JP2010092202A - Storage device using usb interface - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a storage device using a USB interface corresponding to a copyright protection technology. <P>SOLUTION: The storage device connected through a USB interface to an external device is provided with a rewritable memory, and a controller. The memory includes: a system region for preliminarily storing unique identification data; an authentication region for storing a cryptographic key created by using the identification data and a user region for storing content encrypted by the cryptographic key. The controller is provided with: a system region access control part for controlling access by an external device to the system region; a user region access control part for controlling access to the user region by the external device; an authentication part for verifying the validity of the external device; and an authentication region access control part for, when authentication by the authentication part succeeds, permitting the external device to acquire the cryptographic key. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a storage device using a USB interface.

  With the digitization of content such as video and music, illegal copying that infringes copyright has become a problem. As one of countermeasures against this problem, a CPRM (Content Protection for Recordable Media) technique is known. This technique is a copyright protection technique for recording media, and is currently employed in DVD-RAM / R / RW, SD memory cards, and the like (for example, Patent Document 1).

Japanese Patent No. 33891286 JP 2008-40597 A

  However, storage devices using USB interfaces that have been widely used in the past (for example, USB flash memory and USB-connected hard disks) also store and play back encrypted content protected by the CPRM technology. There was a request to want.

  An object of the present invention is to provide a storage device using a USB interface compatible with copyright protection technology.

  SUMMARY An advantage of some aspects of the invention is to solve at least a part of the problems described above, and the invention can be implemented as the following forms or application examples.

[Application Example 1]
A storage device connected to an external device using a USB interface,
Rewritable memory,
A controller for controlling the memory;
With
The memory is
A system area for storing in advance unique identification data capable of distinguishing the storage device from other storage devices;
An authentication area for storing an encryption key created using the identification data;
A user area for storing digital content encrypted by the encryption key;
Including
The controller is
A system area access control unit for controlling access by the external device to the system area;
A user area access control unit for controlling access by the external device to the user area;
An authentication unit for verifying the validity of the external device;
An authentication area access control unit for permitting acquisition of the encryption key by an external device when authentication by the authentication unit is successful;
A storage device.
In this way, it is possible to provide a storage device using a USB interface that supports copyright protection technology.

[Application Example 2]
A storage device according to Application Example 1,
The identification data is
A first manufacturer ID assigned by a first standard or a standard governing body to identify the manufacturer of the storage device;
A second manufacturer ID assigned by a second standard or standard governing body to identify the manufacturer of the storage device;
In the manufacturer, a serial number ID set by the manufacturer in order to identify a specific part constituting the storage device from a similar part in another storage device,
A storage device created from
In this way, unique identification data can be created from an existing ID that is normally used in a storage device using a USB interface.

[Application Example 3]
A storage device according to Application Example 2,
The storage device, wherein the identification data is created by encrypting at least a part of the first manufacturer ID, the second manufacturer ID, and the manufacturing number ID.
In this way, in the storage device using the USB interface, the configuration of the identification data can be kept secret even if the existing ID that is normally used is information that can be browsed by the user. As a result, the security of identification data can be improved.

  Note that the present invention can be realized in various modes. For example, a storage device using a USB interface compatible with copyright protection technology, a method for realizing copyright protection technology in a storage device using a USB interface, a computer program for realizing the functions of these methods or devices, It can be realized in the form of a storage medium or the like on which a computer program is recorded.

Next, embodiments of the present invention will be described in the following order based on examples.
A. Example:
B. Variation:

A. Example:
FIG. 1 is an explanatory diagram showing a schematic configuration of a storage device as an embodiment of the present invention. The storage device 10 (hereinafter, also simply referred to as “USB flash memory”) is a storage device connected to an external device using a USB interface, and includes a controller 100 and a flash memory 200.

  The flash memory 200 is a nonvolatile semiconductor memory capable of erasing and rewriting data. The flash memory 200 includes a system area 210, an authentication area 220, and a user area 230. The system area 210 is a read-only storage area. In the system area 210, a media ID 212 is stored in advance. The media ID 212 is unique identification data for identifying individual recording media and conforms to CPRM. A method for creating the media ID 212 will be described later. Note that the system area 210 may be arranged not on the flash memory 200 but on a read-only storage medium such as a ROM. The authentication area 220 is an area for storing an encryption key 222 used for content encryption / decryption in CPRM control. The user area 230 is an area in which a user can freely read and write through an external device. The user area 230 can store encrypted content 232 encrypted by CPRM control and unencrypted user data 234.

