JP2010140298A - Recording medium device, and authentication method for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem in the conventional memory card, wherein no means is provided for authentication between a server when storing a content distributed from the server, although a means is provided for authentication between an access device when the access device reads out information from the memory card or stores information into the memory card. <P>SOLUTION: When the access device reads and writes the information from and in the memory card, the memory card is provided with a means for authentication by use of a first encryption medium key group, retained in the memory card, to generate a first medium specific key for use in authentication between with the access device. When writing the content distributed from the server, the memory card is provided with a means for authentication by use of a second encryption medium key group, received from the server, to generate a second medium specific key for use in authentication between the server and it. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a recording medium device for recording digital content to be digitally distributed and an authentication method for the recording medium device.

  Digital content, which is a digital work such as a movie or music, is digitally distributed to a recording device (for example, KIOSK terminal, personal computer, etc.) via a network, and is recorded on the recording medium using the recording device. Digital content distribution services such as playing recorded content on a playback device (for example, a music player, a video display portable terminal, etc.) are becoming widespread.

At this time, in order to protect the rights of the copyright holder of the digital content, a technique for preventing the digital content once recorded on the recording medium from being copied and reproduced on another recording medium is required.
(Configuration of conventional content distribution / recording / playback system)
In the following, an example of a conventional content distribution / recording / reproducing system for preventing such illegal acts will be briefly described with reference to FIG. Here, a case where the recording medium is a memory card will be described as an example.

As shown in FIG. 31, the conventional content distribution / recording / playback system includes a server 10, a recording device 20, a memory card 30 and a playback device 40.
The server 10 includes an authentication key storage unit 11, an authentication unit 12, a media ID acquisition unit 13, a key information storage unit 14, a signature generation unit 15, a signature key storage unit 16, an encrypted content storage unit 17, and a request reception unit 18. Is done.

  Here, the authentication key storage unit 11 stores an authentication key for authenticating the recording device 20 in a concealed form from the outside. The authentication unit 12 authenticates the recording device 20 using the authentication key stored in the authentication key storage unit 11. The media ID acquisition unit 13 acquires a media ID and a content ID from the recording device when the authentication of the recording device 20 by the authentication unit 12 is successful. The key information storage unit 14 stores key information for decrypting each encrypted content. The signature generation unit 15 acquires key information corresponding to the acquired content ID from the key information storage unit, and uses the key information and the signature key stored in the signature key storage unit 16 for the acquired media ID. Using this, signature data is generated, and key information and signed key information including the signature data are generated. The signature key storage unit 16 stores a signature key, which is secret information known only by the server, in a secret form from the outside. The encrypted content storage unit 17 stores various encrypted contents. The request receiving unit 18 receives a content distribution request from the recording device 20.

The recording device 20 includes a media ID reading unit 21, an authentication key generation unit 22, an authentication unit 23, a media ID acquisition unit 24, an authentication key storage unit 25, an authentication unit 26, and a content request unit 27.
Here, the media ID reading unit 21 reads the media ID from the memory card. The authentication key generation unit 22 generates an authentication key using the read media ID. The authentication unit 23 authenticates the memory card using the generated authentication key. The media ID acquisition unit 24 acquires the read media ID as valid only when the authentication of the memory card is successful.
The authentication key storage unit 25 stores an authentication key for authenticating the server 10 in a concealed form from the outside.

The authentication unit 26 authenticates the server 10 using the authentication key stored in the authentication key storage unit 25. The content requesting unit 27 requests the content by sending a content ID that is identification information of the content to be purchased to the server.

The memory card 30 includes a media ID storage unit 31, an authentication key storage unit 32, an authentication unit 33, a signed key information storage unit 34, and an encrypted content storage unit 35.

  Here, the media ID storage unit 31 is an area that cannot be written from the outside, and stores a different media ID for each memory card. The authentication key storage unit 32 stores an authentication key that is different for each memory card in a concealed form from the outside. The authentication unit 33 uses the authentication key stored in the authentication key storage unit 32 to authenticate the recording device or the playback device. The signed key information storage unit 34 stores signed key information written from the recording device 20. The encrypted content storage unit 35 stores the encrypted content written from the recording device 20.

The signed key information storage unit 34 and the encrypted content storage unit 35 are externally readable / writable areas.
The playback device 40 includes a media ID reading unit 41, an authentication key generation unit 42, an authentication unit 43, a media ID acquisition unit 44, a signature verification unit 45, a content key generation unit 46, a verification key storage unit 47, a decryption unit 48, and a playback unit. 49.

  Here, the media ID reading unit 41 reads the media ID from the memory card. The authentication key generation unit 42 generates an authentication key using the read media ID. The authentication unit 43 authenticates the memory card using the generated authentication key. The media ID acquisition unit 44 acquires the read media ID as the media ID of the valid memory card only when the authentication of the memory card is successful.

  The signature verification unit 45 reads the signed key information from the memory card, and uses the key information included in the signed key information, the signature data, and the acquired media ID to verify the verification stored in the verification key storage unit 47. The signature data is verified using the key. When the verification is successful, the content key generation unit 46 generates a content key using the key information included in the signed key information. The decryption unit 48 reads the encrypted content from the memory card, and decrypts the read encryption using the generated content key. The playback unit 49 plays back the decrypted content.

(Operation of conventional content distribution / recording / playback system)
(1) Operation at the time of content distribution / recording The operation at the time of requesting the server for content distribution, receiving the requested content from the server, and recording it on the memory card is as follows.

(S1) The media ID reading unit 21 of the recording device 20 reads the media ID from the media ID storage unit 31 of the memory card 30 attached to the recording device 20. (s2) The authentication key generation unit 22 sets the read media ID to the read media ID. (S3) The authentication unit 23 of the recording device 20 uses the generated authentication key, and the authentication unit 33 of the memory card 30 authenticates each other using the authentication key of the authentication key storage unit 32. (S4) If the media ID acquisition unit 24 of the recording device succeeds in authentication, the media ID read in (s1) is acquired as valid (s5) The content request unit 27 of the recording device 20 acquires the server To the memory card 30 is sent a content ID, which is identification information of the content to be recorded / reproduced, and requests distribution of the content (s6) The request unit accepting unit 18 receives the content ID from the recording device 20 and accepts the content distribution request. (S7) The authentication unit 12 of the server 10 uses the authentication key of the authentication key storage unit 11 to record the recording device 20. Authenticate each other using the authentication key of the authentication key storage unit 25. (s8) If the media ID acquisition unit 13 of the server succeeds in the authentication, the media ID acquisition unit 24 of the recording device 24 (S9) The signature generation unit 15 of the server reads the key information corresponding to the content ID received in (s5) from the key information storage unit 14, and uses the read key information and the acquired media ID. On the other hand, a signature is generated using the signature key in the signature key storage unit 16, signature key information including the key information and the generated signature data is generated, and distributed to the recording device 20 (s1). ) The encrypted content storage 17 of the server distributes the encrypted content corresponding to the content ID to the recording device 20. (s11) The recording device 20 receives the signed key information and the encrypted content from the server, and the memory card. To record

(2) Operation at the time of reproduction The operation at the time of reproducing the content recorded on the memory card is as follows.

(S12) The media ID reading unit 41 of the playback device 40 reads the media ID from the media ID storage unit 31 of the memory card 30 attached to the playback device 40. (s13) The authentication key generation unit 42 sets the read media ID to the read media ID. (S14) The authentication unit 43 of the playback device 40 uses the generated authentication key, and the authentication unit 33 of the memory card 30 authenticates each other using the authentication key of the authentication key storage unit 32. (S15) If the media ID acquisition unit 44 of the playback device 40 succeeds in authentication, the media ID read in (s12) is acquired as valid. (S16) The signature verification unit 45 of the playback device 40 The signed key information is read from the signed key information storage unit 34 of the memory card 30, and the key information, signature data, and acquired media ID included in the signed key information are matched. Then, signature verification is performed using the verification key stored in the verification key storage unit 47. (s17) When the signature verification is successful, the content key generation unit 46 of the playback device 40 uses the key information to (S18) The decryption unit 48 of the playback device 40 reads the encrypted content from the encrypted content storage unit 35 of the memory card 30, and uses the generated content key to encrypt the read encrypted content. (S19) The decrypting unit 49 of the playback device 40 plays back the decrypted content.

In such a conventional content distribution / recording / reproducing system, the encrypted content recorded on a certain memory card cannot be reproduced even if copied to another memory card. Hereinafter, this will be described with reference to FIG.

Different media IDs (ID1, ID2) are stored in the respective media ID storage units (31A, 31B) of the two memory cards (30A, 30B).
The signed key information storage unit 34A and the encrypted content storage unit 35A of the memory card 30A store the signed key information (S (ID1 || KD) || KD) and the encrypted content (E (K1, C)) is stored. Here, S (ID1 || KD) indicates that the signature is applied to the concatenated value of the media ID (ID1) and the key information KD using the signature generation function S. As the signature generation function S, for example, a signature algorithm such as RSA or ECDSA can be used. Since RSA and ECDSA are publicly known, description thereof is omitted. Below, it demonstrates as what uses RSA. E (K1, C) indicates that the content C is encrypted by the encryption function E using the content key K1. As the encryption function E, for example, an encryption algorithm such as AES encryption can be used. Since AES is publicly known, description thereof is omitted. The content key K1 is generated based on the key information KD.

The signed key information storage unit 34B and the encrypted content storage unit 35B of the memory card 30B include the signed key information stored in the signed key information storage unit 34A and the encrypted content storage unit 14A of the memory card 30A ( A copy of S (ID1 || KD) || KD) and encrypted content E (K1, C) is stored.
At this time, the playback device 40B tries to play back the encrypted content Enc (K1, C) stored in the memory card 30B. In this case, the verification function V is used for the ID2 read from the media ID storage unit 31B of the memory card 30B, the signature data S (ID1 || KD) and the key information KD included in the signed key information,
V (S (ID1 || KD)) and (ID2 || KD)
Are matched (when RSA is used as a signature function). Here, since V (S (ID1 || KD)) = ID1 || KD, the above verification formulas do not match, so verification fails. Thus, even if the encrypted content normally recorded on a certain memory card is copied to another memory card, it cannot be reproduced.

  However, in such a conventional content distribution / recording / playback system, an unauthorized card maker creates a plurality of memory cards storing the same media ID, and the server authenticates one of the memory cards storing the same media ID. The encrypted content and the signed key information are obtained and recorded in the file, and then copied to another memory card having the same media ID, whereby the content can be illegally copied.

Hereinafter, this will be described with reference to FIG. Here, for simplicity, the case of two memory cards will be described.
It is assumed that the same media ID (that is, ID1) is stored in the media ID storage units (31A, 31B) of the two memory cards (30A, 30B) by an unauthorized card manufacturer.

In the signed key information storage unit 34A and the encrypted content storage unit 35A of the memory card 30A, signed key information (S (ID1, KD), KD) that is properly acquired from the server and recorded by the recording device Assume that encrypted content (E (K1, C)) is stored.
In the encrypted content storage unit 35B of the memory card 30B, signed key information (S (ID1 || KD) | stored in the signed key information storage unit 34A and the encrypted content storage unit 35A of the memory card 30A | KD) and a copy of the encrypted content (E (K1, C)) are stored.

At this time, let us consider a case where the playback device 40B is used to attempt playback of the encrypted content Enc (K1, C) stored in the memory card 30B. In this case, the verification function V is used for the ID1 read from the media ID storage unit 31B of the memory card 30B and the signed key information (S (ID1 || KD), || KD).
V (S (ID1 || KD)) and (ID1 || KD)
Are matched (when RSA is used as a signature function).

Here, since V (S (ID1 || KD)) = ID1 || KD, the above verification expressions match and the verification succeeds. Then, the encrypted content is decrypted using the content key generated from the key information KD, and the decrypted content is reproduced.
JP 05-257816 A

  In order to solve this problem, for example, a memory control LSI maker provides a memory control LSI (hereinafter referred to as a controller) of a memory card with a unique media ID for each memory card and authentication means based on the media ID. Whether the memory card is equipped with this controller, the card maker creates a memory card using this controller, and the access device authenticates with the authentication means of this controller. There is a technique for confirming whether or not content is recorded / reproduced on a memory card not equipped with this controller.

This prevents the card manufacturer from storing the same media ID in the memory card.

However, in the above-described conventional content distribution / recording / reproducing system, since the recording device authenticates the memory card and the recording device is authenticated by the server (indirect authentication), the recording device is analyzed and installed in the recording device. The modified recording device, for example, by altering the software program is false to the server as a memory card equipped with the above controller, even though it is a memory card not equipped with the above controller. There was a problem that it was possible.

  A simple system for solving this problem is shown in FIG. The system of FIG. 34 differs from the system of FIG. 31 in that the recording device 20 in FIG. 31 directly authenticates the memory card 30 with the authentication key generation unit 22 and the authentication unit 23, and the server 10 directly accesses the memory card 30. In order to authenticate, it moved to the authentication key production | generation part 22a and the authentication part 23a of the server apparatus 10 like FIG.

  However, in the system of FIG. 34, the authentication key generation unit 22a and authentication unit 23a of the server, the authentication key generation unit 42 of the playback device, and the authentication unit 43 have the same configuration, so the playback device 40 is analyzed and mounted on the playback device. The modified playback device is still a memory card equipped with the above-mentioned controller, even though the modified playback device is a memory card not equipped with the above-mentioned controller for the server. There was a problem that it was possible to deceive.

The present invention solves such a conventional problem. Even when the access device (recording device or reproducing device) is analyzed and secret information held or derived by the access device is leaked, the access device To provide a recording medium device and an authentication method for the recording medium device that can prevent a server from pretending to be a recording medium device of the present invention even if the installed software program is modified Objective.

  In order to solve the above-described conventional problems, a recording medium device according to the present invention includes a server device that distributes digital work information, and an area that receives and stores digital work information distributed from the server device. And a recording medium device used in a digital work protection system that includes an access device that reads information from or writes information to the region, wherein the server device includes a unique device key and each recording device The second media key is encrypted with the unique device key held by the media device, and the second media key is encrypted with the encrypted media key subgroup obtained by encrypting the second media key, and the unique device key held by each server device. A second encrypted media group including an encrypted media key sub-group, the access device holds a unique device key, and the recording medium device Is a unique device key, a unique media ID, and a unique device key held by each recording medium device. Each of the access devices is an encrypted media key subgroup obtained by encrypting the first media key. Holding a first encrypted media group including an encrypted media key sub-group obtained by encrypting the first media key with a unique device key to be held, and the recording medium device receives the second media from the server device. When receiving the digital work information distributed from the server device and storing the digital work information distributed from the server device in the area, the second encrypted media group is stored with the device key of the recording medium device. Decrypt and generate a second media key, generate a second media unique key using the media ID and the generated second media key, and use the generated second media unique key Mutual authentication is performed with the server device, and when the access device reads information from the region or writes information to the region, the access device decrypts the first encrypted media group with the device key of the recording medium device. A first media key is generated, a first media unique key is generated using the media ID and the generated first media key, and the access device is generated using the generated first media unique key. And an authentication means for performing mutual authentication.

