”, or playback control information existing for each other video title set is stored in the DVD navigation space as VTSI (Video Title Set Information). Be expanded.

  In VTSI, PGCI (Program Chain Information), which is information of a reproduction sequence called PGC (Program Chain), is described. The PGCI is composed of a set of cells and a kind of programming information called a command. Cell itself is a set of a part or all of a VOB (which is an abbreviation of Video Object and indicates an MPEG stream), and playback of a cell means that a section specified by the cell of the VOB is played back. ing.

  The command is processed by a DVD virtual machine and is similar to a Java (registered trademark) script executed on a browser. However, while Java (registered trademark) scripts control windows and browsers in addition to logical operations (for example, opening a new browser window), DVD commands play AV titles in addition to logical operations. It is different in that it only performs control, for example, specifying a chapter to be played back.

  The Cell has VOB start and end addresses (logical addresses) recorded on the disc as its internal information, and the player reads data using the VOB start and end address information described in the Cell. Execute playback.

  FIG. 1 is a schematic diagram for explaining navigation information embedded in an AV stream. The interactivity, which is the feature of SD-DVD, is not realized only by the navigation information recorded in the aforementioned “VIDEO_TS.IFO”, “VTS — 01 — 0.IFO”, etc. It is multiplexed together with video and audio data in a VOB using a dedicated carrier called a pack (called Navi pack or NV_PCK).

  Here, a menu is described as an example of simple interactivity. Several buttons appear on the menu screen, and each button defines processing when the button is selected and executed. In addition, one button is selected on the menu (the highlight button has a translucent color overlaid on the selection button), and the user can use the up / down / left / right keys on the remote control to move the selected button up / down / left / right. It can be moved to any of the buttons. Using the up / down / left / right keys on the remote control, move the highlight to the button you want to select and execute, and press the enter key to execute the corresponding command program. In general, reproduction of a corresponding title or chapter is executed by a command.

The upper left part of FIG. 2 shows an outline in NV_PCK.
NV_PCK includes highlight color information and individual button information. In the highlight color information, color palette information is described, and a semi-transparent color of the highlight displayed on the overlay is designated. The button information includes rectangular area information that is position information of each button, movement information from the button to another button (designation of a destination button corresponding to each of the user's up / down / left / right key operations), and button command information. (Command executed when the button is determined) is described.

  The highlight on the menu is created as an overlay image as shown in the upper right part of the center of FIG. The overlay image is obtained by adding the color palette information color to the rectangular area information of the button information. This overlay image is combined with the background image shown on the right and displayed on the screen.

  As described above, the menu is realized in the DVD. The reason why a part of the navigation data is embedded in the stream using NV_PCK is that the menu information is dynamically updated in synchronization with the stream, for example, during 5 to 10 minutes during movie playback. This is because, even in the case of an application in which synchronization timing is likely to be a problem, such as a menu being displayed only on the screen, it can be realized without any problem.

  FIG. 3 is an image of a DVD VOB. As shown in the figure, data (A stage) such as video, audio, subtitles, etc. is packetized and packed (B stage) based on the MPEG system (ISO / IEC13818-1) standard, and each is multiplexed into one. MPEG program stream (stage C). Further, as described above, NV_PCK including a button command for realizing interactive is also multiplexed together.

  The multiplexing feature of the MPEG system is that each data to be multiplexed is a bit string based on the decoding order, but between the multiplexed data, that is, between video, audio and subtitles, it is not necessarily the playback order, in other words For example, the bit string is not formed based on the decoding order. This is because the MPEG system stream decoder model (generally called System Target Decoder or STD (D stage in FIG. 3)) has a decoder buffer corresponding to each elementary stream after demultiplexing, and by the decoding timing It comes from temporarily accumulating data. This decoder buffer has a different size for each elementary stream, and has 232 kB for video, 4 kB for audio, and 52 kB for subtitles. For this reason, since the data input timing to each decoder buffer is different for each elementary stream, there is a difference between the order in which the bit string is formed as the MPEG system stream and the display (decoding) timing.

  That is, subtitle data multiplexed side by side with video data is not necessarily decoded at the same timing.

The configuration of such a DVD is described in Patent Document 1 below.
Patent No. 2813245

  By the way, the BD-ROM, which is a next-generation information recording medium, is scheduled to record applications including data written in a declarative language such as XML and a script program instead of the above-described program (navigation command). ing. Further, the BD player has a network connection function, and can execute by changing from the application to an application arranged in a content server on the Internet.

  For this reason, when executing an application arranged on a content server on the Internet, there is a possibility that an application flowing on the network is falsified or the content server is misrepresented and a user downloads and executes a malicious application. When such a program forged or altered by a malicious third party is executed in the player, the player system is destroyed, or video data to be protected recorded on a legitimate information recording medium is stolen or altered. Serious problems occur.

  However, in the existing technology, there is no mechanism for authenticating an application using HTML and a script arranged in a content server on the Internet, like an application on a BD-ROM disc.

  In order to solve the above-described problem, in the application authentication method according to the present invention, a file (Network Resource List File) in which a file name constituting each application arranged in the content server and each hash value is described is arranged on the content server. The BD player that reads and executes the information recording medium in advance acquires the Network Resource List File in advance and verifies it by means such as signature or HTTPS. As a result, when a transition to the application on the content server occurs, the BD player confirms that the file name of the application configuration file to be downloaded and its hash value are the same as those described in the Network Resource List File. .

  With the configuration described above, when an application placed on the content server is executed, the application is an application created by a legitimate studio, or other application, for example, a malicious third party forges the application. Whether it is a falsified application can be easily and quickly determined.

  As a result, regarding applications deployed on content servers on the Internet, applications other than those created by legitimate Studios that have not been tampered with may be considered to cause serious problems, and functions that can be used and resources that can be accessed will be denied. It becomes possible to restrict.

Example 1
First, a first embodiment of the present invention will be described.

(Logical data structure on disk)
FIG. 4 shows the structure of a BD-ROM (hereinafter also referred to as “BD”), in particular, the structure of a BD disk (104) as a disk medium and data (101, 102, 103) recorded on the disk. FIG. Data recorded on the BD disc (104) is AV data (103), BD management information (102) such as management information related to AV data and an AV playback sequence, and a BD playback program (101) that realizes interactive processing. . In the present embodiment, a BD disc will be described mainly with respect to an AV application for reproducing AV contents such as movies, but the BD disc will be used as a recording medium for computers such as a CD-ROM and a DVD-ROM. Of course, it is also possible. FIG. 5 is a diagram showing logical data recorded on the BD disc described above. A BD disc has a spiral recording area from the inner circumference to the outer circumference like other optical discs such as DVDs and CDs, and logical data is transferred between the inner lead-in and outer lead-out. It has a logical address space that can be recorded. Further, inside the lead-in, there is a special area that can be read only by a drive called BCA (Burst Cutting Area). Since this area cannot be read from an application, it is often used for copyright protection technology, for example.

  Application data such as video data is recorded in the logical address space with file system information (volume) at the head. As described in the prior art, the file system is UDF, ISO9660 or the like, and logical data recorded in the same way as a normal PC can be read using a directory and file structure. .

  In the case of this embodiment, the directory and file structure on the BD disc is a BDVIDEO directory placed directly under the root directory (ROOT). This directory is a directory in which data (101, 102, 103 described in FIG. 4) such as AV contents and management information handled by the BD-ROM is recorded.

  The following seven types of files are recorded under the BDVIDEO directory.

BD. INFO (fixed file name)
This is one of “BD management information” and is a file in which information related to the entire BD disc is recorded. The BD player first reads this file.

BD. PROG (fixed file name)
It is one of “BD playback programs” and is a file in which programs related to the entire BD disc are recorded.

XXX. PL ("XXX" is variable, extension "PL" is fixed)
It is one of “BD management information”, and is a file in which play list information for recording a scenario is recorded. I have one file per playlist.

XXX. PROG ("XXX" is variable, extension "PL" is fixed)
It is one of “BD playback programs” and is a file in which a program for each playlist described above is recorded. Correspondence with a playlist is identified by a file body name (“XXX” matches).

YYY. VOB ("YYY" is variable, extension "VOB" is fixed)
It is one of “AV data” and is a file in which VOB (same as VOB described in the conventional example) is recorded. There is one file for each VOB.

YYY. VOBI ("YYY" is variable, extension "VOBI" is fixed)
This is one of “BD management information” and is a file in which management information related to VOB as AV data is recorded. The correspondence with the VOB is identified by the file body name (“YYY” matches).

ZZZ. PNG ("ZZZ" is variable, extension "PNG" is fixed)
It is one of “AV data” and is a file in which image data PNG (an image format standardized by W3C and read as “ping”) for composing subtitles and menus is recorded. There is one file for each PNG image.

(Player configuration)
Next, the configuration of the player that plays the above-described BD disc will be described with reference to FIGS. 6 and 7. FIG.

FIG. 6 is a block diagram showing a rough functional configuration of the player.
Data on the BD disc (201) is read through the optical pickup (202). The read data is recorded in a dedicated memory according to the type of each data. The BD playback program (the contents of the “BD.PROG” or “XXX.PROG” file) is stored in the program recording memory (203) in the BD management information (“BD.INFO”, “XXX.PL” or “YYY.VOBI”). Are recorded in the management information recording memory (204), and AV data ("YYY.VOB" or "ZZZ.PNG") is recorded in the AV recording memory (205).

  The BD playback program recorded in the program recording memory (203) is recorded by the program processing unit (206), and the BD management information recorded in the management information recording memory (204) is recorded by the management information processing unit (207). The AV data recorded in the memory (205) is processed by the presentation processing unit (208).

  The program processing unit (206) receives event information such as playlist information to be played back and program execution timing from the management information processing unit (207), and processes the program. Also, the program can dynamically change the play list to be played back. In this case, the play list play command is sent to the management information processing unit (207). The program processing unit (206) receives an event from the user, that is, a request from the remote control key, and executes an execution process when there is a program corresponding to the user event.

  The management information processing unit (207) receives an instruction from the program processing unit (206), analyzes the management information of the VOB corresponding to the corresponding playlist and the playlist, and the AV data to be processed by the presentation processing unit (208). Instruct to play. Also, the management information processing unit (207) receives the reference time information from the presentation processing unit (208), instructs the presentation processing unit (208) to stop AV data reproduction based on the time information, and the program processing unit An event indicating the program execution timing is generated for (206).

  The presentation processing unit (208) has a decoder corresponding to each of video, audio, and caption / image, and decodes and outputs AV data in accordance with an instruction from the management information processing unit (207). In the case of video data and subtitles / images, after decoding, the video data and subtitles / images are drawn on the respective dedicated planes, the video plane (210) and the image plane (209), and the video synthesis process is performed by the synthesis processing unit (211). Output to the device.

  As shown in FIG. 6, the BD player has a configuration based on the data configuration recorded on the BD disc shown in FIG.

  FIG. 7 is a detailed block diagram of the player configuration described above. In FIG. 7, the AV recording memory (205) is in the image memory (308) and the track buffer (309), the program processing unit (206) is in the program processor (302) and the UOP manager (303), and the management information processing unit (207). ) Is a scenario processor (305) and a presentation controller (306), and a presentation processing unit (208) is a clock (307), a demultiplexer (310), an image processor (311), a video processor (312) and a sound processor (313). Are corresponding to each.

  The VOB data (MPEG stream) read from the BD disc (201) is recorded in the track buffer (309), and the image data (PNG) is recorded in the image memory (308). The demultiplexer (310) extracts the VOB data recorded in the track buffer (309) based on the time of the clock (307), and sends the video data to the video processor (312) and the audio data to the sound processor (313). The video processor (312) and the sound processor (313) are each composed of a decoder buffer and a decoder as defined by the MPEG system standard. That is, the video and audio data sent from the demultiplexer (310) are temporarily recorded in the respective decoder buffers and decoded by the individual decoders according to the clock (307).

  The PNG recorded in the image memory (308) has the following two processing methods. If the image data is for subtitles, the presentation controller (306) instructs the decoding timing. In order for the scenario processor (305) to receive the time information from the clock (307) once and display the appropriate subtitles, the subtitles are displayed to the presentation controller (306) at the subtitle display time (start and end). Give hidden instructions. The image processor (311) that has received the decode / display instruction from the presentation controller (306) extracts the corresponding PNG data from the image memory (308), decodes it, and draws it on the image plane (314).

  Next, when the image data is for a menu, the program processor (302) instructs the decoding timing. The time when the program processor (302) instructs to decode the image depends on the BD program being processed by the program processor (302), and is not generally determined.