  The controller 100 includes a control circuit for controlling the flash memory 200. The controller 100 includes an authentication unit 110, a main control unit 120, a system area access control unit 130, an authentication area access control unit 140, a user area access control unit 150, and an encryption / decryption unit 160. . The authentication unit 110 executes an authentication process for verifying the validity of the external device connected to the USB flash memory 10. Details of the authentication process will be described later. The system area access control unit 130 has a function of controlling access to the system area 210. For example, when receiving a read-only command from an external device, the system area access control unit 130 reads the media ID 212 stored in the system area 210. The reading of the media ID 212 may be permitted only to an external device that has been successfully authenticated. The authentication area access control unit 140 has a function of controlling access to the authentication area 220. Specifically, the reading and writing of the encryption key 222 are controlled in accordance with a command from an external device in which the authentication process is successful (validated). The command used at this time is preferably encrypted. The user area access control unit 150 has a function of controlling access to the user area 230. Specifically, the reading and writing of the encrypted content 232 and user data 234 from the external device are controlled. The encryption / decryption unit 160 creates an encryption key 222 compliant with CPRM under the control of the main control unit 120. The encryption key 222 is stored in the system area 210, a device key (not shown) given from an external device, an MKB 122 (Media Key Block) stored in a storage area (not shown) in the main control unit 120, and the like. It is a key encrypted with a key created from the media ID 212 that exists. Details of the encryption key 222 will be described later. These CPRM controls are realized by the cooperation of the main control unit 120 and the encryption / decryption unit 160. The MKB 122 may be stored in any area in the flash memory 200. The main control unit 120 performs the above-described CPRM control, and has a function of supervising control of each control unit.

  FIG. 2 is an explanatory diagram showing the configuration of the media ID 212. The media ID 212 is a 64-bit unique ID. The media ID 212 is created from the MID 214, VID 215, PRV 216, and PSN 217. The MID 214 is a first manufacturer ID (manufacturing ID) assigned to each manufacturer from 4C Entity, LLC, which is a standard license mechanism. The MID 214 is stored in the system area 210, and a copy of the MID 214 is stored in the 0th byte of the media ID 212. The VID 215 is a second manufacturer ID (vendor ID) assigned for each manufacturer from USB-IF (USB Implementers Forum), which is an industry group that formulates the USB standard. The VID 215 is stored in the system area 210, and the VID 215 is encoded or encrypted and stored in the first and second bytes of the media ID 212. The PRV 216 is a product version identification number set in the initialization process in the manufacturing stage of the USB flash memory 10. The PRV 216 is stored in the system area 210, and a copy of the PRV 216 is stored in the third byte of the media ID 212. The PRV 216 can be omitted. For example, the VID 215 may be stored in the first to third bytes of the media ID 212. The PSN 217 is a product serial number set in the controller 100 that is a part of the USB flash memory 10, and is stored in the system area 210. This product serial number is a production number ID set to identify a specific controller 100 from another controller 100 within the manufacturer. A copy of this PSN 217 is stored in the 4th to 7th bytes of the media ID 212. Note that PSN 217 is preferably a unique number within the manufacturer.

  If the media ID 212 is created in this way, a unique media ID 212 compliant with CPRM can be prepared using existing information normally used for the USB flash memory 10. Further, since the information such as VID 215 and PRV 216 is information that can be browsed by the user via an external device, the configuration of the media ID 212 can be concealed by encrypting at least a part thereof. As a result, the security of the media ID 212 can be improved.

  FIG. 3 is an explanatory diagram showing a flow of authentication processing between the external device and the USB flash memory 10. When the USB flash memory 10 is connected to an external device, first, an authentication process for verifying the validity of the external device is performed. This authentication process is challenge-response type mutual authentication performed between the external device and the authentication unit 110 of the USB flash memory 10 (step S200). Specifically, first, the authentication unit 110 transmits a value called “challenge” to the external device. The external device performs arithmetic processing by multiplying the challenge value by the password held by itself. The external device transmits the hash value obtained as a result of the arithmetic processing to the authentication unit 110 as a “response”. The authentication unit 110 collates the response value from the external device with the response value generated by itself, and determines that the authentication is successful if the two response values match. In this authentication process, a device ID can be used as a password held by an external device.

  When this authentication fails (authentication is impossible), the authentication unit 110 determines that access to the authentication area 220 is impossible (step S202). In this state, access from the external device to the USB flash memory 10 is restricted to the user area 230 (step S210). For this reason, the external device cannot store the encryption key 222 used for encrypting the digital content in the authentication area 220 when generating and storing the encrypted content 232. ii) Playing back the encrypted content 232 In this case, the encryption key 222 for decrypting the encrypted content 232 cannot be acquired from the authentication area 220. Therefore, in this case, the USB flash memory 10 functions as a normal USB flash memory.