  According to the recording medium device of the present invention, when the digital work information distributed from the server device is received and stored in the area of the recording medium device, the authentication key (second medium) used for authentication with the server device. A unique key) and an authentication key (first media unique key) used for authentication with the access device when the access device (recording device or playback device) reads information from or writes information to the region. Therefore, even if the access device is analyzed and the authentication key (first media unique key) used for authentication with the access device is leaked, the authentication key used for authentication with the server (the first key) The second media unique key) does not leak, so even if it attempts to impersonate the server with the recording medium device of the present invention, the authentication fails and the impersonation attack can be prevented. That.

  A recording medium device according to a first aspect of the present invention includes a server device for distributing digital literary work information, a recording medium device having an area for receiving and storing digital literary work information distributed from the server device, and the region. A recording medium device used in a digital copyright protection system that includes an access device that reads information from or writes information to the area, and the server device holds a unique device key and each recording medium device Encrypted media key sub-groups, each of which encrypts a second media key with a unique device key, and an encrypted media key, which encrypts the second media key with a unique device key held by each server device A second encrypted media group including a sub group, the access device holds a unique device key, and the recording medium device stores a unique device key. A unique media key, a unique device key held by each recording medium device, an encrypted media key sub-group in which the first media key is encrypted, and a unique device key held by each access device. A first encrypted media group including an encrypted media key subgroup obtained by encrypting the first media key with a device key, and the recording medium device receives the second encrypted media group from the server device. And receiving the digital work information distributed from the server device and storing it in the area, the second encrypted media group is decrypted with the device key of the recording medium device. A second media unique key using the generated media ID and the generated second media key, and the server device using the generated second media unique key. When mutual authentication is performed, and the access device reads information from the area or writes information to the area, the access device decrypts the first encrypted media group with the device key of the recording medium device, and obtains the first media key. Authentication, generating a first media unique key using the generated media ID and the generated first media key, and performing mutual authentication with the access device using the generated first media unique key Means are provided.

  A recording medium device according to a second aspect of the present invention includes a server device for distributing digital work information, a recording medium device having an area for receiving and storing digital work information distributed from the server device, and the area. Is a recording medium device used in a digital copyright protection system that includes an access device that reads information from or writes information to the area, and the server device holds a unique device key. A unique device key, and the recording medium device encrypts the first media key with a unique device key, a unique media ID, and a unique device key held by each access device. An encrypted media key sub-group in which the second media key is encrypted with a sub-group and a unique device key held by each recording medium device , An encrypted media key sub-group in which the third media key is encrypted with a unique device key held by each server device, and a first encryption auxiliary in which the first auxiliary key is encrypted with the first media key A first encrypted auxiliary key obtained by encrypting the first auxiliary key with the second media key, and a second encrypted auxiliary key obtained by encrypting the second auxiliary key with the second media key. , Holding the encrypted media group including the second encryption auxiliary key obtained by encrypting the second auxiliary key with the third media key, and the recording medium device is digital work information distributed from the server device Is received and stored in the area, the encrypted media group is decrypted with the device key of the recording medium device to generate the second media key, and the generated second media key is used to generate the second media key. Decrypt the encrypted auxiliary key to generate a second auxiliary key, and A second media unique key is generated using the ID and the generated second auxiliary key, and mutual authentication is performed with the server device using the generated second media unique key. When reading information from or writing information to the area, the encrypted media group is decrypted with the device key of the recording medium device to generate a second media key, and the generated second media key is used. , Decrypting the first encryption auxiliary key to generate a first auxiliary key, generating a first media unique key using the media ID and the generated first auxiliary key, and generating the generated first An authentication unit that performs mutual authentication with an access device using a single media unique key is provided.

According to this configuration, since it can be configured using a single encrypted media key group, there is an effect that the memory size for holding the encrypted media key group in the recording medium device is reduced.
Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
<Overall configuration>
FIG. 1 is a diagram showing an overall configuration of a content distribution / recording / playback system according to Embodiment 1 of the present invention. The content distribution / recording / playback system includes a server device 100, a recording device 200, a recording medium device 300, and a playback device 400. Hereinafter, a case where the recording medium device 300 is a memory card will be described.

<Detailed configuration of server device>
FIG. 2 shows a detailed configuration of the server apparatus 100.

  As shown in FIG. 2, the server device includes a key information storage unit 111, a content key storage unit 112, a content storage unit 113, a server private key storage unit 114, a signed key information generation unit 115, a content key encryption unit 116, Content encryption unit 117, encrypted media key group storage unit 121, media ID acquisition unit 122, device key storage unit 123, media key generation unit 124, media unique key generation unit 125, authentication unit 126, content request reception unit 131, The encrypted media key group transmission unit 132, the media ID reception unit 133, the signed key information transmission unit 134, the encrypted content key transmission unit 135, and the encrypted content transmission unit 136 are configured.

The key information storage unit 111 stores key information (KD) for decrypting the encrypted content key. Here, the key information (KD) is, for example, a 128-bit random numerical value. However, it is not limited to this.
The content key storage unit 112 stores a content key (Kc) for encrypting the content or decrypting the encrypted content. Here, the content key (Kc) is a 128-bit random numerical value and is unique for each content. Here, the content key (Kc) is unique for each content, but is not limited to this configuration. “Content key is unique for each content” means that a different content key is assigned to each content. However, when random numerical values are used as in the present embodiment, there is a possibility that content keys assigned to a plurality of contents coincide by chance. Therefore, in this specification, the term “unique” is used including such a case. The same applies to the case where the word “unique” is used for information other than the content key. For example, if all the issued content keys are recorded and the unissued value is a new content key, a different content key can be assigned to each content. The same applies to information described below using the term “unique”.

The content storage unit 113 stores content that is a digital work.
The server secret key storage unit 114 stores the signing key Sk, which is secret information known only by the server, in a concealed form from the outside. The signature key Sk is, for example, a secret key for an RSA signature function or a secret key for an ECDSA elliptic signature function.
The signed key information generation unit 115 generates the signature data S from the following formula using the signature key Sk for at least the key information (KD) and the media ID (MID),
Signature data S = S (Sk, KD || MID)
Signed key information (KD || S) composed of key information and the generated signature data is generated. An example of signed key information is shown in FIG.

In the following, unless otherwise specified, an expression such as X (A, B) means that information B is converted by the function X using A as a key. Here, for the signature function S (), for example, an RSA signature function or an ECDSA elliptic signature function can be used. Since the RSA signature function and the ECDSA elliptic signature function are known, the description thereof will be omitted.
The content key encryption unit 116 encrypts the content key (Kc) by the following formula using the key K generated from the key information (KD).

E (K, Kc)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted.
The key K is generated by the following formula, for example.
K = F (KD)
Here, the function F () is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Here, (+) represents an exclusive OR operation. Note that the function F () is not limited to this configuration.

The content encryption unit 117 encrypts the content (C) using the content key Kc by the following formula.
E (Kc, C)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted. In addition, although it was set as the AES encryption function here, it is not limited to an AES encryption function.

The encrypted media key group storage unit 121 stores a second encrypted media key group.
An example of the second encrypted media key group is shown in FIG. As shown in FIG. 13, the second encrypted media key group includes the following three types of information.
First encrypted media key subgroup (E (DK_hi, 0) (i = 1, 2,..., N1):
For an access device (recording device or playback device), an access device (recording device) whose device ID for identifying the access device (recording device or playback device) is hi (i = 1, 2,..., N1). Or information obtained by encrypting 0 with each device key DK_hi (i = 1, 2,..., N1) (128 bits).

Second encrypted media key subgroup (E (DK_ci, Km2) (i = 1, 2,..., N2))
For the memory card, each device key DK_ci (i = 1, 2,..., N2) of the memory card whose media ID for identifying the memory card is ci (i = 1, 2,..., N2). ) (128 bits), information obtained by encrypting the second media key Km2 (128 bits).

Third encrypted media key subgroup (E (DK_si, Km2) (i = 1, 2,..., N3))
For the server, each device key DK_si (i = 1, 2,..., N3) of the server whose server ID for identifying the server is si (i = 1, 2,..., N3) (128) Bit), information obtained by encrypting the second media key Km2 (128 bits).

Here, E () is, for example, an AES encryption function. Although the AES encryption function is used here, other encryption functions may be used.
If the device key of the server or the memory card leaks, the second encrypted media key group can be used to invalidate the server or memory card having the leaked device key.

  For example, if the device key DK_c1 of the memory card with the memory card ID = c1 is found to be leaked, a new second media key Km2_new is generated and a new second encryption is performed using the new second media key Km2_new. Generate media keys. However, the encrypted media key corresponding to ID = c1 of the new encrypted media key group is E (DK_c1, 0) obtained by encrypting 0 with the device key DK_c1.

Thus, since the device key DK_c1 cannot generate a new Km2_new, the memory card having the device key DK_c1 is invalidated.
The media ID acquisition unit 122 acquires the media ID and the content ID from the recording device when the authentication of the memory card 300 by the authentication unit 126 is successful.
The device key storage unit 123 stores the server device key in an area concealed from the outside. The device key of the server is a unique key for each server. Here, the device key of the server is different from the device key of another server, the device key of each recording device, the device key of each memory card, and the device key of each playback device. The server device key is given by, for example, an organization that licenses the manufacture of the memory card according to the first embodiment.

The media key generation unit 124 uses the AES decryption function to decrypt the second encrypted media key group with the device key acquired from the device key storage unit 123 by the following formula, thereby obtaining the second media key. Generate.
Second media key = AES_D (device key, second encrypted media key group)
In the example of FIG. 13, for example, the server s1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_s1, Km2) using the device key DK_s1.

The media unique key generation unit 125 uses the one-way function G, the second media key generated by the media key generation unit 124 and the media ID acquired from the media ID acquisition unit 122 according to the following formula: Generate a media unique key.
Media unique key (Ksc) = G (second media key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.

Media unique key = AES_D (second media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.
The authentication unit 126 performs mutual authentication with the authentication unit 314 of the memory card. The detailed configuration of mutual authentication will be described later.

The content request receiving unit 131 receives content request information from the recording device. It is assumed that the content request information includes at least a content ID that is identification information of the content that the recording device wants to record on the memory card.
The encrypted media key group transmission unit 132 acquires the second encrypted media key group from the encrypted media key group storage unit 121 and transmits it to the recording device.

The media ID receiving unit 133 receives a media ID from the recording device 200.
The signed key information transmission unit 134 acquires the signed key information from the signed key information signature generation unit 115 and transmits it to the recording apparatus 200.
The encrypted content key transmission unit 135 transmits the encrypted content key received from the content key encryption unit 116 to the recording device 200.

The encrypted content transmission unit 136 transmits the encrypted content received from the content encryption unit 117 to the recording device 200.

<Detailed configuration of recording apparatus>
FIG. 3 shows a detailed configuration of the recording apparatus. The recording device 200 includes a device key storage unit 211, a media key generation unit 212, a media unique key generation unit 213, an authentication unit 214, a command transmission unit 221, an encrypted media key group transmission unit 222, and an encrypted media key group reading unit 223. , Media ID reading unit 224, signed key information writing unit 225, encrypted content key writing unit 226, encrypted content writing unit 227, content request transmission unit 231, encrypted media key group reception unit 232, media ID The transmission unit 233 includes a signed key information reception unit 234, an encrypted content key reception unit 235, and an encrypted content reception unit 236.

  The device key storage unit 211 stores the device key of the recording apparatus in an area concealed from the outside. The device key of the recording apparatus is a unique key for each recording apparatus. Here, the device key of the recording device is different from the device key of each server, the device key of another recording device, the device key of each memory card, and the device key of each playback device. The device key of the recording apparatus is given by, for example, an organization that licenses the manufacture of the memory card according to the first embodiment.

The media key generation unit 212 uses the AES decryption function to decrypt the first encrypted media key group read from the memory card with the device key acquired from the device key storage unit 211 according to the following formula. A single media key is generated.
First media key = AES_D (device key, first encrypted media key group)

An example of the first encrypted media key group is shown in FIG. As shown in FIG. 12, the first encrypted media key group includes the following three types of information.

First encrypted media key subgroup (E (DK_hi, Km1) (i = 1, 2,..., N1))
For an access device (recording device or playback device), an access device (recording device) whose device ID for identifying the access device (recording device or playback device) is hi (i = 1, 2,..., N1). Or information obtained by encrypting the first media key Km1 (128 bits) with each device key DK_hi (i = 1, 2,..., N1) (128 bits).

Second encrypted media key subgroup (E (DK_ci, Km1) (i = 1, 2,..., N2))
For the memory card, each device key DK_ci (i = 1, 2,..., N2) of the memory card whose media ID for identifying the memory card is ci (i = 1, 2,..., N2). ) (128 bits), information obtained by encrypting the first media key Km1 (128 bits).

Third encrypted media key subgroup (E (DK_si, 0) (i = 1, 2,..., N3))
For the server, each device key DK_si (i = 1, 2,..., N3) of the server whose server ID for identifying the server is si (i = 1, 2,..., N3) (128) (Bit), information obtained by encrypting 0.

Here, E () is, for example, an AES encryption function. Although the AES encryption function is used here, other encryption functions may be used.
If the device key of the memory card, recording device, or playback device leaks, the first encrypted media key group invalidates the memory card, recording device, or playback device having the leaked device key. Can be used.

  For example, if it is found that the device key DK_h1 of the recording apparatus with the device ID = h1 has leaked, a new first media key Km1_new is generated, and the above-described first encrypted media key group is generated using these. However, the encrypted media key corresponding to ID = h1 of the encrypted media key group is E (DK_h1, 0) obtained by encrypting 0 with the device key DK_h1.

Thus, since the device key DK_h1 cannot generate a new Km1_new, the device having the device key DK_h1 is invalidated.
The media unique key generation unit 213 uses the one-way function G, the first media key generated by the media key generation unit 212 and the media ID acquired from the media ID reading unit 224, according to the following formula: Generate a media unique key.

