JP4346490B2 - ENCRYPTION DEVICE, INFORMATION REPRODUCTION DEVICE, ENCRYPTION METHOD, AND INFORMATION REPRODUCTION METHOD - Google Patents

Description

  The present invention relates to an encryption device, an information reproduction device, an encryption method, and an information reproduction method for preventing digitally recorded data from being copied from a recording medium.

  Conventionally, as a medium for recording digitized information (for example, a document, sound, image, program, etc.), there are a compact disk and a laser disk as a sound and image recording medium. In addition, a program or data recording medium such as a computer includes a floppy disk and a hard disk. In addition to these recording media, DVDs (digital video discs), which are large-capacity recording media, have been developed.

  In various digital recording media as described above, digital data is recorded as it is (including those that can be decoded and compressed), so the recorded data can be copied to other media. To do so, for example, it is possible to easily copy without loss of sound quality and image quality, to make a large number of duplicates, and there has been a problem such as infringement of copyright.

  As described above, when copying from a digital recording medium, there is no deterioration in sound quality and image quality, and copying can be performed while maintaining the sound quality and image quality of the master. For this reason, there has been a problem that an illegal act of selling media without paying a copyright fee can be performed by an illegal copy called a pirated version.

  The present invention has been made in view of the above circumstances, and provides an encryption device, an information reproduction device, an encryption method, and an information reproduction method for preventing unauthorized copying from a digitally recorded recording medium. With the goal.

The encryption device according to the present invention includes a first encryption unit that encrypts data with a first key, and a second encryption unit that encrypts the first key with a plurality of predetermined second keys. Encryption means, a third encryption means for encrypting the first key with the first key itself, and the first key generated by the first encryption means. Data, a plurality of first keys respectively encrypted with the plurality of second keys generated by the second encryption means, and the first key generated by the third encryption means. And a recording means for recording the first key encrypted with the key itself on a recording medium .

  Preferably, the recording means records data encrypted with the first key in a data area portion of the recording medium, and a plurality of first keys respectively encrypted with the plurality of second keys. The key and the first key encrypted with the first key itself may be recorded in the lead-in area portion of the recording medium.

The encryption apparatus according to the present invention includes a first encryption unit that encrypts data with a third key, a second encryption unit that encrypts the third key with a first key, Third encryption means for encrypting the first key with a plurality of predetermined second keys, and fourth encryption means for encrypting the first key with the first key itself And data encrypted with the third key generated by the first encryption means, and third data encrypted with the first key generated by the second encryption means. A key, a plurality of first keys respectively encrypted with the plurality of second keys generated by the third encryption means, and the first key generated by the fourth encryption means Recording means for recording the first key encrypted with the key itself onto a recording medium is provided.

  Preferably, the recording means records the data encrypted with the third key in a data area part of the recording medium, and the third key encrypted with the first key; The plurality of first keys encrypted with the plurality of second keys and the first key encrypted with the first key itself may be recorded in the lead-in area portion of the recording medium. Good.

  Preferably, the data may be video or music content, and the recording medium may be a DVD.

In addition, the information reproducing apparatus according to the present invention includes MPEG2 data encrypted with the first key, and the first key and the first key itself encrypted with two or more predetermined second keys, respectively. The first key encrypted with the predetermined two or more second keys read from the medium on which the first key encrypted with the first key is recorded, and the first key itself. First decryption means for decrypting the first key by a predetermined method using the encrypted first key and the second key recorded in the apparatus so as not to be taken out from the outside. And decrypting the MPEG2 data encrypted with the first key, read from the medium, with the decrypted first key inputted from the first decryption means. And the MPEG decoded by the second decoding means. Bei example the MPEG2 decoder means for decoding the data, the first decoding means, when decoding the first key in the predetermined manner, in the two or more second key predetermined Each of the encrypted first keys is decrypted with a second key recorded in the device so as not to be taken out from the outside, and a first key candidate obtained thereby, Determining whether or not the first key that is the source of the first key encrypted by the first key itself matches is determined until the second match is obtained in the determination. If the match is obtained in the determination, the first key candidate that has been determined, or the first key itself, is repeatedly performed while changing the first key encrypted with the key. The first key obtained by decrypting the first key encrypted in step 1 with the first key candidate is It is intended to force,
The first decryption means decrypts the first key candidate value and the first key encrypted with the first key itself as the determination by using the first key candidate. Whether or not the obtained value matches, or the value obtained by encrypting the first key candidate with the first key candidate and the first key itself is the value of the first key and wherein the this is performed to determine whether or not to match a.

