JP3861790B2 - Data management system, data management method, client terminal, and server device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
  The present invention relates to a data management system and a data management method for managing data transmitted from a server device to a client terminal connected via a network, and a client terminal and a server device constituting the data management systemInRelated.
[0002]
[Prior art]
Copyright protection is a major problem in a system that distributes video / audio as digital data and displays / outputs it. Since digital data does not deteriorate due to copying, if the copied data can be viewed as it is, a large amount of copies are generated and the commercial value of the content is reduced.
[0003]
For this reason, digital video / audio data is protected by encryption by a copyright management system, and data can be copied but can be played back unless there is a key to decrypt the encrypted data. It is common to make it impossible. Content viewing is controlled by key management.
[0004]
For example, Patent Document 1 below discloses a technique for protecting copyright by a CBC (Ciphering Block Chaining) method that increases encryption strength by linking data encrypted in units of blocks with previous block data. ing.
[0005]
In the technique described in Patent Document 1, content data is blocked and encrypted in a chain to increase the encryption strength, and the initial value required for the first block when performing encryption is set. For example, in the case of an MPEG stream, the loss of the data area is reduced by generating from the content data of the sector such as unique information of the header.
[0006]
[Patent Document 1]
JP 2002-202719 A
[0007]
[Problems to be solved by the invention]
However, recently, the copyright provided by the content provider is not protected, and the content provider may be greatly damaged. Although the key management described above is based on an advanced cryptographic system based on mathematical theory, there are many cases where the cryptographic key is broken due to the rapid development of cryptographic technology and research in recent years and the speeding up of computers. ing. Once the encryption key is broken, the method and the decrypted content spread rapidly through the Internet and the like, causing serious damage to the content provider side. Even if encrypted, if all data of one content is placed on the user side, one piece of content will be copied as a whole if the encryption is broken. Therefore, it is desirable to manage the content by dividing it into a plurality of partial data. However, if the next part can be requested without actually viewing a part of the content, the content can be requested by a malicious user. The entire data can be acquired.
[0008]
As another problem for content providers, in the case of digital video / audio data, viewing can be started at any time or skipped without viewing a CM (commercial film) inserted in the middle of the program. There is a problem that it is easy to watch. For example, even in the above-described Patent Document 1, once data is decoded, it is possible to view the data from an arbitrary time or skip it. Although this improves the convenience on the viewer side, it reduces the advertising effect for the content provider and is not preferable.
[0009]
The present invention has been proposed in view of such a conventional situation, a data management system capable of reducing damage on the provider side of content data and managing content data safely, and data management It is an object to provide a method, a client terminal, and a server device.
[0011]
[Means for Solving the Problems]
  In order to achieve the above-described object, a data management system according to the present invention is connected to a network and sequentially transmits encrypted block data that has been blocked and encrypted, and the server connected to the network. A data management system having a client terminal that receives and reproduces encrypted block data from a device, wherein the client terminal stores decryption means for decrypting the encrypted block data and decrypted block data Data storage means, encryption key generation means for generating an encryption key for decrypting the next encrypted block data based on the data stored in the data storage means, and based on the encryption key generated by the encryption key generation means Transmitting means for transmitting an authentication key to the server device, the server device comprising the client Authentication means for authenticating the authentication key sent from the end, characterized in that it comprises a transmitting means for transmitting only following encryption block data when authenticating the authentication key by the authentication means.
[0012]
In the present invention, the server device receives the authentication key from the client terminal after transmitting the block data, and if it does not authenticate, the server device does not transmit the next block data. The block data can be prevented from being transmitted to the server device, and the data transmitted by the server device can be managed safely.
[0013]
The block data is encrypted data that is divided and encrypted in predetermined time units, and the client terminal can include a decryption unit that decrypts the encrypted data. If it transmits, the safety | security of the data transmitted from a server apparatus will increase further.
[0014]
Further, the key generation means generates a decryption key based on the data stored in the data storage means, and the decryption means decrypts the encrypted data using the decryption key or based on the authentication key. A decryption key is generated, and the decryption means decrypts the encrypted data using the decryption key or decrypts the encrypted data using the authentication key generated by the key generation means as a decryption key. Thus, only the client terminal authenticated by the server device can acquire the decryption key for decrypting the encrypted data.
[0015]
Furthermore, the data storage means is a VRAM (video memory), the client terminal is a display device for displaying data written in the VRAM, and the key generation means writes the data in the VRAM. When the data is displayed on the display device, the decryption key can be generated. As a result, the decryption key can be generated if the data is not expanded in the VRAM for display on the display device as the client terminal. Since the previous data must be reproduced (displayed) in order to obtain the next data, the client terminal user does not reproduce the data from the middle or skips the data and skips it. Reduce the damage on the customer side.