Media unique key (Khc) = G (first media key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (first media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.
The authentication unit 214 performs mutual authentication with the authentication unit 314 of the memory card. The configuration of mutual authentication will be described later.

  The command transmission unit 221 transmits a command to the memory card. The command to be transmitted includes a command for reading the media ID, a command for reading the first encrypted media key group, a command for transmitting the second encrypted media key group, a command for writing signed key information, a signature, These are commands for reading attached key information, commands for writing encrypted content keys, commands for reading encrypted content keys, commands for writing encrypted content, commands for reading encrypted content, and the like.

The encrypted media key group transmission unit 222 transmits the second encrypted media key group received from the server to the memory card.
The encrypted media key group reading unit 223 reads the first encrypted media key group from the memory card.
The media ID reading unit 224 reads the media ID from the memory card.
The signed key information writing unit 225 writes the signed key information received from the server to the memory card.

The encrypted content key writing unit 226 writes the encrypted content key received from the server to the memory card.
The encrypted content writing unit 227 writes the encrypted content received from the server to the memory card.
The content request transmission unit 231 transmits content request information to the server. The content request information includes at least a content ID that is content identification information that the recording device 200 wants to record on the memory card 300.

The encrypted media key group receiving unit 232 receives the second encrypted media key group from the server.
The media ID transmission unit 233 transmits the media ID read from the memory card to the server.
The signed key information receiving unit 234 receives signed key information from the server.

The encrypted content key receiving unit 235 receives the encrypted content key from the server.
The encrypted content receiving unit 236 receives encrypted content from the server.

<Detailed configuration of memory card>
FIG. 4 shows a detailed configuration of the memory card. As illustrated in FIG. 4, the memory card 300 includes a device key storage unit 311, a media key generation unit 312, a media unique key generation unit 313, an authentication unit 314, a signed key information storage unit 315, and an encrypted content key storage unit 316. , Encrypted content storage unit 317, control unit 318, encrypted media key group selection unit 319, media ID storage unit 320, encrypted media key group storage unit 321, encrypted media key group storage unit 322, command reception unit 331, It consists of an encrypted media key group receiving unit 332, an encrypted media key group transmitting unit 333, a media ID transmitting unit 334, a signed key information transmitting / receiving unit 335, an encrypted content key transmitting / receiving unit 336, and an encrypted content transmitting / receiving unit 337. .

  The device key storage unit 311 stores the device key of the memory card in an area concealed from the outside. The device key of the memory card is a unique key for each memory card. Here, the device key of the memory card is different from the device key of each server, the device key of each recording device, the device key of another memory card, and the device key of each playback device. The device key of the memory card is given by, for example, an organization that licenses the manufacture of the memory card according to the first embodiment.

The media key generation unit 312 decrypts the encrypted media key group selected from the first or second encrypted media key group by the encrypted media key group selection unit 319 with the device key acquired from the device key storage unit 311. Thus, the first or second media key is generated.
First media key = AES_D (device key, first encrypted media key group)
Second media key = AES_D (device key, second encrypted media key group)
In the example of FIG. 12, for example, the memory card (c1) generates the first media key Km1 by decrypting E (DK_c1, Km1) of the first encrypted media key group using the device key DK_c1. To do.

In the example of FIG. 13, for example, the memory card (c1) generates the second media key Km2 by decrypting E (DK_c1, Km2) of the second encrypted media key group using the device key DK_c1. To do.
The media unique key generation unit 313 uses the one-way function G, the first or second media key generated by the media key generation unit 312 and the media ID acquired from the media ID storage unit 320 to A media unique key is generated by the following formula.

Media unique key (Khc) = G (first media key, media ID)
Media unique key (Ksc) = G (second media key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key (Khc) = AES_D (first media key, media ID) (+) media ID
Media unique key (Ksc) = AES_D (second media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

The authentication unit 314 performs mutual authentication with the server authentication unit 126, the recording device authentication unit 214, or the playback device authentication unit 414. The configuration of mutual authentication will be described later.
The signed key information storage unit 314 stores signed key information written from the recording apparatus 200.
The encrypted content key storage unit 316 stores the encrypted content key written from the recording device 200.

The encrypted content storage unit 317 stores the encrypted content written from the recording device 200.
When the command received from the recording apparatus is a command for transmitting the second encrypted media key group, the control unit 318 controls the encrypted media key group selection unit 319 to select the second encrypted media key group. If the command received from the recording device is a command for reading the first encrypted media key group, the encrypted media key group selection unit 319 is controlled to select the first encrypted media key group.

The encrypted media key group selection unit 319 selects the first encrypted media key group or the second encrypted media key group based on the control of the control unit 318.
The media ID storage unit 320 stores the media ID. The encrypted media key group storage unit 321 stores the second encrypted media key group received from the recording device.

The encrypted media key group storage unit 322 stores the first encrypted media key group. For example, it is assumed that the first media key group is stored in advance when the memory card is manufactured.
The command receiving unit 331 receives a command from the recording device or the playback device. The received command includes a command for reading the media ID, a command for reading the first encrypted media key group, a command for transmitting the second encrypted media key group, a command for writing signed key information, A command for reading key information, a command for writing an encrypted content key, a command for reading an encrypted content key, a command for writing encrypted content, a command for reading encrypted content, and the like.

The encrypted media key group receiving unit 332 receives the second encrypted media key group from the recording device.
The encrypted media key group transmission unit 333 transmits the first encrypted media key group to the recording device or the playback device.
The media ID transmission unit 334 transmits the media ID to the recording device or the playback device.

The signed key information transmission / reception unit 335 receives the signed key information from the recording device or transmits the signed key information to the playback device.
The encrypted content key transmission / reception unit 336 receives the encrypted content key from the recording device or transmits the encrypted content key to the playback device.
The encrypted content transmission / reception unit 337 receives the encrypted content from the recording device or transmits the encrypted content to the playback device.

<Detailed configuration of playback device>
FIG. 5 shows a detailed configuration of the recording apparatus. The playback device 400 includes a device key storage unit 411, a media key generation unit 412, a media unique key generation unit 413, an authentication unit 414, a media ID acquisition unit 415, an encrypted content key decryption unit 416, an encrypted content decryption unit 417, and a server. Public key storage unit 418, signed key information verification unit 419, decryption key generation unit 420, playback unit 421, command transmission unit 431, encrypted media key group reading unit 433, media ID reading unit 434, signed key information reading unit 435, an encrypted content key reading unit 436, and an encrypted content reading unit 437.

  The device key storage unit 411 stores the device key of the playback device in an area concealed from the outside. The device key of the playback device is a unique key for each playback device. Here, the device key of the playback device is different from the device key of each server, the device key of each recording device, the device key of each memory card, and the device keys of other playback devices. The device key of the playback apparatus is given by, for example, an organization that licenses the manufacture of the memory card according to the first embodiment.

The media key generation unit 412 uses the AES decryption function to decrypt the first encrypted media key group read from the memory card with the device key acquired from the device key storage unit 411 according to the following formula. A single media key is generated.
First media key = AES_D (device key, first encrypted media key group)
An example of the first encrypted media key group is shown in FIG.
In the example of FIG. 12, for example, the playback device (h2) generates the first media key Km1 by decrypting E (DK_h2, Km1) of the first encrypted media key group using the device key DK_h2. To do.

The media unique key generation unit 413 uses the one-way function G, the media key generated by the media key generation unit 212 and the media ID acquired from the media ID reading unit 224, and the media unique key by the following formula: Is generated.
Media unique key (Khc) = G (first media key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.

Media unique key = AES_D (media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.
The authentication unit 414 performs mutual authentication with the authentication unit 314 of the memory card. The configuration of mutual authentication will be described later.
The media ID acquisition unit 415 acquires a media ID when the authentication of the memory card 300 by the authentication unit 414 is successful.

The encrypted content key decryption unit 416 decrypts the key K generated by the decryption key generation unit 420 using the following equation.
Kc = D (K, E (K, Kc))
Here, D () is, for example, an AES decoding function. Since AES is publicly known, description thereof is omitted.

The encrypted content decryption unit 417 decrypts the encrypted content E (Kc, C) with the following expression using the content key Kc decrypted by the encrypted content key decryption unit 416.
C = D (Kc, E (Kc, C))
The server public key storage unit 418 stores a verification key Pk corresponding to a signature key Sk that is secret information known only by the server.

The signed key information verification unit 419 uses the verification key Pk acquired from the server public key storage 418, the media ID (MID) read from the memory card, and the signed key information (KD || S) as follows. Verify whether the expression is true.
V (Pk, S) = KD || MID
Here, as described above, the signature data S is obtained by signing the key information KD and the media ID (concatenated value of MID with the signature key Sk, and represented by S = S (Sk, KD || MID). The function V is a signature verification function corresponding to the function S and performs signature verification using the verification key Pk, for example, the function V is an RSA signature verification function, where V is RSA. Although the case where the signature verification function is used has been shown, the ECDSA elliptic signature verification function may be used instead of the RSA signature verification function, in which case V (Pk, S, KD || MID) = 0. The RSA signature verification function and the ECDSA elliptic signature verification function are well known and will not be described.

When the signature verification is successful in the signed key information verification unit 419, the decryption key generation unit 420 generates a key K from the key information KD by the following expression.
K = F (KD)
Here, F is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Note that F is not limited to this configuration.

The playback unit 421 decrypts the content decrypted by the encrypted content decryption unit 417.
The command transmission unit 431 transmits a command to the memory card. The command to be transmitted includes a command for reading the media ID, a command for reading the first encrypted media key group, a command for reading the signed key information, a command for reading the encrypted content key, and a command for reading the encrypted content. Etc. are included.

The encrypted media key group reading unit 433 reads the encrypted media key group from the memory card 300.
The media ID reading unit 434 reads the media ID from the memory card 300.
The signed key information reading unit 435 reads signed key information from the memory card 300.
The encrypted content key reading unit 436 reads the encrypted content key from the memory card 300.

The encrypted content reading unit 437 reads the encrypted content from the memory card 300.

<Detailed configuration of authentication unit between server / memory card>
FIG. 14 shows the detailed configuration of the authentication unit between the server / memory card.

As illustrated in FIG. 14, the authentication unit 126 of the server 100 further includes an encryption unit 141, a random number generation unit 142, a decryption unit 143, and a random number comparison unit 144.
The encryption unit 141 encrypts the random number R1 (128 bits) received from the memory card using the unique key (Ksc) (128 bits) received from the media unique key generation unit 125 according to the following formula:
E (Ksc, R1)
Send to memory card.

The random number generation unit 142 generates a random number R2 (128 bits) and transmits it to the memory card.
The decryption unit 143 decrypts the encrypted random number (E (Ksc, R2)) received from the memory card using the unique key (Ksc) received from the media unique key generation unit 125 according to the following expression.
D (Ksc, E (Ksc, R2))
The random number comparison unit 144 confirms whether the random number (R2) generated by the random number generation unit 142 matches the result decrypted by the decryption unit 143, and authenticates that the other party is a regular memory card.

Here, E () can use an AES encryption function, and D () can use an AES decryption function.

As shown in FIG. 14, the authentication unit 314 of the memory card further includes a random number generation unit 341, a decryption unit 342, a random number comparison unit 343, and an encryption unit 344.
The random number generation unit 341 generates a random number R1 (128 bits) and transmits it to the server.

The decryption unit 342 decrypts the encrypted random number (E (Ksc, R1)) received from the server using the unique key (Ksc) received from the media unique key generation unit 313 according to the following expression.
D (Ksc, E (Ksc, R1))
The random number comparison unit 343 confirms whether the random number (R1) generated by the random number generation unit 341 matches the result of decryption by the decryption unit 342, and authenticates that the other party is a legitimate server.

The encryption unit 344 encrypts the random number R2 (128 bits) received from the server using the following expression using the unique key (Ksc) (128 bits) received from the media unique key generation unit 313,
E (Ksc, R2)
Send to server.

Here, E () can use an AES encryption function, and D () can use an AES decryption function.

<Detailed Configuration of Authentication Unit Between Recording Device / Memory Card>
FIG. 15 shows a detailed configuration of the authentication unit between the recording device and the memory card.
As shown in FIG. 15, the authentication unit 214 of the recording apparatus further includes an encryption unit 241, a random number generation unit 242, a decryption unit 243, and a random number comparison unit 244.

The encryption unit 241 encrypts the random number R1 (128 bits) received from the memory card using the following expression using the unique key (Khc) (128 bits) received from the media unique key generation unit 213:
E (Khc, R1)
Send to memory card.

The random number generation unit 142 generates a random number R2 (128 bits) and transmits it to the memory card.
The decryption unit 143 decrypts the encrypted random number (E (Khc, R2)) received from the memory card using the unique key (Khc) received from the media unique key generation unit 125 according to the following equation.
D (Khc, E (Khc, R2))
The random number comparison unit 144 confirms whether the random number (R2) generated by the random number generation unit 142 matches the result decrypted by the decryption unit 143, and authenticates that the other party is a regular memory card.

Here, E () can use an AES encryption function, and D () can use an AES decryption function.

As shown in FIG. 15, the authentication unit 314 of the memory card further includes a random number generation unit 341, a decryption unit 342, a random number comparison unit 343, and an encryption unit 344.
The random number generation unit 341 generates a random number R1 (128 bits) and transmits it to the recording device.
The decryption unit 342 decrypts the encrypted random number (E (Khc, R1)) received from the recording apparatus using the unique key (Khc) received from the media unique key generation unit 313 by the following formula.

D (Ksc, E (Ksc, R1))
The random number comparison unit 343 confirms whether the random number (R1) generated by the random number generation unit 341 matches the result decrypted by the decryption unit 342, and authenticates that the other party is a legitimate recording device.
The encryption unit 344 encrypts the random number R2 (128 bits) received from the recording apparatus using the unique key (Ksc) (128 bits) received from the media unique key generation unit 313 by the following formula:
E (Ksc, R2)
Send to recording device.

Here, E () can use an AES encryption function, and D () can use an AES decryption function.

<Detailed configuration of authentication unit between playback device / memory card>
FIG. 16 shows a detailed configuration of the authentication unit between the playback device and the memory card.
As shown in FIG. 16, the authentication unit 414 of the playback apparatus further includes an encryption unit 441, a random number generation unit 442, a decryption unit 443, and a random number comparison unit 444.

The encryption unit 441, random number generation unit 442, decryption unit 443, and random number comparison unit 444 of the playback device have the same configuration as the encryption unit 241, random number generation unit 242, decryption unit 243, and random number comparison unit 244 of the recording device. Therefore, explanation is omitted.