The present invention also provides an encryption method in an encryption apparatus comprising a first encryption means, a second encryption means , a third encryption means, and a recording means , wherein the first encryption means Thus, a first step of encrypting data with a first key and a second step of encrypting the first key with a plurality of predetermined second keys by the second encryption means, respectively. The third step of encrypting the first key with the first key itself by the third encryption unit, and the step generated by the recording unit in the first step. Data encrypted with the first key, a plurality of first keys respectively encrypted with the plurality of second keys generated in the second step, and generated in the third step And a first key encrypted with the first key itself as a recording medium. Encryption method; and a fourth step of recording the.

  Preferably, in the fourth step, the recording means records the data encrypted with the first key in a data area portion of the recording medium and encrypts the data with the plurality of second keys. The plurality of first keys and the first key encrypted with the first key itself may be recorded in the lead-in area portion of the recording medium.

Further, the present invention is an encryption method in an encryption apparatus comprising a first encryption means, a second encryption means, a third encryption means , a fourth encryption means, and a recording means , A first step of encrypting data with a third key by the first encryption means, and a second step of encrypting the third key with the first key by the second encryption means. The second step of encrypting the first key with a plurality of predetermined third keys by the third encryption unit, and the fourth encryption unit, A fourth step of encrypting the first key with the first key itself; data encrypted with the third key generated in the first step by the recording means; A third key encrypted with the first key generated in step 2, and the first key A plurality of first keys respectively encrypted with the plurality of second keys generated in the step, and a first key encrypted with the first key itself generated in the fourth step. And a fifth step of recording the key on the recording medium .

Preferably, in the fifth step, the recording means records the data encrypted by the recording means with the third key in a data area portion of the recording medium and encrypts the data with the first key. Read the third key, the plurality of first keys encrypted with the plurality of second keys, and the first key encrypted with the first key itself from the recording medium. You may make it record in an in-area part.
Preferably, the data may be video or music content, and the recording medium may be a DVD.

The present invention also provides an information reproduction method in an information reproduction apparatus comprising a first decoding means, a second decoding means, and an MPEG2 decoder means, wherein the first decoding means uses a first key. From the medium on which the MPEG2 data encrypted with the first key encrypted with the two or more predetermined second keys and the first key encrypted with the first key itself are recorded. The read first key encrypted with the predetermined two or more second keys, the first key encrypted with the first key itself, and the device itself from the outside A first step of decrypting the first key by a predetermined method using the second key recorded so that it cannot be taken out, and the second key is read from the medium by the second decryption means. MPEG2 data encrypted with the first key is A second step of decrypting with the decrypted first key inputted from the decryption means, and the MPEG2 decoder means for decoding the MPEG2 data decrypted by the second decryption means And in the first step, the first decryption means decrypts the first key by the predetermined method in the two or more predetermined steps. The first key obtained by decrypting one of the first keys encrypted with the second key with the second key recorded in the device so as not to be taken out from the outside. Is determined in the determination to determine whether or not the candidate of the first key and the first key that is the source of the first key encrypted by the first key itself match. Until the first key encrypted with the second key If the match is obtained in the determination, the first key candidate for which the determination is made or the first key encrypted with the first key itself is A first key obtained by decrypting with one key candidate, and in the first step, the first decrypting means determines, as the determination, the first key candidate Whether or not a value matches a value obtained by decrypting the first key encrypted with the first key itself with the first key candidate, or the first key To determine whether the value obtained by encrypting the first key candidate with the first key candidate itself matches the value of the first key encrypted with the first key itself. and wherein and a call.

  Preferably, the data includes at least one of key information, a document, sound, an image, and a program.

  The recording medium can be applied to various media such as a DVD, CD-ROM, floppy disk, and hard disk.

  According to the present invention, only a legitimate one having at least one of the plurality of second keys can obtain the first key, and hence the plain data of the data encrypted with the first key. Can be obtained. As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  In addition, according to the present invention, for example, the encryption unit and the decryption unit can be designed separately from the core part of the reproduction part of a digital recording / reproduction device, etc. It is only necessary to exchange the encoding unit and the decoding unit.

  Each of the inventions related to the above devices is also established as an invention related to a method and an invention related to a storage medium, and each invention related to the above method is an invention related to an apparatus and an invention related to a storage medium, respectively. Also holds.

