JP2009194640A - Method for transferring content - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently and safely transfer contents to a recording medium while utilizing an existing system. <P>SOLUTION: A key generating apparatus 100 generates Ko, generates Km and Kp from the Ko, delivers Kp to a content provision apparatus 200 while generating MKB from a part of a plurality of previously held device keys and Ko and Km and transmits the MKB to a host apparatus 300 and the recording medium 400. The host apparatus 300 computes Km for an authentication from the previously held device key for the host apparatus on the basis of the MKB. The recording medium 400 computes Ko from the previously held device key for the recording medium on the basis of the MKB, and computes Km and Kp for the authentication. The content provision apparatus 200 generates a MAC value on the basis of the contents and Kp, and transmits the MAC value and the contents to the recording medium 400 after the success of an authentication processing. The recording medium 400 generates the MAC value on the basis of the contents and Kp, and records the contents in the recording medium 400 when the MAC value and the transmitted MAC value coincide. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a content transfer method for transferring content to a recording medium.

  Conventionally, content such as moving images, music, and programs has been widely distributed from a supplier to a user via a communication network such as ROM media or the Internet. In content distribution, there is a case where a portion between a device that supplies content and a recording medium is distributed in an encrypted form for confidentiality from a third party. At that time, a media key for decrypting the encrypted data is required for the device using the data. The media key is provided in a form encrypted and included in data called an MKB (Media Key Block) (see, for example, Non-Patent Document 1 and Non-Patent Document 2).

  The recording medium in this case is provided with a user area called a general user that can be accessed even by a person who does not know the secret, and a protected area that can be accessed only by a person who also has secret information.

  The protected area is an area where information recorded by accessing from a host or the like having certain secret information can be handled correctly. For example, an SD (Secure Digital) card has a protection area, and a device having a device key (Device Key) undergoes an authentication process between the device and a recording medium (see, for example, Patent Document 1), However, the same session key (Session Key) is generated each time, and the data in the protected area can be read and written by exchanging data by encrypting with the session key. On the other hand, since a device that does not have a device key fails in the authentication process between the device and the recording medium, it is impossible to read / write data in the protected area. Also, a device that does not know the session key cannot correctly read and write data in the protected area. Furthermore, the host itself is required to be tamper resistant so that the secret information cannot be accessed from the outside. However, it is assumed that the secret information may be leaked. The authentication process between the device and the recording medium is also provided with a mechanism for invalidating access from the leaked secret information.

  A recording medium provided with a protected area also includes a general area that can be read and written without authentication. For example, a key obtained by encrypting moving image content recorded in the general area of the medium is recorded in the protected area, and a specific program is locked from the protected area. Is read and the video content is decrypted and reproduced.

  In addition, the recording medium is used as a recording medium for recording digital data called content such as music, video, program, etc., but the content provided by the content provider can be altered before it is recorded on the recording medium. There is sex. In order to prevent tampering, it is possible to detect tampering in the middle by applying an electronic signature to the content itself and checking the signature in the recording medium. At that time, information called a public key for falsification detection is required. This data may be disclosed, but it must be written on a recording medium so that it cannot be rewritten.

In addition, when content is transferred between a device and a recording medium, a MAC operation (for example, Non-Patent Document 3) is often used to enhance security.
JP 2004-220317 A “Content Protection for Recordable Media Specification, SD Memory Card Book Common Part, Revision 0.961, May 3, 2007”, [online], The 4C Entity, LLC, [February 4, 2008 search], Internet <URL: http : //www.4centity.com/ ＞ “Content Protection for Recordable Media Specification, Introduction and Common Cryptographic Elements, Revision 1.01, May 3, 2007”, [online], The 4C Entity, LLC, [February 4, 2008 search], Internet <URL: http: //www.4centity.com/ ＞ “Handbook of Applied Cryptgraphy”, CRC Press, 1996, Section 9.5 Keyed hash functions (MACS)

  A recording medium having the above-described device-recording medium authentication processing function and content alteration detection function needs to have secret information or information that cannot be rewritten inside. A recording medium that satisfies these requirements must have tamper resistance so that such information cannot be accessed from the outside. However, since this tamper resistance requires a high level of technology, there may be a possibility that a recording medium having only insufficient tamper resistance may appear on the market. It is necessary to devise so that content is not recorded on such a problematic recording medium. For example, it may be required to provide a new mechanism for eliminating not only a host device having a problem in the above-described authentication process between the device and the recording medium but also the recording medium.