<Operation of Content Distribution / Recording / Playback System>
The operation when the recording apparatus 200 receives content (signed key information, encrypted content key, encrypted content) from the server 100 and records it on the memory card 100 will be described in the following order. (1) At server / card authentication (2) Operation at the time of content reception from the server to the recording device (3) Operation at the time of content recording from the recording device to the memory card (4) Operation at the time of content reproduction from the memory card or the reproduction device

(1) Operation during Server / Card Authentication FIG. 6 is an example of an operation flow for authentication between the server / memory card.

As shown in FIG. 6, first, the content request transmission unit 231 of the recording apparatus 200 sends content request information to the server 100 and requests the server to distribute the content (S101). Then, the content request receiving unit 131 of the server receives the content request information from the recording device 200 (S102).
Here, the content request information includes at least a content ID that is identification information of the content recorded and reproduced on the memory card. In addition, the server distributes content corresponding to the content ID (actually, encrypted content, encrypted content key, signed key information).

Next, the encrypted media key group transmission unit 132 of the server 100 transmits the second encrypted media key group to the recording device 200 (S103), and the encrypted media key group reception unit 232 of the recording device
The second encrypted media key group is received from the server (S104).
Next, the command transmission unit 221 of the recording device 200 sends a command for transmitting the second encrypted media key group to the memory card 300, and the encrypted media key group transmission unit 222 of the recording device 200 The encrypted media key group is transmitted to the memory card (S105). Then, the encrypted media key group receiving unit 332 of the memory card 300 receives the second encrypted media key group from the recording device 200 (S106).

  Next, when the command received from the recording device 200 is a command for transmitting the second encrypted media key group, the memory card control unit 318 sends the encrypted media key group selection unit 319 to the second encrypted media key group selection unit 319. Control is performed to select an encrypted media key group (S107). As will be described later, when the command received from the recording apparatus 200 is a command for reading the first encrypted media key group, the control unit 318 of the memory card sends the encrypted media key group selection unit 319 to the first Control to select one encryption media key group.

  Here, depending on whether the received command is a read command for the first encrypted media key group or a transmission command for the second encrypted media key group, the control unit 318 determines whether the first encrypted media key group is the first encrypted media key group. Although the configuration for controlling the encrypted media key group selection unit 319 to select the key group and select the second encrypted media key group in the latter case has been described, the present invention is not limited to this configuration. For example, in the case of the former, the control unit 318 selects the first encrypted media key group in response to the command requesting authentication with the recording device or the playback device or the command requesting authentication with the server, and the latter In this case, the encryption media key group selection unit 319 may be controlled to select the second encryption media key group. A configuration not based on the command is also possible. For example, when the encrypted media key group receiving unit 332 of the memory card receives the second encrypted media key group, the control unit 318 sends the encrypted media key group selecting unit 319 to the encrypted media key group selecting unit 319. If the second encrypted media key group is selected and not received, the first encrypted media key group may be controlled to be selected.

Next, the media key generation unit 312 of the memory card uses the AES decryption function to decrypt the second encrypted media key group with the device key of the memory card according to the following formula, whereby the second media A key is generated (S108).
Second media key = AES_D (device key, second encrypted media key group)
In the example of FIG. 13, for example, the memory card c1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_c1, Km2) using the device key DK_c1.

Next, the media key generation unit 124 of the server uses the AES decryption function to generate the second media key by decrypting the second encrypted media key group with the server device key according to the following formula: (S109).
Second media key = AES_D (device key, second encrypted media key group)
In the example of FIG. 13, for example, the server s1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_s1, Km2) using the device key DK_s1.

  Next, the command transmission unit 221 of the recording device 200 transmits a command for reading the media ID to the memory card (S110), and the media ID transmission unit 334 of the memory card 300 responds to this command by the media ID storage unit 320. The media ID is acquired from the data and transmitted to the recording device 200 (S111), and the media ID reading unit 224 of the recording device receives the media ID from the memory card.

Next, the media ID transmission unit 233 of the recording device 200 transmits the media ID read from the memory card to the server (S112), and the media ID reception unit 133 of the server receives the media ID from the recording device (S112). S113).
Next, the media unique key generation unit 125 of the server uses the second media key generated by the media key generation unit 124 and the media ID acquired from the media ID acquisition unit 122 using the one-way function G. Then, a second media unique key is generated by the following formula (S114).

Second media unique key (Ksc) = G (second media key (Km2), media ID)
Next, the media unique key generation unit 313 of the memory card similarly uses the one-way function G from the second media key (Km2) generated by the media key generation unit 312 and the media ID storage unit 320. Using the acquired media ID, a second media unique key (Ksc) is generated by the following formula (S115).

Second media unique key (Ksc) = G (second media key (Km2), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

  Next, the authentication unit 126 of the server 100 requests the recording device to transmit a command for authenticating with the server to the memory card. The command transmission unit 221 of the recording device 200 that has received the command sends a command for authentication with the server to the memory card 300, and the authentication unit 126 of the server 100 and the authentication unit 314 of the memory card 300 perform mutual authentication (S116). ).

Here, the detailed procedure of mutual authentication is as follows, for example.
(A) The random number generation unit 341 of the authentication unit 314 of the memory card 300 generates a random number R1 and transmits it to the authentication unit 126 of the server 100. (b) The encryption unit 141 of the authentication unit 126 of the server receives the random number R1. Encrypted with the second media unique key Ksc (E (Ksc, R1) and sent to the authentication unit 314 of the memory card. (C) The decryption unit 342 of the authentication unit 314 of the memory card received with the second media unique key Ksc. E (Ksc, R1) decoded (D (Ksc, (E (Ksc, R1))) (= R1)
(D) The random number comparison unit 343 of the authentication unit of the memory card authenticates that the other party is a legitimate server because the result of decryption in (3) matches the random number generated in (1). ) The random number generation unit 142 of the server authentication unit 126 generates a random number R2 and transmits it to the authentication unit 314 of the memory card 300. (f) The encryption unit 344 of the authentication unit 314 of the memory card 300 outputs the second random number R2. (E (Ksc, R2) and sent to the server authentication unit 126) (g) The decryption unit 143 of the server authentication unit 126 receives the E () received with the second media unique key Ksc. Ksc, R2) is decoded (D (Ksc, (E (Ksc, R2))) (= R2)
(H) The server authenticates that the other party is a regular memory card by matching the result of decryption in (7) of the random number comparison unit 144 of the server authentication unit with the random number generated in (5). The mutual authentication procedure is an example, and other mutual authentication methods may be used.

(2) Operation at the time of content reception from server to recording device FIG. 7 is an example of an operation flow at the time of content reception from the server to the recording device.
As shown in FIG. 7, when the authentication in S116 is successful, the media ID acquisition unit 122 of the server acquires that the media ID received in S113 is a valid media ID (S117).

Next, the signed key information generation unit 115 of the server generates signature data S from the following equation using the signature key Sk for at least the key information (KD) and the media ID (MID).
Signature data S = S (Sk, KD || MID)
Then, the signed key information generating unit 115 of the server generates signed key information (KD || S) including the key information and the generated signature data (S118). An example of signed key information is shown in FIG.

Here, for the signature function S (), for example, an RSA signature function or an ECDSA elliptic signature function can be used. Since the RSA signature function and the ECDSA elliptic signature function are known, the description thereof will be omitted.
Next, the signed key information transmitting unit 134 of the server transmits the signed key information to the recording device (S119), and the signed key information receiving unit 234 of the recording device receives the signed key information (S120).

Next, the content key encryption unit 116 of the server encrypts the content key (Kc) (128 bits) with the key K generated from the key information (KD) (128 bits) according to the following formula (S121).

E (K, Kc)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted. Further, the key K is generated by the following expression, for example.
K = F (KD)
Here, F is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Note that F is not limited to this configuration.

Next, the encrypted content key transmission unit 135 transmits the encrypted content key to the recording device (S122), and the encrypted content key reception unit 235 of the recording device receives the encrypted content key from the server (S123). .
Next, the content encryption unit 117 of the server encrypts the content (C) with the content key Kc by the following formula (S124).

E (Kc, C)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted.
Next, the encrypted content transmission unit 136 of the server transmits the encrypted content to the recording device (S125), and the encrypted content reception unit 236 of the recording device receives the encrypted content from the server (S126).

(3) Operation when Recording Content from Recording Device to Memory Card FIG. 8 is an example of an operation flow when recording content from the recording device to the memory card.
As shown in FIG. 8, the command transmission unit 221 of the recording device 200 sends a command for reading the first encrypted media key group to the memory card 300 (S127). In response to this command, the encrypted media key group transmission unit 333 of the memory card 300 transmits the first encrypted media key group stored in the encrypted media key group storage unit 332 to the recording device 200 (S128). ). Then, the encrypted media key group reading unit 223 of the recording device receives the first encrypted media key group from the memory card.

  Next, when the command received from the recording device is a command for reading the first encrypted media key group, the control unit 318 of the memory card sets the encrypted media key group selecting unit to the first encrypted media key group. Is selected (S139). As described above, when the received command is a command for transmitting the second encrypted media key group, the control unit 318 of the memory card sends the second encrypted media key to the encrypted media key group selecting unit. Control to select a group.

Next, the media key generation unit 312 of the memory card uses the AES decryption function to decrypt the first encrypted media key group with the device key of the memory card according to the following formula, whereby the first media A key is generated (S130).
First media key = AES_D (device key, first encrypted media key group)
In the example of FIG. 12, for example, the memory card c1 generates the first media key Km1 by decrypting E (DK_c1, Km1) of the first encrypted media key group using the device key DK_c1.

Next, the media key generation unit 212 of the recording device uses the AES decryption function to decrypt the first encrypted media key group using the device key of the recording device according to the following formula, thereby obtaining the first media key: Is generated (S131).
First media key = AES_D (device key, first encrypted media key group)
In the example of FIG. 12, for example, the recording device h1 generates the first media key Km1 by decrypting the encrypted media key group E (DK_h1, Km1) using the device key DK_h1.

  Next, the command transmission unit 221 of the recording device 200 transmits a command for reading the media ID to the memory card 300 (S132), and the media ID transmission unit 334 of the memory card 300 receives the media ID from the media ID storage unit 320. It is acquired and transmitted to the media ID reading unit 224 of the recording device 200 (S133).

  Next, the media unique key generation unit 213 of the recording apparatus uses the one-way function G to obtain the first media key (Km1) generated by the media key generation unit 212 and the media acquired from the media ID reading unit 224. Using the ID, a first media unique key is generated by the following formula (S134).

First media unique key (Khc) = G (first media key (Km1), media ID)
Next, the media unique key generation unit 313 of the memory card similarly uses the one-way function G to generate the first media key generated by the media key generation unit 312 and the media acquired from the media ID storage unit 320. Using the ID, a first media unique key is generated by the following formula (S135).

First media unique key (Khc) = G (first media key (Km1), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Next, the command transmission unit 221 of the recording device 200 sends a command for authentication to the memory card 300, and the authentication unit 214 of the recording device performs mutual authentication with the authentication unit 314 of the memory card 300 (S136).
Here, the detailed procedure of mutual authentication is as follows, for example.

(A) The random number generation unit 341 of the authentication unit 314 of the memory card 300 generates the random number R1 and transmits it to the authentication unit 214 of the recording device. (B) The encryption unit 241 of the authentication unit 214 of the recording device generates the random number R1. Encrypted with the first media unique key Khc (E (Khc, R1) and sent to the authentication unit 314 of the memory card. (C) The decryption unit 342 of the authentication unit 314 of the memory card uses the first media unique key Khc. Decode the received E (Khc, R1) (D (Khc, (E (Khc, R1))) (= R1)
(D) The random number comparison unit 343 of the authentication unit of the memory card authenticates that the other party is a regular recording device when the decrypted result matches the random number generated in (1). (E) The recording device The random number generation unit 242 of the authentication unit 214 generates the random number R2 and transmits it to the authentication unit 314 of the memory card 300. (f) The encryption unit 344 of the authentication unit 314 of the memory card 300 transmits the random number R2 to the first medium. Encrypted with the unique key Khc (E (Khc, R2) and sent to the authentication unit 214 of the recording device. (G) The decryption 244 of the authentication unit 214 of the recording device received the E (Khc) received with the first media unique key Khc. , R2) is decoded (D (Khc, (E (Khc, R2))) (= R2).
(H) The random number comparison unit 244 of the authentication unit of the recording device authenticates that the other party is a normal memory card by verifying that the decrypted result matches the random number generated in (5). The mutual authentication procedure is an example, and other mutual authentication methods may be used.

Next, when the mutual authentication is successful, the command transmission unit 221 of the recording device 200 sends a command to write the signed key information to the memory card 300, and the signed key information writing unit 225 of the recording device The signed key information is transmitted to the memory card (S137).
If the mutual authentication is successful, the signed key information transmitting / receiving unit 335 of the memory card receives the signed key information from the recording device and stores it in the signed key information storage unit 315 according to the received command. (S138).

  Next, when the above mutual authentication is successful, the command transmission unit 221 of the recording device 200 sends a command to write the encrypted content key to the memory card 300, and the encrypted content key writing unit 226 The key is transmitted to the recording device (S139). When the above mutual authentication is successful, the encrypted content key transmission / reception unit 336 of the memory card receives the encrypted content key from the recording device according to the received command and stores it in the encrypted content key storage unit 316 (S140). ).

Here, as described above, the signed key information storage unit 315 and the encrypted content key storage unit 316 are regions in which the signed key information and the encrypted content key can be written when mutual authentication is successful.
However, it is not limited to this configuration. For example, only one of the signed key information storage unit 315 and the encrypted content key storage unit 316 may be a writable area when the mutual authentication is successful. In addition, any area may be a writable area regardless of mutual authentication.

  Next, the command transmission unit of the recording device sends an encrypted content write command to the memory card, and the encrypted content writing unit 227 transmits the encrypted content to the recording device (S141). Then, the encrypted content transmission / reception unit 337 of the recording device receives the encrypted content from the recording device and stores it in the encrypted content storage unit 317 (S142).

(4) Operation during Content Playback from Memory Card or Playback Device FIGS. 9 and 10 are examples of an operation flow during content playback from the memory card to the playback device.
As shown in FIG. 9, the command transmission unit 431 of the playback device 400 sends a command for reading the first encrypted media key group to the memory card 300 (S201). In response to this command, the encrypted media key group transmission unit 333 of the memory card 300 transmits the first encrypted media key group stored in the encrypted media key group storage unit 332 to the playback device 400 (S202). The encrypted media key group reading unit 433 of the playback device receives the first encrypted media key group from the memory card.

