JP3916217B2 - Bridge device and transmission method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a bridge device and a transmission method for transmitting content transmitted on a network to another network.
[0002]
[Prior art]
Currently, high-speed and multifunctional data transmission using digital transmission is rapidly spreading. In digital transmission, it is easy to falsify and copy data (content) flowing on a transmission path, and a protection technique for the content is required. For this purpose, there is a DTCP (Digital Transmission Content Protection) standard as one of the standardized technologies (see http://www.dcp.com). This is a technology developed to protect digital synchronous packet data that flows on the IEEE 1394 high-speed serial bus from being tampered with or protected from illegal duplication. Its specifications are disclosed at the above URL. Yes. This technology has already been used when data is exchanged between Digital TV and Digital VHS.
[0003]
The DTCP standard is not limited to the IEEE 1394 high-speed serial bus, but is being extended to a standard for transmission on another bus standard such as USB (Universal Serial Bus).
[0004]
In DTCP, when the transmission device resumes after stopping the transmission of the content, the transmission device must change the key and send it. The receiving device can detect the stop of content transmission, but cannot accurately determine exactly, so it is necessary to check the key number (the key number that changes every time content is transmitted) with the AKE (Authentication & Key Exchange) command. there were. In addition, when a single content is received by a plurality of receiving devices, the number of content transmissions is limited, so that the transmitting device records the number of receiving devices to be authenticated and exceeds the limit (62). Since the authentication cannot be performed, the transmitting device counts the number of receiving devices to be authenticated in response to a request from the receiving device.
[0005]
When performing DTCP processing across different buses, the different buses are connected by a DTCP bridge device, and processing is performed via the DTCP bridge device. The DTCP bridge device is classified into a type in which DTCP processing is directly performed between nodes on different buses, and a type in which nodes on different buses respectively perform DTCP processing with DTCP bridge devices.
[0006]
In the latter DTCP bridging device, when a plurality of receiving devices are bridged, the bridging device makes an authentication request by indicating to the transmitting device by certification information that it is a bridge. If there is this information, the transmitting device counts the number of authentication requests even from the same device.
[0007]
In the latter type of DTCP bridge device, when the bridge device receives data (content) from a transmitting device on the network and transmits data to a plurality of receiving devices on another network, When transmission is interrupted and resumed, it is necessary to inform the receiving device.
[0008]
The reason is as follows. When the transmission of data from the transmitting device is interrupted, if the transmission of data from the bridge device to the receiving device is similarly interrupted, an authentication request is received from a plurality of receiving devices on another network after the restart. If the transmission of data from the transmitting device is interrupted by disturbance such as noise, an authentication request from another network is generated each time. Therefore, it is conceivable to transmit an empty packet without interrupting data transmission from the bridge device to the receiving device.
[0009]
However, if the transmission of data from the transmission device is not interrupted by noise and the transmission device intentionally interrupts the transmission of content, an authentication request must be made. In addition, in this case, the bridge device is not allowed to make an authentication request on behalf. This is because in this case, the bridge device needs to make multiple authentication requests (to ensure that the number of transmitting devices can be counted correctly), but the first authentication request is accepted, but (because of the limited number of devices). There is a possibility that the second authentication request is rejected by the transmitting device (when the transmitting device authenticates up to (number limit-1)). Therefore, it is necessary for the receiving device to make an authentication request again.
[0010]
[Problems to be solved by the invention]
As described above, the receiving device receiving data via the bridge device needs to know whether the content of the transmitting device has changed.
[0011]
An object of the present invention is to provide a bridge device and a transmission method in which a receiving device receiving data via a bridge device can know a change in content transmitted from a transmitting device.
[0012]
[Means for Solving the Problems]
To achieve the above object, the bridge device of the invention according to claim 1 receives content transmitted over a network, decrypts the received content with the first secret key, and then uses the second secret key. The bridge device for transmitting the encrypted content to another network has an identification information adding means for adding identification information for identifying the first secret key to the content encrypted with the second secret key. .
[0013]
The bridge device of the invention according to claim 2 is characterized in that, in claim 1, the identification information adding means adds the key number of the first secret key to the content encrypted with the second secret key. To do.
[0014]
In the transmission method of the invention according to claim 3, the bridge device that has received the content transmitted over the network decrypts it with the first secret key, encrypts it with the second secret key, and transmits it to another network. In this transmission method, identification information for identifying the first secret key is added to the content encrypted by the bridge device using the second secret key.
[0015]
According to a fourth aspect of the present invention, there is provided a transmission method according to the third aspect, wherein the identification information is a key number of a first secret key.
[0016]
The transmission method of the invention according to claim 5 is such that the content received by the bridge device that has received the content transmitted from the transmitting device on the network is decrypted with the first secret key and then encrypted with the second secret key. In the transmission method for transmitting converted content to a receiving device on another network , identification information for identifying the change of the first secret key when the bridge device resumes receiving after stopping receiving , If identification information bridge device is added is the same as before the stop, the receiving device is characterized by not perform re-authentication of the second secret key.