  However, since the recording medium often has a limited calculation memory and calculation capability, it is required to be able to transfer content to the recording medium safely while maintaining compatibility with existing mechanisms as much as possible. At that time, for example, whether the data from the correct content provider is written at the time of content transfer to the recording medium, whether there is a problem in the host device that intervenes the transfer, or whether there is a problem in the recording medium, etc. It is desirable to be able to confirm with this method.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a content transfer method capable of transferring content to a recording medium efficiently and safely using an existing method.

  The content transfer method according to the present invention is a content transfer method for securely transferring content provided by a content providing device to a recording medium through a host device by using an MKB (Media Key Block) generated by a key generating device. The key generation device generates a first key, generates a second key and a third key from the first key through a predetermined one-way function, and uses the third key as the content. The MKB is generated from a part of a plurality of device keys owned in advance, the first key, and the second key, and the generated MKB is transmitted to the host device and the recording medium. The host device calculates the second key from the device key of the host device owned in advance based on the MKB transmitted from the key generation device, and uses the calculated second key as the second key. Based on the MKB transmitted from the key generation device, the recording medium calculates the first key from the device key of the recording medium owned in advance and is used for the authentication process with the recording medium. The second key and the third key are calculated using the same key as the one-way function in the key generation device, and the calculated second key is used for authentication processing with the host device. The content providing device performs a predetermined MAC (Message Authentication Code) operation based on the content and the third key passed from the key generation device to generate a MAC value, and the generated MAC value The content is transmitted to the recording medium via the host device after successful authentication processing between the host device and the recording medium, and the recording medium is transmitted from the content providing device. Based on the content and the calculated third key, a MAC value is generated by the same operation as the MAC operation in the content providing device, and the generated MAC value and a MAC value transmitted from the content providing device are It is characterized by verifying whether or not they match, and if they match, the content is recorded in the recording medium.

  According to the present invention, it is possible to efficiently and safely transfer content to a recording medium while using an existing method.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing various components constituting a content transfer system according to an embodiment of the present invention.

  This content transfer system includes a key generation device 100, a content providing device 200, host devices 310, 320, 330,..., And recording media 410, 420, 430,. Of these, there may be one or more host devices and recording media, but in the example of this figure, three of them are taken up as representative ones.

  Note that devices other than the recording media 410, 420, 430,... Are realized as a computer, for example, and all or part of their functions are realized as a computer program. The recording media 410, 420, 430,... Are realized as SD memory cards, for example. The connection between the device and the recording medium and the connection between the devices may be directly connected or may be connected through a network. In addition, information that requires confidentiality such as a key is safely stored in the protection area described in the above background art.

  The key generation device 100 includes a device key DB 101, an MKB generator 102, a one-way device 103, and a key generator 104.

  The content providing device 200 includes an encryption processing unit 201, a MAC calculation unit 202, and content 203.

  Each of the host devices 310, 320, and 330 includes MKB processing units 312, 322, and 332, and owns device keys (eg, # H1, # H2, and # H3) 311, 321, and 331, respectively. The recording media 410, 420, and 430 include MKB processing units 412, 422, and 432, respectively, and own device keys (eg, #M 1, #M 2, #M 3) 411, 412, and 413. These device keys are distributed in advance from the key generation device 100 and bundled with each host device and each recording medium. The device key is generally distributed to a host device and a recording medium as a set of a plurality of device keys. In that case, the device key in the present embodiment refers to one set of device keys.

  FIG. 2 shows various elements included in each recording medium and each host device in more detail. The function of each element will be described later.