  Next, when the command received from the playback device is a command for reading the first encrypted media key group, the control unit 318 of the memory card sends the first encrypted media to the encrypted media key group selecting unit. Control is performed to select a key group (S203). As described above, when the received command is a command for transmitting the second encrypted media key group, the control unit 318 of the memory card sends the second encrypted media key to the encrypted media key group selecting unit. Control to select a group.

Next, the media key generation unit 312 of the memory card uses the AES decryption function to decrypt the first encrypted media key group with the device key of the memory card according to the following formula, whereby the first media A key is generated (S204).
First media key = AES_D (device key, first encrypted media key group)
In the example of FIG. 12, for example, the memory card c1 generates the first media key Km1 by decrypting the encrypted media key group E (DK_c1, Km1) using the device key DK_c1.

Next, the media key generation unit 412 of the playback device uses the AES decryption function to decrypt the first encrypted media key group with the device key of the recording device according to the following formula, thereby obtaining the first media key: Is generated (S205).
First media key = AES_D (device key, first encrypted media key group)
In the example of FIG. 12, for example, the recording device h2 generates the first media key Km1 by decrypting the encrypted media key group E (DK_h2, Km1) using the device key DK_h2.

  Next, the command transmission unit 431 of the playback device 400 transmits a command for reading the media ID to the memory card 300 (S206), and the media ID transmission unit 334 of the memory card 300 receives the media ID from the media ID storage unit 320. It is acquired and transmitted to the playback device 400 (S207).

Next, the media unique key generation unit 413 of the playback apparatus uses the one-way function G to obtain the first media key (Km1) generated by the media key generation unit 412 and the media acquired from the media ID reading unit 434. Using the ID, a first media unique key is generated by the following formula (S208).
First media unique key (Khc) = G (first media key (Km1), media ID)
Next, the media unique key generation unit 313 of the memory card similarly uses the one-way function G to generate the first media key generated by the media key generation unit 312 and the media acquired from the media ID storage unit 320. Using the ID, a first media unique key is generated by the following formula (S209).

First media unique key (Khc) = G (first media key (Km1), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Next, the command transmission unit 431 of the playback device 400 sends a command for authentication to the memory card 300, and the authentication unit 414 of the playback device performs mutual authentication with the authentication unit 314 of the memory card 300 (S210).
Here, the detailed procedure of mutual authentication is as follows, for example.

(A) The random number generation unit 341 of the authentication unit 314 of the memory card 300 generates the random number R1 and transmits it to the authentication unit 414 of the playback device. (B) The encryption unit 441 of the authentication unit 414 of the playback device generates the random number R1. Encrypted with the first media unique key Khc (E (Khc, R1) and sent to the authentication unit 314 of the memory card. (C) The decryption unit 342 of the authentication unit 314 of the memory card uses the first media unique key Khc. Decode the received E (Khc, R1) (D (Khc, (E (Khc, R1))) (= R1)
(D) The random number comparison unit 343 of the authentication unit of the memory card authenticates that the other party is a regular playback device because the decrypted result matches the random number generated in (1). (E) The playback device The random number generation unit 242 of the authentication unit 414 generates the random number R2 and transmits it to the authentication unit 314 of the memory card 300. (f) The encryption unit 344 of the authentication unit 314 of the memory card 300 transmits the random number R2 to the first medium. Encrypted with unique key Khc (E (Khc, R2) and sent to authentication unit 214 of playback device (g) Decryption 444 of authentication unit 214 of playback device receives E (Khc) received with first media unique key Khc , R2) is decoded (D (Khc, (E (Khc, R2))) (= R2).
(H) The random number comparison unit 444 of the authentication unit of the playback device authenticates that the other party is a legitimate memory card by matching the decrypted result with the random number generated in (5).

Next, when the mutual authentication is successful, the command transmission unit 431 of the playback device 400 sends a command for reading the signed key information to the memory card 300 (S211), and when the mutual authentication is successful, the command is received. In response to the received command, the signed key information transmission / reception unit 335 of the memory card transmits the signed key information acquired from the signed key information storage unit 315 to the playback device (S212), and the signed key information reading unit of the playback device 435 receives the signed key information from the memory card.

  Next, the signed key information verification unit 419 of the playback device, the verification key Pk acquired from the server public key storage 418, the media ID (MID) read from the memory card, and the signed key information (KD || S) For example, when the RSA signature verification function is used, it is verified whether or not the following expression is satisfied (S213).

V (Pk, S) = KD || MID
Here, as described above, the signature data S is the signature key Sk and the key information KD and the media ID (signed to the concatenated value of MID, S = S (Sk, KD || MID). .
Then, when the above formula is satisfied, the subsequent processing is performed, and when the above formula is not satisfied, the processing is terminated.

In the above description, an RSA signature verification function is used as the signature verification function V (). However, as the signature verification function, an ECDSA elliptic signature verification function may be used instead of the RSA signature verification function. When using the ECDSA elliptic signature verification function, the verification formula is
V (Pk, S, KD || MID) = 0
It is represented by Since the RSA signature verification function and the ECDSA elliptic signature verification function are known, the description thereof is omitted.

Next, when the signature verification by the signed key information verification unit 419 is successful, the decryption key generation unit 420 of the playback device generates a key K from the key information KD using the following formula (S214).
K = F (KD)
Here, F is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Note that F is not limited to this configuration.

  Next, when the above mutual authentication is successful, the command transmission unit 431 of the playback device 400 sends a command to read the content key to the memory card 300 (S215), and when the above mutual authentication is successful, In response, the encrypted content key transmission / reception unit 336 of the memory card transmits the encrypted content key to the playback device (S216), and the encrypted content key reading unit 436 of the playback device receives the encrypted content key from the memory card. To do.

Here, as described above, the signed key information storage unit 315 and the encrypted content key storage unit 316 are areas in which the signed key information and the encrypted content key can be read when mutual authentication is successful.
However, it is not limited to this configuration. For example, only one of the signed key information storage unit 315 and the encrypted content key storage unit 316 may be an area that can be read when mutual authentication is successful. In addition, any area may be a readable area regardless of mutual authentication.

Next, the encrypted content key decryption unit 416 of the playback device uses the key K generated in S214 to decrypt the encrypted content using the following formula (S217).
Kc = D (K, E (K, Kc))
Here, D () is, for example, an AES decoding function. Since AES is publicly known, description thereof is omitted.

Next, the command transmission unit 431 of the playback device 400 sends a command for reading content to the memory card 300 (S218),
The encrypted content transmission / reception unit 437 of the memory card transmits the encrypted content to the memory card (S219), and the encrypted content transmission / reception unit 337 of the playback device reads the encrypted content from the memory card.

Next, the encrypted content decrypting unit 417 decrypts the encrypted content using the content key Kc generated in S217 using the following formula (S220).
C = D (Kc, E (Kc, C))
Here, D () is, for example, an AES decoding function. Since AES is publicly known, description thereof is omitted.

Next, the playback unit 421 of the playback device decrypts the encrypted content with the content key decrypted in S220 (S221).

(Embodiment 2)
<Overall configuration>
The overall configuration of the content distribution / recording / reproducing system according to the second embodiment of the present invention is the same as that of the first embodiment, and includes a server device 100a, a recording device 200a, a recording medium device 300a, and a reproducing device 400a. Hereinafter, a case where the recording medium device 300a is a memory card will be described.

<Detailed configuration of server device>
FIG. 17 shows a detailed configuration of the server apparatus 100a.

  As shown in FIG. 17, the server device 100a includes a key information storage unit 111a, a content key storage unit 112a, a content storage unit 113a, a server secret key storage unit 114a, a signed key information generation unit 115a, and a content key encryption unit 116a. , Content encryption unit 117a, encrypted media key group storage unit 121a, media ID acquisition unit 122a, device key storage unit 123a, media key generation unit 124a, media unique key generation unit 125a, authentication unit 126a, content request reception unit 131a A media ID receiving unit 133a, a signed key information transmitting unit 134a, an encrypted content key transmitting unit 135a, an encrypted content transmitting unit 136a, and an encrypted media key group receiving unit 137a.

Below, a different part from Embodiment 1 is demonstrated.
The encrypted media key receiving unit 137a receives an encrypted media key group from the recording device 200.
The encrypted media key group storage unit 121a stores the encrypted media key group received from the recording device 200.

The media key generation unit 124a generates a third media key by the following formula.
Third media key (Km3) = AES_D (device key, encrypted media key group)
Then, using the second encryption auxiliary key (E (Km3, Kmsc), a second auxiliary key (Kmsc) is generated by the following equation.
Kmsc = D (Km3, E (Km3, Kmsc)
Using the one-way function G, the media key unique key generation unit 125a uses the second auxiliary key generated by the media key generation unit 124a and the media ID acquired from the media ID reception unit 133a, using the following formula: To generate a second media unique key.

Second media unique key (Ksc) = G (second auxiliary key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (second auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Other parts are the same as the corresponding parts in the first embodiment. Corresponding parts are given the same numbers.

<Detailed configuration of recording apparatus>
FIG. 18 shows a detailed configuration of the recording apparatus. The recording device 200a includes a device key storage unit 211a, a media key generation unit 212a, a media unique key generation unit 213a, an authentication unit 214a, a command transmission unit 221a, an encrypted media key group reading unit 223a, a media ID reading unit 224a, a signature attached Key information writing unit 225a, encrypted content key writing unit 226a, encrypted content writing unit 227a, content request transmission unit 231a, media ID transmission unit 233a, signed key information reception unit 234a, encrypted content key reception unit 235a, an encrypted content receiving unit 236a, and an encrypted media key group receiving unit 222a.

Below, a different part from Embodiment 1 is demonstrated.
The encrypted media key transmission unit 237 a transmits the read encrypted media key group from the memory card 300 to the server 100.

The media key generation unit 212a generates a first media key by the following formula.

First media key (Km1) = AES_D (device key, encrypted media key group)
Then, using the first encryption auxiliary key (E (Km1, Kmhc)), the first auxiliary key (Kmhc) is generated by the following equation.
Kmhc = D (Km1, E (Km1, Kmsc))
The media key unique key generation unit 213a uses the one-way function G, the first auxiliary key generated by the media key generation unit 212a, and the media ID acquired from the media ID reception unit 133a, using the following formula: To generate the first media unique key.

First media unique key (Khc) = G (first auxiliary key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (first auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Other parts are the same as the corresponding parts in the first embodiment. Corresponding parts are given the same numbers.

<Detailed configuration of memory card>
FIG. 19 shows a detailed configuration of the memory card. As shown in FIG. 19, the memory card 300a includes a device key storage unit 311a, a media key generation unit 312a, a media unique key generation unit 313a, an authentication unit 314a, a signed key information storage unit 315a, and an encrypted content key storage unit 316a. , Encrypted content storage unit 317a, control unit 318a, media ID storage unit 320a, encrypted media key group storage unit 322a, media key selection unit 323a, command reception unit 331a, encrypted media key group transmission unit 333a, media ID transmission 334a, signed key information transmission / reception unit 335a, encrypted content key transmission / reception unit 336a, and encrypted content transmission / reception unit 337a.

Below, a different part from Embodiment 1 is demonstrated.
The encrypted media key group storage unit 322a stores an encrypted media key group.
An example of the encrypted media key group is shown in FIG. As shown in FIG. 26, the encrypted media key group includes the following three types of information.

First encryption auxiliary key (E (Km1, Kmhc))
For the recording device or the playback device, each device key DK_hi (i = i =) of the recording device or the playback device whose device ID for identifying the recording device or the playback device is hi (i = 1, 2,..., N1). 1, 2..., N1) (128 bits), the first encrypted media key subgroup (E (DK_hi, Km1) (i = 1) obtained by encrypting the first media key Km1 (128 bits). 2,..., N1)) and information obtained by encrypting the first auxiliary key (Kmhc) with the first media key Km1.

Second encryption auxiliary key (E (Km2, Kmsc))
For the memory card, each device key DK_ci (i = 1, 2,..., N2) of the memory card whose media ID for identifying the memory card is ci (i = 1, 2,..., N2). ) (128 bits) and the second encrypted media key subgroup (E (DK_ci, Km2) (i = 1, 2,..., N2) obtained by encrypting the second media key Km2 (128 bits). ), The first encryption auxiliary key (E (Km2, Kmhc)) obtained by encrypting the first auxiliary key (Kmhc) with the second media key Km2, and the second media key Km2. Information obtained by encrypting the auxiliary key (Kmsc).

Third encryption auxiliary key (E (Km3, Kmsc))
For the server, each device key DK_si (i = 1, 2,..., N3) of the server whose server ID for identifying the server is si (i = 1, 2,..., N3) (128) Bit), the third encrypted media key sub-group (E (DK_si, Km3) (i = 1, 2,..., N3)) obtained by encrypting the third media key Km3 (128 bits) and the first Information obtained by encrypting the second auxiliary key (Kmsc) with the third media key Km3.

Here, E () is, for example, an AES encryption function. Although the AES encryption function is used here, other encryption functions may be used.

In the unlikely event that the device key of the server, memory card, recording device or playback device leaks, the encrypted media key group invalidates the server, memory card, recording device or playback device having the leaked device key. Can be used.

  For example, when it is found that the device key DK_h1 of the recording apparatus with the device ID = h1 has been leaked, a new first media key Km1_new, second media key Km2_new, and third media key Km3_new are generated and used. Generate a new set of encrypted media keys. However, the encrypted media key corresponding to ID = h1 of the new encrypted media key group is E (DK_h1, 0) obtained by encrypting 0 with the device key DK_h1.

Thus, since the device key DK_h1 cannot generate a new Km1_new, the device having the device key DK_h1 is invalidated.

When the command received from the recording device is a command indicating authentication with the server, the control unit 318a causes the media key selection unit 323a to execute the second encryption auxiliary key (E (Km2,. Kmsc)) is selected, and if the command received from the recording device or the playback device is a command indicating authentication with the recording device or the playback device, the media key selection unit is included in the encrypted media key group Control is performed to select the first encryption auxiliary key (E (Km2, Khc)).

The media key selection unit 323a selects the first encryption auxiliary key or the second encryption auxiliary key based on the control of the control unit 318a.
The media key generation unit 312a generates a second media key by the following formula.
Second media key (Km2) = AES_D (device key, encrypted media key group)

Then, when the media key selection unit 323a selects the first encryption auxiliary key (E (Km2, Kmhc), the first encryption auxiliary key is decrypted by the following formula to obtain the first auxiliary key (Kmhc). ) Is generated.

