JP2007081918A - Content providing management device, content distribution system, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform improvement of safety, and effective content management, by adding functions to automatically cause security function to be executed on a contents capsule. <P>SOLUTION: A content providing management device 20 distributes a program which updates the cryptographic key of the distributing contents, unifying with digital contents (contents capsule) to a user device 10, based on certificate lapse information acquired from the outside, or time information. Moreover, the content providing management device 20 also adds functions regarding authentication of the user or of the user device, or acquisition of time information, and confirmation of a utilization limit to the contents capsule. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a content provision management device, a content distribution system, and a program suitable for use in protecting digital content.

  In recent years, with respect to multimedia contents such as audio and moving images, services that are sold using a network have begun to spread. When reproducing such digital contents, it is necessary to confirm that the user or the user device is a valid right holder.

2. Description of the Related Art Conventionally, there has been known a method for easily realizing partial use control for a provided content that provides only a part of the content or sets usage restrictions. Specifically, the provider side encrypts the content using a predetermined encryption method, adds usage restriction information to the encrypted content, and transmits the encrypted content as capsule content. Then, the user side separates the received capsule content into encrypted content and usage restriction information, and when there is a usage request, determines whether or not the content can be used by checking the content of the request with the usage restriction information. This is a mechanism for decrypting the encrypted content and permitting the use only in such a case (see, for example, Patent Document 1).
JP 2002-353953 A

According to the technique disclosed in Patent Document 1 described above, it is possible to control the use restriction of content by setting on the content provider side, but when the key for encrypting the content is compromised, the key is automatically updated. Since no function was added, there was a problem from the viewpoint of safety.
Also, the control that automatically stops the use when a certain period of time has passed based on the rights purchased by the user is left to the user side, so the load on the user side is large and efficient content management is required. There was a flaw in terms.

  The present invention has been made based on the various circumstances described above, and is provided in a form (content capsule) in which functions relating to automatic update of key information for encrypting content, confirmation of an expiration date, etc. are included in a program. It is an object of the present invention to provide a content provision management device, a content distribution system, and a program that improve safety and realize efficient copyright management by constructing a mechanism to perform the above.

  In order to solve the above-described problems, the present invention is a content provision management device that distributes content to a user device via a network, and is distributed based on certificate revocation information or time information acquired from the outside. Content distribution means for distributing a program for updating the encryption key of the content to be integrated with the content.

  Also, in the present invention, the content distribution means stores a content storage unit that stores the encrypted content, a logic for encryption, and an encryption key in an integrated manner. Encryption / decryption unit that performs decryption or re-encryption according to the logic for the above, and encryption / decryption that performs condition determination based on certificate revocation information or time information acquired from the outside, and changes the encryption logic The authentication key update unit generates authentication key information based on the authentication information of the user or the user device acquired when the content is used, and authenticates the user or the user device using the generated authentication key information. And an authentication unit.

  In the present invention, the authentication unit generates a public key using authentication information of the user or the user device, transmits a random number generated to the user device, and generates signature information of the random number. And signature verification to determine whether the device is a valid right holder or a user device.

  In addition, the present invention provides a user device that acquires and reproduces content, and the user device is connected via a network, receives the request for content acquisition, performs user authentication, and When authentication is established, a condition determination based on certificate revocation information or time information acquired from the outside is performed, and when the condition is established, a logic update process for encrypting the content is executed, and the update is performed. And a content provision management device that distributes the content decrypted according to the logic to the user device that has made the request.

  Further, the present invention is a program used for a content provision management apparatus connected via a network to a user apparatus, wherein a logic for encryption and an encryption key are stored in an integrated manner, A step of decrypting or re-encrypting according to the logic for encryption, a condition determination based on certificate revocation information or time information acquired from the outside, and a step of changing the encryption logic; and Generating authentication key information based on authentication information of the user or the user device acquired from the user device when used, and authenticating the user or the device using the generated authentication key information; When the user or the user device is authenticated, the decrypted content is distributed to the user device that requested it. Characterized in that to execute Tsu and up, to the computer.

According to the present invention, the content provision management apparatus integrates (contents capsule) a program for automatically updating the encryption key of content to be distributed based on certificate revocation information or time information acquired from the outside. By distributing to the user device, the security function can be automatically executed by the content capsule itself, which improves safety and enables efficient content management.
In addition to the key information update function described above, the content capsule can be loaded with functions for user or user device authentication or time information acquisition and expiration date checking. Can be reduced and various security functions can be realized.