  The arbitrary host device 300 includes a device key (for example, # H1) 301, an MKB processing unit 302, and an authentication processing unit 303. A certain recording medium 400 includes a device key (for example, # M1) 401, an MKB processing unit 402, an authentication processing unit 403, a unidirectional device 404, a decryption processing unit 405, a MAC operation unit 406, and a MAC verification unit 407.

  FIG. 3 is a diagram showing in detail the overall configuration of the system and the flow of processing. Here, a method of securely transferring content provided by the content providing device 200 to the recording medium 400 through the host device 300 by using a single MKB generated by the key generating device 100 will be described.

  The key generation device 100 generates a first key (hereinafter referred to as “Ko”) from the key generator 104, puts this Ko in the unidirectional device 103, and refers to the second key (hereinafter referred to as “Km”). ) And a third key (hereinafter referred to as “Kp”), and the generated Kp is passed to the content providing device 200. A one-way genitalia is a function that calculates the value of one or more outputs from one input. A function that makes it difficult to analogize the values of other outputs and inputs from one value among multiple outputs. Point to. For example, the following calculation formula can be specifically applied.

Km = Enc (Kg, Ko) XOR Ko
Kp = Enc (Kg, Ko + 1) XOR Ko + 1
Here, Enc (A, B) indicates a value obtained by encrypting B with A. Kg is a fixed key value, + is an addition operation, and XOR is an exclusive OR. According to this calculation formula, it is difficult to estimate Ko from Km and Kp. It is also difficult to make an analogy between Km and Kp.

  The key generation device 100 may transmit Kp directly to the content providing device 200 when passing the Kp to the content providing device 200, but instead, the key generation device 100 stores the Kp in a predetermined storage medium. Even after the temporary storage, the content providing device 200 reads the data or sends it to the content providing device 200 side, so that Kp is supplied to the content providing device 200 through a two-stage process. Good.

  Based on the Kp passed from the key generation device 100 and the content, the content providing device 200 performs a predetermined MAC (Message Authentication Code) operation by the MAC operation unit 202 to generate a MAC value, and uses the Kp. The content is encrypted by the encryption processing unit 201, and the encrypted content and the MAC value are transmitted via the host device 300 through a secure channel formed by a successful authentication process between the host device 300 and the recording medium 400 described later. To the recording medium 400. The MAC operation at this time can be realized by a calculation formula shown in Non-Patent Document 3, for example.

  In addition, the key generation device 100 uses the MKB generator 102 to generate Ko from the key generator 104, Km generated from the unidirectional device 103, and some of the plurality of device keys included in the device key DB 101. An MKB is generated, and the generated MKB is transmitted to the host device 300 and transmitted to the recording medium 400. For example, if the MKB shown in Non-Patent Document 2 is used, an MKB for generating Km and an MKB for generating Ko can be generated, so that Km and Ko can be generated with one MKB. By configuring, the MKB used in this example can be generated.

  When generating the MKB, the key generation device 100 includes data that allows Km to be calculated from a device key owned by an arbitrary host device (here, a device key 301 owned by the host device 300), and an arbitrary The MKB includes data that enables Ko calculation from the device key owned by the recording medium (device key 401 owned by the recording medium 400 in this example). Further, when generating the MKB, the key generation device 100 further includes verification data for verifying whether the Km calculated by the arbitrary host device (here, the host device 300) is correct from the MKB. The MKB includes verification data for verifying whether the Ko calculated by an arbitrary recording medium (here, the recording medium 400) from the MKB is correct. An example of the data structure of the MKB in this case is shown in FIG.

  As shown in FIG. 4, in the MKB, x data Enc (Kd_h1, Km) that enables Km to be calculated from the x device keys Kd_h1 to Kd_hx for the host device, respectively. To Enc (Kd_hx, Km). Similarly, y pieces of data Enc (Kd_m1, Ko) to Enc (Kd_my, Ko) are provided that allow Ko to be calculated from y device keys Kd_m1 to Kd_my for the recording medium. That is, if the host device has any one of the x device keys Kd_h1 to Kd_hx, Km can be calculated from the corresponding data. Similarly, if the recording medium has any one of the y device keys Kd_m1 to Kd_my, Ko can be calculated from the corresponding data.