  As described with reference to FIG. 6, the image data and the video data are recorded on the image plane (314) and the video plane (315) after being decoded, and are synthesized and output by the synthesis processing unit (316).

  The management information (scenario, AV management information) read from the BD disc (201) is recorded in the management information recording memory (304), but the scenario information (“BD.INFO” and “XXX.PL”) is stored in the management information recording memory (304). It is read and processed by the scenario processor (305). The AV management information (“YYY.VOBI”) is read and processed by the presentation controller (306).

  The scenario processor (305) analyzes the information of the playlist, and instructs the presentation controller (306) the VOB referenced by the playlist and the playback position thereof. The presentation controller (306) manages the management information of the target VOB. ("YYY.VOBI") is analyzed, and an instruction is issued to the drive controller (317) to read out the target VOB.

  The drive controller (317) moves the optical pickup according to the instruction of the presentation controller (306), and reads the target AV data. The read AV data is recorded in the image memory (308) or the track buffer (309) as described above.

  The scenario processor (305) monitors the time of the clock (307) and throws an event to the program processor (302) at the timing set in the management information.

  The BD program (“BD.PROG” or “XXX.PROG”) recorded in the program recording memory (301) is executed by the program processor 302. The program processor (302) processes the BD program when an event is sent from the scenario processor (305) or when an event is sent from the UOP manager (303). The UOP manager (303) generates an event in the program processor (302) when a request is sent from the user by a remote control key.

(Application space)
FIG. 8 is a diagram showing an application space of the BD-ROM.

  In the application space of the BD-ROM, a play list (PlayList) is one reproduction unit. The playlist has a static scenario composed of a playback sequence of a cell (Cell) and a dynamic scenario described by a program. Unless there is a dynamic scenario by the program, the playlist only reproduces the individual cells in order, and the reproduction of the playlist ends when the reproduction of all the cells is completed. On the other hand, the program can dynamically change the playback target depending on the playback description beyond the playlist, the user selection, or the player status. A typical example is a menu. In the case of a BD-ROM, the menu is to dynamically select a scenario to be played by the user's selection, that is, a playlist.

  The program here is an event handler executed by a time event or a user event.

  The time event is an event generated based on time information embedded in the playlist. The event sent from the scenario processor (305) described in FIG. 7 to the program processor (302) corresponds to this. When a time event is issued, the program processor (302) executes an event handler associated with the ID. As described above, the program to be executed can instruct playback of another playlist. In this case, playback of the currently played playlist is stopped and playback of the specified playlist is started. And transition.

  A user event is an event generated by a user's remote control key operation. User events are roughly divided into two types. The first is a menu selection event generated by operating a cursor key ("Up", "Down", "Left", "Right" key) or a "Determination" key. The event handler corresponding to the event selected from the menu is valid only for a limited period in the playlist (the validity period of each event handler is set as playlist information). A valid event handler is searched when the “down”, “left”, “right” key, or “decision” key is pressed. If there is a valid event handler, the event handler is executed. In other cases, menu selection events will be ignored.

  The second user event is a menu call event generated by operating the “menu” key. When a menu call event is generated, a global event handler is called. A global event handler does not depend on a playlist and is always an effective event handler. By using this function, it is possible to implement a DVD menu call (calling a voice, subtitle menu, etc. during title playback, and executing title playback from the point where it was interrupted after changing the voice or subtitle).

  A cell (Cell), which is a unit constituting a static scenario in a playlist, refers to all or part of a playback section of a VOB (MPEG stream). The cell has a playback section in the VOB as start and end time information. The VOB management information (VOBI) paired with each VOB has a time map (Time Map or TM) inside, and the playback and end times of the VOB described above are indicated in the VOB ( That is, it is possible to derive the read start address and end address in the target file “YYY.VOB”). Details of the time map will be described later.

(Details of VOB)
FIG. 9 is a configuration diagram of an MPEG stream (VOB) used in this embodiment. As shown in FIG. 9, a VOB is composed of a plurality of VOBUs (Video Object Units). The VOBU is one playback unit as a multiplexed stream including audio data on the basis of GOP (Group Of Pictures) referred to as an MPEG video stream. A VOBU has a duration of 0.4 to 1.0 seconds, and usually has a playback time of 0.5 seconds. This is because the structure of MPEG GOP is usually derived by 15 frames / second (in the case of NTSC).

  The VOBU has a video pack (V_PCK) and an audio pack (A_PCK) therein. Each pack is composed of one sector, in the case of this embodiment, in units of 2 kB.

FIG. 10 is a diagram showing the configuration of the pack.
As shown in FIG. 10, elementary data such as video data and audio data are sequentially entered from the head into a data storage area of a packet called a payload. A packet header is attached to the payload to form one packet. In the packet header, an ID for identifying which stream, video, or audio the data stored in the payload is, and if there are multiple streams of video or audio, which stream is the data (Stream_id) and time stamps DTS and PTS which are decoding time and display time information of the payload are recorded. PTS / DTS is not necessarily recorded in all packet headers, but rules for recording in MPEG are defined. Details of the rules are described in the MPEG system (ISO / IEC13818-1) standard, and therefore will be omitted.

  The packet is further provided with a header (pack header) to form a pack. In the pack header, a time stamp SCR (System Clock Reference) indicating when the pack passes the demultiplexer and is input to the decoder buffer of each elementary stream is recorded.

(VOB interleaved recording)
Next, interleaved recording of a VOB file will be described with reference to FIGS.

  The upper part of FIG. 11 is a part of the player configuration diagram described above. As shown in the figure, the data on the BD disc is input to the track buffer if it is a VOB or MPEG stream through the optical pickup, and is input to the image memory if it is PNG or image data.

  The track buffer is a FIFO, and the input VOB data is sent to the demultiplexer in the input order. At this time, each pack is extracted from the track buffer in accordance with the SCR described above, and the data is sent to the video processor or sound processor via the demultiplexer. On the other hand, in the case of image data, the presentation controller instructs which image to draw. The image data used for drawing is deleted from the image memory at the same time in the case of image data for subtitles, but remains in the image memory in the case of image data for menus. This is because menu drawing may depend on user operations, and the same image may be drawn multiple times.

  The lower part of FIG. 11 is a diagram showing interleaved recording of a VOB file and a PNG file on a BD disc. In general, in the case of a ROM such as a CD-ROM or a DVD-ROM, AV data serving as a series of continuous reproduction units is continuously recorded. As long as continuous recording is performed, the drive only needs to read the data sequentially and send it to the player side. However, if the continuous data is divided and discretely arranged on the disc, seek is performed between individual continuous sections. This is because an operation is entered, and during this time, reading of data is stopped, and supply of data may be stopped. Similarly, in the case of a BD-ROM, it is desirable that the VOB file can be recorded in a continuous area. However, there is data that is reproduced in synchronization with video data recorded in the VOB, such as subtitle data. Similar to the VOB file, it is necessary to read the caption data from the BD disc by some method.

  As one method of reading subtitle data, there is a method of reading subtitle image data (PNG file) all at once before the start of VOB reproduction. However, in this case, a large amount of memory used for temporary recording is required, which is unrealistic.

  Therefore, in this embodiment, a method is used in which the VOB file is divided into several blocks and interleaved with image data. The lower part of FIG. 11 illustrates the interleave recording. By appropriately interleaving the VOB file and the image data, it becomes possible to store the image data in the image memory at a necessary timing without the large amount of temporary recording memory as described above. However, when reading the image data, the reading of the VOB data is naturally stopped.

  FIG. 12 is a diagram for explaining a VOB data continuous supply model using a track buffer that solves this problem.

  As described above, VOB data is temporarily stored in the track buffer. If a difference is provided between the data input rate to the track buffer and the data output rate from the track buffer, as long as data is continuously read from the BD disc, the data storage amount of the track buffer increases. Here, the input rate to the track buffer is Va, and the output rate from the track buffer is Vb. As shown in the upper part of FIG. 12, it is assumed that a continuous recording area of VOB continues from “a1” to “a2” of logical addresses. It is assumed that between “a2” and “a3” is an interval in which image data is recorded and VOB data cannot be read.

The lower part of FIG. 12 shows the inside of the track buffer. The horizontal axis indicates time, and the vertical axis indicates the amount of data stored in the track buffer. Time “t1” indicates the time when reading of “a1”, which is the starting point of one continuous recording area of the VOB, is started. After this time, data is accumulated in the track buffer at the rate Va-Vb. Needless to say, this rate is the difference between the input and output rates of the track buffer. The time “t2” is the time when the data “a2”, which is the end point of one continuous recording area, is read. That is, the amount of data in the track buffer increases from time “t1” to “t2” at the rate Va−Vb, and the data accumulation amount at time “t2” can be obtained by the following equation. .
B (t2) = (Va−Vb) × (t2−t1) (Formula 1)

  After this, since the image data continues until the address “a3” on the BD disc, the input to the track buffer becomes 0, and the data amount in the track buffer decreases at the output rate “−Vb”. Become. This is up to the read position “a3” and “t3” in time.

  What is important here is that if the amount of data stored in the track buffer before time “t3” becomes zero, there is no VOB data to be supplied to the decoder, and there is a possibility that VOB reproduction stops. There is. However, if data remains in the track buffer at time “t3”, this means that VOB playback can be continued without stopping.

This condition can be expressed by the following equation.
B (t2) ≧ −Vb × (t3−t2) (Formula 2)
That is, it is only necessary to determine the arrangement of the image data so as to satisfy Expression 2.

(Navigation data structure)
The structure of navigation data (BD management information) in the BD-ROM will be described with reference to FIGS. FIG. 13 shows the internal structure of the VOB management information information file (“YYY.VOBI”).

  The VOB management information includes stream attribute information (Attribute) and time map (TMAP) of the VOB. Each stream attribute has a video attribute (Video) and an audio attribute (Audio # 0 to Audio # m). Particularly in the case of an audio stream, since a VOB can have a plurality of audio streams at the same time, the presence or absence of a data field is indicated by the number of audio streams (Number).

The following are the fields that the video attribute (Video) has and the values that each can have.
Compression method (Coding):
MPEG1
MPEG2
MPEG4
Resolution:
1920x1080
1280x720
720x480
720x565
Aspect ratio (Aspect)
4: 3
16: 9
Frame rate
60
59.94
50
30
29.97
25
24

The following are the fields that the audio attribute (Audio) has and the values that each can have.
Compression method (Coding):
AC3
MPEG1
MPEG2
LPCM
Number of channels (Ch):
1-8
Language attribute:

  The time map (TMAP) is a table having information for each VOBU, and has the number of VOBUs (Number) possessed by the VOB and each VOBU information (VOBU # 1 to VOBU # n). Each VOBU information has a playback time length (Duration) of the VOBU and a data size (Size) of the VOBU.

FIG. 14 is a diagram for explaining the details of the VOBU information.
As is widely known, an MPEG stream has two aspects, a temporal aspect and a data size aspect. For example, since AC3, which is a voice compression standard, performs compression at a fixed bit rate, the relationship between time and address can be obtained by a linear expression. However, in the case of MPEG video data, each frame has a fixed display time, for example, in the case of NTSC, one frame has a display time of 1 / 29.97 seconds, but the data size after compression of each frame is picture size. The data size varies greatly depending on the characteristics and the picture type used for compression, so-called I / P / B picture. Therefore, in the case of MPEG video, the relationship between time and address cannot be expressed in a general form.

  As a matter of course, an MPEG system stream in which MPEG video data is multiplexed, that is, VOB, cannot express time and data in a general form. Instead, the time map (TMAP) links the relationship between time and address in the VOB. As shown in FIG. 14, a table having a number of frames in a VOBU and the number of packs in a VOBU as entries for each VOBU is a time map (TMAP).

The usage of the time map (TMAP) will be described with reference to FIG.
When time information is given as shown in FIG. 15, first, a search is performed as to which VOBU the time belongs to. This is done by adding the number of frames for each VOBU of the time submap, and the VOBU whose sum of frames exceeds or coincides with the time (converted to the number of frames) becomes the VOBU. Next, the size for each VOBU of the time map is added to the VOBU immediately before the VOBU, and the value is the leading address of the pack to be read in order to reproduce the frame including the given time.

Next, the internal structure of the playlist information (“XXX.PL”) will be described with reference to FIG.
The playlist information includes a cell list (CellList) and an event list (EventList).

  The cell list (CellList) is a reproduction cell sequence in the playlist, and the cells are reproduced in the description order of the list. The contents of the cell list (CellList) are the number of cells (Number) and cell information (Cell # 1 to Cell # n).