[0016]
  A data management method according to the present invention includes a server device that is connected to a network and sequentially transmits encrypted block data that has been blocked and encrypted, and receives encrypted block data from the server device that is connected to the network. A data management method for a data management system having a client terminal for playback, wherein the server device transmits the encrypted block data to the client terminal, and the client terminal is transmitted from the server device. A receiving step of receiving the encrypted block data; a decrypting step in which the client terminal decrypts the received encrypted block data using an encryption key; and the client terminal stores the decrypted data in a data storage means. A data storing step for storing, and the client terminal storing the data An encryption key generation step for generating an encryption key for decrypting the next encrypted block data based on the data stored in the storage means, and authentication based on the encryption key generated by the client terminal in the encryption key generation step A transmission step of transmitting a key to the server device; and an authentication step of authenticating the authentication key transmitted from the client terminal by the server device, wherein the encrypted block data of the server device is transmitted to the client terminal. In the transmission step of transmitting, the next encrypted block data is transmitted only when the authentication key is authenticated in the authentication step.
[0017]
In the present invention, in the transmission process of the server device, the next block data is transmitted only when the authentication key transmitted from the client terminal is authenticated. Therefore, the block data is transmitted to the client terminal that is not authenticated by the server device. Is transmitted, and data transmitted from the server device can be managed safely.
[0018]
  A client terminal according to the present invention is connected via a network to a server device that sequentially transmits encrypted block data that has been blocked and encrypted, and receives and reproduces encrypted block data from the server device A receiving means for receiving the encrypted block data transmitted from the server device; a decrypting means for decrypting the received encrypted block data; and a data storage means for storing the decrypted block data An encryption key generating means for generating an encryption key for decrypting the next encrypted block data based on the data stored in the data storage means, and an authentication key based on the encryption key generated by the encryption key generating means Transmitting means to transmit to the server device, and the receiving means is configured such that the server device uses the transmitting means. Characterized by receiving only following encryption block data when authenticating authenticates the signal has been said authentication key.
[0019]
  A server apparatus according to the present invention is a server apparatus that sequentially transmits encrypted block data that has been blocked and encrypted to a client terminal via a network, and transmits the encrypted block data to the client terminal. A transmitting means; a receiving means for receiving an authentication key transmitted from the client terminal; and an authenticating means for authenticating the authentication key received by the receiving means, wherein the authenticating means comprises the received authentication Authenticates that the key is an authentication key based on an encryption key for decrypting the next encrypted block data generated based on the encrypted block data in the client terminal, and the transmission means uses the authentication means to Only when the authentication key is authenticated, the next encrypted block data is transmitted.
[0029]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. As described above, after confirming that the user has actually viewed part of the content, a system that can provide the next part of content is desired. It is unrealistic to request explicit input feedback, such as pressing a button.
[0030]
By the way, in the case of an ordinary digital device, data is written in a VRAM (Video RAM) that is a display memory for digital data, and an image indicated by the data is displayed on the display. Therefore, in this embodiment, writing data into the VRAM is regarded as data display, and if the video data is not expanded in the VRAM, that is, if the video data is not displayed on the display, the next content is acquired. It provides a mechanism that cannot be done. In the following, a system for reproducing video data will be described, but it goes without saying that audio data can be similarly constructed.
[0031]
Hereinafter, a first embodiment of the present invention will be described. FIG. 1A is a block diagram schematically illustrating the data management system according to the first embodiment, and FIG. 1B is a schematic diagram illustrating content distributed from the server device to a client terminal that is a viewing terminal. FIG. As shown in FIG. 1 (a), the data management system 100 is composed of a server device 20a managed by a content distributor and a client terminal 10a for viewing the distributed content, both of which are connected via a network. It is connected. The server device 20a includes a content distribution server device 21a that actually distributes content and an authentication management server device 22 that manages the authentication key of the client terminal 10a. The client terminal 10a has a data viewing management unit 11a.
[0032]
As shown in FIG. 1B, the content distribution server device 21a is a partial content C obtained by dividing content C, which is video data representing one video, into a plurality of block data._n(C₁~ C_n) Are sequentially transmitted to the client terminal 10a. The block length (time length) of this block data may be fixed or variable. The client terminal 10a receives the partial content C transmitted from the content distribution server device 21a by the data viewing management unit 11a._nAre played (displayed) sequentially.
[0033]
The client terminal 10a sends a content viewing permission request R to the authentication management server device 22 of the server device 20.₀This request R₀Is accepted by the server device 20, the content distribution server device 21a receives the first content C.₁Is sent. Request R₀Alternatively, an authentication number or the like that can identify the client terminal 10b may be transmitted together.