  Further, in the MKB, verification data Enc (Km, fixed data) for verifying whether or not Km calculated by the host device is correct and whether or not Ko calculated by the recording medium is correct are verified. Verification data Enc (Ko, fixed data). In other words, whether or not Km is correct can be determined by determining whether or not the data obtained by decoding Km to be verified matches the fixed data. Similarly, whether or not Ko is correct can be determined by determining whether or not the data obtained by decoding the verification target Ko matches the fixed data.

  Based on the MKB transmitted from the key generation device 100, the host device 300 performs MKB processing by the MKB processing unit 302, calculates Km from the device key 301 of the host device 300 owned in advance, and calculates this Km is used for authentication processing with the recording medium 400.

  The recording medium 400 performs MKB processing by the MKB processing unit 402 based on the MKB transmitted from the key generation device 100, calculates Ko from the device key 310 of the recording medium 400 owned in advance, and this calculation Km and Kp are calculated through a unidirectional device (unidirectional function) 404 that is the same as the unidirectional device (unidirectional function) 103 in the key generation device 100, and the calculated Km is authenticated with the host device 300. Used for.

  The host device 300 and the recording medium 400 perform authentication processing using the mutual Km. As the authentication process, for example, a method disclosed in Patent Document 1 is adopted. Only when the authentication process is successful, a security channel is formed between the host device 300 and the recording medium 400, and the encrypted content and the MAC value from the content providing device 200 are transmitted to the recording medium through the security channel. .

  The recording medium 400 decrypts the encrypted content transmitted through the security channel using the Kp calculated through the one-way unit 404, and based on the decrypted content and the Kp calculated through the one-way unit 404, The MAC value is generated by the MAC operation in the MAC operation unit 406 that is the same as the MAC operation in the MAC operation unit 202 in the content providing device 200, and the generated MAC value matches the MAC value transmitted through the security channel. The MAC verifying unit 407 confirms whether or not the content is to be tampered with, and verifies whether the content has been tampered with. If they match, it is assumed that the content has not been tampered with, and the content is recorded in a predetermined recording medium by the recording unit 408.

  By such processing, only contents that have not been correctly tampered with efficiently and safely can be transported to the recording medium 400 and recorded.

  In the above process, encryption by the encryption processing unit 201 and decryption by the decryption processing unit 405 can be omitted for the content. Of course, also in this case, tampering detection can be performed by the MAC verification unit 407, so that safety can be maintained. Such a form can be adopted when encryption is not necessary due to a request from a content providing device. On the contrary, if the encryption in the above-mentioned encryption processing unit 201 and the decryption in the decryption processing unit 405 are performed, the MAC calculation in the MAC calculation units 202 and 406 and the MAC verification in the MAC verification unit 407 are omitted. It is also possible.

  Next, a method for invalidating (revoking) a corresponding host device or recording medium when a certain device key is leaked or torn in the system will be described.

  In order to realize the invalidation, the host device or recording medium to be invalidated does not allow the MKB processing in its own MKB processing unit to fail so that Km and Ko cannot be calculated correctly. For that purpose, when the MKB is generated by the MKB generator 102, data that makes it impossible to calculate Km from the device key owned by the host device to be invalidated is included in the MKB, or the invalidation target Data that makes it impossible to calculate Ko from the device key owned by the recording medium is included in the MKB. By using such a method, for example, only the host device 320, the host device 330, and the recording medium 420 can be selectively invalidated as shown in FIG. In this case, only the host device 310 that can calculate Km necessary for the authentication process can authenticate only with the recording media 410 and 430. As a result, for example, a problematic host device or recording medium can be prevented from being used, and content transfer can be performed only between specific devices.

  FIG. 6 is a diagram illustrating an example of the data structure of the MBK in which a part of the device key is revoked (revoked) by the MKB generator 102.