  The first aspect of the present invention also provides a digital recording medium that records digital data encrypted with a predetermined first session key and a first session key encrypted with a predetermined master key. A decryption method for obtaining plaintext of data, wherein a decryption unit generates a second session key based on a predetermined random number, and decrypts the generated second session key with the master key The second session key decrypted with the master key is transmitted from the decryption unit to the encryption unit, and the second session key decrypted with the transmitted master key is transmitted by the encryption unit, Encrypting with the master key, taking out the second session key, and using the second session key taken out by the encryption unit, the recording medium The first session key encrypted with the master key read out from the server is encrypted, and encrypted from the encryption unit to the decryption unit using the second session key, and encrypted with the master key. The first session key encrypted with the master key encrypted with the transmitted second session key at the decryption unit. Decrypting using the second session key, extracting the first session key encrypted with the master key, and further extracting the first session key encrypted with the extracted master key with the master key. Decrypting and taking out the first session key, and using the taken out first session key, the first session key read out from the recording medium It decodes the digital data encrypted with the session key, and wherein the obtaining the plaintext of the digital data.

  The present invention 2 includes digital data encrypted with a predetermined first session key, a first session key encrypted with a predetermined master key of a plurality of predetermined master keys, A decryption method for obtaining a plaintext of the digital data from a recording medium on which a first session key encrypted with one session key itself is recorded, wherein a decryption unit generates a predetermined random number To generate a second session key, decrypt the generated second session key with a predetermined master key, and decrypt it with the predetermined master key from the decryption unit to the encryption unit. The second session key is transmitted, and the second session key decrypted with the transmitted predetermined master key is transmitted by the encryption unit to the predetermined session key. The second session key is extracted by encrypting with a star key, and the encryption unit encrypts with the predetermined master key read from the recording medium using the second session key extracted. The encrypted first session key is encrypted, and the first session key itself read out from the recording medium is encrypted using the extracted second session key. Encrypting the session key, transmitting the first session key encrypted with the predetermined master key, encrypted with the second session key, from the encryption unit to the decryption unit; The first session key encrypted using the first session key and encrypted with the first session key itself is transmitted to the decryption unit. The first session key encrypted with the predetermined master key encrypted using the transmitted second session key is decrypted using the second session key, and the predetermined session key is decrypted. The first session key encrypted with the master key and the first session key encrypted with the transmitted first session key and encrypted with the transmitted second session key Is decrypted using the second session key, the first session key encrypted with the first session key itself is extracted, and the decryption unit encrypts it with the predetermined master key extracted. A first session key candidate obtained by decrypting the converted first session key with one of a plurality of predetermined master keys, and the extracted first session key When the first session key encrypted with one session key itself matches the one decrypted with the first session key candidate, the first session key candidate is designated as the predetermined first session. Using the obtained first session key as a key, the digital data encrypted with the first session key read from the recording medium is decrypted, and the plaintext of the digital data is obtained It is characterized by obtaining.

  The third aspect of the present invention includes a digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and the first session key itself. A decryption method for obtaining a plaintext of the digital data from a recording medium on which an encrypted first session key is recorded, wherein a second session based on a predetermined random number is performed in the decryption unit Generate a key, decrypt the generated second session key with a predetermined master key, and transmit the second session key decrypted with the predetermined master key from the decryption unit to the encryption unit And the encryption unit encrypts the second session key decrypted with the predetermined master key transmitted with the predetermined master key, and The session key is extracted, and the encryption unit encrypts the first session key encrypted with the master key read from the recording medium, using the extracted second session key. The first session key encrypted with the first session key read from the recording medium is encrypted using the extracted second session key, and the decryption unit is decrypted from the encryption unit. And transmitting the first session key encrypted with the master key, encrypted with the second session key, and encrypted with the second session key, The first session key encrypted with the session key itself is transmitted, and the decryption unit uses the transmitted second session key. The encrypted first session key encrypted with the master key is decrypted with the second session key, and the first session key encrypted with the master key is extracted and transmitted. The first session key encrypted with the first session key itself, decrypted with the second session key, and decrypted with the second session key, The first session key encrypted with the session key itself is extracted, and the decryption unit decrypts the first session key encrypted with the extracted master key with the predetermined master key. The first session key candidate and the first session key encrypted with the extracted first session key itself are used as the first session key candidate. When the first session key candidate is used as the predetermined first session key and the obtained first session key is used, the first session key candidate is read from the recording medium. The digital data encrypted with the first session key is decrypted to obtain a plaintext of the digital data.

  The present invention 4 includes digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and the first session key itself. A decryption method for obtaining a first session key used for decrypting the digital data from a recording medium on which an encrypted first session key is recorded, wherein the first session key is encrypted with the master key. The session key is decrypted with a predetermined one of the plurality of master keys to generate a first session key candidate, and the generated first session key candidate is used to generate the first session key candidate. The first session key encrypted with the session key itself is decrypted, and the first session key candidate and the first session key candidate decrypted by using the first session key candidate The first session key encrypted with the session key itself is compared, and if they match in the comparison, the first session key candidate is determined as the predetermined first session key. .

  A fifth aspect of the present invention is characterized in that, in any one of the first to third aspects of the present invention, the encryption unit and the decryption unit are integrated circuit elements formed independently.