Kmhc = D (Km2, E (Km2, Kmhc))
In addition, when the media key selection unit 323a selects the second encryption auxiliary key (E (Km2, Kmsc), the second auxiliary key (Kmsc) is generated by the following formula.
Kmsc = D (Km2, E (Km2, Kmsc)

The media key unique key generation unit 313a uses the one-way function G, the first or second auxiliary key generated by the media key generation unit 312 and the media ID acquired from the media ID storage unit 320, A media unique key is generated by the following formula.

First media unique key (Khc) = G (first auxiliary key, media ID)
Second media unique key (Ksc) = G (second auxiliary key, media ID)

As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.

Media unique key = AES_D (second media key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

The authentication unit 314a uses the media unique key (Khc) generated by the media unique key generation unit 313a or the media unique key (Ksc), and the authentication unit of the recording device or the playback device, or the authentication unit of the server Mutual authentication between the two.

The other parts have the same configuration as the corresponding parts in the first embodiment, and thus description thereof is omitted. Corresponding parts are given the same numbers.

<Detailed configuration of playback device>
FIG. 20 shows a detailed configuration of the playback apparatus. The playback device 400a includes a device key storage unit 411a, a media key generation unit 412a, a media unique key generation unit 413a, an authentication unit 414a, a media ID acquisition unit 415a, an encrypted content key decryption unit 416a, an encrypted content decryption unit 417a, a server Public key storage unit 418a, signed key information verification unit 419a, decryption key generation unit 420a, playback unit 421a, command transmission unit 431a, encrypted media key group reading unit 433a, media ID reading unit 434a, signed key information reading unit 435a, an encrypted content key reading unit 436a, and an encrypted content reading unit 437a.

Below, a different part from Embodiment 1 is demonstrated.

The media key generation unit 412a generates a first media key by the following formula.
First media key (Km1) = AES_D (device key, encrypted media key group)
Then, using the first encryption auxiliary key (E (Km1, Kmhc)), the first auxiliary key (Kmhc) is generated by the following equation.

Kmhc = D (Km1, E (Km1, Kmhc))
The media key unique key generation unit 413a uses the one-way function G, the first auxiliary key generated by the media key generation unit 412a, and the media ID acquired from the media ID reception unit 133a, using the following formula: To generate the first media unique key.
First media unique key (Khc) = G (first auxiliary key, media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.

Media unique key = AES_D (first auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Other parts are the same as the corresponding parts in the first embodiment. Corresponding parts are given the same numbers.

<Operation of Content Distribution / Recording / Playback System>
The operation when the recording device 200a receives content (signed key information, encrypted content key, encrypted content) from the server 100a and records it on the memory card 100a will be described in the following order. (1) At server / card authentication (2) Operation at the time of content reception from the server to the recording device (3) Operation at the time of content recording from the recording device to the memory card (4) Operation at the time of content reproduction from the memory card or the reproduction device

(1) Operation during Server / Card Authentication FIG. 21 is an example of an operation flow for authentication between a server and a memory card.

As shown in FIG. 21, first, the content request transmission unit 231a of the recording apparatus 200a sends content request information to the server 100a, requests the server for content distribution (S101a), and receives the content request from the server. The unit 131a receives the content request information from the recording device 200 (S102a).
Here, it is assumed that the content request information includes at least a content ID that is identification information of the content recorded and reproduced on the memory card, and the server corresponds to the content ID (actually, encrypted content, encrypted content). Key, signed key information).

  Next, the command transmission unit 221a of the recording device 200a sends a command for reading the encrypted media key group to the memory card 300a for authentication with the server (S103a), and the encryption of the memory card 300a is performed in accordance with this command. The media key group transmission unit 333a transmits the encrypted media key group stored in the encrypted media key group storage unit 332 to the recording device 200 (S104a), and the encrypted media key group reading unit 223 of the recording device stores the memory. Receive encrypted media keys from the card.

Next, the encrypted media key transmission unit 237a of the recording device 200a transmits the encrypted media key group to the server (S105a), and the encrypted media key reception unit 137a of the server receives the encrypted media key group (S105a). S106a).

Next, the media key generation unit 124a of the server generates a third media key by decrypting the encrypted media key group with the device key of the server according to the following formula using the AES decryption function (S107a). ).

Third media key (Km3) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the server s1 generates the third media key Km3 by decrypting the encrypted media key group E (DK_s1, Km3) using the device key DK_s1. Then, by using the generated third media key Km3, the second encryption auxiliary key E (Km3, Kmsc) is decrypted to generate the second auxiliary key Kmsc.

Next, when the received command from the recording device 200 is a command for reading an encrypted media key group for authentication with the server, the memory card control unit 318a sends the second key to the media key selection unit 319a. Control is performed to select an encryption auxiliary key (S108a). (Note that, as will be described later, when the command received from the recording device 200 is a command for reading an encrypted media key group for authentication with the recording device or the playback device, the control unit 318a of the memory card The selection unit 319a is controlled to select the first encryption auxiliary key.)
Here, depending on whether the received command is a read command of the encrypted media key group for authentication with the server or a read command of the encrypted media key group for authentication with the recording device or the playback device, the control unit A configuration has been described in which the media key selection unit 319a controls the media key selection unit 319a to select the first encryption auxiliary key in the former case and to select the second encryption auxiliary key in the latter case. It is not limited. For example, in response to the command requesting authentication with the recording device or the playback device or the command requesting authentication with the server, the control unit 318a sends the media key selection unit 319a the first encryption auxiliary in the former case. A configuration may be adopted in which a key is selected, and in the latter case, control is performed such that the second encryption auxiliary key is selected. Further, an authentication identification flag for identifying whether the authentication is performed by the server or the authentication with the recording device or the playback device may be provided as an argument of the read command of the encrypted media key group. At this time, for example, if the authentication identification flag is 1 bit, if the authentication identification flag is 0, it indicates that for server authentication, and if the authentication identification flag is 1, it indicates that for recording apparatus or playback apparatus authentication. If 0 is 0, the control unit 318a controls the media key selection unit 319a to select the second encryption auxiliary key, and if the authentication identification flag is 1, the control unit 318a controls to select the first encryption auxiliary key. The structure to do may be sufficient.

Further, the configuration may not be based on commands.

Next, the media key generation unit 312a of the memory card uses the AES decryption function to decrypt the encrypted media key group using the device key of the memory card according to the following formula, thereby obtaining the second media key (Km2 ) Is generated (S109a).

Second media key (Km2) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the memory card c1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_c1, Km2) using the device key DK_c1.

Then, using the generated second media key Km2, the second encryption auxiliary key E (Km2, Kmsc) is decrypted to generate a second auxiliary key Kmsc.

  Next, the command transmission unit 221a of the recording device 200a transmits a command for reading the media ID to the memory card (S110a), and the media ID transmission unit 334a of the memory card 300a responds to this command by the media ID storage unit 320a. The media ID is acquired from the data and transmitted to the recording device 200a (S111a), and the media ID reading unit 224a of the recording device receives the media ID from the memory card.

Next, the media ID transmission unit 233a of the recording device 200a transmits the media ID read from the memory card to the server (S112a), and the media ID reception unit 133a of the server receives the media ID from the recording device ( S113a).
Next, the media unique key generation unit 125a of the server uses the one-way function G to use the second auxiliary key Kmsc generated by the media key generation unit 124a and the media ID acquired from the media ID acquisition unit 122a. Thus, the second media unique key Ksc is generated by the following formula (S114a).

Second media unique key (Ksc) = G (second auxiliary key (Kmsc), media ID)
Next, the media unique key generation unit 313a of the memory card similarly uses the one-way function G from the second auxiliary key (Kmsc) generated by the media key generation unit 312a and the media ID storage unit 320. Using the acquired media ID, a second media unique key (Ksc) is generated by the following formula (S115a).

Second media unique key (Ksc) = G (second auxiliary key (Kmsc), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (second auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Next, the authentication unit 126a of the server 100a requests the recording device to transmit a command for authenticating with the server to the memory card, and in response thereto, the command transmission unit 221a of the recording device 200a receives the memory card. A command for authentication with the server is sent to 300a, and the authentication unit 126a of the server 100a and the authentication unit 314a of the memory card 300a perform mutual authentication (S116a).
Here, the detailed procedure of mutual authentication is as follows, for example.

(A) The random number generation unit 341a of the authentication unit 314a of the memory card 300a generates a random number R1 and transmits it to the authentication unit 126a of the server 100a via the recording device. (B) The encryption unit of the authentication unit 126a of the server 141a encrypts the random number R1 with the second media unique key Ksc (E (Ksc, R1) and sends it to the authentication unit 314a of the memory card via the recording device. (C) The authentication unit 314a of the memory card The decryption unit 342a decrypts E (Ksc, R1) received with the second media unique key Ksc (D (Ksc, (E (Ksc, R1))) (= R1)
(D) The random number comparison unit 343a of the authentication unit of the memory card authenticates that the other party is a legitimate server because the result of decryption in (3) matches the random number generated in (1). ) The random number generation unit 142a of the server authentication unit 126a generates the random number R2 and transmits it to the authentication unit 314a of the memory card 300a via the recording device. (F) The encryption unit 344a of the authentication unit 314a of the memory card 300a. Encrypts the random number R2 with the second media unique key Ksc (E (Ksc, R2) and sends it to the server authentication unit 126a via the recording device. (G) Decryption unit 143a of the server authentication unit 126a Decrypts E (Ksc, R2) received with the second media unique key Ksc (D (Ksc, (E (Ksc, R2))) (= R2)
(H) The server authenticates that the other party is a regular memory card when the result of decryption in (7) of the random number comparison unit 144a of the server authentication unit matches the random number generated in (5). The mutual authentication procedure is an example, and other mutual authentication methods may be used.

(2) Operation at the time of content reception from server to recording device FIG. 22 is an example of an operation flow at the time of content reception from the server to the recording device.
As shown in FIG. 22, when the authentication in S116a is successful, the media ID acquisition unit 122a of the server acquires that the media ID received in S113a is valid (S117a).

Next, the signed key information generation unit 115a of the server generates signature data S from the following formula using the signature key Sk for at least the key information (KD) and the media ID (MID),
Signature data S = S (Sk, KD || MID)
Signed key information (KD || S) composed of the key information and the generated signature data is generated (S118a). An example of signed key information is shown in FIG.

Here, for the signature function S (), for example, an RSA signature function or an ECDSA elliptic signature function can be used. Since the RSA signature function and the ECDSA elliptic signature function are known, the description thereof will be omitted.
Next, the signed key information transmitting unit 134a of the server transmits the signed key information to the recording device (S119a), and the signed key information receiving unit 234a of the recording device receives the signed key information (S120a).

Next, the content key encryption unit 116a of the server encrypts the content key (Kc) (128 bits) with the key K generated from the key information (KD) (128 bits) by the following formula (S121a).

E (K, Kc)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted. The key K is generated by the following formula, for example.
K = F (KD)
Here, F is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Note that F is not limited to this configuration.

Next, the encrypted content key transmission unit 135a transmits the encrypted content key to the recording device (S122a), and the encrypted content key reception unit 235a of the recording device receives the encrypted content key from the server (S123a). .
Next, the content encryption unit 117a of the server encrypts the content (C) with the content key Kc by the following formula (S124a).

E (Kc, C)
Here, E () is, for example, an AES encryption function. Since AES is publicly known, description thereof is omitted.
Next, the encrypted content transmission unit 136a of the server transmits the encrypted content to the recording device (S125a), and the encrypted content reception unit 236a of the recording device receives the encrypted content from the server (S126a).

(3) Operation when Recording Content from Recording Device to Memory Card FIG. 23 is an example of an operation flow when recording content from the recording device to the memory card.
As shown in FIG. 23, the command transmission unit 221a of the recording device 200a sends a command for reading the encrypted media key group for authentication with the recording device to the memory card 300a (S127a), and the memory is responded to this command. The encrypted media key group transmission unit 333a of the card 300a transmits the encrypted media key group stored in the encrypted media key group storage unit 332a to the recording device 200a (S128a), and reads the encrypted media key group of the recording device. The unit 223a receives the encrypted media key group from the memory card.

  Next, when the command received from the recording device is a command for reading an encrypted media key group for authentication with the recording device, the memory card control unit 318a sends the first key to the media key selection unit 323a. Control is performed to select an encryption auxiliary key (S139a). As described above, when the received command is a command for reading the encrypted media key group for authentication with the server, the control unit 318a of the memory card sends the second encryption auxiliary key to the media key selection unit. Control to select.

Next, the media key generation unit 312a of the memory card uses the AES decryption function to decrypt the encrypted media key group using the device key of the memory card according to the following formula, thereby obtaining the second media key (Km2 ) Is generated (S130a).
Second media key (Km2) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the memory card c1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_c1, Km2) using the device key DK_c1.

Then, using the generated second media key Km2, the first encryption auxiliary key E (Km2, Kmhc) is decrypted to generate the first auxiliary key Kmhc.

Next, the media key generation unit 212a of the recording device uses the AES decryption function to decrypt the encrypted media key group with the device key of the recording device according to the following formula, whereby the first media key (Km1) Is generated (S131a).

First media key (Km1) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the recording apparatus h1 generates the first media key Km1 by decrypting the encrypted media key group E (DK_h1, Km1) using the device key DK_h1.
Then, using the generated first media key Km1, the first encryption auxiliary key E (Km1, Kmhc) is decrypted to generate the first auxiliary key Kmhc.

Next, the command transmission unit 221a of the recording device 200a transmits a command for reading the media ID to the memory card 300a (S132a), and the media ID transmission unit 334a of the memory card 300a receives the media ID from the media ID storage unit 320a. It is acquired and transmitted to the media ID reading unit 224a of the recording device 200a (S133a).

  Next, the media unique key generation unit 213a of the recording device uses the one-way function G to obtain the first auxiliary key (Kmhc) generated by the media key generation unit 212a and the media acquired from the media ID reading unit 224a. Using the ID, a first media unique key Khc is generated by the following formula (S134a).

First media unique key (Khc) = G (first auxiliary key (Kmhc), media ID)
Next, the media unique key generation unit 313a of the memory card similarly uses the one-way function G from the first auxiliary key (Kmhc) generated by the media key generation unit 312a and the media ID storage unit 320a. Using the acquired media ID, a first media unique key (Khc) is generated by the following formula (S135a).

First media unique key (Khc) = G (first auxiliary key (Kmhc), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (first auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Next, the command transmission unit 221a of the recording device 200a sends a command for authentication with the recording device to the memory card 300a, and the authentication unit 214a of the recording device performs mutual authentication with the authentication unit 314a of the memory card 300a ( S136a).
Here, the detailed procedure of mutual authentication is as follows, for example.