  The cell information (Cell #) has a VOB file name (VOBName), a valid section start time (In) and a valid section end time (Out) in the VOB, and a caption table (SubtitleTable). The valid section start time (In) and valid section end time (Out) are each expressed by a frame number in the VOB, and the address of VOB data necessary for reproduction is obtained by using the time map (TMAP) described above. I can do things.

  The caption table (SubtitleTable) is a table having caption information that is reproduced in synchronization with the VOB. Subtitles can have multiple languages as well as audio, and the first information of the subtitle table (SubtitleTable) consists of the number of languages (Number) followed by tables for each language (Language # 1 to Language # k). Yes.

  A table (Language #) for each language includes language information (Language), the number of subtitle information (Number) of subtitles displayed individually, and subtitle information of subtitles (Speech # 1 to Speech # j) displayed individually. The caption information (Speech #) is composed of the corresponding image data file name (Name), caption display start time (In) and caption display end time (Out), and caption display position (Position). .

  The event list (EventList) is a table that defines the events listed in the play list. The event list is made up of individual events (Event # 1 to Event # m) following the number of events (Number), and each event (Event #) includes an event type (Type) and an event ID (ID). The event generation time (Time) and the validity period (Duration) are included.

  FIG. 17 is an event handler table (“XXX.PROG”) having event handlers (time events and user events for menu selection) for each playlist.

  The event handler table has a defined number of event handlers / programs (Number) and individual event handlers / programs (Program # 1 to Program # n). The description in each event handler / program (Program #) has the event handler ID (ID) paired with the event handler start definition (<event_handler> tag) and the above-mentioned event ID. It is described between parentheses “{” and “}” following the Function.

  Next, the internal structure of information relating to the entire BD disc (“BD. INFO”) will be described with reference to FIG.

  The entire BD disc information includes a title list (TitleList) and an event table for global events (EventTable).

  The title list (TitleList) is composed of the number of titles (Number) in the disc and the following pieces of title information (Title # 1 to Title # n). Each piece of title information (Title) includes a playlist table (PLTable) included in the title and a chapter list (ChapterList) in the title. The playlist table (PLTable) has the number of playlists in the title (Number) and the playlist name (Name), that is, the playlist file name.

  The chapter list (ChapterList) is composed of the number of chapters (Number) included in the title and individual chapter information (Chapter # 1 to Chapter # n), and the chapter information (Chapter #) is a table of cells included in the chapter (Chapter #). The cell table (CellTable) includes the number of cells (Number) and individual cell entry information (CellEntry # 1 to CellEntry # k). Cell entry information (CellEntry #) is described by the name of the playlist including the cell and the cell number in the playlist.

  The event list (EventList) includes the number of global events (Number) and information on individual global events. It should be noted that the global event defined first is called a first event (FirstEvent), and is the first event called when a BD disc is inserted into a player. The event information for global events has only an event type (Type) and an event ID (ID).

  FIG. 19 is a global event handler program table (“BD.PROG”). This table has the same contents as the event handler table described in FIG.

(Event generation mechanism)
The event generation mechanism will be described with reference to FIGS.

FIG. 20 is an example of a time event.
As described above, a time event is defined by an event list (EventList) of playlist information (“XXX.PL”). When an event defined as a time event, that is, when the event type (Type) is “TimeEvent”, the time event having the ID “Ex1” is transferred from the scenario processor to the program processor when the event generation time (“t1”) is reached. Against. The program processor searches for an event handler having the event ID “Ex1” and executes the target event handler. For example, in this embodiment, two button images can be drawn.

FIG. 21 shows an example of a user event for performing a menu operation.
As described above, the user event for performing the menu operation is also defined in the event list (EventList) of the playlist information (“XXX.PL”). When an event defined as a user event, ie, an event type (Type) is “UserEvent”, the user event becomes ready when the event generation time (“t1”) is reached. At this time, the event itself has not yet been generated. The event is in a ready state for the period described by the valid standard information (Duration).

  As shown in FIG. 21, when the user presses the “up”, “down”, “left”, “right” key or “decision” key of the remote control key, a UOP event is first generated by the UOP manager and raised to the program processor. The program processor sends a UOP event to the scenario processor, and the scenario processor searches whether there is a valid user event at the time when the UOP event is received. Generate and lift to the program processor. The program processor searches for an event handler having the event ID “Ev1” and executes the target event handler. For example, in the case of the present embodiment, reproduction of playlist # 2 is started.

  The generated user event does not include information on which remote control key is pressed by the user. Information on the selected remote control key is transmitted to the program processor by a UOP event, and is recorded and held in the register SPRM (8) of the virtual player. The event handler program can check the value of this register and execute branch processing.

FIG. 22 shows an example of a global event.
As described above, a global event is defined by an event list (EventList) of information (“BD. INFO”) relating to the entire BD disc. When an event defined as a global event, that is, an event type (Type) is “GlobalEvent”, an event is generated only when a user operates a remote control key.

  When the user presses “Menu”, a UOP event is first generated by the UOP manager and raised to the program processor. The program processor sends a UOP event to the scenario processor, and the scenario processor generates a corresponding global event and sends it to the program processor. The program processor searches for an event handler having the event ID “menu” and executes the target event handler. For example, in the case of the present embodiment, reproduction of playlist # 3 is started.

  In this embodiment, it is simply called a “menu” key, but there may be a plurality of menu keys as in a DVD. It is possible to cope by defining IDs corresponding to the respective menu keys.

(Virtual player machine)
The functional configuration of the program processor will be described with reference to FIG.

  The program processor is a processing module having a virtual player machine inside. The virtual player machine is a functional model defined as a BD-ROM and does not depend on the implementation of each BD-ROM player. That is, it is guaranteed that the same function can be executed in any BD-ROM player.

  The virtual player machine has two functions. Programming functions and player variables (registers). The programming function defines two functions described below as BD-ROM specific functions based on Java (registered trademark) Script.

Link function: Stops the current playback and starts playback from the specified playlist, cell, and time Link (PL #, Cell #, time)
PL #: Playlist name Cell #: Cell number time: Playback start time in the cell PNG drawing function: Draws specified PNG data on the image plane Draw (File, X, Y)
File: PNG file name X: X coordinate position Y: Y coordinate position Image plane clear function: Clear specified area of image plane Clear (X, Y, W, H)
X: X coordinate position Y: Y coordinate position W: X direction width H: Y direction width

  The player variables include a system parameter (SPRM) indicating the player status and a general parameter (GPRM) that can be used for general purposes.

FIG. 24 is a list of system parameters (SPRM).
SPRM (0): Language code SPRM (1): Audio stream number SPRM (2): Subtitle stream number SPRM (3): Angle number SPRM (4): Title number SPRM (5): Chapter number SPRM (6): Program Number SPRM (7): Cell number SPRM (8): Selection key information SPRM (9): Navigation timer SPRM (10): Playback time information SPRM (11): Karaoke mixing mode SPRM (12): Parental country information SPRM (13): Parental level SPRM (14): Player set value (video)
SPRM (15): Player setting value (audio)
SPRM (16): Audio stream language code SPRM (17): Audio stream language code (extended)
SPRM (18): Language code for subtitle stream SPRM (19): Language code for subtitle stream (extended)
SPRM (20): Player region code SPRM (21): Reserve SPRM (22): Reserve SPRM (23): Playback state SPRM (24): Reserve SPRM (25): Reserve SPRM (26): Reserve SPRM (27): Spare SPRM (28): Spare SPRM (29): Spare SPRM (30): Spare SPRM (31): Spare

  In this embodiment, the programming function of the virtual player is based on Java (registered trademark) Script. However, instead of Java (registered trademark) Script, B-Shell used in UNIX (registered trademark) OS, Other programming functions such as Perl Script may be used. In other words, the present invention is not limited to Java (registered trademark) Script.

(Program example)
25 and 26 are examples of programs in the event handler.

FIG. 25 shows an example of a menu having two selection buttons.
The program on the left side of FIG. 25 is executed using the time event at the head of the cell (PlayList # 1. Cell # 1). Here, “1” is first set to GPRM (0), one of the general parameters. GPRM (0) is used to identify the selected button in the program. In the initial state, the initial value is that the button 1 arranged on the left side is selected.

  Next, PNG drawing is performed for each of the buttons 1 and 2 by using a drawing function Draw. The button 1 draws the PNG image “1black.png” with the coordinates (10, 200) as the starting point (left end). The button 2 draws a PNG image “2white.png” with the coordinates (330, 200) as a starting point (left end).

  At the end of this cell, the program on the right side of FIG. 25 is executed using a time event. Here, it is specified to play again from the beginning of the cell using the Link function.

FIG. 26 is an example of an event handler for a user event for menu selection.
When the remote control key of “Left” key, “Right” key, or “Determination” key is pressed, a corresponding program is written in the event handler. When the user presses the remote control key, as described in FIG. 21, a user event is generated and the event handler of FIG. 26 is activated. In this event handler, branch processing is performed using the value of GPRM (0) identifying the selection button and SPRM (8) identifying the selected remote control key.

Condition 1) When button 1 is selected and the selection key is the “right” key GPRM (0) is reset to 2, and the button in the selected state is changed to right button 2.
Rewrite the images of Button 1 and Button 2, respectively.
Condition 2) When the selection key is “OK” and button 1 is selected, playback of playlist # 2 is started. Condition 3) When the selection key is “OK”. When button 2 is selected, playback of playlist # 3 is started. Execution processing is performed as described above.

(Player processing flow)
Next, the processing flow in the player will be described with reference to FIGS.

FIG. 27 is a basic processing flow up to AV playback.
When the BD disc is inserted (S101), the BD-ROM player is set to BD. Reading and analysis of INFO file (S102), BD. PROG reading (S103) is executed. BD. INFO and BD. Both PROGs are temporarily stored in the management information recording memory and analyzed by the scenario processor.

  Subsequently, the scenario processor is BD. The first event is generated according to the first event (FirstEvent) information in the INFO file (S104). The generated first event is received by the program processor, and an event handler corresponding to the event is executed (S105).

  It is expected that playlist information to be reproduced first is recorded in the event handler corresponding to the first event. If play list reproduction is not instructed, the player does not reproduce anything and simply waits for acceptance of a user event. In this case, it continues to wait for accepting a user event (S201). When the BD-ROM player receives a remote control operation from the user, the UOP manager raises a UOP event to the program manager (S202).

  The program manager determines whether the UOP event is caused by a menu key (S203). If the UOP event is a menu key, the program manager sends a UOP event to the scenario processor, and the scenario processor generates a user event (S204). The program processor executes an event handler corresponding to the generated user event (S205).

FIG. 28 is a processing flow from the start of PL playback to the start of VOB playback.
As described above, play list reproduction is started by the first event handler or the global event handler (S301). The scenario processor reads and analyzes playlist information “XXX.PL” as information necessary for playback of the playlist to be played back (S302), and reads program information “XXX.PROG” corresponding to the playlist (S303). ). Subsequently, the scenario processor starts cell reproduction based on the cell information registered in the playlist (S304). Cell playback means that a request is sent from the scenario processor to the presentation controller, and the presentation controller starts AV playback (S305).

  When the start of AV playback (S401) is started, the presentation controller reads and analyzes the VOB information file (XXX.VOBI) corresponding to the cell to be played back (S402). The presentation controller uses the time map to specify the VOBU to start playback and its address, and instructs the drive controller to specify the read address. The drive controller reads the target VOB data (S403), and the VOB data is sent to the decoder. Playback is started (S404). The VOB playback is continued until the playback section of the VOB ends (S405), and when it ends, the process proceeds to the next cell playback S304. Next, if there is no cell, playback stops (S406).

FIG. 29 is an event processing flow after the start of AV playback.
The BD-ROM player is an event-driven player model. When playback of the playlist is started, event processing processes for the time event system, the user event system, and the caption display system are started, and the event processing is executed in parallel.

The S500 system processing is a time event system processing flow.
After the play list reproduction is started (S501), the scenario processor confirms whether or not the time event occurrence time is reached (S503) through a step (S502) for confirming whether the play list reproduction is completed. If the time event occurrence time is reached, the scenario processor generates a time event (S504), and the program processor receives the time event and executes the event handler (S505).

  If the time event occurrence time is not reached in step S503, or after the event handler execution process in step S504, the process returns to step S502 again, and the above-described process is repeated. Also, when it is confirmed in step S502 that the play list reproduction has been completed, the time event processing is forcibly terminated.