  A sixth aspect of the present invention is characterized in that, in any one of the first to third aspects, transmission performed between the encryption unit and the decryption unit is performed using a CPU BUS.

  The present invention 7 is the invention according to any one of the above inventions 1 to 3, wherein the predetermined random number changes at least every time the recording medium is reproduced.

  The present invention 8 is characterized in that, in any one of the inventions 1 to 3, the predetermined random number is generated based on time information obtained at a predetermined timing.

  The predetermined timing is, for example, a timing when the recording medium is mounted on the driving device.

  A ninth aspect of the present invention is characterized in that, in any one of the first to fourth aspects, the data includes at least one of key information, a document, sound, an image, and a program.

  According to the tenth aspect of the present invention, there is provided a recording medium that records digital data encrypted with a predetermined first session key and a first session key encrypted with a predetermined master key. A decryption device for obtaining plaintext, the second session key generation means provided in the decryption unit for generating a different second session key according to a predetermined condition, and the generated second session key Decrypting the session key with the master key in the decryption unit, transmitting the data into the encryption unit, and encrypting the second session key with the master key in the encryption unit The data is encrypted with the master key read out from the recording medium using the extracting means and the second session key extracted by the means Means for encrypting the first session key and transmitting it to the decryption unit; and the encrypted first session key transmitted by the means into the decryption unit generated in the decryption unit. Means for obtaining the first session key by decrypting using the second session key and further using the master key, and using the first session key obtained by the means, the recording medium Means for decrypting the digital data encrypted with the first session key read out from the data to obtain a plaintext of the digital data.

  The present invention 11 is characterized in that, in the above invention 10, the second session key generation means generates a different second session key every time the recording medium is decrypted or according to time information. To do.

  A recording medium according to a twelfth aspect of the present invention includes a digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, The first session key encrypted with the session key itself is recorded.

  The recording medium can be applied to various media such as a DVD, CD-ROM, floppy disk, and hard disk.

  Each of the inventions related to the above devices is also established as an invention related to a method and an invention related to a storage medium, and each invention related to the above method is an invention related to an apparatus and an invention related to a storage medium, respectively. Also holds.

  According to the present invention, even if the data flowing in the signal line connecting the encryption unit and the decryption unit is stored, the data is encrypted and is necessary for encrypting the data. Since the information is generated based on random numbers and cannot be reproduced later, the stored data cannot be reproduced or used even if the master key in the decryption unit is broken. .

  As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  In addition, according to the present invention, the encryption unit and the decryption unit can be designed separately from the core part of the playback part of the digital recording / playback device, so that even if the encryption is broken, the encryption unit and the decryption unit It is only necessary to replace the conversion unit.

  According to the present invention, the digital data encrypted with the predetermined first session key and the first encrypted with the predetermined master key among the plurality of predetermined master keys are recorded on the recording medium. Recording one session key and the first session key encrypted with the first session key itself, so that the predetermined master key is any of a plurality of master keys, The decryption unit having a plurality of master keys can extract the first session key and decrypt the data using the first session key.

  According to the present invention, on the recording medium, digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and By recording the first session key encrypted with the first session key itself, the decryption unit having at least one of the plurality of master keys allows the first session to be recorded. The key can be taken out and the data can be decrypted by this first session key.

  According to the present invention, only a legitimate one having at least one of the plurality of second keys can obtain the first key, and hence the plain data of the data encrypted with the first key. Can be obtained.

  As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  Hereinafter, embodiments of the invention will be described with reference to the drawings.

In this embodiment, an operation for encrypting certain data a using the key K is expressed as E _K (a), and an operation for decrypting the certain data a using the key K is expressed as D _K (a). . By using this expression, for example, an operation of encrypting and decrypting certain data a using the key K is represented by D _K (E _K (a)).

In this embodiment, certain data may be decrypted first, and then the decrypted data may be restored to the original data. This is based on the fact that the decryption of data has the same effect as encryption due to the nature of encryption. In other words, in order to restore the decrypted data, the key used for decryption must be known, and if the key is known, the decrypted data is encrypted to obtain the first decrypted data. . In this operation, if the encryption key is x and the data is y,
E _x (D _x (y)) = y
It is represented by

  In the present embodiment, an example of a system that reads, decodes, decodes and reproduces image data recorded on a DVD and compressed and encrypted in accordance with a data compression standard called MPEG2 will be described.

(First embodiment)
The first embodiment will be described below.

  FIG. 1 is a block diagram showing a configuration of a system according to the first embodiment of the present invention. An example of the operation of this embodiment is shown in the flowchart of FIG.