(A) The random number generation unit 341a of the authentication unit 314a of the memory card 300a generates a random number R1 and transmits it to the authentication unit 214a of the recording device. (B) The encryption unit 241a of the authentication unit 214a of the recording device generates the random number R1. Encrypted with the first media unique key Khc (E (Khc, R1) and sent to the authentication unit 314a of the memory card. (C) The decryption unit 342a of the authentication unit 314a of the memory card uses the first media unique key Khc. Decode the received E (Khc, R1) (D (Khc, (E (Khc, R1))) (= R1)
(D) The random number comparison unit 343a of the authentication unit a of the memory card authenticates that the other party is a regular recording device because the decrypted result matches the random number generated in (1). (E) Recording The random number generation unit 242a of the authentication unit 214a of the device generates the random number R2 and transmits it to the authentication unit 314a of the memory card 300a. (F) The encryption unit 344a of the authentication unit 314a of the memory card 300a Encrypted with media unique key Khc (E (Khc, R2) and sent to authentication unit 214a of recording device (g) Decryption 244a of authentication unit 214a of recording device receives E ( Khc, R2) is decoded (D (Khc, (E (Khc, R2))) (= R2)
(H) The random number comparison unit 244a of the authentication unit of the recording apparatus authenticates that the other party is a regular memory card by matching the decrypted result with the random number generated in (5). The mutual authentication procedure is an example, and other mutual authentication methods may be used.

Next, when the above mutual authentication is successful, the command transmission unit 221a of the recording device 200a sends a command to write signed key information to the memory card 300a, and the signed key information writing unit 225a of the recording device The signed key information is transmitted to the memory card (S137a),
When the above mutual authentication is successful, the signed key information transmitting / receiving unit 335a of the memory card receives the signed key information from the recording device according to the received command and stores it in the signed key information storage unit 315a (S138a). ).

  Next, when the mutual authentication is successful, the command transmission unit 221a of the recording device 200a sends a command to write the encrypted content key to the memory card 300a, and the encrypted content key writing unit 226a When the key is transmitted to the recording device (S139a) and the mutual authentication is successful, the encrypted content key transmission / reception unit 336a of the memory card receives the encrypted content key from the recording device according to the received command, and It stores in the generalized content key storage unit 316a (S140a).

Here, as described above, the signed key information storage unit 315a and the encrypted content key storage unit 316a are areas in which the signed key information and the encrypted content key can be written when mutual authentication is successful. .
However, it is not limited to this configuration. For example, only one of the signed key information storage unit 315a and the encrypted content key storage unit 316a may be a writable area when the mutual authentication is successful. In addition, any area may be a writable area regardless of mutual authentication.

  Next, the command transmission unit of the recording device sends an encrypted content write command to the memory card, and the encrypted content writing unit 227a transmits the encrypted content to the recording device (S141a). The transmission / reception unit 337a receives the encrypted content from the recording device and stores it in the encrypted content storage unit 317a (S142a).

(4) Operation during Content Playback from Memory Card or Playback Device FIGS. 24 and 25 are examples of an operation flow during content playback from the memory card to the playback device.
As shown in FIG. 24, the command transmission unit 431a of the playback device 400a sends a command for reading the encrypted media key group to the memory card 300a (S201a), and the encrypted media key group of the memory card 300a in response to this command. The transmission unit 333 transmits the encrypted media key group stored in the encrypted media key group storage unit 332a to the playback device 400a (S202a), and the encrypted media key group reading unit 433 of the playback device encrypts from the memory card. Receive a media key set.

Next, when the command received from the playback device is a command for reading an encrypted media key group for authentication with the playback device, the control unit 318a of the memory card sends the first encryption to the media key selection unit. Control is performed to select the encryption auxiliary key (S203a).

Next, the media key generation unit 312a of the memory card uses the AES decryption function to decrypt the encrypted media key group using the device key of the memory card according to the following formula, thereby obtaining the second media key (Km2 ) Is generated (S204a).

Second media key (Km2) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the memory card c1 generates the second media key Km2 by decrypting the encrypted media key group E (DK_c1, Km2) using the device key DK_c1.
Then, using the generated second media key Km2, the first encryption auxiliary key E (Km2, Kmhc) is decrypted to generate the first auxiliary key Kmhc.

Next, the media key generation unit 412a of the playback device uses the AES decryption function to decrypt the encrypted media key group with the device key of the playback device according to the following formula, and thereby the first media key (Km1) Is generated (S205a).
First media key (Km1) = AES_D (device key, encrypted media key group)
In the example of FIG. 26, for example, the playback device h2 generates the first media key Km1 by decrypting the encrypted media key group E (DK_h2, Km1) using the device key DK_h2.

Then, using the generated first media key Km1, the first encryption auxiliary key E (Km1, Kmhc) is decrypted to generate the first auxiliary key Kmhc.

Next, the command transmission unit 431a of the playback device 400a transmits a command for reading the media ID to the memory card 300 (S206a), and the media ID transmission unit 334a of the memory card 300a receives the media ID from the media ID storage unit 320a. It is acquired and transmitted to the playback device 400a (S207a).

Next, the media unique key generation unit 413a of the playback device uses the one-way function G to obtain the first auxiliary key (Kmhc) generated by the media key generation unit 412a and the media acquired from the media ID reading unit 434a. Using the ID, a first media unique key Khc is generated by the following formula (S208a).
First media unique key (Khc) = G (first auxiliary key (Kmhc), media ID)
Next, the media unique key generation unit 313a of the memory card similarly uses the one-way function G to obtain the first auxiliary key generated by the media key generation unit 312a and the media acquired from the media ID storage unit 320a. Using the ID, a first media unique key Khc) is generated by the following formula (S209a).

First media unique key (Khc) = G (first auxiliary key (Kmhc), media ID)
As a specific example of the one-way function G, for example, it can be realized by the following expression using AES encryption.
Media unique key = AES_D (first auxiliary key, media ID) (+) media ID
Here, (+) represents an exclusive OR operation.

Next, the command transmission unit 431a of the playback device 400a sends a command for authentication with the Ichi device to the memory card 300a, and the authentication unit 414a of the playback device performs mutual authentication with the authentication unit 314a of the memory card 300a ( S210a).
Here, the detailed procedure of mutual authentication is as follows, for example.

(A) The random number generation unit 341a of the authentication unit 314a of the memory card 300a generates a random number R1 and transmits it to the authentication unit 414a of the playback device. (B) The encryption unit 441a of the authentication unit 414a of the playback device generates the random number R1. Encrypted with the first media unique key Khc (E (Khc, R1) and sent to the authentication unit 314a of the memory card. (C) The decryption unit 342a of the authentication unit 314a of the memory card uses the first media unique key Khc. Decode the received E (Khc, R1) (D (Khc, (E (Khc, R1))) (= R1)
(D) The random number comparison unit 343a of the authentication unit of the memory card authenticates that the other party is a regular playback device because the decrypted result matches the random number generated in (1). (E) The playback device The random number generation unit 242a of the authentication unit 414a generates the random number R2 and transmits it to the authentication unit 314a of the memory card 300a. (F) The encryption unit 344a of the authentication unit 314a of the memory card 300a sends the random number R2 to the first medium. Encrypted with the unique key Khc (E (Khc, R2) and sent to the authentication unit 214a of the playback device. (G) The decryption 443a of the authentication unit 214a of the playback device receives the E (Khc) received with the first media unique key Khc. , R2) is decoded (D (Khc, (E (Khc, R2))) (= R2).
(H) The random number comparison unit 444a of the authentication unit of the playback device authenticates that the other party is a regular memory card by matching the decrypted result with the random number generated in (5).

Next, when the above mutual authentication is successful, the command transmission unit 431a of the playback device 400a sends a command for reading the signed key information to the memory card 300a (S211a), and when the above mutual authentication is successful, the command is received. In response to the received command, the signed key information transmission / reception unit 335a of the memory card transmits the signed key information acquired from the signed key information storage unit 315a to the playback device (S212a), and the signed key information reading unit of the playback device 435a receives the signed key information from the memory card.

  Next, the signed key information verification unit 419a of the playback apparatus, the verification key Pk acquired from the server public key storage 418a, the media ID (MID) read from the memory card, and the signed key information (KD || S) For example, when the RSA signature verification function is used, it is verified whether or not the following expression is established (S213a).

V (Pk, S) = KD || MID
Here, as described above, the signature data S is the signature key Sk and the key information KD and the media ID (signed to the concatenated value of MID, S = S (Sk, KD || MID). .
Then, when the above formula is satisfied, the subsequent processing is performed, and when the following formula is not satisfied, the processing is terminated.

In the above description, an RSA signature verification function is used as the signature verification function V (). However, as the signature verification function, an ECDSA elliptic signature verification function may be used instead of the RSA signature verification function. When using the ECDSA elliptic signature verification function, the verification formula is
V (Pk, S, KD || MID) = 0
It is represented by Since the RSA signature verification function and the ECDSA elliptic signature verification function are known, the description thereof is omitted.

Next, when the signature verification is successful in the signed key information verification unit 419a, the decryption key generation unit 420a of the playback device generates a key K from the key information KD using the following formula (S214a).
K = F (KD)
Here, F is a secret one-way function, for example,
F (KD) = AES_D (secret key, KD) (+) KD
And Note that F is not limited to this configuration.

  Next, when the above mutual authentication is successful, the command transmission unit 431a of the playback device 400a sends a command for reading the content key to the memory card 300a (S215a), and when the above mutual authentication is successful, In response, the encrypted content key transmission / reception unit 336a of the memory card transmits the encrypted content key to the playback device (S216a), and the encrypted content key reading unit 436a of the playback device receives the encrypted content key from the memory card. To do.

Here, as described above, the signed key information storage unit 315a and the encrypted content key storage unit 316a are areas in which the signed key information and the encrypted content key can be read when mutual authentication is successful.
However, it is not limited to this configuration. For example, only one of the signed key information storage unit 315a and the encrypted content key storage unit 316a may be an area that can be read when mutual authentication is successful. In addition, any area may be a readable area regardless of mutual authentication.

Next, the encrypted content key decryption unit 416a of the playback device uses the key K generated in S214a to decrypt the encrypted content using the following formula (S217a).
Kc = D (K, E (K, Kc))
Here, D () is, for example, an AES decoding function. Since AES is publicly known, description thereof is omitted.

Next, the command transmission unit 431a of the playback device 400a sends a command for reading content to the memory card 300a (S218a),
The encrypted content transmission / reception unit 437a of the memory card transmits the encrypted content to the memory card (S219a), and the encrypted content transmission / reception unit 337a of the playback device reads the encrypted content from the memory card.

Next, the encrypted content decryption unit 417a decrypts the encrypted content using the content key Kc generated in S217a using the following formula (S220a).
C = D (Kc, E (Kc, C))
Here, D () is, for example, an AES decoding function. Since AES is publicly known, description thereof is omitted.

Next, the playback unit 421a of the playback device decrypts the encrypted content with the content key decrypted in S220a (S221a).

<Modification>
(1) In the first embodiment, based on the type of command received by the command receiving unit 331 (that is, whether the first encrypted media key read command or the second encrypted media key transmission command) Accordingly, under the control of the control unit 318, the encrypted media key group selection unit 319 selects 1) the first encrypted media key group stored in the encrypted media key group storage unit 322, or 2 ) The second encrypted media key group received from the server is selected. However, the present invention is not limited to this configuration. For example, as shown in FIG. 27, the memory card 300 is further provided with a media unique key storage unit 351 and a media unique key selection unit 352, and the first encrypted media key group is stored in the media unique key storage unit 351. A first media unique key (Khc) generated as a result of processing by the media key generation unit and the media unique key generation unit is stored in advance. Then, based on the type of command received by the command receiving unit 331 (that is, the first encrypted media key read command for authentication with the recording device or the playback device, or the second command for authentication with the server). The media unique key selection unit 352 under the control of the control unit 318, 1) a first media unique key (preliminarily stored in the media unique key storage unit 351) 2) a second media unique key (2) generated as a result of processing the second encrypted media key group received from the server by the media key generation unit 312 and the media unique key generation unit 313 It is also possible to select Ksc).

  (2) In the modified example (1), the memory card is further provided with a media unique key update unit 361 and a process selection unit 362 as shown in FIG. Based on the type of command received by the command receiving unit 331 (that is, the transmission command of the second encrypted media key group for authentication with the server or the first encryption stored in the memory card) Whether the processing selection unit 362 selects 1) mutual authentication processing with the server under the control of the control unit 318, or 2) The first encryption media key group for update may be selected to perform processing for updating the first encryption media key group. Here, the mutual authentication process with the server 1) is generated as a result of processing the second encrypted media key group received from the server by the media key generation unit 312 and the media unique key generation unit 313. This is performed using the second media unique key (Ksc). Further, in the update process of the first encrypted media key group in 2), the first encrypted media key group for update received from the server or the recording device is converted into the media key generation unit 312 and the media unique key generation unit 313. The media unique key (Khc) stored in the media unique key storage unit 361 by the media unique key update unit 362 is the first media unique key for update (Khc_new) generated as a result of the process. And the encrypted media key group updating unit 362 updates the encrypted media key group stored in the encrypted media key group storage unit 322 with the first encrypted media key group for update.

  (3) In the first embodiment and the second embodiment, the following configuration may be provided. Here, the case of Embodiment 1 will be described. In S116 of the first embodiment, when the server authenticates the memory card, 1) the authentication unit 126 of the server 100 requests the recording device 200 to transmit a command for authenticating with the server to the memory card. 2) In response to this, the command transmission unit 221 of the recording apparatus 200 sends a command for authentication with the server to the memory card 300. 3) The authentication unit 126 of the server 100 and the authentication unit 314 of the memory card 300 mutually communicate. The configuration is to perform authentication. At this time, if mutual authentication fails, for example, as a return value of a command for authenticating with the server sent from the recording device, a return value indicating that the authentication has failed is transmitted to the recording device. May be configured to display an appropriate error message to the user according to the return value (for example, display a message such as “This card has been disabled”). In the above description, the recording apparatus is notified that authentication has failed as a return value of the authentication command. However, the present invention is not limited to this configuration. Any interface that notifies the recording device that the mutual authentication has failed from the memory card may be provided.