The S600 system processing is a user event system processing flow.
After the play list reproduction is started (S601), the play list reproduction end confirmation step (S602) is performed, and then the process proceeds to the UOP reception confirmation step (S603). When the UOP is accepted, the UOP manager generates a UOP event (S604), and the program processor that receives the UOP event checks whether the UOP event is a menu call (S605). The program processor causes the scenario processor to generate an event (S607), and the program processor executes the event handler (S608).

  If it is determined in step S605 that the UOP event is not a menu call, it indicates that the UOP event is an event by a cursor key or a “decision” key. In this case, the scenario processor determines whether the current time is within the user event valid period (S606), and if it is within the valid period, the scenario processor generates a user event (S607), and the program processor is targeted. The event handler is executed (S608).

  If no UOP is accepted in step S603, if the current time is not in the user event valid period in step S606, or after the event handler execution process in step S608, the process returns to step S602 again to repeat the above-described process. Further, when it is confirmed in step S602 that the play list reproduction has ended, the user event processing is forcibly ended.

FIG. 30 is a flowchart of caption processing.
After the play list reproduction is started (S701), the play list reproduction end confirmation step (S702) is followed by the subtitle drawing start time confirmation step (S703). In the case of the caption rendering start time, the scenario processor instructs the presentation controller to render captions, and the presentation controller instructs the image processor to render captions (S704). If it is determined in step S703 that it is not the caption drawing start time, it is confirmed whether it is the caption display end time (S705). If it is determined that the subtitle display end time is reached, the presentation controller instructs the image processor to delete the subtitle and deletes the drawn subtitle from the image plane (S706).

  After the caption drawing step S704 ends, after the caption erasure step S706 ends, or when it is determined that the time is not the same at the caption display end time confirmation step S705, the process returns to step S702 and the above-described processing is repeated. Also, when it is confirmed in step S702 that the playlist reproduction has been completed, the caption display processing is forcibly terminated.

(Example 2)
Next, a second embodiment of the present invention will be described.

  The second embodiment relates to the introduction of an XML / XHTML / HTML-based screen configuration environment and a programming environment using events and scripts in order to realize richer interactivity in the BD-ROM. . Basically, the contents are based on the first embodiment, and the description will be focused on the expansion or different portions.

(Content control using HTML files)
FIG. 31 shows how the module configuration, control flow, events, etc. related to scenario control using HTML and script are transmitted.

  The user event processing unit is a module that receives a remote control signal and assigns an event to the next module. Events related to playback control, such as playback / stop / fast forward / rewind / skip / angle change / audio switching / subtitle switching, are sent to the AV playback control unit. Events such as button focus movement (up / down / left / right keys) and determination are sent to the HTML processing unit. Events for title selection and menu call related to title switching are sent to the title control unit. The Index Table is a file listing the titles in the disc, and is obtained by cutting out the Title List portion of FIG. 18 into one.

  The title control unit is a module that performs title switching according to the Index Table when title switching is requested. When the title is defined in HTML, control is performed so that the HTML file associated with the title is read into the HTML processing unit.

  The HTML processing unit is a module that reads an HTML file, configures a screen according to style definition information, and executes related scripts according to events. As a result of executing the script, if AV playback is necessary, the AV playback control unit is controlled to start playback, and if title switching is necessary, the title control unit is controlled.

  The AV playback control unit plays back an AV stream in accordance with an event or an instruction, generates an event when the state of the AV playback control unit changes or the playback position of the AV stream reaches a specific position, and generates an HTML processing unit. Notify

  The event notifying that the state of the player has changed is a playback instruction from the user. When the user event processing unit notifies the AV playback control unit of the playback start request event, the AV playback control unit starts playback. At this time, the event is such that the AV playback control unit notifies the change from the stopped state to the playback state.

  The event notifying the playback position is reached when the end of the AV stream is reached, when the cell boundary is reached, or when there is data indicating a point in time of the AV stream called a mark. It is an event to notify that.

FIG. 32 shows the operation when a certain title is selected.
When a certain title defined in the Index Table is selected, an HTML file associated with the title is called. In the HTML file, a script for performing reproduction control is also described. In the example in the figure, the script file is indirectly referenced, but can be described directly in the HTML file. Further, for the sake of explanation, it is described as HTML, but it may be in XHTML format, or may be in a format using a unique tag or the like as long as it is in XML format.

  In the “onLoad” attribute described in the HTML file in the figure, a script to be executed when the file is read is defined. In this example, when an HTML file is read, a script “playTitle1” is called, and the script itself is described in the script file.

  In addition, by using an <event> tag, a mechanism for executing a script in response to an event notified from a user event processing unit or an AV playback control unit is also provided. In this example, when the “EndOfStream” event occurs, a script “jumpTitle2” is called. The “EndOfStream” event is an event generated by the AV playback control unit when, for example, AV playback reaches the end of the file.

  Also, an event processing function (for example, a BDIMoviePlaybackEventHandler () function) whose function name is reserved in advance is described in a script tag of an HTML document or a script file, so that a user event processing unit or AV It is also possible to execute a script in response to an event notified from the playback control unit.

  FIG. 33 shows an example in which screen generation is added to the previous example. For example, HTML is called from the Index Table as described above, and the HTML is written when information for generating a menu screen or the like is written. A style sheet such as CSS may be used as the screen configuration style.

  In this example, two buttons are arranged on the screen. When each button is pressed, the corresponding script is executed. When a certain button is selected, a script defined in the “onClick” attribute is executed. When the left button associated with the PNG image file written as TitleA is selected, the “playA” script is executed and jumps to title 1. Similarly, when the Title B button is selected, after a certain AV stream is reproduced, the program jumps to title 2.

  By using the mechanism described so far, it is possible to provide a mechanism in which a menu screen is displayed using an HTML file, and playback of content is started when selection of a certain button is selected.

  Further, by adding a script part and an API executed by the script, more complicated functions such as an application such as an Internet connection or a download service can be executed.

(Resource management)
When the HTML file forms a screen such as a menu screen, a data file such as a PNG image file is referred to. The more sophisticated the menu, the more complicated the graphics to display and the larger the image data size for displaying it.

  An HTML file can be created so that the screen is switched by a user operation. This is the case when selecting an item in the menu screen causes a submenu to appear. In such a case, image data that was not displayed at the first moment when the menu screen is displayed may be required later.

  However, if a video is displayed in the background of the menu screen, that is, if an AV stream is being played back, if you try to read the image data after it is needed, you will seek to the position where the file is on the disc. And then reading it back to the original position, there is a possibility that the playback of the AV stream is temporarily interrupted. A sufficient amount of buffer is loaded, and this can be avoided if the AV stream is pre-read in advance, but the image has high resolution and high image quality, and a high bit rate is required. Therefore, a considerably large-capacity buffer must be prepared, which leads to an increase in cost and is not realistic.

  In addition, with a medium such as a hard disk that has a short seek time and a high reading speed, even a small amount of buffer can be used to read other data without interrupting AV. With this drive, seeking takes time and reading speed is not so fast, so further technical advancement is required for realization.

  Therefore, it is desirable to use a model in which data other than AV is not read once AV playback is started.

FIG. 34 shows the data life cycle in such a case.
Before AV playback starts, data files such as HTML files and script files that are necessary for displaying the screen, such as PNG image files referenced from those files, are preloaded on the buffer. .

Once AV playback is started, the data is not read to the disc.
Note that when AV playback may be stopped, there is no need to consider them.

  Also, if it is necessary to distinguish between the case where AV playback is not desired to stop and the case where it may be stopped depending on the content, an identifier for distinguishing these two patterns may be prepared in the management information.

  When the HTML processing unit needs data, it is read from the buffer onto the work memory of the HTML processing unit and used for screen display. When the screen is not displayed, the unnecessary data is released from the work memory, and the next necessary data is read from the buffer.

This work memory may be shared with the buffer.
Save the memory in the buffer until you no longer need it, and free it when you no longer need it.

(Data life cycle)
As described above, if the timing for reading data into the buffer and the timing for releasing the data from the buffer can be clearly determined, the management of the data life cycle becomes clear and easy to manage.

  If data management becomes easier, it becomes easier for the content creator to determine a content configuration that can be operated by any player, and content creation becomes easier.

  The start timing and end timing of the data life cycle are preferably the timing at which AV playback is stopped, or the timing at which playback is stopped temporarily or even when continuous playback is not required.

  Such timing includes an AV stream switching point, a screen switching point constituted by an HTML file, a title switching timing, and the like, and may be other points as long as the above conditions are satisfied.

  Using the structure described so far, the timing of title switching can be explicitly referred to as static data in the Index Table, and can be easily controlled from the player. Therefore, the data life cycle starts when a certain title starts, and ends when a certain title ends.

  In other words, when a title starts, all the data needed to play that title is preloaded into the buffer and released from the buffer when the title ends, for example when jumping to another title To do.

  FIG. 35 is a timing chart showing the flow of control between each module, the flow of data, and the data life cycle corresponding thereto.

  By defining such a life cycle and buffer size, you can quantitatively determine how much image data can be used when creating a title, and what application can be executed. It becomes very easy to make.

  The release of the buffer may be forcibly performed from the title control unit or a higher-order module, or may be performed by the HTML processing unit.

  When the title is switched while the application is being executed by a user operation, the title control unit cancels the script that is currently being executed and instructs the HTML processing unit to release the buffer. Also, when the title is switched, an instruction is given to read a file related to the next title into the buffer.

(Data reading guarantee)
As described above, it is necessary to preload a file other than the AV stream in the buffer before starting the reproduction of the AV stream. At that time, it takes time to analyze the HTML file and list the necessary files.

  Therefore, as shown in FIG. 36A, a resource list in which files necessary for each title are listed is created for each title, and when a title is selected, all the files listed in the title list are buffered. Just load it into

  Also, if there are many files, it will take time to read each file, so it will cause unnecessary seeks by placing the listed files in one place on the disk. It is also possible to read all necessary files without any problems.

  Alternatively, as shown in FIG. 36B, the files may be grouped together in a ZIP file or the like for each directory structure, and after reading into the buffer, the files may be expanded in the buffer to configure the directory structure or the like. . The file may not be a ZIP file as long as the file can be put together and the directory structure can be maintained. Also, it does not have to be a compressed file.

  Alternatively, as shown in FIG. 37, each file of the logical file tree 400 having a directory structure in the production stage or the like is placed flat in a Content Archive File 401 (hereinafter referred to as a CAR file), and is HTTP entity format. Make multi-parts. Furthermore, the directory structure information of the logical file tree 400 may be stored in the Resource List File 402, and this Resource List File 402 may be arranged in the CAR file 401.

(Effect of archive configuration using ZIP file and CAR file 401)
The improvement of the writing efficiency / reading efficiency to the disc that can be realized by adopting the configuration of FIG. 36B and the configuration of FIG. 37 will be described.

  If an HTML file or an image file is individually arranged on the disk, an area (fragmentation) where nothing is written is generated in a sector on the disk where only information relating to one file can be arranged, and the writing efficiency is lowered.

  In reading, the number of HTML files and image files is read, and each time a read is performed, a disc SEEK process occurs, and it takes a long time to read the related file, and the start of the title is slow. Become.

  On the other hand, when the ZIP file or the CAR file 401 is used, the HTML file used for screen presentation, the image file group referred to by the HTML file, and the HTML to be presented next after the document transitions from the HTML file. Since files (contents) related to a series of operations such as files are archived, the total size and number of fragmentation are reduced, the writing efficiency to the disk is increased, and the files are archived in one file. Therefore, only one read process occurs, the SEEK number is suppressed, and the disk can be read quickly.

  In addition, by using such a mechanism, it is possible to provide a mechanism that makes it easier for players to control errors by making it easier to understand mistakes during authoring by managing resources easily for each title and making data reading more efficient It becomes.

(Startup process flow in Resource List File format)
Hereinafter, a more detailed implementation will be described with respect to a mechanism in which archive files such as ZIP files and CAR files described with reference to FIGS. 36 and 37 are applied.

  FIG. 39 shows an example in which a Resource List File using XML is described. The Resource List File is described for each title, and describes the application that is executed when each title is played back.

  In the example described above with reference to FIG. 32, the HTML file is associated with the title defined by the Index Table, but the CAR file is associated with each title defined by the Index Table. In the CAR file, a Resource List File is stored, and when a certain title defined in the Index Table is selected, the CAR file associated with the title is first called, and the Resource List associated with the CAR file is stored. The file is called next.

  Note that a method in which the Resource List File of each title is associated from the Index Table may be used.

  The S800 system in FIG. 38 shows a flow from selection of a Title to presentation of a screen by HTML in a method in which a CAR file is associated with each title defined in the Index Table.