[0034]
The client terminal 10a receives the first content C₁To the next partial content C by the method described later.₂Request R₁Key K to do₁Is generated. This key K₁Is transmitted to the authentication management server device 22 as authentication of the client terminal 10a. In this embodiment, the key K₁Is the authentication of the client terminal 10a and the content C₂Request R₁Shall be. This key K₁Is the key K₀Since it cannot be generated by a client terminal that does not have, it can be used for authentication of the client terminal 10a.
[0035]
The authentication management server device 22 receives the next content C that is additional data.₂Request R₁If there is a key K transmitted from the client terminal 10a₁Is confirmed, the next content C is sent to the content distribution server device 21a.₂Is transmitted to the client terminal 10a. The content distribution server device 21a follows this instruction to the next content C₂Is transmitted to the client terminal 10a. In the client terminal 10a, the next content C₂To K again₂Is generated. This key K₂Is content C₂Next content C₃Request R₂And used for authentication of the client terminal 10a.
[0036]
Next, the above-described key generation will be described. FIG. 2 is a block diagram showing the data viewing management unit 11a of the client terminal 10a. The data viewing management unit 11a is a partial content C composed of video data transmitted from the content distribution server device 21a._nAnd a receiving unit (not shown) for receiving the partial content C_nThe video display memory unit 2 for storing the key K and the key K based on the video data written in the video display memory unit 2_nNext key generation unit 3a for generating_nIs provided with a memory position designating unit 4 for designating an address of data in the video display memory unit 2.
[0037]
The video display memory unit 2 is a video display memory called a so-called VideoRAM or frame buffer. This video display memory unit 2 has a partial content C_nIs supplied and developed, a video is displayed on a video display device (not shown). This video display memory unit 2 has a partial content C_nIs supplied, an address in the video display memory unit 2 is specified by the memory position specifying unit 4.
[0038]
The next key generation unit 3a uses the data at the address designated by the memory location designation unit 4 in the video display memory unit 2 to generate the key K_nIs generated. For example, four addresses A1 to A4 in video data are designated, and a key K obtained by connecting the data of these addresses A1 to A4._nIs generated. Key K generated here_nIncludes the following partial content C_{n + 1}To key K_{n + 1}For specifying the address in the video display memory unit 2 for generating the key K_nIs supplied to the memory location specifying unit 4. This key K_nIs sent from the transmission unit (not shown) to the authentication management server device 22 shown in FIG._{n + 1}Request R_nAnd an authentication key for authenticating the client terminal 10a.
[0039]
The memory location designating unit 4 has a key K_nTo the next key K_{n + 1}Get the address to generate. Next partial content C_{n + 1}Is written in the video display memory unit 2, the memory location specifying unit 4 displays the key K_nThe address of the video display memory unit 2 can be designated by the address acquired from the above. As a result, the next key generation unit 3a uses the key K_{n + 1}Can be generated.
[0040]
Partial content C_nIs video data for a plurality of frames. The next key generation unit 3a may generate keys in all frames, but when content is transmitted in real time from the content distribution server device 21a, the key K is set frame by frame._nIt is not realistic to send the request to the authentication management server 22 as an authentication and request the next frame data._nFor example, a key is generated from the first frame. Hereinafter, a frame for generating a key is referred to as a key frame. The memory position designating unit 4 designates an address in the key frame._nKey K instead of the first frame in_nHowever, it is also possible to include information indicating what number frame is used as the key frame, together with information for designating the address of the key frame. In this way, the data of the designated address in one frame or the main frame among the video frames in the partial content sent not in the whole frame but in a predetermined time unit can be used for key generation.
[0041]
Here, in the present embodiment, partial content C_nIf the video is not written and displayed in the video display memory unit 2 which is a VRAM, the next key K_nCannot be generated, and the next partial content C_{n + 1}Data that cannot be obtained. If it is not expanded in VRAM like this, the key K_nData that cannot be generated includes, for example, data that is interpolated at the time of expansion. Further, for example, the data of the address position specified by the memory position specifying unit 4 is obtained by calculation and the key K_nEven if it is possible to obtain the key K_nProcessing takes time, the processing load on the client terminal 10a is heavy, and the partial content C in real time_nWill not be able to play. Therefore, the key K is used by using the data expanded in the video display memory 2._nShall be obtained.
[0042]
Partial content C_nIs a voice data, for example, a time in the partial content may be specified and a key may be generated from the data at that time.
[0043]
In the present embodiment, the client terminal 10a transmits the partial content C that is divided and sent._nTo key K_nIs generated, and the next partial content C is generated._{n + 1}Request R_nAnd used for authentication of the client terminal 10a. As a result, in the client terminal 10a, the content C_nSince the key for authentication cannot be generated without viewing (playing), it is possible to prevent a part of the content such as a CM inserted in the middle of the content from being skipped and viewed without viewing. it can.