FIG. 1 is a diagram conceptually showing the structure of a content capsule generated by the content provision management apparatus according to the embodiment of the present invention.
As shown in FIG. 1, the content capsule has a hierarchical structure, and from the higher level to the lower level, the program part including the authentication module 1, the automatic descriptor update module, and the descriptor 3, and the encrypted content 4 part, Consists of.

Here, the distributed content is encrypted and stored by the encryption logic of the descriptor 3. In addition, the descriptor 3 decrypts the content or re-encrypts the content with the updated encryption key in accordance with the instruction of the module (descriptor automatic update module 2) positioned at the higher level. In the descriptor 3, the encryption logic and the key information are integrated and stored.
The automatic descriptor update module 2 changes the encryption logic based on certificate revocation information and time information acquired from outside via communication via a network. The encryption logic can be changed every time an event occurs or at regular intervals. In the latter case, the encryption or decryption logic is changed at regular intervals.

The authentication module 1 authenticates whether the user is a legitimate right owner or a legitimate user device. Accordingly, the authentication module 1 acquires user authentication information such as device information and user ID, generates authentication key information from the acquired information, and a user who has issued a content acquisition request with the generated authentication key information. Alternatively, the user device is authenticated. For example, a public key is generated from device information and a user ID using ID type encryption. It then sends a random number to the other party and receives a random number signature. Finally, the received signature is verified to confirm whether it is a legitimate rights owner.
The ID type encryption is a method of generating a public key (decryption key) for decryption (verification) from ID information, and further generating a secret key (encryption key) for encryption (signature) from the public key. . A feature of ID-type encryption is that public keys are generated from meaningful ID information, so there are many types of public keys, and the public key itself can have meaningful information.

FIG. 2 is a diagram showing an example of a system configuration of the content distribution system according to the embodiment of the present invention.
The content distribution system according to the embodiment of the present invention includes a user device 10 and a content provision management device 20, which are connected via a network (not shown). The user device 10 includes a content reproduction unit 11 and an interface unit 12. The content reproduction unit 11 is a main body part that executes a reproduction program. The decrypted content acquisition request generated here is transmitted to the content provision management device 20 via the interface unit 12 and is generated by the content provision management device 20. Capsule content is captured via the interface unit 12.

The content provision management apparatus 20 functions as a content distribution unit that distributes a program for updating an encryption key of content to be distributed in an integrated manner based on certificate revocation information or time information acquired from the outside. The content distribution unit includes an interface unit 21, an authentication unit 22, an encryption / decryption logic update unit 23, an encryption / decryption unit 24, and a content storage unit 25.
The interface unit 21 manages the interface with the user device 10 and transfers the decrypted content acquisition request generated by the user device 10 to the authentication unit 21, and also displays the capsule content transferred via the authentication unit 21. Distribution to the user apparatus 10 via a network (not shown). Further, the authentication unit 22 generates authentication key information based on the authentication information of the user or the user device 10 acquired when the content is used, and authenticates the user or the user device 10 using the generated authentication key information. Do.

The encryption / decryption logic update unit 22 performs condition determination based on certificate revocation information or time information acquired by communication from the outside, and changes the encryption logic of the encryption / decryption unit 24 described later. The encryption / decryption unit 24 stores the encryption logic and the encryption key in an integrated manner, and decrypts or re-encrypts the encrypted content according to the encryption logic.
The content storage unit 25 is a storage device that stores encrypted digital content.

FIG. 3 is a flowchart quoted for explaining the operation of the content provision management apparatus according to the embodiment of the present invention. FIG. 3 also shows a processing procedure of a program generated by the content provision management device of the present invention and distributed to the user device.
The operation of the content provision management apparatus according to the embodiment of the present invention shown in FIG. 2 will be described below with reference to the flowchart shown in FIG.

First, the content utilization device 10 transmits a decrypted content acquisition request generated by the content reproduction unit 11 to the content provision management device 20 via the interface unit 12 and the network. The content provision management apparatus 20 that has received the content acquisition request via the network transfers the decrypted content acquisition request to the authentication unit 22 via the interface unit 21 (S31).
Upon receiving the decrypted content acquisition request, the authentication unit 22 executes an authentication process (S32). Here, it is assumed that the authentication uses ID-type encryption, receives the device information of the user device 10 or the user ID transmitted together with the decryption content acquisition request, generates a public key from these, and sends a random number to the user device 10 And a signature of a random number is received from the user device 10. Then, the authentication unit 22 verifies the received signature to confirm whether or not it is a legitimate right owner.