  In the example of FIG. 6, among the x device keys Kd_h1 to Kd_hx for the host device, the device key Kd_h4 is invalidated, and among the y device keys Kd_m1 to Kd_my for the recording medium, the device key Kd_m5 is It has been disabled. That is, the host device that owns the device key Kd_h4 cannot calculate Km because the data Enc (Kd_h4, Km) to be used is changed to the data Enc (Kd_h4, all 0), and the device key In the recording medium having Kd_m5, the data Enc (Kd_m5, Ko) to be used is changed to the data Enc (Kd_m5, all 0), and therefore Ko cannot be calculated.

  Next, operations performed between devices constituting the system will be described with reference to the sequence diagram of FIG. Here, FIG. 3 is also referred to as needed.

  The host device 300 owns the device key Kd_h in advance (step S1), and the recording medium 400 owns the device key Kd_m (step S2).

  The key generation device 100 generates Ko from the key generator 104 (step S11), puts this Ko into the unidirectional device 103 to generate Km and Kp (step S12), and uses the generated Kp as the content providing device 200. (Step S13).

  In addition, the key generation device 100 uses the MKB generator 102 to generate Ko from the key generator 104, Km generated from the unidirectional device 103, and some of the plurality of device keys included in the device key DB 101. An MKB is generated, and the generated MKB is transmitted to the host device 300 (step S15), and is transmitted to the recording medium 400 (step S16).

  On the other hand, the content providing device 200 generates a MAC value by performing a predetermined MAC operation by the MAC operation unit 202 based on the Kp passed from the key generation device 100 and the content, and uses the Kp to perform an encryption processing unit. The content is encrypted by 201 (step S21), and the encrypted content and the MAC value are transmitted to the host device 300 (step S22).

  Based on the MKB transmitted from the key generation device 100, the host device 300 performs an MKB process (MKB Process) by the MKB processing unit 302 and calculates Km from the owned device key Kd_h (step S31). This calculated Km is used for authentication processing with the recording medium 400 (step S43).

  The recording medium 400 performs MKB processing (MKB Process) by the MKB processing unit 402 based on the MKB transmitted from the key generation device 100, and calculates Ko from the owned device key Kd_m (Step S41). Km and Kp are calculated for the calculated Ko through the same one-way device (one-way function) 404 as the one-way device (one-way function) 103 in the key generation device 100 (step S42), and the calculated Km is used as the host. Used for authentication processing with the device 300.

  The host device 300 and the recording medium 400 perform authentication processing by using the mutual Km (step S43). If this authentication process is successful, a security channel is formed between the host device 300 and the recording medium 400, and the encrypted content and the MAC value from the content providing device 200 are transmitted to the recording medium through this security channel (step S44). ).

  The recording medium 400 decrypts the encrypted content transmitted through the security channel using the Kp calculated through the one-way unit 404, and based on the decrypted content and the Kp calculated through the one-way unit 404, The MAC value is generated by the MAC calculation in the MAC calculation unit 406 that is the same as the MAC calculation in the MAC calculation unit 202 in the content providing device 200, and the generated MAC value matches the MAC value transmitted through the security channel. Whether or not the content is falsified is confirmed by the MAC verification unit 407. If the contents match, it is considered that the content has not been falsified and the content is recorded by the recording unit 408. Recording is performed in a predetermined recording medium (step S45).

  As described above in detail, according to this embodiment, it is possible to efficiently and safely transfer content to a recording medium while using an existing method. Further, by performing invalidation using the MKB, for example, a problematic host device or recording medium can be prevented from being used, and content transfer can be performed only between specific devices. it can.

  Note that the method described in the above embodiment includes a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk (MO) as programs that can be executed by a computer. ), And can be distributed in a storage medium such as a semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  In addition, an OS (operating system) running on a computer based on an instruction of a program installed in the computer from a storage medium, MW (middleware) such as database management software, network software, and the like realize the above-described embodiment. A part of each process may be executed.