  When a title defined in the Index Table is selected (S801), the CAR file associated with the title is called and stored in the buffer for the CAR file (S802). Next, the Resource List File stored in the CAR file is cut out, the Resource List File is analyzed, and the HTML file to be activated is specified (S803). The Resource List File can be quickly cut out by placing the Resource List File at the beginning of the multipart CAR file.

  Next, the HTML file stored in the CAR file is cut out using the Offset value of the HTML file to be activated described in the Resource List File, and the HTML file is analyzed (S804). If Offset is not described, a logical path is constructed by adding the directory name and file name described in the directory structure, and the resource header of each file archived in the ZIP file using this logical path. The HTML file can be identified and cut out by comparing with the resource path described in (1).

  If the HTML file refers to a data file such as an image file, the Resource List File is further analyzed, the corresponding data file is cut out, layout processing and script processing are performed, and a screen is presented (S805). ).

  Furthermore, a processing flow from when the screen is presented to when the document transition processing is generated by a user operation or script processing until the next presentation screen is presented will be described using the S900 system of FIG.

  When a document transition occurs due to a user operation or script processing (S901), the specified URI is analyzed to determine whether it belongs to the same title, and if it belongs to another title, the Index Table is analyzed to determine another title. Is started, and the process proceeds to (S801) (S902). If it belongs to the same title, the Resource List File in the pre-loaded CAR file is analyzed to identify the designated HTML file (S903). Next, the HTML file stored in the CAR file is cut out using the Offset value described in the Resource List File, and the HTML file is analyzed (S904). When a data file such as an image file is referred to, the Resource List File is further analyzed, the corresponding data file is cut out, layout processing and script processing are performed, and a screen is presented (S905).

(Structure of Resource List File in XML format)
FIG. 39 shows a description example of the Resource List File in the XML format. An XML-format Resource List File is composed of an XML declaration and four elements: <application>, <entry>, <toppage>, and <linkfile>.

An application name is described in the name attribute of the <application> element.
For HTML (hereinafter referred to as Toppage) that needs to be read and analyzed first when executing an application, the file name is described as the src attribute of the <toppage> element.

  The file name of each file constituting the application except Toppage is listed in the URI format as the src attribute of the <linkfile> element.

  In addition, a file group (including Toppage) constituting these applications is recorded on the BD-ROM as an archive file as a whole, and the file name of the archive file is <entry> in the URI format in the Resource List File. > Described as the src attribute of the element.

  In this way, the BD player reads the Resource List File corresponding to the title at the time of playing the title, so that the files constituting the applications arranged together as archive files on the BD-ROM do not cause useless seeks. It can be read in a batch and all file names used in the application can be known.

  Further, by referring to the <Toppage> element in the Resource List File, it is possible to know which file is analyzed first when executing an application described in HTML and script.

  When a title different from the currently playing title is selected, the file described in the Resource List File of the title being played may be released, or the Resource List File associated with the selected title is released. You may release only files that are not listed in. By using the Resource List File in this way, it is possible to manage resources for each title in an easy-to-understand manner, improve the efficiency of data reading, and provide a mechanism that is less prone to errors during authoring and that is easy to control by the player It becomes possible.

  In the Resource List File of the present embodiment, the name of the application is described in the name attribute of the <application> element, and the player uses the title name of the inserted BD-ROM Disc and the application name to inform the player. Can be identified. Accordingly, an area for each application may be set in the local storage of the player. Further, only the application can access the application area, and access to other applications may be prohibited.

(Structure of Resource List File in binary format)
The internal structure of the Resource List File in binary format that stores the directory structure information of the file archived in the CAR file will be described with reference to FIG.

<Resource List File>
The Resource List File in binary format is composed of Base Info and Base Directory. In the Base Info, information related to the entire CAR file in which the Resource List File is stored is described.

<Base Directory>
Base Directory describes the directory structure information of files such as HTML files stored in CAR files, and consists of Directories and Files placed one level below, with Information, Number, and CAR files as top directories. The The total number of Directories and Files is the number described in Number. In Information, information related to Base Directory is described.

<Directory>
The Directory is composed of Information, Number, and Directory and File that are arranged one stage below this Directory. The total number of Directories and Files is the number described in Number. In the Information, the name of the Directory and the attribute information of the Directory are described. Further, the directory arranged under the subordinate has the same configuration as that of the present directory.

<File>
File is composed of Information, Offset, and Name. In the Information, attribute information of this File is described. Name is a name. Offset describes the bit length from the beginning of the CAR file of the original file arranged in the CAR file.

(Effects of Resource List File in binary format)
By analyzing the internal directory and file of the Resource List File in binary format, the directory structure of the flat file in the CAR file and the multipart file can be restored, and in the File Since a real file position can be calculated from a CAR file preloaded by a buffer using a certain offset, a target file can be quickly cut out from a huge CAR file of several M to bytes.

(Problems in transition from HTML presentation state outside the disc to HTML on the disc)
With reference to FIG. 41, a description will be given of a problem in a case where a document transitions from a state where an HTML file outside the disc such as a content server is presented to an HTML file on the disc.

  Once a document transitions to an HTML file on the content server, such as after browsing between HTML files on the disk, there is no problem with document transitions between the HTML files on the content server. When an attempt is made to transition to a document, the HTML file on the content server cannot obtain information on the HTML on the disk, such as what is the currently inserted disk and what logical directory structure it is. Therefore, unless information is held in advance, the expected document transition to the HTML file on the disk cannot be performed. As a result, since the title is restarted and the screen is presented, the operation result previously browsed between the HTML files on the disc is deleted, or the screen of the HTML file on the disc presented last is re-presented. I can't.

(Transition method from HTML file outside disk to HTML file on disk)
FIG. 42 shows the internal structure of a Resource List File in binary format to which a mechanism for designating HTML to be presented when a document transition request from the outside of the disk to the HTML file on the disk is generated.

<Resource List File>
The Resource List File in binary format is composed of Base Info, Entry List, and Base Directory. In the Base Info, information related to the entire CAR file in which the Resource List File is stored is described.

<Entry List>
The Entry List is composed of Number and Entry Info. The number of entries is the number described in Number. Entry Info is composed of Entry Type and Offset. Entry Type represents the activation type such as an HTML file to be presented when a document transition request from an HTML file outside the disc to this title is received. Offset is an Offset value in the Resource List File of the File structure corresponding to the HTML file to be presented.

<Base Directory>
Base Directory describes the directory structure information of files such as HTML files stored in the CAR file, and consists of Information and Number, and the Directory and File placed one level below the CAR file as the top directory. Is done. The total number of Directories and Files is the number described in Number. In Information, information related to Base Directory is described.

<Directory>
The directory is composed of an information and a number, and a directory and a file arranged one stage below the directory. The total number of Directories and Files is the number described in Number. In the Information, the name of the Directory and the attribute information of the Directory are described. Further, the directory arranged under the subordinate has the same configuration as that of the present directory.

<File>
File is composed of Information, Offset, and Name. In the Information, attribute information of this File is described. Name is a name. Offset describes the bit length from the beginning of the CAR file of the original file arranged in the CAR file.

  Next, a processing flow when a document transition request from the outside of the disk to the HTML file on the disk is generated using this Resource List File will be described with reference to FIG.

  When a document transition is requested from an HTML file outside the disc to an HTML file on the disc (S1001), the designated URI is analyzed to determine whether it belongs to the same title, and if it belongs to another title, if it belongs to another title, Index Table In order to instruct activation to another title, the process proceeds to (S801) (S1002).

  If it belongs to the same title, it analyzes the Resource List File in the CAR file that has already been preloaded, identifies the “HTML file to be presented when requesting document transition from outside the disk” in the Entry List, and from the Offset, The file structure is analyzed, and the HTML file to be activated is specified (S1003).

  Note that the HTML file on the content server may not be able to determine the URI indicating the title to which the currently pre-loaded CAR file belongs. However, as the URI specifying the disc and title, the currently inserted disc and the current buffer are preloaded. By specifying a URI ("bd: //-1.-1." Etc., where -1 indicates the currently selected disc or title) that specifies the title being recorded, There is no need to identify.

  Next, the HTML file stored in the CAR file is cut out using the Offset value described in the Resource List File, and the HTML file is analyzed (S1004).

  In the HTML file screen presentation process when a document transition request is made from outside the disk, by using this HTML script function, browsing to some extent before the document transitions to the outside of the disk or between HTML files on the disk It is possible to restore the state when it was.

  For example, pre-transition information such as AV playback position and game progress / score at the time of document transition to the outside of the disc is saved in the player storage area by a data storage I / F such as DOM cookie or User Register / Global Register. If it is, the script function reads the pre-transition information, and for example, the playback of the AV can be restarted from the playback position before the transition, or the game can be restarted from the middle (S1005).

  By using the above mechanism, when the transition from the HTML file presentation state outside the disc to the HTML file on the disc occurs, the same title activation screen is not presented every time, but between the HTML files on the disc. It is possible to present a screen that reflects the user operations and the progress / scores of the game that were being browsed. If the document transition is not to a different title, the HTML file is read from the preloaded CAR file, so that a new disc SEEK does not occur and the screen can be presented promptly. In addition, since the HTML file is read and presented from the preloaded CAR file, even if the AV is continuously played regardless of the document transition, the AV playback breaks or video caused by the disc SEEK of the file other than the AV Disturbance does not occur.

(Issues when errors occur)
The problem assumed when an error occurs will be described with reference to FIG.

  When an HTML browser used on an existing PC fails to obtain the next HTML file to be presented at the time of document transition, the content server generates a notification screen indicating that the HTML file does not exist, and the HTML file The HTML browser that received and received the error file presents an HTML file for error notification or received an error code (No. 404) notifying that the HTML file does not exist. The HTML file for errors prepared by embedding in the file was presented.

  For this reason, when an error occurs, the HTML file created by the creator is not presented, and the operation intended by the creator cannot be realized. For example, the error screen cannot be designed as intended by the creator, or the connection to the next AV operation or script operation is broken.

(Method to achieve the intended behavior of the creator when an error occurs)
As shown below, an activation type is added to the entry type of the entry list of the resource list file in the binary format shown in FIG.

<Entry List>
The Entry List is composed of Number and Entry Info. The number of entries is the number described in Number. Entry Info is composed of Entry Type and Offset. Entry Type represents the activation type, such as an HTML file when a document transition request from HTML outside the disc to this Title is received, or an HTML file to be presented when an error occurs. Offset is an Offset value in the Resource List File of the File structure corresponding to the HTML file to be presented.

  FIG. 45 shows a processing flow when an error such as an HTML file acquisition failure occurs at the time of document transition to an HTML file on the content server.

  In the document transition of the HTML file on the content server, if an error occurs, such as failure to acquire the HTML file and notification of the error code 404 from the content server (S1101), it is in the preloaded CAR file. Analyze the Resource List File, specify the "HTML file to be presented when an error occurs" from the Entry List, specify the File structure from the Offset value, and specify the HTML file to be started (S1102).

  Next, the HTML file stored in the CAR file is cut out and analyzed using the Offset value described in the specified File structure (S1103).

  In the screen presentation process of the HTML file for errors prepared by the creator, by using the script function, a screen corresponding to the error is presented, script processing that is not affected by the error is prepared, etc. , Can achieve the process intended by the creator.

  For example, the error status HTML OnLoad script calls the error status acquisition function, and if it is found that there is an HTML acquisition error on the content server, it presents a screen notifying that there is a communication error, and on the content server By creating and presenting a screen with reduced links to the HTML file, the same error can be avoided by subsequent user operations, and continuous screen presentation becomes possible (S1104).

  By using the above mechanism, when an error occurs, the error screen built in the browser is not presented, but the error HTML created by the creator is presented, and the UI and the next operation are connected. Can be produced by the creator. Further, since the HTML file is read from the preloaded CAR file, a new disk SEEK process is not generated, and the screen can be presented promptly. In addition, since the HTML file is read and presented from the preloaded CAR file, even if the AV is continuously played regardless of the document transition, the AV playback breaks or video caused by the disc SEEK of the file other than the AV Disturbance does not occur.

(Example 3)
Next, a third embodiment of the present invention will be described.

  The third embodiment relates to the introduction of an environment for verifying the validity of an application recorded in a BD-ROM disc and ensuring that the application is executed with the optimum execution authority in the BD-ROM. It is. Basically, the contents are based on the first embodiment and the second embodiment, and the explanation will be focused on the expansion or different portions.