The system according to the present embodiment is connected to a so-called CPU BUS of a CPU (not shown) used for reproduction provided in a computer such as a personal computer, and encrypted data (E _SK described later) (Data)) is configured to flow on the CPU BUS. In FIG. 1, only the part related to the CPU used for reproduction is shown.

  As shown in FIG. 1, the system according to the present embodiment is a DVD drive device (not shown) for reading data from the DVD 101, connected to the DVD drive device without a CPU BUS, or built in the DVD drive device. The encryption unit 107 and the decryption unit 114 are provided.

  The encryption unit 107 and the decryption unit 114 are connected to the CPU BUS110. Output of data from the decryption unit 114 is performed through, for example, an I / O port other than the CPU BUS. That is, in this embodiment, data input / output is performed without going through the CPU BUS, but the CPU BUS is used for data transfer between the encryption unit 107 and the decryption unit 114.

  The encryption unit 107 includes a demodulation / error correction circuit 117, a demodulation / error correction circuit 118, and an encryption circuit 104. In FIG. 1, two encryption circuits 104 are shown in the encryption unit 107, but it is assumed that there is actually one encryption circuit. It is assumed that the encryption unit 107 is formed as an independent IC chip. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107, but may be provided on the side of the preceding unit or the like (inside the DVD drive device).

On the other hand, the decryption unit 114 includes a decryption circuit 112 and a session key generation circuit 111 that generates a second session key S _K ′. In the present embodiment, it is assumed that the decoding unit 114 includes an MPEG decoder circuit 115 and a conversion circuit 116 that converts decoded image data from digital to analog. In FIG. 1, four decoding circuits 112 are shown in the decoding unit 114, but it is assumed that there is actually one decoding circuit. The decryption unit 114 is formed as an independent IC chip.

  Also, a master key to be described later is registered (created) in the encryption unit 107 and the decryption unit 114. The master key is recorded in a secret area inside the chip so that the user cannot intentionally take it out in each of the chip of the encryption unit and the chip of the decryption unit so that the user cannot obtain it from the outside. Shall.

  The overall control is controlled by a control unit (not shown). The control unit can be realized, for example, by executing a program by the CPU of the computer. Specific examples of control by the control unit include an instruction relating to reading of data from a DVD, designation of a data transmission destination, an instruction relating to data output from the decoding unit 114, and the like. In addition, for example, the trigger for starting the control unit may be triggered by a user via a user interface or may be triggered by a process in an application program.

In the present embodiment, the first session key is represented by S _K , the second session key is represented by S _K ′, the master key is represented by M _K , and image data (that is, a group of encrypted data) is represented by Data. These are all plaintext.

In FIG. 1, reference numeral 102 denotes E _MK (S _K ) generated by encrypting the first session key S _K using the master key M _K , and 103 denotes image data Data using the first session key S _K. E _SK (Data) generated by encryption, 105 is the master key M _K , 106 is the second session key S _K ′, 108 is the second session key S _K ′ and the master key M _K. D _MK (S _K ′) decrypted using the first session key E _MK (S _K ) encrypted using the master key M _K and encrypted using the second session key S _K ′ E _{SK ′} (E _MK (S _K )), and 113 represents the first session key S _K.

As shown in FIG. 3, on the DVD 101, E _MK (S _K ) generated by encrypting the first session key S _K using the master key M _K is a key recording area (read) in the innermost periphery. in-in area), the image data data first session key S _K E _SK generated by encrypting using (data) is assumed to be recorded in the data recording area (data area).

  The operation of this embodiment will be described below with reference to the flowchart of FIG.

In step S 1, the first session key E _MK (S _K ) encrypted using the master key M _K recorded on the DVD 101 by a DVD drive device (not shown) is read and taken into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

On the other hand, in step S2, in the decryption unit 114, the session key generation circuit 111 generates a second session key S _K ′ by inputting a random number, for example, time information from a clock (not shown). Then, the decryption circuit 112 decrypts the generated second session key S _K ′ using the master key M _K to generate D _MK (S _K ′), and sends it to the encryption unit 107 through the CPU BUS 110. send.

  As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.

  Alternatively, the session key generation circuit 111 may be composed of a random number generator for the key length, for example. Note that when a key is generated with a random number in which all bits may be 0 or 1, it is necessary to perform a check process or the like so that all bits do not become 0 or 1.

In step S3, in the encryption unit 107, the encryption circuit 104 encrypts D _MK (S _K ′) received through the CPU BUS 110 using the master key M _K. That is,
E _MK (D _MK (S _K ′)) = S _K ′
Thus, the second session key S _K ′ generated by the session key generation circuit 111 in the decryption unit 114 can be obtained.

Here, even if the second session key S _K ′ generated by the session key generation circuit 111 is stolen on the CPU BUS 110, it is not understood.