[0017]
Further, the transmission method of the invention according to claim 6 is such that the content received by the bridge device that has received the content transmitted from the transmitting device on the network is decrypted with the first secret key and then encrypted with the second secret key. In the transmission method for transmitting converted content to a receiving device on another network , identification information for identifying the change of the first secret key when the bridge device resumes receiving after stopping receiving , When the identification information added by the bridge device is different from that before the stop, the receiving device re-authenticates the second secret key.
[0018]
With such a configuration, it is possible to provide a bridge device and a transmission method in which a receiving device receiving data via the bridge device can know a change in content transmitted from the transmitting device.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the bridge device of the present invention. The bridge device 1 includes a first network interface (network I / F) 2 for receiving from a transmitting device on the network, and a data decrypting unit 3 for decrypting the content received by the first secret key shared with the transmitting device, The content decrypted by the decrypting unit 3 is encrypted using a second secret key shared between the bridge device 1 and the receiving device that is on a different network from the transmitting device and receives the content transmitted from the bridge device. A data encryption unit 4 is provided. The second secret key is shared by the receiving device and the bridge device 1 through authentication.
[0020]
The bridge device 1 also includes a key number adding unit 5 that adds a key number to the encrypted content. The key number adding unit 5 adds the key number of the first secret key shared with the transmitting device to the content encrypted by the data encryption unit 4. Since this key number is added to the content, the receiving device receiving it can recognize the change of the secret key of the content itself. As a result, unnecessary authentication of the secret key from the receiving device accompanying reception interruption due to reception failure such as noise is prevented. This key number corresponds to the secret key on a one-to-one basis and may be information that can identify the secret key, or may be information sufficient to identify the secret key even if it is not one-to-one.
[0021]
Furthermore, the bridge device 1 includes a second network interface (network I / F) 6 for transmitting the content with the key number added thereto to the receiving device.
[0022]
FIG. 2 is a block diagram showing a schematic configuration of a network in which the bridge device 1 is used. The bridge device 1 receives the content transmitted from the transmission device 7 provided in the network A, and adds a key number after decryption and encryption as described above to the network B different from the network A. The content is transmitted to the receiving device 8 provided.
[0023]
An example of a data format transmitted from the bridge device 1 to the receiving device 8 is shown in FIG. FIG. 3 shows an example of a frame format when a 1394 Isochronous packet is transmitted on an 802.11a packet. In the figure, the contents of each area of the data format are as follows. (1) Frame Control is information about a frame such as frame type identification, presence / absence of subsequent fragments, retransmission frame identification, and the like. (2) Duration ID is the total time of all sequences related to frame transmission, or an ID number assigned to each station from the access point. (3) Add1 is a destination address. (4) Add2 is a source address. (5) Add3 and Add4 are addresses used when relaying between access points. (6) SEQ Ctrl is a management number for fragmentation and order control. (7) Frame Body is payload data to be transmitted. (8) Data Type is the type of packet data, and in this example is “1394 Isochronous Packet”. (9) Key No is a key number embedded in Frame Body. (10) Frame Body is content data to be transmitted. (11) FCS is a data check field.
[0024]
Next, the operation of the bridge device of the present invention will be described with reference to FIGS. FIG. 4 is a flowchart for explaining a normal operation. As shown in FIG. 4A, the bridge device 1 receives content from the transmission device 7 on the network A. The content is protected by DTCP, and the transmission device 7 and the bridge device 1 share the secret key A_kx1. The bridge device 1 decrypts the encrypted content transmitted using the shared secret key A_Kx1.
[0025]
The bridge device 1 encrypts the decrypted content and transmits it to the receiving device 8 on another network B. For encryption, the private key B_kx1 that is shared by the bridge device 1 and the receiving device 8 is used. When transmitting the encrypted content, the bridge device 1 transmits not only the encrypted content packet but also the key number A_k1 of the secret key A_kx1 indicated as Key No in FIG. The secret key A_kx1 and the key number A_k1 have a one-to-one correspondence, and the key number A_k1 can identify the secret key A_kx1.
[0026]
The receiving device 8 decrypts the received content using the secret key B_kx1 that is shared with the bridge device 1.
[0027]
Next, as illustrated in FIG. 4B, when the transmission of content from the transmission device 7 stops, the bridge device 1 stops transmission to the reception device 8 on the network B.
[0028]
Thereafter, as shown in FIG. 4C, when the transmission of the content is resumed from the transmission device 7 and the bridge device resumes the reception, the bridge device 1 confirms and changes the key number transmitted by the transmission device 7. If it is, re-authenticate. A key number A_k2 of a new common secret key A_kx2 obtained as a result of re-authentication is embedded in a packet to be transmitted to the receiving device 8 on the network B, and is transmitted together with content data.