(Application authentication on Disc)
With the HTML and script described above, the studio can provide the user with a richly expressive application using the content recorded on the BD-ROM and the resources of the BD player. On the other hand, if the execution environment of such an application is abused or misused, there is a possibility that various damage will be caused to the user or the studio. For example, playback of a BD-ROM created by a malicious third party may cause serious problems such as destruction of the player's system or theft of the player's resources. In addition, even when a legitimate BD-ROM is tampered with, there is a possibility that serious problems such as destruction of the player system, the player's resources being stolen, and the content on the BD-ROM being stolen may occur.

  In this way, when an application using HTML and script is executed by a BD player, an application created outside a regular studio or a falsified application as shown in FIG. 46 may be detected, which may cause a serious problem. Applications need to be able to refuse execution or to limit the functions that can be used and the resources that can be accessed.

  Therefore, in the present embodiment, an application authentication mechanism for verifying whether or not an application using HTML and script recorded on a BD-ROM Disc is created in a regular studio is provided.

Hereinafter, the outline of the application authentication mechanism of the present embodiment will be described with reference to FIG.
First, a regular studio creates an application using HTML and script ((1) authoring). HTML and script applications are composed of one or more files. Next, the application whose validity is to be verified is signed with a public key certificate ((2) signature). The public key certificate may be from a studio belonging to a BD licensing organization or may be issued by a BD licensing organization. In the present embodiment, the public key certificate for signing an application is a studio public key certificate approved by a BD licensing organization. Although the signature method will be described later, the files to be signed for the application may be only HTML files and script files that constitute the application, or any or all files linked from the HTML file. (Files linked from HTML files include image files, audio files, video files, and style files).

  When the BD-ROM created as described above is sold and the purchased user inserts it into the BD player ((3) sale), when the BD player executes the application, the validity of the signature for the entire file army is verified. ((4) Signature verification). As a result, it is confirmed that the application is a legitimate one created in the studio, and the BD player executes the application ((5) execution).

Hereinafter, a signature method in the present embodiment will be described.
An application based on HTML and script is composed of one or more files, but the method of creating a signature for each file verifies the validity of a plurality of signatures for a plurality of files constituting the application at the time of application execution. Depending on the performance of the BD player, there is a possibility that the performance at the time of executing the application may decrease. Therefore, the Resource List File described with reference to FIG. 39 or 42 in the second embodiment is applied to the signature in the present embodiment. Specifically, in addition to the file names of the files constituting the application, the hash value of each file is also described in the Resource List File, and only one Resource List File is signed by signing only the Resource List File. Limited to.

  Here, the hash value is fixed-length data obtained by inputting data of an arbitrary length into a one-way function. Although it is easy to calculate a hash value from the original file, the hash value It has the characteristic that it is difficult to classify the original file from the value, and the characteristic that the hash value obtained changes even if the input data is slightly different. One-way functions include MD5 (Message Digest 5) and SHA-1 (Secure Hash Algorithm 1).

  FIG. 48 shows an example of the Resource List File when the application authentication mechanism according to the present embodiment is introduced into the Resource List File in the XML format described with reference to FIG.

  As shown in Fig. 48, the SHA-1 calculation result is described as an attribute value for describing the hash value of each file in the <linkpage> element that lists the file names that make up the application. "Sha-digest" and "md5-digest" that describe MD5 calculation results are added. Each element shall have either “sha-digest”, “md5-digest”, or both.

  In addition, a <signiture> element is newly added to the Resource List File shown in FIG. 48, and the file name of the signature data to the Resource List File is described as the src attribute of the <signiture> element in the URI format. The format of the signature data is described as the sig-type attribute of the <signiture> element. If the signature data file name is described in the Resource List File after signing it in the Resource List File, the Resource List File data will be changed and the created signature data itself will be invalidated. The data name of signature data described in the List File needs to be determined before the signature data is created. The file name of the signature data may be explicitly determined uniquely for each application. For example, it may be defined as having the same file body of Toppage in the same directory as Toppage and having the extension “.rsa”. This completes the creation of the application and when the toppage name is determined, the name of the signature data is uniquely determined, so it is possible to create a Resource List File even before signature data is created. Data in Resource List File does not change.

  The format of the signature data includes PKCS # 7 (Public-Key Cryptography Standards # 7) defined by RSA. FIG. 49 shows an example of signature data for the Resource List File in the PKCS # 7 format. As shown in FIG. 49, the signature of Resource List File by PKCS # 7 is applied to the hash value of Resource List File, the studio public key certificate, and the hash value of Resource List File in addition to Version information and algorithm information. And the result of signing using the studio's public key certificate.

  FIG. 50 shows an example of the Resource List File when the application authentication mechanism according to this embodiment is introduced to the Resource List File in the binary format described with reference to FIG. In the Resource List File in FIG. 50, a Signature File is added below the Base Directory. The Signature File includes Information, Offset, and Name like the File in FIG. Information includes attribute information of the signature file including information that the signature data format of the signature file is PKCS # 7, for example. Name is the name of the Signature File. Offset indicates where the Signature File is placed in the CAR file, and describes the bit length from the beginning of the CAR file.

  In the Resource List File in FIG. 50, a Hash Value is added below each File. When the Hash value of the file exists, the hash value of the File is described in the Hash Vule, and information such as the hash format is described in Information.

  Hereinafter, a method for verifying validity of an application according to the present embodiment will be described with reference to FIG.

  First, when a BD-ROM Disc is inserted into the player and an arbitrary title defined in the IndexTable is started by automatically selecting the top of the IndexTable or by the user selecting it (step S1201), the player selects the title. Referring to the IndexTable in which is defined, the Resource List File of the title associated with the IndexTable or the CAR file is read by the method described above (step S1202). The Resource List File is assumed to take the format described above with reference to FIG. 48 or 50 as an example. Next, signature data (Signature File) is read with reference to the Resource List File (step S1203). The signature data takes the form described above with reference to FIG. 41 as an example, and includes the hash value of the Resource List File to be signed, the signature, and the public key certificate of the studio used for the signature. Next, the player takes out the studio public key certificate included in the signature data. This public key certificate is a general public key certificate. The public key certificate of the studio is used to verify the public key of the studio, the signature of the public key, the signature of the certificate authority, and the signature of the certificate authority. Is included. The player extracts the studio public key from the extracted studio public key certificate (step S1204), and decrypts the signature for the hash value of the Resource List File extracted from the signature data using the public key extracted in step S1204 (step S1204). Step S1205). Next, the hash value of the Resource List File is extracted from the signature data and input to the one-way function to calculate the hash value (step S1206). Next, the decrypted data obtained by decrypting in step S1205 is compared with the hash value obtained by calculating in step S1206 (step S1207). If the decrypted data and the hash value are equal, it is confirmed that the signature data is correct and that the Resource List File has not been forged or falsified, and the process advances to step S1208. If the decrypted data and the hash value are not equal, the Resource List File or the signature data may have been falsified or forged, and the process proceeds to step S1211. In step S1208, the validity of the studio public key certificate included in the signature data is verified. The public key certificate of the studio includes the public key of the studio, the signature of the public key by the certificate authority, and the public key certificate of the signed certificate authority, and the public key certificate included in the public key certificate of the studio The validity of the signature is confirmed using the public key certificate of the certificate authority included in the public key certificate of the studio (the same procedure as in steps S1204 to S1207 in FIG. 50). The public key certificate of the signed certificate authority also includes the public key certificate of the parent certificate authority that has signed the public key of the certificate authority in a chain form. When the validity of the chain of public key certificates of these certificate authorities is confirmed in the same procedure as before, the public key certificate of the certificate authority that is the root is finally obtained. As a method for confirming whether or not the public key certificate of the root certificate authority is authentic, a method may be used in which the player has the public key certificate of the root certificate authority and compared with it, or the BD-ROM Disc is secure. It may be recorded by a method and compared with it.

  If the root certificate authority public key certificate finally obtained is authentic, it is finally confirmed that the studio public key certificate is valid (step S1209), and the process proceeds to step S1210. It is verified that the Resource List File of the title (or CAR file) is not forged or falsified (step S1210). If the public key certificate of the studio is not valid, the process proceeds to step S1211, and it is detected that the Resource List File may be forged or tampered (step S1211).

  In this embodiment, the hash value of the Resource List File is directly included in the signature data for signing. However, this is only an example, and another signature file linked from the Resource List File is prepared. In addition, Resource List File hash value and other data for improving safety (for example, a list of hash values obtained by further passing the hash value of each file constituting the application described in Resource List File through a one-way function) You can take a mechanism to prepare and sign it.

  As described above, the validity verification method of the Resource List File has been described with reference to FIG. 42. When actually executing an application using HTML and script, the validity of each file constituting the application is verified by the method shown in FIG. There is a need to.

  The application file validity verification method in this embodiment will be described below with reference to FIG.

  First, the validity verification of the Resource List File is completed (step S1301). When Toppage is executed or a file constituting an application is read by reading a link file or the like (step S1302), the file name of the file read in step S1302 is described in Resource List File, and the file is included in Resource List File It is confirmed whether or not the hash value is described (step S1303). If the file name of the read file is described in Resource List File and the hash value is described (yes in step S1304), the process proceeds to step S1305, and if not described (no in step S1304), the process proceeds to step S1309. . If the file name of the file read in step S1302 does not exist in the Resource List File, the information indicating the Toppage on the Resource List File and the link source HTML Document may have been falsified. If the hash value does not exist, it is considered that the creator Studio does not need to authenticate the file (HTML Document).

  In step S1305, the hash value of the file read in step S1302 is calculated. At this time, the hash value is calculated in the format specified in the Resource List File. For example, if the Resource List File is in the format shown in FIG. 48 and the sha-digest attribute is specified in the <toppage> <linkfile> element, the hash value is calculated with SHA-1, and the md5-digest attribute is If specified, the hash value is calculated by MD5. If both are specified, two hash values of SHA-1 and MD5 are calculated. When the Resource List File has the format shown in FIG. 50, the hash format to be calculated is described in Information of each File.

  Next, the hash value calculated in step S1305 is compared with the hash value of the file described in Resource List File (step S1306). If the hash value calculated in step S1305 is equal to the hash value of the file described in the Resource List File (yes in step S1307), the validity of the read file has been verified, and the file is the creator. It is confirmed that the file has been authenticated by STUDIO and has not been falsified or forged by a malicious third party (step S1308).

  On the other hand, if the hash value calculated in step S1305 and the hash value of the file described in the Resource List File are not equal (no in step S1307), the read file is forged or altered by a malicious third party. (Step S1309).

  When the forgery / falsification of the Resource List File is detected by the procedure shown in FIG. 51 or when the falsification / falsification of the application file is detected by the procedure shown in FIG. 52, the execution of the application may be rejected. The application may be executed in such a manner that only a minimum function that does not affect the player and the content to be protected can be executed. Also, access to the BD-ROM other than the application configuration file may be denied or restricted, or access to the local storage such as the HDD or flash memory provided in the player may be denied or restricted. Good. In addition, when the file name of the file does not exist in the Resource List File in step S1304 in FIG. 52, this indicates that the producer, Studio, considers that the authentication of the file is not required. The application may be executed with restriction so that only a minimum function that does not affect the content can be executed. Also, access to the BD-ROM other than the application configuration file may be denied or restricted, or access to the local storage such as the HDD or flash memory provided in the player may be denied or restricted. Good.

  Note that application file validation may be performed on all files that make up the application listed in the Resource List File immediately after the player reads the Resource List File and the application validation is completed. It is also possible to use a method of verifying the files that are necessary for executing the application each time. In this case, after the validation of the Resource List File is completed, the validation of the application file is performed only on the Toppage, and then necessary for executing the application by establishing a link from the Toppage. The validity of each file is verified sequentially.

  Further, when the validity of the application and its configuration file cannot be verified, not only the execution of the application but also the execution of the BD-ROM Disc itself on which the application is recorded may be prohibited. In addition, when the validity of the application and its configuration file cannot be verified, it is possible to take measures to prohibit and execute functions that may adversely affect the system or access to content to be protected.

Example 4
Next, a fourth embodiment of the present invention will be described.
The fourth embodiment relates to the introduction of an environment for verifying the validity of an application on a network and ensuring that it is executed with an optimal execution authority in a BD-ROM. Basically, the contents are based on the first embodiment, the second embodiment, and the third embodiment, and the description will be focused on the expanded or different portions.

(Application authentication on Disc)
When an application using HTML and script placed on a content server on the Internet can be executed in the same way as an application on a BD-ROM Disc, the application that flows on the network is altered, the content is connected to a malicious server, etc. There is a possibility that a user may execute a malicious application by misrepresenting the server. When a program forged or altered by a malicious third party is executed by a player, the player system is destroyed, or video data recorded on a legitimate information recording medium is stolen or altered. Serious problems can occur.