Next, in step S4, the encryption unit 107 uses the second session key S _K ′ obtained as described above to use the encrypted first session key E _MK (S _K ) is encrypted to generate E _{SK ′} (E _MK (S _K )), which is sent to the decryption unit 114 through the CPU BUS 110.

Next, in step S5, in the decryption unit 114, the decryption circuit 112 decrypts E _{SK ′} (E _MK (S _K )) received through the CPU BUS 110 using the second session key S _K ′. ,
D _{SK ′} (E _{SK ′} (E _MK (S _K ))) = E _MK (S _K )
Get.

Further, the decryption circuit 112 decrypts the obtained E _MK (S _K ) using the master key M _K.
D _MK (E _MK (S _K )) = S _K
Next, it is possible to obtain a first session key S _K.

After obtaining the first session key S _K As described above, in step S6, recorded on the DVD101 by the DVD driving unit (not shown), the image data encrypted using the first session key S _K E _SK (Data) is read and taken into the encryption unit 107. At that time, the demodulation / error correction circuit 118 performs demodulation and error correction in the data. Then, E _SK (Data) is sent to the encryption unit 107 through the CPU BUS110.

Next, in step S7, the decoding unit 114, the decoding circuit 112, the E _SK (Data) received via the CPU BUS 110, decrypted using the first session key S _K,
D _SK (E _SK (Data)) = Data
Thus, the encrypted image data can be decrypted to obtain plain data.

Then, for example, steps S6 and S7 are repeatedly performed until the processing of the data to be decoded (that is, E _SK (Data)) is finished or the processing is requested to be stopped.

  When the image data Data obtained as described above is compressed in accordance with, for example, the data compression standard of MPEG2, it is decoded by the MPEG decoder circuit 115 and converted into an analog signal by the D / A conversion circuit 116. Then, it is sent to a video device such as a television (not shown) and reproduced.

  Note that either step S1 or steps S2 and S3 may be executed first.

As for execution of step S6 and step S7, a method of sequentially performing in units of one E _SK (Data), or a predetermined number of E _SK (Data) is read in step S6, temporarily stored in a buffer, etc. A method of decoding E _SK (Data) in the buffer in step S7 or a method of performing steps S6 and S7 in a pipeline process is conceivable.

Further, when the image data E _SK (Data) is transferred from the decoding circuit 112 to the MPEG decoder circuit 115, it may be transferred in one Data unit or a predetermined number of Data units.

As described above, according to the present embodiment, when reproducing a medium in which the digitized data is encrypted and recorded (when decrypting the encrypted data), the decrypted data is stored in the CPU BUS of the computer. The second session key S _K ′ used for encryption of the first session key that does not flow and that is necessary for decryption of the encrypted data that flows to the CPU BUS is, for example, time data reproduction. Therefore, even if data flowing through the CPU BUS 110 is stored in the digital storage medium 211 from the signal line 210 as shown in FIG. 4, it cannot be reproduced or used.

  As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  In this embodiment, the circuit used for encryption and decryption can be designed separately from the core of the playback portion of a digital recording / playback device such as a DVD as can be seen from FIG. Even so, it is only necessary to exchange the decryption unit 114 (or the encryption unit 107 and the decryption unit 114).

  In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. The decoding unit 114 has one decoding circuit, but may be provided as two, three, or four decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.

  In addition, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.

(Second Embodiment)
Next, a second embodiment will be described.

  In the present embodiment, for example, a plurality of predetermined master keys are prepared, and one or a plurality of master keys are prepared for each predetermined unit such as a manufacturer of a decoding unit (or a DVD production / sales company). An example suitable for such allocation will be described.

  FIG. 5 is a block diagram showing a configuration of a system according to the second embodiment of the present invention. An example of the operation of this embodiment is shown in the flowcharts of FIGS.

The system according to the present embodiment is connected to a so-called CPU BUS of a CPU (not shown) used for reproduction provided in a computer such as a personal computer, and is encrypted data (E _SK (Data )) Is configured to flow on the CPU BUS. FIG. 5 shows only the part related to the CPU used for reproduction.

  As shown in FIG. 5, the system according to this embodiment is a DVD drive device (not shown) for reading data from the DVD 101, connected to the DVD drive device without a CPU BUS, or built in the DVD drive device. And an encryption unit 107 and a decryption unit 114a.

  The encryption unit 107 and the decryption unit 114a are connected to the CPU BUS110. Data output from the decryption unit 114a is performed through, for example, an I / O port other than the CPU BUS. That is, in the present embodiment, data input / output is performed without going through the CPU BUS, but the CPU BUS is used for data transfer between the encryption unit 107 and the decryption unit 114a.