[0044]
In addition, the content encryption in the first embodiment is optional, and may or may not be performed. As a decryption key used when encrypted, a part of the above-described authentication key is used. Alternatively, all may be used, or a decryption key may be prepared separately.
[0045]
Next, a second embodiment of the present invention will be described. In the first embodiment described above, if the partial content is not displayed, the key for authenticating the client terminal cannot be generated and the next content is not transmitted. In the second embodiment, it is assumed that the server device transmits the encrypted content, and unless one partial content is decrypted, an encryption key for decrypting the next partial content cannot be obtained. It provides a mechanism that prevents content from being decrypted. In the following embodiments, the same components as those in the first embodiment shown in FIGS. 1 and 2 are denoted by the same reference numerals, and detailed description thereof is omitted.
[0046]
FIG. 3 is a block diagram schematically showing a data management system according to the second embodiment. As shown in FIG. 3, the server device 20b in the data management system 200 includes a key management server device 23 that performs key management of encrypted content instead of the authentication management server device 22 shown in FIG. The client terminal 10b has a data viewing management unit 11b.
[0047]
Partial content C transmitted by content distribution server device 21b in the present embodiment to client terminal 10b_nIs encrypted. The client terminal 10b receives the partial content C transmitted from the content distribution server device 21b by the data viewing management unit 11b._nAre sequentially decoded and displayed.
[0048]
In this system 200, the client terminal 10b sends a request R for permission to view content to the key management server device 22 of the server device 20.₀This request R₀Is accepted by the server device 20, the key management server device 22 sends the initial key K to the client terminal 10b.₀Will be notified. This initial key K₀Is the first content C transmitted from the content distribution server device 21b.₁Is a decryption key for decrypting. Where initial key K₀May be previously owned by the client terminal 10b as a key unique only to the client terminal 10b. Request R₀Are transmitted together with an authentication number or the like that can identify the client terminal 10b. Thereafter, from the content distribution server device 21b, the content C_nAre sent sequentially.
[0049]
The client terminal 10b receives the first content C₁The initial key K₀Decrypted by Then, the client terminal 10b₁And the next partial content C by the method described later.₂Encryption key K required to decrypt₁Is generated.
[0050]
The content distribution server device 21b receives the partial content C_nWill be delivered sequentially. In the present embodiment, partial content C_nIs encrypted and cannot be decrypted by a client terminal that does not have an initial key, so there is no need to authenticate each partial content.
[0051]
Next, generation of the above-described encryption key will be described. FIG. 4 is a block diagram showing the data viewing management unit 11b of the client terminal 10b. The data viewing management unit 11b is a partial content C composed of encrypted video data transmitted from the content distribution server device 21b._nAnd a receiving unit (not shown) for receiving the partial content C from the receiving unit._n, A decryption unit 1 for decrypting the video data, a video display memory unit 2 for storing the decrypted video data, and an encryption key K based on the video data written in the video display memory unit 2_nA next key generation unit 3b for generating the encryption key K_nIs provided with a memory position designating unit 4 for designating an address of data in the video display memory unit 2.
[0052]
The decryption unit 1 includes an encryption key K generated by the encryption key generation unit 3b._n-1Is supplied, and the decryption unit 1 uses the encryption key K_n-1Is used as a decryption key, and content C is encrypted video data sent from the content distribution server device 21b._nAnd decoded video data D_nIs sent to the video display unit 2.
[0053]
The next key generation unit 3b uses the video data at the address designated by the memory location designation unit 4 in the video display memory unit 2 to use the encryption key K_nIs generated. This encryption key K_nIncludes the following partial content C_{n + 1}To encryption key K_{n + 1}For specifying an address in the video display memory unit 2 for generating the encryption key K._nIs supplied to the memory location specifying unit 4. In the present embodiment, the encryption key K_nTo the next partial content C_{n + 1}Encryption key K for use as a decryption key for decrypting the data of_nIs supplied to the decoding unit 1.
[0054]
In the decryption unit 1, the next partial content C_{n + 1}Is supplied and the encryption key K_nAs the decryption key, the next partial content C_{n + 1}And the decoded video data D_{n + 1}Is written in the video display memory unit 2, the memory location specifying unit 4 stores the encryption key K_nThe address of the video display memory unit 2 is designated by the address acquired from the above. As a result, the next key generation unit 3b uses the encryption key K_{n + 1}Can be generated.
[0055]
In the present embodiment, the encrypted partial content C_nIs displayed and the next partial content C is not decrypted._{n + 1}Can not be decrypted, only the client terminal that is authenticated first and receives the initial key can decrypt the partial contents to the end. The copyrights of the parties are protected. Further, as in the first embodiment, since the decryption key for decrypting the next content cannot be generated unless the content is once displayed, the viewer is prevented from partially viewing the content.