  Furthermore, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN or the Internet is downloaded and stored or temporarily stored.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  The computer according to the present invention executes each process in the above-described embodiment based on a program stored in a storage medium, and includes a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.

  In addition, the computer in the present invention is not limited to a personal computer, but includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. .

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Moreover, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine the component covering different embodiment suitably.

The figure which shows the various components which comprise the content transfer system which concerns on one Embodiment of this invention. The figure which shows the various elements which each recording medium and each host apparatus have in detail. The figure which shows the structure of the whole system, and the flow of a process in detail. The figure which shows an example of the data structure of MKB. The figure which shows selectively invalidating some host apparatuses and recording media. The figure which shows an example of the data structure of MBK by which some device keys were revoked (revoked) by the MKB generator. The sequence diagram which shows the operation | movement performed between the apparatuses which comprise the system.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Key generation apparatus, 101 ... Device key DB, 102 ... MKB generator, 103 ... Unidirectional apparatus, 104 ... Key generator, 200 ... Content provision apparatus, 201 ... Encryption processing part, 202 ... MAC operation part, 203 ... Content, 300, 310, 320, 330 ... Host device, 301, 311, 321, 331 ... Device key, 302, 312, 322, 332 ... MKB processing unit, 303 ... Authentication processing unit, 400, 410, 420, 430 ... Recording medium, 401, 411, 412, 413 ... device key, 402, 412, 422, 432 ... MKB processing unit, 403 ... authentication processing unit, 404 ... unidirectional device, 405 ... decryption processing unit, 406 ... MAC operation unit, 407 ... MAC verification unit, 408 ... recording unit.

Claims (5)

A content transfer method for securely transferring content provided by a content providing device to a recording medium through a host device by using an MKB (Media Key Block) generated by a key generating device,
The key generation device generates a first key, generates a second key and a third key from the first key through a predetermined one-way function, and uses the third key as the content providing device. And generating an MKB from a part of a plurality of device keys owned in advance, the first key, and the second key, and transmitting the generated MKB to the host device and the recording medium,
The host device calculates the second key from the device key of the host device owned in advance based on the MKB transmitted from the key generation device, and authenticates the calculated second key with the recording medium. Used for processing,
The recording medium calculates the first key from a device key of the recording medium owned in advance based on the MKB transmitted from the key generation device, and the calculated first key is stored in the key generation device. Calculating the second key and the third key through the same function as the one-way function, and using the calculated second key for authentication processing with the host device;
The content providing device generates a MAC value by performing a predetermined MAC (Message Authentication Code) operation based on the content and a third key passed from the key generation device, and the generated MAC value and the content Is transmitted to the recording medium via the host device after successful authentication processing between the host device and the recording medium,
The recording medium generates a MAC value by the same calculation as the MAC calculation in the content providing device based on the content transmitted from the content providing device and the calculated third key, and the generated MAC value And a MAC value transmitted from the content providing device are verified to match, and if they match, the content is recorded in the recording medium. The content providing device encrypts the content using a third key passed from the key generation device without the MAC operation between the content generation device and the recording medium, and the encrypted content is stored in the host Sent to the recording medium via the device,
The content transfer method according to claim 1, wherein the recording medium decrypts the content transmitted from the content providing device using the calculated third key.   When the key generation device generates the MKB, the second key can be calculated from the device key owned by an arbitrary host device and the device key owned by an arbitrary recording medium. The content transfer method according to claim 1 or 2, wherein the MKB includes data capable of calculating one key.   When the key generation device generates the MKB, verification data for verifying whether the second key calculated by the arbitrary host device from the MKB is correct, and an arbitrary recording medium from the MKB 4. The content transfer method according to claim 3, wherein verification data for verifying whether or not the first key calculated by is is correct is included in the MKB.   When invalidating an arbitrary host device or recording medium, when the key generation device generates the MKB, data that makes it impossible to calculate the second key from a device key owned by the host device, or 5. The content transfer method according to claim 1, wherein data that makes it impossible to calculate the first key from a device key possessed by the recording medium is included in the MKB. 6.

Images