  However, in the existing technology, there is no mechanism for authenticating HTML and script applications placed on content servers on the Internet, as well as applications on BD-ROM Discs.

  Therefore, in order to solve this problem, for example, there is a method in which an application on the Internet accessed from an application on the BD-ROM disc authenticated by the above-described method is similarly trusted. But this can only avoid access to malicious servers. Therefore, as another method, there is a method of using HTTPS when accessing an application using HTML and script arranged in a content server on the Internet. As a result, it is possible to prevent content server misrepresentation and forgery / falsification of a configuration file of an application to be received and executed.

  However, HTTPS processing has a high processing load and takes time, and if HTTPS is always used to access an application on a content server that requires authentication, the performance of the entire application is degraded.

  Therefore, in the present embodiment, a mechanism is provided that allows light and safe authentication of HTML and script applications placed on content servers on the Internet.

(Network Resource List)
The outline of the application authentication method on the content server in the present embodiment will be described below with reference to FIG.

  First, the BD player downloads a Network Resource List File from a content server storing an application that requires authentication ((1) in FIG. 53). The data format of the Network Resource List will be described later. The Network Resource List is associated with the title, and the location information is described in the Index Table, the title definition associated from the Index Table, the CAR file of the title, the Resource List File in the CAR file, etc. It shall be. A plurality of Network Resource Lists may be provided for each title. Note that the BD player may download the Network Resource List at the start of the title, or may download it when a link file on the network is actually needed. In addition, once downloaded Network Resource List may be cached in the buffer, but when using HTTP for downloading, for example, the update date and time of Network Resource List is obtained by HTTP HEAD method etc., and the latest Network Resource List is always updated. You may check.

  Next, the BD player confirms the validity of the Network Resource List downloaded in (1) ((2) in FIG. 53). Although details will be described later with reference to FIGS. 56 and 57, there are two methods for verifying validity: a method using HTTPS and a method using a signature.

  Next, the BD player downloads the link file that is actually necessary for the title execution ((3) in FIG. 53). At this time, it is confirmed in advance that the entry of the link file exists in the Network Resource List downloaded in (1).

  Next, the BD player calculates the hash value of the link file downloaded in (3) ((4) in FIG. 53).

  Next, the BD player checks whether the hash value calculated in (4) is equal to the hash value of the link file described in the Network Resource List downloaded in (1) ((5) in FIG. 53). . If they are equal, it can be confirmed that the downloaded link file is a regular link file published by the content server and has not been tampered with during downloading.

  The outline of the application authentication method on the content server in the present invention has been described above.

  In the content server, there is a need to determine whether the BD player is a legitimate player, for example, executing a Disc accessible to the content server. In this case, for example, when downloading a Network Resource List or a link file in (1) of FIG. 53 or (3) of FIG. 53, an HTTPS connection with client authentication enabled is required, or a Network Resource List in HTTP For example, there is a method of sending an HTTP GET request after URL-encoding information that cannot be known unless you can access the Disc such as ID and Password specially recorded in the CAR file. At this time, for example, when the BD player comes to download the Network Resource List in (1) of FIG. 53, client authentication is performed, and the IP address of the BD player at that time is recorded, and subsequent link file download is recorded. By permitting only the BD player with the specified IP address, it is possible to reduce the number of times of client authentication by HTTPS or URL encoding.

  FIG. 54 shows an example of a network resource list in XML format when the application authentication method on the content server according to the present embodiment is introduced. As shown in FIG. 54, the Network Resource List in the XML format includes an xml declaration, a <NetworkResource> element, and a <linkfile element and a <signature> element which are child elements of the <NetworkResource> element.

  The <NetworkResource> element has a base attribute, and the content server storing the link file described in the NetworkResource and the storage location (Base-URL) of the link file are described in the URL format. The <linkfile> element describes the link file on the content server that you want to authenticate in the title, the URL of the link file is described in the src attribute, and the hash of the link file in the sha-digest or md5-digest attribute The value is described in SHA-1 format or MD5 format. The <signature> element is used when verifying the validity of the Network Resource List by using the signature for the Network Resource List. The URL of the Network Resource List signature data is described in the src attribute, and the signature data in the sig-type attribute. The format is described. Note that the <signature> element is not required when verifying the validity of the Network Resource List using HTTPS, or when information related to the signature data of the Network Resource List is described in a CAR other than the Network Resource List, such as the CAR of the title. Not described.

  Next, FIG. 55 shows an example of a binary network resource list when the application authentication method on the content server according to the present embodiment is introduced.

<Network Resource List File>
The network resource list file in binary format is composed of Base Info and Base Directory. Base Info describes information related to the entire Network Resource List File, such as the location information of the content server storing the link file described in the Network Resource List and the root directory information where the link file is placed on the content server. Is done.

<Base Directory>
In the Base Directory, the location of the link file stored on the content server is described as directory structure information. The root directory described in Information, Number, and Base Info is the top directory, and one level below it. It is comprised from Directory and File arrange | positioned. The total number of Directories and Files is the number described in Number. In Information, information related to Base Directory is described. When verifying the validity of the Network Resource List by using the signature for the Network Resource List, the information and signature data in which attribute data is described are recorded first as the signature file, and the signature data placement state in the Network Resource List is recorded. The name of is listed.

<Directory>
The directory is composed of an information and a number, and a directory and a file arranged one stage below the directory. The total number of Directories and Files is the number described in Number. In the Information, the name of the Directory and the attribute information of the Directory are described. Further, the directory arranged under the subordinate has the same configuration as that of the present directory.

<File>
The file is composed of information, name, and hash value. Information includes attribute information of the link file. Name is the name of the link file. Hash Vale describes the hash value of the link file.

  Hereinafter, a verification method when a signature is used for validity verification of the Network Resource List will be described with reference to FIG.

  The BD player performs this processing at the time when the link file arranged in the content server on the Internet in the title is actually needed or before the network connection is started (step S1401).

  First, the BD player downloads the Network Resource List based on the position information (URL) of the Network Resource List File of the content server specified by the title definition associated with the IndexTable or the Resource List File in the CAR file (Step S1). S1402). As an example, the Network Resource List File is assumed to have the format described above with reference to FIG. 54 or FIG. At this time, if necessary, it is confirmed that the location information of the content server described in the Network Resource List File is the same as that of the download source content server.

  Next, the BD player uses the Network Resource List or IndexTable to define the Network Resource List based on the location information (URL) of the signature data of the Network Resource List File specified by the Resource List File in the CAR file. List signature data is downloaded (step S1403). The signature data takes the form described above with reference to FIG. 41 as an example, and includes the hash value of the Network Resource List File to be signed, the signature, and the public key certificate of the studio used for the signature.

  Next, the player takes out the studio public key certificate included in the signature data (step S1404). This public key certificate is a general public key certificate. The public key certificate of the studio is used to verify the public key of the studio, the signature of the public key, the signature of the certificate authority, and the signature of the certificate authority. Is included. The player extracts the studio public key from the extracted studio public key certificate, and decrypts the signature for the hash value of the Resource List File extracted from the signature data using the public key extracted in step S1204 (step S1405). Next, the hash value of the Network Resource List File is extracted from the signature data and input to the one-way function to calculate the hash value (step S1406). Examples of one-way functions include SHA-1 and MD5.

  Next, the decrypted data obtained by decrypting in step S1405 is compared with the hash value obtained in step S1406 (step S1407).

  If the decrypted data and the hash value are the same, if the signature data is correct, it is confirmed that the Network Resource List File is valid and has not been forged or falsified, and the process advances to step S1408. If the decrypted data and the hash value are not equal, it is possible that the Network Resource List File or the signature data has been tampered with or forged, and the process proceeds to step S1411.

  In step S1408, the validity of the studio public key certificate included in the signature data is verified. The public key certificate of the studio includes the public key of the studio, the signature of the public key by the certificate authority, and the public key certificate of the signed certificate authority, and the public key certificate included in the public key certificate of the studio The validity of the signature is confirmed using the public key certificate of the certificate authority included in the public key certificate of the studio (the same procedure as in steps S1404 to S1407 in FIG. 56). The public key certificate of the signed certificate authority also includes the public key certificate of the parent certificate authority that has signed the public key of the certificate authority in a chain form. When the validity of the chain of public key certificates of these certificate authorities is confirmed in the same procedure as before, the public key certificate of the certificate authority that is the root is finally obtained. As a method for confirming whether or not the public key certificate of the root certificate authority is authentic, a method of giving the BD player the public key certificate of the root certificate authority and comparing it with the public key certificate may be used. It is also possible to record by a simple method and compare with that.

  If the finally obtained root certificate authority public key certificate is authentic, it is finally confirmed that the studio public key certificate is valid (Yes in step S1409), and the process proceeds to step S1410. Finally, it is verified that the Network Resource List File of the content server is not forged or falsified (step S1410). If the studio public key certificate is not valid, the process advances to step S1411 to detect that the Network Resource List File may be forged or falsified (step S1411).

  Next, a verification method when HTTPS is used for validity verification of the Network Resource List will be described with reference to FIG.

  The BD player performs this processing at the time when the link file arranged in the content server on the Internet in the title is actually needed or before the network connection is started (step S1501).

  First, the BD player establishes an HTTPS connection with the content server specified by the title definition associated with IndexTable, the Resource List File in the CAR file, or the like (step S1502). The public key certificate of the certificate authority necessary for establishing HTTPS may be stored in the BD player in advance, or may be recorded on the BD-ROM Disc using a secure method and used. Further, as described above, not only server authentication of the content server by HTTPS but also client authentication of the BD player may be performed as necessary.

  If the establishment of the HTTPS connection is successful (Yes in step S1503), the process proceeds to step S1504. If the establishment of the HTTPS connection has failed (No in step S1503), the Network Resource List File cannot be acquired safely, and it can be detected even if forgery / tampering occurs in the subsequent download of the link file. It becomes impossible (step S1506). Therefore, thereafter, the execution of the application by the link file on the content server may be prohibited, or the execution of the function that may adversely affect the system or the access to the content to be protected may be prohibited. good.

  Next, the BD player uses the HTTPS connection established in step S1502 based on the title definition associated with IndexTable and the location information (URL) of the Network Resource List File of the content server specified by the Resource List File in the CAR file. The Network Resource List is downloaded using (Step S1504). As an example, the Network Resource List File is assumed to have the format described above with reference to FIG. 54 or FIG. At this time, if necessary, it is confirmed that the location information of the content server described in the Network Resource List File is the same as that of the download source content server.

  Through the above processing, the BD player can obtain the Network Resource List File of the content server without forgery or falsification (step S1505).

  Hereinafter, the validity verification method of the link file constituting the application on the content server in this embodiment will be described with reference to FIG.

  First, the verification of the validity of the Network Resource List File is completed by the method described with reference to FIG. 56 or FIG. Then, when access to the link file that constitutes the application arranged in the content server on the Internet occurs (step S1601), first, whether the file name of the link file to be accessed and its hash value exist in the Network Resource List File. It is confirmed whether or not (step S1602).

  If the file name of the link file to be accessed and its hash value exist in the Network Resource List File (yes in step S1603), the process proceeds to step S1604. If not described (no in step S1603), the process proceeds to step S1609. In this case, the link source HTML Document may have been tampered with. If the hash value does not exist, it means that the creator Studio does not need to authenticate the file (HTML Document).

  In step S1604, the link file arranged in the content server on the Internet is downloaded.

  Next, the hash value of the link file downloaded in step S1604 is calculated (step S1605). At this time, the hash value is calculated in the format specified in the Network Resource List File. For example, if the Network Resource List File is in the XML format shown in FIG. 54, if the <linkfile> element specifies the sha-digest attribute, the hash value is calculated with SHA-1 and the md5-digest attribute is specified. If it is, MD5 calculates the hash value, and if both are specified, two hash values, SHA-1 and MD5, are calculated. When the Network Resource List File has the format shown in FIG. 55, the hash format to be calculated is described in Information of each File.

  Next, the hash value calculated in step S1605 is compared with the hash value of the link file described in the Network Resource List File (step S1606). If the hash value calculated in step S1605 is equal to the hash value of the file described in the Network Resource List File (yes in step S1607), the validity of the downloaded link file has been verified, and the link file is It is confirmed that the link file is authenticated by the creator STUDIO and has not been falsified or forged by a malicious third party (step S1608).

  On the other hand, if the hash value calculated in Step S1605 and the hash value of the link file described in the Network Resource List File are not equal (No in Step S1607), the downloaded link file is forged by a malicious third party, or There is a possibility of falsification (step S1609).