[0056]
Next, a third embodiment of the present invention will be described. The present embodiment is a combination of the first embodiment and the second embodiment, in which the server device sequentially distributes the encrypted partial content, and the client terminal The key generated from the above is used as authentication and also as a decryption key.
[0057]
FIG. 5 is a block diagram schematically showing a data management system according to the third embodiment. As shown in FIG. 5, the server device 20c in the data management system 300 performs key management of encrypted content instead of the authentication management server device 22 shown in FIG. 1, and also performs key management for authenticating the client terminal. A server device 24 is provided. The client terminal 10c has a data viewing management unit 11c.
[0058]
As shown in FIG. 1B, the content distribution server device 21c divides content C, which is video data indicating one encrypted video, into partial content C that is divided into predetermined time units (predetermined blocks)._n(C₁~ C_n) Are sequentially transmitted to the client terminal 10c. The client terminal 10c receives the partial content C transmitted from the content distribution server device 21c by the data viewing management unit 11c._nAre sequentially decoded and displayed.
[0059]
FIG. 6 is a diagram showing a data flow in the data management system according to the present embodiment. First, the client terminal 10c sends a content viewing permission request R to the key management server device 22 of the server device 20c.₀This request R₀Is accepted by the server device 20c, the key management server device 24 sends an initial key K to the client terminal 10c.₀Is notified, and the content distribution server device 21c receives the first content C.₁Is sent.
[0060]
The client terminal 10c receives the first content C₁The initial key K₀Decrypted by Then, the client terminal 10c₁And the next partial content C by the same method as in the second embodiment.₂Encryption key K required to decrypt₁Is generated. Next, the client terminal 10c sends the next content C to the server device 20c.₂Request R₁And the encryption key K₁Is transmitted to the key management server device 24 as authentication of the terminal 10c. In this embodiment, the encryption key K₁Is the authentication of the client terminal 10c and the content C₂Request R₁Shall be. This encryption key K₁Is the initial key K₀Since it cannot be generated by a client terminal that does not have, it can be used as authentication of the client terminal 10c.
[0061]
The key management server device 24 uses the next content C as additional data.₂Request R₁If there is an encryption key K transmitted from the client terminal 10c₁Is confirmed, the next content C is sent to the content distribution server device 21c.₂Is transmitted to the client terminal 10c. The content distribution server device 21c follows the instruction and the next content C₂Is transmitted to the client terminal 10c. In the client terminal 10c, the first content C₁Encryption key K obtained from₁Next content C₂Is used as the decryption key for decryption and at the same time the encryption key K₂Is generated. This encryption key K₂Is content C₂Next content C₃Request R₂And content C₃Used to decrypt In this way, the client terminal 10c transmits the partial content C that is divided and sent._nAre sequentially decrypted and output, and the encryption key K_nIs used to generate the next partial content C_{n + 1}Request R_nAnd the next partial content C_{n + 1}Used as a decryption key for Then, the server device 20c receives the partial content C_nAre sequentially transmitted according to the request from the client terminal 10c.
[0062]
Next, generation of the above-described encryption key will be described. FIG. 7 is a block diagram showing the data viewing management unit 11c of the client terminal 10c. The data viewing management unit 11c according to the present embodiment uses the encryption key K generated by the next key generation unit 3c._nHowever, it differs from the data viewing management unit 11b shown in FIG. 4 in that it is sent from a transmission unit (not shown) to the key management server device 24 shown in FIG. The other points are the same as those of the data viewing management unit 11b in the second embodiment.
[0063]
The operation of the data management system according to this embodiment will be described below. FIG. 8A and FIG. 8B are diagrams showing the operation of the entire data management system, and are flowcharts showing the operation on the server device side and the operation on the terminal side, respectively. First, as described above, the client terminal 10c shown in FIG. 8A first sends a content viewing request R to the key management server device 24.₀The initial key K₀As a result, the client terminal 10c sequentially acquires the content C_nAs well as the encryption key K_nIs generated. Then, the client terminal 10c causes the content distribution server device 21c to send the content C_nAnd the content distribution server device 21c responds to the request for distribution of content C._nAre sequentially delivered to the client terminal 10c.
[0064]
That is, as shown in FIG. 8A, the content distribution server device 21c is configured to generate a partial content C that is encrypted video data._nIs delivered to the client terminal 10c (step S1), and the partial content C_nIs transmitted, the next content request R is sent from the client terminal 10c._nWait until you receive Actually, the next content request R so that continuous viewing is possible._nIs the previous partial content C_nIs received before the transmission ends (step S2).