  The encryption unit 107 includes a demodulation / error correction circuit 117, a demodulation / error correction circuit 118, and an encryption circuit 104. In FIG. 1, two encryption circuits 104 are shown in the encryption unit 107, but it is assumed that there is actually one encryption circuit. It is assumed that the encryption unit 107 is formed as an independent IC chip. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107, but may be provided on the side of the preceding unit or the like (inside the DVD drive device).

On the other hand, the decryption unit 114 a includes a decryption circuit 112, a session key generation circuit 111 that generates a second session key S _K ′, and a key determination circuit 120.

  Here, FIG. 6 shows a configuration example of the key determination circuit 120. The key determination circuit 120 includes a decryption circuit 112, a comparison circuit 121, and a gate circuit 122. In the present embodiment, it is assumed that the decoding unit 114a includes an MPEG decoder circuit 115 and a conversion circuit 116 for converting decoded image data from digital to analog.

  In FIG. 5 and FIG. 6, the decryption unit 114a includes a total of five decryption circuits 112 including the two decryption circuits 112 in the key determination circuit 120. Assume that there are two decoding circuits.

  It is assumed that the decryption unit 114a is formed as one independent IC chip.

  A master key described later is registered (built in) in the encryption unit 107 and the decryption unit 114a. The master key is recorded in a secret area inside the chip so that the user cannot intentionally take it out in each of the chip of the encryption unit and the chip of the decryption unit so that the user cannot obtain it from the outside. Shall.

  The overall control is controlled by a control unit (not shown). The control unit can be realized, for example, by executing a program by the CPU of the computer. Specific examples of the control by the control unit include an instruction relating to reading of data from a DVD, designation of a data transmission destination, an instruction relating to data output from the decoding unit 114a, and the like. In addition, for example, the trigger for starting the control unit may be triggered by a user via a user interface or may be triggered by a process in an application program.

In the present embodiment, the first session key is S _K , the second session key is S _K ′, the t-th master key among the n types of master keys is M _kt (where t = 1 to n), Image data (however, a group of encrypted data) is represented by Data. These are all plaintext.

In Figure 1, the E generated by encrypting _MKI (S _K) using the master key M _ki the first session key S _K 102-1, 102-2 first the first session key S _K E _Sk (S _K ) generated by encrypting with one session key S _K itself, 103 indicates E _SK (Data) generated by encrypting image data Data using the first session key S _K. 105 is the master key M _kj , 106 is the second session key S _K ′, 108 is the second session key S _K ′ decrypted using the master key M _kj , D _Mkj (S _K ′) _{Reference numeral} 109-1 denotes E _{SK ′} (E _MKi (S _K ) obtained by encrypting the first session key E _MKi (S _K ) encrypted using the master key M _ki using the second session key S _K ′. a)), is 109-2 encrypted with the first session key S _K itself The first session key E _Sk (S _K) the second session key S _K 'encrypted E _{SK using' (E Sk (S K)} ) which, first session key S _K 113 Respectively.

Here, the number of types of E _MKi (S _K ) generated by encrypting the first session key S _K recorded on the DVD 101 using the master key M _ki , and the master key M _{kj held} in the decryption unit 114a. For the setting of the number of types, for example, several methods are conceivable as shown below.

(Method 1) One master key E _MKi (S _K ) in which i is any one of 1 to n is recorded on the DVD 101, and n pieces corresponding to all of j = 1 to n are stored in the decryption unit 114a. A master key M _kj is provided.

(Method 2) One master key E _MKi (S _K ) corresponding to all i = 1 to n is recorded on the DVD 101, and j is any one of 1 to n in the decryption unit 114a. A master key M _kj is provided.

(Method 3) This is an extension of the above (Method 2). In the DVD 101, n master keys E _MKi (S _K ) corresponding to all of i = 1 to n are recorded, and the decryption unit 114a _stores them. Includes m master keys M _kj where j is m (2 <m <n) types preselected from 1 to n.

  Specific examples of numerical values include, for example, n = 100 or n = 400, and m = 2, 3, 4, or 10, but are not limited thereto.

(Method 4) In the example in which the DVD and the decoding unit are reversed in the above (Method 3), the DVD 101 has m (2 <m <n) types in which i is preselected from 1 to n. _M master keys E _MKi (S _K ) are recorded, and n master keys M _kj corresponding to all j = 1 to n are provided in the decryption unit 114a.

(Method 5) n master keys E _MKi (S _K ) corresponding to all i = 1 to n are recorded on the DVD 101, and n corresponding to all j = 1 to n is stored in the decryption unit 114a. _Number of master keys M _kj .

  In the methods 3 to 5, the decoding procedure is the same.