On the other hand, when the authentication is successful (authentication is possible), the authentication unit 110 determines that access to the authentication area 220 is possible (step S204). Next, a media ID 212 exchange process is performed between the external device and the USB flash memory 10 (step S206). Specifically, the main control unit 120 of the USB flash memory 10 encrypts the media ID 212 using the challenge value used in the mutual authentication in step S200, and transmits it to the external device. In this manner, the USB flash memory 10 can safely transmit the media ID 212 by going through the process of verifying the validity of the external device and encrypting the media ID 212. The external device that has received this performs the following CPRM control on the authentication area 220 and the user area 230 (step S208).
i) When the encrypted content 232 is generated and stored:
The external device uses the decrypted media ID 212, the MKB 122 acquired from the USB flash memory 10, and the device key owned by itself to generate a key called a media unique key. Further, the external device generates an encryption key (hereinafter also referred to as “content key”) for encrypting the digital content, and creates the encrypted content 232 using the content key. This encrypted content 232 is stored in the user area 230. Thereafter, the external device encrypts the content key with the media unique key and generates an encryption key 222. This encryption key 222 is stored in the authentication area 220.
ii) When playing back the encrypted content 232:
The external device generates a media unique key using the decrypted media ID 212, the MKB 122 acquired from the USB flash memory 10, and the device key owned by itself. Then, the encryption key 222 acquired from the USB flash memory 10 is decrypted using the media unique key. The external device performs decryption processing of the encrypted content 232 using the content key obtained by the decryption processing.
In this case, by performing the above-described control, the USB flash memory 10 can function as a USB flash memory compatible with copyright protection technology.

  As described above, in the above embodiment, the media ID and MKB corresponding to the copyright protection technology (CPRM) are prepared in the USB memory, and the digital content is encrypted and decrypted using the media ID and MKB. It is possible to provide a USB flash memory compliant with the above.

B. Variation:
The present invention is not limited to the above-described examples and embodiments, and can be implemented in various modes without departing from the gist thereof. For example, the following modifications are possible.

B1. Modification 1:
In the above embodiment, the USB flash memory is used as an example of the storage device using the USB interface. However, any storage device can be used. For example, it may be a hard disk using a USB interface.

B2. Modification 2:
The configuration of the media ID shown in the above embodiment is merely an example. The media ID can be created by an arbitrary method using a plurality of IDs (MID, VID, PRV, PSN, etc.) as constituent elements. For example, when creating a media ID, the arrangement order of the plurality of IDs can be arbitrarily set. As another example, a configuration may be adopted in which part or all of the media ID is encrypted. Specifically, i) encrypts any one or more IDs among a plurality of IDs that are constituent elements, ii) encrypts a part of the plurality of IDs that are constituent elements (for example, a part of PSN) It is possible to adopt a configuration such as

It is explanatory drawing which shows schematic structure of the memory | storage device as one Example of this invention. It is explanatory drawing which shows the structure of media ID212. 4 is an explanatory diagram showing a flow of authentication processing between an external device and a USB flash memory 10; FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Storage device 100 ... Controller 110 ... Authentication part 120 ... Main control part 122 ... MKB
DESCRIPTION OF SYMBOLS 130 ... System area access control part 140 ... Authentication area access control part 150 ... User area access control part 160 ... Decryption part 200 ... Flash memory 210 ... System area 220 ... Authentication area 222 ... Encryption key 230 ... User area 232 ... Encryption Content 234 ... user data

Claims (3)

A storage device connected to an external device using a USB interface,
Rewritable memory,
A controller for controlling the memory;
With
The memory is
A system area for storing in advance unique identification data capable of distinguishing the storage device from other storage devices;
An authentication area for storing an encryption key created using the identification data;
A user area for storing digital content encrypted by the encryption key;
Including
The controller is
A system area access control unit for controlling access by the external device to the system area;
A user area access control unit for controlling access by the external device to the user area;
An authentication unit for verifying the validity of the external device;
An authentication area access control unit for permitting acquisition of the encryption key by an external device when authentication by the authentication unit is successful;
A storage device. The storage device according to claim 1,
The identification data is
A first manufacturer ID assigned by a first standard or a standard governing body to identify the manufacturer of the storage device;
A second manufacturer ID assigned by a second standard or standard governing body to identify the manufacturer of the storage device;
In the manufacturer, a serial number ID set by the manufacturer in order to identify a specific part constituting the storage device from a similar part in another storage device,
A storage device created from The storage device according to claim 2,
The storage device, wherein the identification data is created by encrypting at least a part of the first manufacturer ID, the second manufacturer ID, and the manufacturing number ID.

Images