[0065]
In the present embodiment, as described above, the current partial content C_nEncryption key K obtained by decrypting_nTo the next partial content C_{n + 1}Request R_nAnd also used as an authentication key. Therefore, the key management server device 24 uses the encryption key K that is the next content request sent from the client terminal._nIt is determined whether or not the (authentication key) is a correct authentication key (step S3). If the authentication key is not correct, the content distribution server device 21c is instructed to stop the content distribution at this time. On the other hand, if it is authenticated that the authentication key is correct, the process returns to step S1, and the content distribution server device 21c determines that the next content C_{n + 1}Will be sent.
[0066]
Further, as shown in FIG. 8 (b), the client terminal 10c receives content C that is encrypted video data._nIs received (step S11), and the first content C is received.₁In the case of the initial key K transmitted from the key management server device 24 by the decrypting unit 1 shown in FIG.₀Is decoded and written into the video display memory unit 2 to display the video. Partial content C other than the first_nIn the case of the encryption key K generated by the key generation unit 3c_n-1To use content C_nIs decoded and written into the video display memory unit 2 to display the video (step S12).
[0067]
When the decrypted video is written in the video display memory unit 2, the next content C for obtaining the next data is obtained by the encryption key generation unit 3c._{n + 1}Encryption key K_nIs generated (step S13). And this encryption key K_nIs transmitted to the key management server device 24, the key management server device 24 authenticates the client terminal 10c, and the next content C is received from the content distribution server device 21c._{n + 1}Is sent.
[0068]
Next, the encryption key generation method will be described in more detail. FIG. 9 is a flowchart showing an encryption key generation method of the client terminal 10c. As shown in FIG. 9, when the decryption unit 1 shown in FIG. 7 receives the encrypted data (step S21), the previous partial content C_n-1Encryption key K obtained from_n-1As a decryption key, and the decoded video data D_nIs sent to the video display memory unit 2 (step S22).
[0069]
The memory position designating unit 4 determines whether or not the frame of the decoded video data sent to the video display memory unit 2 is a key frame (step S23), and if it is a key frame, the video display memory unit 2 Among the video data written in the data, the data at the address (address) designated by the memory location designation unit 4 is sent to the next key generation unit 3c (step S24).
[0070]
The next key generation unit 3c uses this value to generate the next encryption key K_nIs generated (step S25). This encryption key K_nIs the next content C_{n + 1}And is sent to the decryption unit 1 and used as a decryption key for the encryption key K_nTo the next encryption key K_{n + 1}An address value for designating an address necessary for generating is acquired and supplied to the memory location designating unit 4 (step S26). Also, the encryption key K_nIs sent to the key management server device 24 and the next partial content C_{n + 1}Request R_nAnd used for authentication of the client terminal 10c (step S27). Thereafter, the processes in steps S21 to S27 are repeated until the last content is decrypted.
[0071]
Where encryption key K_nIn the simplest case, it is possible to always specify the same address, or to specify a different address for each key frame position.
[0072]
Also, the generated encryption key K_nTo the key management server device 24, the partial content C which is the next video data block_{n + 1}And the key management server device 24 side receives the received encryption key K_nIs confirmed to be correct, the partial content C which is the next video data block_{n + 1}By transmitting the partial content C at the client terminal 10c._nThe next content C only if is actually displayed_{n + 1}Can be obtained. This authentication is based on the encryption key K_nThe encryption key K_nOr encryption key K_nYou may send data generated from as authentication. For example, a unique key unique to the client terminal 10c is prepared, and the generated encryption key K_nIs encrypted, and with this unique key, the encryption key K_nYou may use what decrypted as authentication. Similarly, the encryption key K_nIs used as the decryption key, but the encryption key K_nPart or encryption key K_nThe data generated by a predetermined method may be used as the decryption key.
[0073]
Furthermore, by giving an ID for identifying the hardware of the client terminal 10c as a video display device, it is possible to control so that only video data having a unique key corresponding to the client terminal 10c can be displayed.
[0074]
In this way, if a partial video showing a part of the video is not actually displayed, it is possible to acquire the next content by guaranteeing that the viewer has viewed it as desired by the distribution company by creating a mechanism that cannot acquire the next content. Can be provided.
[0075]
It should be noted that the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the present invention. For example, the content is transmitted from the server device to the client terminal via the network, but the decryption data in which the decryption key for decrypting the encrypted data is decrypted from the encrypted data temporally before the encrypted data. The provider provides the client with the encrypted data stored in the recording medium or the like whose decryption key is obtained by decrypting and reproducing the previous encrypted data. It is also possible to use a terminal as shown in FIG. 7 as a decryption device and decrypt the encrypted data. Since such encrypted data cannot be decrypted unless it is actually displayed, it is possible to protect the interests of the provider that provides the encrypted data. In this case, the receiving means described in FIG. 7 is not necessary.