  As described above, the validity verification method of the application on the network according to the present embodiment has been described. With this verification method, the BD player downloads the application arranged on the content server on the Internet safely and verifies the validity. Can be run on. Further, the validity can be verified without imposing much processing load.

  By utilizing the present invention, it becomes possible to introduce AV reproduction control by video data, HTML and script. In particular, it has the potential to be used in the movie industry and consumer equipment industry that are involved in the production of video content.

DVD configuration diagram Highlight configuration diagram Diagram showing an example of multiplexing on a DVD Data hierarchy diagram of BD-ROM Configuration diagram of logical space on BD-ROM Outline block diagram of BD-ROM player Configuration block diagram of BD-ROM player BD-ROM application space explanatory diagram Configuration diagram of MPEG stream (VOB) Pack configuration diagram The figure explaining the relationship between AV stream and a player structure AV data continuous supply model diagram to track buffer VOB information file configuration diagram Illustration of time map How to get address information using time map Playlist file structure diagram Configuration diagram of program files corresponding to playlists BD disk overall management information file configuration diagram Diagram of the file that records global event handlers Diagram explaining examples of time events Diagram explaining examples of user events Diagram explaining an example of a global event handler Virtual machine configuration diagram Diagram of player variable table Figure showing an example of event handler (time event) Diagram showing an example of event handler (user event) Flow chart of basic processing of player Flow chart of playlist playback processing Event processing flowchart Subtitle processing flowchart Diagram explaining module configuration and control flow Diagram explaining the relationship between Index Table and HTML file Example of an HTML file that displays buttons Explanatory drawing explaining the life cycle of data Timing chart explaining the data life cycle Diagram explaining how to combine data into one Diagram explaining how to combine data into one Flow chart of processing in Title activation and document transition Diagram showing an example of a Resource List File in XML format Resource List File structure diagram in binary format The figure explaining the relationship between HTML on the disk and HTML on the Web Resource List File structure diagram in binary format Flow chart of processing when document transition occurs Figure explaining the error presentation screen when an error occurs Flow chart of processing when an error occurs Diagram explaining forged / tampered application Diagram explaining the outline of application authentication Diagram showing an example of an XML-format Resource ListFile with an application authentication function Diagram of signature data Diagram showing an example of a Resource ListFile in binary format with application authentication function Flow chart of validation process of Resource List File Flowchart of validation process of application configuration file Diagram explaining the outline of application authentication on the content server Figure showing an example of an XML format Network Resource List File Figure showing an example of Network Resource List File in binary format Flowchart of Resource List File validation process using signature Flowchart of Resource List File validation process using HTTPS Flow chart of link file validation process

Explanation of symbols

201 BD disc 202 optical pickup 203 program recording memory 204 management information recording memory 205 AV recording memory 206 program processing unit 207 management information processing unit 208 presentation processing unit 209 image plane 210 video plane 211 composition processing unit 301 program recording memory 302 program processor 303 UOP manager 304 Management information recording memory 305 Scenario processor 306 Presentation controller 307 Clock 308 Image memory 309 Track buffer 310 Demultiplexer 311 Image processor 312 Video processor 313 Sound processor 314 Image plane 315 Video plane 316 Composition processing unit 317 Drive controller 00 logical file tree of 401 Content Archive File
402 Resource List File
410 HTML Browser
420 HTML file for error S101 Disc insertion step S102 BD. INFO reading step S103 BD. PROG reading step S104 First event generation step S105 Event handler execution step S201 UOP reception step S202 UOP event generation step S203 Menu call determination step S204 Event generation step S205 Event handler execution step S301 Playlist reproduction start step S302 Playlist information (XXX.PL ) Reading step S303 Playlist program (XXX.PROG) reading step S304 Cell playback start step S305 AV playback start step S401 AV playback start step S402 VOB information (YYY.VOBI) reading step S403 VOB (YYY.VOB) reading step S404 VOB Playback start step S405 VOB Playback end step S406 Next cell presence determination step S501 Playlist playback start step S502 Playlist playback end determination step S503 Time event time determination step S504 Event generation step S505 Event handler execution step S601 Playlist playback start step S602 Playlist playback end determination step S603 UOP reception determination step S604 UOP event generation step S605 Menu call determination step S606 User event valid period determination step S607 Event generation step S608 Event handler execution step S701 Playlist reproduction end determination step S702 Playlist reproduction end determination step S703 Subtitle drawing start determination step S704 Subtitle rendering step S7 05 Subtitle display end determination step S706 Subtitle deletion step S801 Title activation step S802 CAR file preload step S803 Resource List File reading step S804 HTML file reading step S805 Screen presentation step S901 Document transition operation step S902 Title determination step S903 Lisres Rest read Step S904 HTML file reading step S905 Screen presentation step S1001 Document transition operation step S1002 Title determination step S1003 Resource List File reading step S1004 HTML file reading step S1005 Screen presentation step S1101 Error generation step S1 02 Resource List File reading step S1103 HTML file reading step S1104 Screen presentation step S1201 Title start step S1202 Resource List File reading step S1203 Signature data reading step S1204 Public key extraction step S1205 Signature decryption step S1206 Signature verification hash value calculation step S1207 Signature determination step S1208 Public key certificate verification step S1209 Public key certificate determination step S1210 Application validity verification completion step S1211 Application forgery detection step S1301 Application validity verification completion step S1302 Application configuration file reading step S1303 Configuration file existence Confirmation step S1304 Existence determination step S1305 Configuration file hash value calculation step S1306 Hash value comparison step S1307 Hash value determination step S1308 Application configuration file validity verification completion step S1309 Application data forgery / tamper detection step S1401 Network connection start step S1402 Network Resource List File download step S1403 Signature data download step S1404 Public key extraction step S1405 Signature decryption step S1406 Signature verification hash value calculation step S1407 Signature determination step S1408 Public key certificate verification step S1409 Public key certificate determination step S1410 Network Resource List File Validity verification completion Step S1411 Forgery of Network Resource List File竄 Detection step S1501 Network connection start step S1502 HTTPS connection establishment step S1503 HTTPS establishment confirmation step S1504 Network Resource List File download step S1505 Network Resource List File validity verification completion step S1506 Authentication failure step S1601 Link file access generation step S1602 Link file existence confirmation Step S1603 Existence determination step S1604 Link file download step S1605 Link file hash value calculation step S1606 Hash value comparison step S1607 Hash value determination step S1608 Link file validity verification completion step S1609 Link file validity verification failure step

Claims (24)

An information recording medium in which one or more titles including a digital stream and one or more applications described in a declarative language and including one or more files are recorded,
The information recording medium is recorded with position information of a file list in which file names of files constituting a reliable application arranged on the application server and respective hash values are recorded. Medium. The information recording medium according to claim 1, wherein the position information of the file list is recorded in association with each title for each application server. The information recording medium according to claim 1, wherein position information of a signature for the file list is further recorded. The information recording medium according to claim 1, further comprising a public key certificate for secure communication for receiving the file list. The information recording medium according to claim 1, wherein the file list also includes position information of a signature for the file list. A playback device that simultaneously performs playback of a title including a digital stream recorded on an information recording medium and execution of an application recorded on the information recording medium or disposed on an application server,
A title control unit that controls branching between multiple titles;
A playback control unit that plays back a digital stream belonging to one title;
A file list receiving unit that receives the file list based on position information of a file list in which the file name and hash value of each file constituting the application on the application server recorded in the information recording medium is written;
A file list validation unit for confirming the validity of the received file list;
When executing an application arranged in the application server, a file receiving unit that receives a file constituting the application and a hash value of the received file are calculated, and the hash value of the file listed in the file list is matched. A playback apparatus comprising: a hash confirmation unit that confirms this; and an application execution unit that executes an application on the application server based on the received file. The file name of the file constituting the application on the application server described in the file list is the position information of the file,
7. The reproduction according to claim 6, wherein the file receiving unit receives the file after confirming that the position information of the file to be received matches the position information described in the file list. apparatus. A signature receiving unit configured to receive a signature for the file list based on position information of a signature for the file list described in the information recording medium or the file list; and The playback apparatus according to claim 6, wherein validity of the file list is confirmed based on a signature. A public key certificate reading unit that reads the public key certificate recorded in the information recording medium or the playback device;
The file receiving unit receives the file using a secure communication path established using a public key certificate,
The playback apparatus according to claim 6, wherein the file list validity confirmation unit confirms the validity of the file list through whether or not the secure communication path can be established. The application execution unit
The validity of the file list is confirmed by the file list validation unit,
When the hash confirmation unit confirms that the hash value of the file constituting the application on the application server received by the file reception unit matches the hash value described in the file list, the hash confirmation unit is arranged in the application server. The playback apparatus according to claim 6, wherein the reproduced application is trusted. A program for simultaneously playing a title including a digital stream recorded on an information recording medium and executing an application recorded on the information recording medium or arranged in an application server,
A title control step for controlling branching between multiple titles;
A playback control step of playing back a digital stream belonging to one title;
A file list receiving step for receiving the file list based on the position information of the file list in which the file name and hash value of each file constituting the application on the application server recorded in the information recording medium is written;
A file list validation step for validating the received file list;
A file receiving step for receiving a file constituting the application when executing an application arranged in the application server; and a hash value of the received file is calculated and matches a hash value of the file described in the file list A program for causing a computer to execute a hash confirmation step for confirming this and an application execution step for executing an application on an application server based on the received file. The file name of the file constituting the application on the application server described in the file list is the position information of the file,
12. The program according to claim 11, wherein the file receiving step receives the file after confirming that the position information of the file to be received matches the position information described in the file list. . A signature receiving step for receiving a signature for the file list based on position information of a signature for the file list, which is described in the information recording medium or the file list; The program according to claim 11, wherein validity of the file list is confirmed based on a signature. Further comprising a public key certificate reading step for reading the public key certificate recorded in the information recording medium or the playback device,
The file receiving step receives the file using a secure communication path established using a public key certificate,
The program according to claim 11, wherein the file list validity confirmation step confirms validity of the file list through whether or not the secure communication path can be established. The application execution step includes:
The file list validation step confirms the validity of the file list,
And when it is confirmed in the hash confirmation step that the hash value of the file constituting the application on the application server received in the file reception step matches the hash value described in the file list, it is arranged in the application server. 12. The program according to claim 11, wherein the program is trusted. A reproduction method for simultaneously performing reproduction of a title including a digital stream recorded on an information recording medium and execution of an application recorded on the information recording medium or arranged in an application server,
A title control step for controlling branching between multiple titles;
A playback control step of playing back a digital stream belonging to one title;
A file list receiving step for receiving the file list based on the position information of the file list in which the file name and hash value of each file constituting the application on the application server recorded in the information recording medium is written;
A file list validation step for validating the received file list;
A file receiving step for receiving a file constituting the application when executing an application arranged in the application server; and a hash value of the received file is calculated and matches a hash value of the file described in the file list A reproduction method comprising: a hash confirmation step for confirming the above and an application execution step for executing an application on the application server based on the received file. The file name of the file constituting the application on the application server described in the file list is the position information of the file,
17. The reproduction according to claim 16, wherein the file receiving step receives the file after confirming that the position information of the file to be received matches the position information described in the file list. Method. A signature receiving step for receiving a signature for the file list based on position information of a signature for the file list, which is described in the information recording medium or the file list; The reproduction method according to claim 16, wherein validity of the file list is confirmed based on a signature. Further comprising a public key certificate reading step for reading the public key certificate recorded in the information recording medium or the playback device,
The file receiving step receives the file using a secure communication path established using a public key certificate,
The reproduction method according to claim 16, wherein the file list validity confirmation step confirms validity of the file list through whether or not the secure communication path can be established. The application execution step includes:
The file list validation step confirms the validity of the file list,
And when it is confirmed in the hash confirmation step that the hash value of the file constituting the application on the application server received in the file reception step matches the hash value described in the file list, it is arranged in the application server. The playback method according to claim 16, further comprising: trusting the downloaded application. An application server that provides an application to a playback device that plays back an information recording medium on which one or more titles including a digital stream and one or more applications including one or more files are recorded,
The application server records a file list in which file names and hash values of files constituting an application provided by the application server are described,
An application server that provides the file list in response to a request from the playback device. Further recording a signature for the file list;
The application server according to claim 21, wherein the signature is provided in response to a request from the playback device. The application server according to claim 21, wherein the file list is provided only to a playback device that has established a secure communication path. 23. The application server according to claim 22, wherein position information of a signature for the file list is described in the file list.

Images