[0029]
The receiving device 8 confirms the key number embedded in the received content and can recognize that the content private key is different from the previous one because it is different from before the content transmission stop. In this case, the receiving device makes an authentication request to the bridge device 1 again to obtain a new secret key, and decrypts the content using the obtained secret key.
[0030]
Next, an operation when the bridge device 1 cannot receive content from the transmission device 7 due to some cause such as noise will be described with reference to FIG. As shown in FIG. 5A, as in FIG. 4A, the bridge device 1 receives content from the transmitting device 7 on the network A. The content is protected by DTCP, and the transmission device 7 and the bridge device 1 share the secret key A_kx1. The bridge device 1 decrypts the encrypted content transmitted using the shared secret key A_Kx1.
[0031]
The bridge device 1 encrypts the decrypted content and transmits it to the receiving device 8 on another network B. For encryption, the private key B_kx1 that is shared by the bridge device 1 and the receiving device 8 is used. When transmitting the encrypted content, the bridge device 1 transmits not only the encrypted content packet but also the key number A_k1 of the secret key A_kx1. The secret key A_kx1 and the key number A_k1 have a one-to-one correspondence.
[0032]
The receiving device 8 decrypts the received content using the secret key B_kx1 that is shared with the bridge device 1.
[0033]
Next, as illustrated in FIG. 5B, when the bridge device 1 cannot receive the content transmitted from the transmission device 7 due to noise or the like, the bridge device 1 receives the reception device 8 on the network B. Stop sending to.
[0034]
Thereafter, as shown in FIG. 5C, when the bridge device 1 resumes receiving the content transmitted from the transmission device 7, the bridge device 1 confirms the key number transmitted by the transmission device 7. If the key number transmitted by the transmitting device 7 is not different from that before the content transmission is stopped, the bridge device 1 does not re-authenticate. Then, the bridge device 1 transmits the same key number A_kx1 as before the stop of content transmission to the receiving device 8 on the network B together with the content data.
[0035]
The receiving device 8 recognizes that the key number embedded in the content received from the bridge device 1 is the same as the key number before the transmission of the content is stopped, and as a result, the content transmitted when the reception is resumed is the same content as before the stop. It can be recognized that there is. No new authentication request is made for the same content, and the count of the number of receiving devices 8 of the transmitting device 7 is not updated excessively.
[0036]
As described above, when the bridge device 1 notifies the receiving device 8 of the key number obtained by authentication with the transmitting device 7 together with the content, the receiving device 8 confirms this key number and the secret key of the content transmitted. Can recognize changes.
[0037]
The bridging device of the present invention can be applied not only when a wired network and a wireless network are bridged but also when a wireless network and a wireless network are bridged.
[0038]
【The invention's effect】
According to the invention described in detail above, it is possible to provide a bridge device and a transmission method in which a receiving device receiving data via the bridge device can know a change in content transmitted from the transmitting device. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a bridge device according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a network in which the bridge device according to the embodiment of the present invention is used.
FIG. 3 is a schematic diagram showing an example of a format of content transmitted by the bridge device according to the embodiment of the present invention.
FIG. 4 is a flowchart showing the operation of the bridge device of FIG. 1;
FIG. 5 is a flowchart showing another operation of the bridge device of FIG. 1;
[Explanation of symbols]
1 ... Bridge device,
2 ... 1st network I / F,
3 ... data decoding part,
4 ... Data encryption part,
5 ... Key number adding part,
6 ... Second network I / F,
7 ... Transmitting equipment,
8 ... Receiving equipment

Claims (6)

In a bridge device that receives content transmitted over a network, decrypts the received content with a first secret key, and then transmits the content encrypted with the second secret key to another network,
A bridge device comprising: identification information adding means for adding identification information for identifying the first secret key to the content encrypted with the second secret key.   The bridge device according to claim 1, wherein the identification information adding means adds the key number of the first secret key to the content encrypted with the second secret key. In a transmission method in which a bridge device that has received content transmitted over a network decrypts it with a first secret key and then encrypts it with a second secret key and transmits it to another network.
A transmission method, wherein identification information for identifying a first secret key is added to content encrypted by the bridge device using a second secret key.   4. The transmission method according to claim 3, wherein the identification information is a key number of a first secret key. The content received by the bridge device that has received the content transmitted from the transmitting device on the network is decrypted with the first secret key, and then the content encrypted with the second secret key is transmitted to the receiving device on the other network. In the transmission method to
Upon receiving resumed after the bridge device receives stopped, if the identification information stored in the first identification information is a by bridge device for identifying a change in the private key is added is the same as before the stop, the The transmission method, wherein the receiving device does not re-authenticate the second secret key. The content received by the bridge device that has received the content transmitted from the transmitting device on the network is decrypted with the first secret key, and then the content encrypted with the second secret key is transmitted to the receiving device on the other network. In the transmission method to
When reception is resumed after the bridge device has stopped receiving, if the identification information added to the bridge device is different from the pre-stop identification information for identifying a change in the first secret key , the receiving device Performs a re-authentication of the second secret key.

Images