Here, when authentication is established (S33 “Yes”), the authentication unit 22 activates the encryption / decryption logic update unit 23 and requests the decryption content from the encryption / decryption logic update unit 23. (S34). The encryption / decryption logic update unit 23 performs a condition check based on certificate revocation information acquired by communication from the outside, time information, or both (S35), and decrypts content to the encryption / decryption unit 24. Is requested (S36). At this time, if an update process occurs (S37 “Yes”), the encryption / decryption unit 24 is requested to update the key information, and the encryption / decryption unit 24 executes the key information update process. (S38).
Subsequently, the encryption / decryption unit 24 performs a decryption process using a valid encryption key, and sends the corresponding encrypted content stored in the content storage unit 25 to the user apparatus 10 that has requested it. Then, the data is transmitted via the encryption / decryption logic update unit 23, the authentication unit 22, and the interface unit 21 (S39).

  At this time, if necessary, the encryption / decryption logic unit 24 re-encrypts its own content according to another encryption logic generated at random. Then, the decrypted content is transmitted according to another procedure to the user apparatus 10 that has requested it.

As described above, according to the present invention, the program for automatically updating the encryption key of the content to be distributed based on the certificate revocation information or time information acquired from the outside by the content provision management apparatus 20 is integrated with the digital content ( The content capsule itself can automatically execute a security function, which improves safety and enables efficient content management. .
In addition to updating the key information, the function of the user device or user device or the time information acquisition and expiration date confirmation is added to the content capsule to reduce the load on the user device. In addition, various security functions can be realized.

  The procedure executed by each of the content reproduction unit 11, the interface unit 12, the interface unit 21, the authentication unit 22, the encryption / decryption logic update unit 23, and the encryption / decryption unit 24 shown in FIG. The content provision management apparatus and the content distribution system of the present invention can be realized by recording in a readable recording medium, causing the computer system to read and execute the program recorded in the recording medium. The computer system here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is the figure which showed notionally the structure of the content capsule produced | generated by the content provision management apparatus which concerns on embodiment of this invention. It is a figure which shows an example of the system configuration | structure of the content delivery system which concerns on embodiment of this invention. It is the flowchart quoted in order to demonstrate operation | movement of the content provision management apparatus which concerns on embodiment of this invention.

Explanation of symbols

1-authentication module, 2-descriptor automatic update module, 3-descriptor, 4-encrypted content, 10-user device, 11-content playback unit, 12-interface unit, 20-content provision management device, 21-interface unit , 22—Authentication unit, 23—Encryption / decryption logic update unit, 24—Encryption / decryption unit, 25—Content storage unit

Claims (5)

A content provision management device that distributes content to user devices via a network,
Content distribution means for distributing a program for updating an encryption key of the distributed content based on certificate revocation information or time information acquired from the outside, integrated with the content,
A content provision management apparatus comprising: The content distribution means includes:
A content storage unit for storing the encrypted content;
An encryption / decryption unit in which the logic for encryption and the encryption key are integrated and stored, and decrypted or re-encrypted according to the logic for encryption;
An encryption / decryption logic update unit that performs condition determination based on certificate revocation information acquired from the outside or time information, and changes the encryption logic;
An authentication unit that generates authentication key information based on authentication information of the user or the user device, which is acquired when the digital content is used, and authenticates the user or the device using the generated authentication key information;
The content provision management apparatus according to claim 1, further comprising: The authentication unit
A public key is generated using authentication information of the user or user device, a random number generated is transmitted to the user device, signature information of the random number is received, signature verification is performed, 3. The content provision management apparatus according to claim 2, wherein the content provision management apparatus determines whether it is a right owner or a user apparatus. A user device that acquires and plays back decrypted content;
Certificate revocation information or time acquired from outside when the user apparatus is connected to the user apparatus via a network, receives the request for obtaining the decrypted content, performs user authentication, and the authentication is established Condition determination based on information is performed, and when the condition is satisfied, a logic update process for encrypting the content is executed, and the content decrypted according to the updated encryption logic is requested A content provision management device distributed to a user device;
A content distribution system comprising: A user device is a program used in a content provision management device connected via a network,
The encryption logic and the encryption key are stored in an integrated manner, and decrypted or re-encrypted according to the encryption logic;
Performing a condition determination based on certificate revocation information or time information acquired from the outside, and changing the encryption logic;
At the time of the acquisition request of the decrypted content, the authentication key information is generated based on the authentication information of the user or the user device acquired from the user device, and the user or the user device is generated based on the generated authentication key information. Authenticating, and
Delivering the decrypted content to the requested user device when authentication of the user or user device is established;
A program that causes a computer to execute.

Images