[0076]
In the above-described embodiment, the hardware configuration has been described. However, the present invention is not limited to this, and arbitrary processing may be realized by causing a CPU (Central Processing Unit) to execute a computer program. Is possible. In this case, the computer program can be provided by being recorded on a recording medium, or can be provided by being transmitted via the Internet or another transmission medium.
[0077]
Also, as described above, audio data can be managed in the same way. That is, for example, encrypted audio data is transmitted from the server device every predetermined time unit (each block), decrypted by the encryption key, and then reproduced by writing the audio data in the audio reproduction memory area. Do. Then, the data at the specified address in the voice memory area is used to generate the next key, the next key is requested by notifying the generated key to the server device, and the server device receives the received data block. By confirming that the encryption key is correct, the next audio data block is transmitted, so that the audio data can be handled in the same manner as the video data.
[0078]
【The invention's effect】
As described above in detail, the data management system according to the present invention is connected to a network and sequentially transmits blocked block data, and receives block data from the server apparatus connected to the network. A data management system having a client terminal for reproducing the data, wherein the client terminal stores a data storage means for storing the block data, and a key generation means for generating an authentication key based on the data stored in the data storage means And transmitting means for transmitting the authentication key generated by the key generating means to the server device, wherein the server device authenticates the authentication key transmitted from the client terminal, and the authentication means Transmitting means for transmitting the next block data only when the authentication key is authenticated by Since it is not possible to acquire an authentication key for acquiring the content that is the next partial video unless actually viewing a partial video or partial audio indicating a part of video or audio data that is divided and transmitted from the server device, It is possible to provide a service that distributes video / music while guaranteeing that the viewer has watched, that is, the viewer has watched the video. Since the user cannot receive music distribution, it is possible to exclude users who are only interested in copying.
[0079]
The data management system according to the present invention receives a server device connected to a network and transmitting a plurality of encrypted encrypted data, and the encrypted data transmitted from the server device connected to the network. A data management system comprising: a client terminal, wherein the server device includes at least transmission means for transmitting the encrypted data; the client terminal includes decryption means for decrypting the encrypted data; and the decryption means Data storage means for storing the decrypted data decrypted in accordance with the above, and encryption key generation means for generating an encryption key based on the decrypted data stored in the data storage means, wherein the decryption means of the client terminal includes the encryption key An encryption key generated from the first decrypted data obtained by decrypting the first encrypted data is provided by the generating means. And the second encrypted data next to the first encrypted data is decrypted using the encryption key, so that the partial video or a part of the video or audio data that is divided and transmitted from the server device or Since the content that is the next partial video cannot be decrypted unless the partial audio is actually viewed, the viewer can skip the data and view the previous encryption while protecting the content provider's interest. If the data is not decrypted, the next encrypted data cannot be decrypted. Therefore, it is possible to safely manage the data transmitted by the server device by eliminating the user who is only intended for copying.
[Brief description of the drawings]
FIG. 1A is a block diagram schematically showing a data management system according to a first embodiment of the present invention, and FIG. 1B shows content delivered from a server device to a client terminal that is a viewing terminal. It is a schematic diagram.
FIG. 2 is a block diagram showing a data viewing management unit of the client terminal 10a according to the first embodiment of the present invention.
FIG. 3 is a block diagram schematically showing a data management system according to a second embodiment of the present invention.
FIG. 4 is a block diagram illustrating a data viewing management unit of a client terminal 10b according to a second embodiment of the present invention.
FIG. 5 is a block diagram schematically showing a data management system according to a third embodiment of the present invention.
FIG. 6 is a diagram showing a data flow in a data management system according to a third embodiment of the present invention.
FIG. 7 is a block diagram illustrating a data viewing management unit of a client terminal 10b according to a third embodiment of the present invention.
FIGS. 8A and 8B are diagrams showing the operation of the entire data management system in the third embodiment of the present invention, showing the operation on the server device side and the operation on the terminal side, respectively. It is a flowchart.