  (4) In Embodiment 1, the configuration using the first encrypted media key group shown in FIG. 11 and the second encrypted media key group shown in FIG. 12 is shown, but the present invention is not limited to this configuration. For example, an encryption media key group using a tree structure can be used. For example, as shown in FIG. 29, each leaf of the first tree structure has a one-to-one correspondence with each leaf of the first tree structure among the three tree structures. Each leaf has a one-to-one correspondence with a memory card, and each leaf in the third tree structure has a one-to-one correspondence with a server. Each recording device or playback device, memory card, and server has a Assume that the device keys associated with the respective nodes located on the route from the root to the corresponding leaf are held. For example, the recording device 1 holds (Kg, Ka, K1) as a device key, the memory card 1 holds (Kh, Kc, K5) as a device key, and the server 1 holds (Ki, Ke, K9) as a device key. is doing. FIG. 29 shows the first encrypted media key group and the second encrypted media key group at this time. Note that the method of assigning device keys to each recording device or playback device, each memory card, and each server shown in FIG. 29 is an example, and other assignment methods may be used. In the second embodiment, the configuration using the encrypted media key group shown in FIG. 26 is shown, but the present invention is not limited to this configuration. The encrypted media key group shown in FIG. 30 may be used using the same tree structure as described above.

  (4) In the first embodiment, for the first encrypted media key group, the server key DK_si (i = 1, 2,..., N3) (128 bits) for each server is 0 for the server. By using a third encrypted media key subgroup (E (DK_si, 0) (i = 1, 2,..., N3)) that encrypts the server. Although it was set as the structure which cannot obtain Km1, it is not limited to this structure. For example, the first encrypted media key group may not include the third encrypted media key subgroup for the server. In this case, for example, even if the media key generation unit of the server whose server ID is s1 tries to decrypt the first encrypted media key group using the device key DK_s1, it cannot decrypt and cannot generate the media key Km1. Similarly, in the first embodiment, for the second encrypted media key group, the device key DK_hi (i = 1, 2,..., N1) of each recording apparatus or reproducing apparatus is used for the recording apparatus or reproducing apparatus. ) (128 bits) and using the first encrypted media key subgroup (E (DK_hi, 0) (i = 1, 2,..., N1)) in which 0 is encrypted, Although the recording device or the playback device is configured not to obtain the second media key Km2, it is not limited to this configuration. For example, the second encrypted media key group may not include the first encrypted media key subgroup for the recording device or the playback device. In this case, for example, even if the media key generation unit of the recording device whose device ID is h1 tries to decrypt the second encrypted media key group using the device key DK_h1, it cannot decrypt and cannot generate the media key Km2. . Similarly, in the modified example (4), as shown in FIG. 29, in the first encrypted media key group, E (Ki, 0) is included for the server, and the server obtains the first media key Km1. However, instead of this configuration, E (Ki, 0) may not be included in the first encrypted media key group. In the second encrypted media key group, the recording device or the playback device including E (Kg, 0) for the recording device or the playback device is configured so that the second media key Km2 cannot be obtained. Instead of this configuration, E (Kg, 0) may not be included in the second encrypted media key group.

  (5) In the first embodiment and the second embodiment, the playback device inputs the key information (KD) to the secret one-way function F and decrypts the encrypted content key. Although the key K is generated and the encrypted content key is decrypted using the key K, the present invention is not limited to this configuration. For example, a third encrypted media key group may be used as the key information. Here, the third encrypted media key group is obtained by encrypting the key K with each device key DK_hi (i = 1, 2,..., N1) (128 bits) of the recording device or the playback device. Yes (E (DK_hi, K) (i = 1, 2,..., N1)). Further, instead of generating the key K from the key information (KD), the playback device uses the first media key Km1 generated from the first encryption key media key group or the first media unique The key Khc may be used as the key K, and the encrypted content key may be decrypted using the key Khc.

(6) In the first and second embodiments, the case where the recording medium is a memory card has been described as an example. However, the recording medium may be any recording medium including a memory unit and a memory control semiconductor device. good.
(7) In Embodiments 1 and 2, the case where AES is used has been described, but the present invention is not limited to this configuration. For example, instead of AES, another encryption algorithm may be used. Moreover, although the case where RSA or ECDSA is used as the signature generation / verification function has been described, the present invention is not limited to this configuration. For example, instead of AES, another encryption algorithm may be used.

(8) In the first and second embodiments, the apparatus having the digital content recording function is described as the recording apparatus 200, and the apparatus having the reproduction function is described as the reproducing apparatus 400. However, the recording apparatus and the reproducing apparatus may be realized as a recording / reproducing apparatus having both a recording function and a reproducing function.
(9) Each of the above devices is specifically a computer system including a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or hard disk unit. Each device achieves its functions by the microprocessor operating according to the computer program. Here, the computer program is configured by combining a plurality of instruction codes indicating instructions for the computer in order to achieve a predetermined function. Each device is not limited to a computer system including all of a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like, and may be a computer system including a part of them. .

  (10) A part or all of the components constituting each of the above-described devices may be configured by one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip, and specifically, a computer system including a microprocessor, ROM, RAM, and the like. . A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program.

In addition, each part of the components constituting each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or all of them.
Although the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.

Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied.
(11) A part or all of the constituent elements constituting each of the above devices may be configured as an IC card that can be attached to and detached from each device or a single module. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the super multifunctional LSI described above. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.

(12) The present invention may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.
The present invention also provides a computer readable recording medium such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc). ), Recorded in a semiconductor memory or the like. The digital signal may be recorded on these recording media.

In the present invention, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network represented by the Internet, a data broadcast, or the like.
The present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program.

In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, and executed by another independent computer system. (13) The above embodiment and the above modifications may be combined.

  The recording medium device according to the present invention determines whether a server device that distributes content is an illegal memory card or an authorized memory card even if the card manufacturer manufactures an unauthorized memory card. Therefore, the present invention is useful as a recording medium device that performs recording while protecting the copyright of digital content distributed digitally and reproduces the recorded digital content.

FIG. 1 is an overall configuration diagram of a server device, a recording device, a recording medium device, and a playback device in Embodiment 1 of the present invention. Configuration diagram of a server device in Embodiment 1 of the present invention 1 is a configuration diagram of a recording apparatus according to Embodiment 1 of the present invention. 1 is a configuration diagram of a recording medium device according to Embodiment 1 of the present invention. Configuration diagram of a playback apparatus according to Embodiment 1 of the present invention The flowchart which shows the operation | movement at the time of the server / card authentication in Embodiment 1 of this invention The flowchart which shows the operation | movement at the time of the content reception from the server in Embodiment 1 of this invention to a recording device. The flowchart which shows the operation | movement at the time of the content recording from the recording device in Embodiment 1 of this invention to a memory card. The flowchart which shows the operation | movement at the time of the content reproduction from the recording device in Embodiment 1 of this invention to a memory card or a reproducing | regenerating apparatus. The flowchart which shows the operation | movement at the time of the content reproduction from the recording device in Embodiment 1 of this invention to a memory card or a reproducing | regenerating apparatus. Example of signed key information in Embodiment 1 of the present invention Example of first encrypted media key group in Embodiment 1 of the present invention Example of second encrypted media key group in Embodiment 1 of the present invention Configuration example of mutual authentication between server / memory card in Embodiment 1 of the present invention Configuration example of mutual authentication between recording device / memory card in Embodiment 1 of the present invention Configuration example of mutual authentication between playback device and memory card in Embodiment 1 of the present invention Configuration diagram of server device in Embodiment 2 of the present invention Configuration diagram of recording apparatus according to Embodiment 2 of the present invention Configuration diagram of a recording medium device in Embodiment 2 of the present invention Configuration diagram of a playback apparatus according to Embodiment 2 of the present invention The flowchart which shows the operation | movement at the time of the server / card authentication in Embodiment 2 of this invention The flowchart which shows the operation | movement at the time of the content reception from the server in Embodiment 2 of this invention to a recording device. The flowchart which shows the operation | movement at the time of the content recording from the recording device in Embodiment 2 of this invention to a memory card. The flowchart which shows the operation | movement at the time of the content reproduction from the recording device in Embodiment 2 of this invention to a memory card or a reproducing | regenerating apparatus. The flowchart which shows the operation | movement at the time of the content reproduction from the recording device in Embodiment 2 of this invention to a memory card or a reproducing | regenerating apparatus. Example of encrypted media key group in Embodiment 2 of the present invention Configuration diagram of recording medium device in modification (1) Configuration diagram of recording medium device in modification (2) Example of first and second encrypted media key groups in modification (4) Example of encrypted media key group in modification (4) General configuration diagram of a conventional server device, recording device, recording medium device, and playback device Explanatory diagram of effects of conventional technology Explanatory drawing of problems of conventional technology General configuration diagram of a conventional server device, recording device, recording medium device, and playback device

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Server apparatus 200 Recording apparatus 300 Memory card 400 Playback apparatus

Claims (4)

A server device that distributes digital work information, a recording medium device that has an area for receiving and storing digital work information distributed from the server apparatus, and an access device that reads information from or writes information to the area A recording medium device used in a digital copyright protection system comprising:
The server device includes a unique device key and a unique device key held by each recording medium device, and an encrypted media key subgroup obtained by encrypting the second media key, and a unique device key held by each server device. A second encrypted media group including an encrypted media key subgroup obtained by encrypting the second media key with the device key of
The access device holds a unique device key,
The recording medium device includes a unique device key, a unique media ID, and a unique device key held by each recording medium device, and an encrypted media key subgroup obtained by encrypting the first media key, Holding a first encrypted media group including an encrypted media key subgroup obtained by encrypting the first media key with a unique device key held by each access device;
The recording medium device includes a receiving unit that receives the second encrypted media group from the server device;
When the digital work information distributed from the server device is received and stored in the area, the second encrypted media group is decrypted with the device key of the recording medium device to generate a second media key, Generating a second media unique key using the generated media ID and the generated second media key, and performing mutual authentication with the server device using the generated second media unique key;
When the access device reads information from the region or writes information to the region, the access device decrypts the first encrypted media group with the device key of the recording medium device to generate a first media key, and a media ID And an authentication unit that generates a first media unique key using the generated first media key and performs mutual authentication with the access device using the generated first media unique key. A recording medium device.
A server device that distributes digital work information, a recording medium device that has an area for receiving and storing digital work information distributed from the server apparatus, and an access device that reads information from or writes information to the area A recording medium device used in a digital copyright protection system comprising:
The server device holds a unique device key,
The access device holds a unique device key,
The recording medium device includes a unique device key, a unique media ID, an encrypted media key subgroup obtained by encrypting the first media key with a unique device key held by each access device, and each recording medium device. Encrypted by encrypting the second media key with the unique device key held by the encrypted media key sub-group, and encrypting the third media key with the unique device key held by each server device Media key subgroup, first encryption auxiliary key that encrypts the first auxiliary key with the first media key, and first encryption that encrypts the first auxiliary key with the second media key An auxiliary key, a second encrypted auxiliary key obtained by encrypting the second auxiliary key with the second media key, and a second encrypted auxiliary key obtained by encrypting the second auxiliary key with the third media key. Holds a group of encrypted media including
The recording medium device includes:
When the digital work information distributed from the server device is received and stored in the area, the encrypted media group is decrypted with the device key of the recording medium device, and the second media key is generated. Using the second media key, the second encryption auxiliary key is decrypted to generate a second auxiliary key, and a second media unique key is generated using the media ID and the generated second auxiliary key. Generate and perform mutual authentication with the server device using the generated second media unique key,
When the access device reads information from or writes information to the area, the encrypted media group is decrypted with the device key of the recording medium device to generate a second media key,
Using the generated second media key, the first encryption auxiliary key is decrypted to generate a first auxiliary key, and the media ID and the generated first auxiliary key are used to identify the first medium. A recording medium device comprising: an authentication unit that generates a key and performs mutual authentication with the access device using the generated first media unique key.
A server device that distributes digital work information, a recording medium device that has an area for receiving and storing digital work information distributed from the server apparatus, and an access device that reads information from or writes information to the area An authentication method in a recording medium device used for a digital copyright protection system comprising:
The server device includes a unique device key and a unique device key held by each recording medium device, and an encrypted media key subgroup obtained by encrypting the second media key, and a unique device key held by each server device. A second encrypted media group including an encrypted media key subgroup obtained by encrypting the second media key with the device key of
The access device holds a unique device key,
The recording medium device includes a unique device key, a unique media ID, and a unique device key held by each recording medium device, and an encrypted media key subgroup obtained by encrypting the first media key, Holding a first encrypted media group including an encrypted media key subgroup obtained by encrypting the first media key with a unique device key held by each access device;
The recording medium device authentication method includes: a receiving step of receiving the second encrypted media group from the server device;
When the digital work information distributed from the server device is received and stored in the area, the second encrypted media group is decrypted with the device key of the recording medium device to generate a second media key, Generating a second media unique key using the generated media ID and the generated second media key, and performing mutual authentication with the server device using the generated second media unique key;
When the access device reads information from the region or writes information to the region, the access device decrypts the first encrypted media group with the device key of the recording medium device to generate a first media key, and a media ID And an authentication step of generating a first media unique key using the generated first media key and performing mutual authentication with the access device using the generated first media unique key. An authentication method for a recording medium device.
A server device that distributes digital work information, a recording medium device that has an area for receiving and storing digital work information distributed from the server apparatus, and an access device that reads information from or writes information to the area An authentication method for a recording medium device used in a digital copyright protection system comprising:
The server device holds a unique device key,
The access device holds a unique device key,
The recording medium device includes a unique device key, a unique media ID, an encrypted media key subgroup obtained by encrypting the first media key with a unique device key held by each access device, and each recording medium device. Encrypted by encrypting the second media key with the unique device key held by the encrypted media key sub-group, and encrypting the third media key with the unique device key held by each server device Media key subgroup, first encryption auxiliary key that encrypts the first auxiliary key with the first media key, and first encryption that encrypts the first auxiliary key with the second media key An auxiliary key, a second encrypted auxiliary key obtained by encrypting the second auxiliary key with the second media key, and a second encrypted auxiliary key obtained by encrypting the second auxiliary key with the third media key. Holds a group of encrypted media including
The recording medium device authentication method includes:
When the digital work information distributed from the server device is received and stored in the area, the encrypted media group is decrypted with the device key of the recording medium device, and the second media key is generated. Using the second media key, the second encryption auxiliary key is decrypted to generate a second auxiliary key, and a second media unique key is generated using the media ID and the generated second auxiliary key. Generate and perform mutual authentication with the server device using the generated second media unique key,
When the access device reads information from or writes information to the area, the encrypted media group is decrypted with the device key of the recording medium device to generate a second media key,
Using the generated second media key, the first encryption auxiliary key is decrypted to generate a first auxiliary key, and the media ID and the generated first auxiliary key are used to identify the first medium. An authentication method for a recording medium device, comprising: an authentication step of generating a key and performing mutual authentication with the access device using the generated first media unique key.

Images