FIG. 9 is a flowchart showing an encryption key generation method of a client terminal in the third embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Decoding part, 2 Video display memory part, 3a, 3b, 3c Next key generation part, 4 Memory position designation part, 10a, 10b, 10c Client terminal, 11a, 11b, 11c Data viewing management part, 20a, 20b, 20c Server Device, 21a, 21b, 21c content distribution server device, 22 authentication management server device, 23, 24 key management server, 100, 200, 300 data management system

Claims (16)

A server device connected to a network and sequentially transmitting encrypted block data that has been blocked and encrypted, and a client terminal connected to the network for receiving and reproducing encrypted block data from the server device A data management system,
The client terminal is configured to decrypt the encrypted block data, a data storage unit that stores the decrypted block data, and a decryption unit that decrypts the next encrypted block data based on the data stored in the data storage unit. Encryption key generation means for generating the encryption key, and transmission means for transmitting an authentication key based on the encryption key generated by the encryption key generation means to the server device,
The server device includes authentication means for authenticating the authentication key transmitted from the client terminal, and transmission means for transmitting the next encrypted block data only when the authentication key is authenticated by the authentication means. Characteristic data management system. The client terminal sends an authentication key based on an initial key for decrypting first encrypted block data of a series of encrypted block data to the server device,
The data management system according to claim 1, wherein the server device transmits the first encrypted block data only when the authentication key transmitted from the client terminal is authenticated. The data storage means is a VRAM (video memory),
The client terminal is a display device that displays data written in the VRAM,
The data management system according to claim 1, wherein the encryption key generation unit generates the encryption key when the data is written in the VRAM and displayed on the display device. The encryption key generating means of the client terminal has position specifying means for specifying an address of data stored in the data storage means, and uses the data of the address specified by the position specifying means to use the encryption key. The data management system according to claim 1, wherein: 5. The data management system according to claim 4, wherein the position specifying means uses position specifying information based on an encryption key from the encryption key generating means for address specification for generating the next encryption key. The encrypted data is obtained by encrypting a plurality of frame data,
The data management system according to claim 4, wherein the position specifying means of the client terminal specifies an address in predetermined frame data determined in advance among a plurality of frame data. The encrypted data is obtained by encrypting a plurality of frame data,
5. The data management system according to claim 4, wherein the position specifying means of the client terminal specifies a key frame which is one of a plurality of frame data and specifies an address in the key frame. A server device connected to a network and sequentially transmitting encrypted block data that has been blocked and encrypted, and a client terminal connected to the network for receiving and reproducing encrypted block data from the server device A data management method for a data management system, comprising:
A transmission step in which the server device transmits the encrypted block data to the client terminal;
A receiving step in which the client terminal receives the encrypted block data transmitted from the server device;
A decrypting step in which the client terminal decrypts the received encrypted block data using an encryption key;
A data storage step in which the client terminal stores the decrypted data in a data storage means;
An encryption key generating step for generating an encryption key for the client terminal to decrypt the next encrypted block data based on the data stored in the data storage means;
A transmission step in which the client terminal transmits an authentication key based on the encryption key generated in the encryption key generation step to the server device;
An authentication step in which the server device authenticates the authentication key transmitted from the client terminal;
In the transmission step of transmitting the encrypted block data of the server device to the client terminal, the next encrypted block data is transmitted only when the authentication key is authenticated in the authentication step. Method. The data storage means is a VRAM (video memory),
The client terminal is a display device that displays data written in the VRAM,
9. The data management method according to claim 8, wherein, in the encryption key generation step, the encryption key is generated when the data is written in the VRAM and displayed on the display device. The encryption key generation step of the client terminal includes a position specifying step for specifying an address of data stored in the data storage means, and the encryption key is generated using data at the address specified in the position specifying step. The data management method according to claim 8, wherein: 11. The data management method according to claim 10, wherein, in the location designation step, location designation information based on an encryption key from the encryption key generation means is used for address designation for the next encryption key generation. A client terminal connected via a network to a server device that sequentially transmits encrypted block data that has been blocked and encrypted, and receives and reproduces the encrypted block data from the server device,
Receiving means for receiving the encrypted block data transmitted from the server device;
Decryption means for decrypting the received encrypted block data;
Data storage means for storing the decoded block data;
An encryption key generating means for generating an encryption key for decrypting the next encrypted block data based on the data stored in the data storage means;
Transmission means for transmitting an authentication key based on the encryption key generated by the encryption key generation means to the server device,
The client terminal characterized in that the receiving means receives the next encrypted block data only when the server device authenticates and authenticates the authentication key transmitted by the transmitting means. The data storage means is a VRAM (video memory),
The client terminal is a display device that displays data written in the VRAM,
The client terminal according to claim 12, wherein the encryption key generation unit generates the encryption key when the data is written in the VRAM and displayed on the display device. The encryption key generating means has a position specifying means for specifying an address of data stored in the data storage means, and generates the encryption key using data at the address specified by the position specifying means. The client terminal according to claim 12. 15. The client terminal according to claim 14, wherein the position specifying means uses position specifying information based on the encryption key from the encryption key generating means for address specification for generating the next encryption key. A server device that sequentially transmits encrypted block data that has been blocked and encrypted to a client terminal via a network,
Transmitting means for transmitting the encrypted block data to the client terminal;
Receiving means for receiving an authentication key transmitted from the client terminal;
Authentication means for authenticating the authentication key received by the receiving means,
The authenticating means authenticates that the received authentication key is an authentication key based on an encryption key for decrypting the next encrypted block data generated based on the encrypted block data in the client terminal;
The server device, wherein the transmitting unit transmits the next encrypted block data only when the authentication key is authenticated by the authentication unit.

Images