As shown in FIG. 3, on the DVD 101, one (in the case of the above (Method 1)) generated by encrypting the first session key S _K using the master key M _ki (in the case of (Method 1)) or a plurality (in the above case) E _MKI (S _K (method 2) to the case of (method 5))) is the innermost portion of the key recording area (lead-in area), the image data data using the first session key S _K It is assumed that E _SK (Data) generated by encryption is recorded in a data recording area (data area).

In the decoding unit 114, n (in the case of (Method 1), (Method 4), (Method 5) above), 1 (in the case of (Method 2) above), or m (in the case of (Method 2) above) It is assumed that the master key M _kj described above (in the case of method 3) is registered.

  It is assumed that one predetermined master key is registered in the encryption unit 107.

  Hereinafter, the (Method 1), (Method 2), and (Method 3 to Method 5) will be sequentially described.

  First, the operation of the present embodiment will be described with reference to the flowcharts of FIGS. 7 and 8 in the case of (Method 1).

In step S 11, the first session key E _Sk (S _K ) encrypted by the first session key S _K itself recorded on the DVD 101 by a DVD drive device (not shown) is read and taken into the encryption unit 107. . At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

In step S12, a first session key E _Mki (S _K ) (i = 1 to n) recorded on the DVD 101 by a DVD drive device (not shown) and encrypted using the master key M _ki . 1; i is unknown here) and read into the cryptographic unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

On the other hand, in step S13, in the decryption unit 114a, the session key generation circuit 111 generates a second session key S _K ′ by inputting random numbers, for example, time information from a clock (not shown). Then, the decryption circuit 112 decrypts the generated second session key S _K ′ using the master key M _kj (where j is a predetermined one of 1 to n), and D _Mkj ( S _K ′) is generated and sent to the encryption unit 107 through the CPU BUS 110.

  As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.

  Alternatively, the session key generation circuit 111 may be composed of a random number generator for the key length, for example. Note that when a key is generated with a random number in which all bits may be 0 or 1, it is necessary to perform a check process or the like so that all bits do not become 0 or 1.

In step S14, in the encryption unit 107, the encryption circuit 104 receives D _Mkj (S _K ′) received through the CPU BUS 110, the master key is the master key M _kj (where j is predetermined from 1 to n). Encryption). That is,
E _Mkj (D _Mkj (S _K ′)) = S _K ′
Thus, the second session key S _K ′ generated by the session key generation circuit 111 in the decryption unit 114a can be obtained.

Here, even if the second session key S _K ′ generated by the session key generation circuit 111 is stolen on the CPU BUS 110, it is not understood.

Next, in step S15, the encryption unit 107 uses the second session key S _K ′ obtained as described above to use the encrypted first session key E _Sk (S _K ) is encrypted to generate E _{SK ′} (E _Sk (S _K )), which is sent to the decryption unit 114a through the CPU BUS 110.

Similarly, in step S16, the encryption unit 107 uses the second session key S _K ′ obtained as described above to use the encrypted first session key E _Mki (S _K ) is encrypted to generate E _{SK ′} (E _Mki (S _K )), which is sent to the decryption unit 114a through the CPU BUS110.

Next, in step S17, in the decryption unit 114a, the decryption circuit 112 decrypts E _{SK ′} (E _Sk (S _K )) received through the CPU BUS 110 using the second session key S _{K ′.} ,
D _{SK ′} (E _{SK ′} (E _Sk (S _K ))) = E _Sk (S _K )
Get.

Similarly, in step S18, in the decryption unit 114a, the decryption circuit 112 decrypts E _{SK ′} (E _Mki (S _K )) received through the CPU BUS 110 using the second session key S _K ′. ,
D _{SK ′} (E _{SK ′} (E _Mki (S _K ))) = E _Mki (S _K )
Get.

Here, since the master key M _ki used to generate E _Mki (S _K ) is unknown, in step S19, the first session key S _K is used by using the key determination circuit 120 as shown below. Ask for.

  First, the principle of the key determination process will be described.

First, when E _Mki (S _K ) is decrypted with all the master keys M _kj (j = 1 to n),
S _kij = D _Mkj (E _Mki (S _K )) (j = 1 to n)
Is obtained. Here, any one of S _kij (j = 1 to n) is the first session key S _K.

Next, using the above E _Sk (S _K ), it is _checked which of the generated S _kij (j = 1 to n) is the first session key S _K.

Therefore, if E _Sk (S _K ) is decrypted with all the first session key candidates S _kij (j = 1 to n), respectively,
S _k ″ (i, j) = D _Skij (E _Sk (S _K ))
Is obtained.

Here, in the case of using the same master key M _kj and the master key M _ki used in generating the E _Mki (S _K) in a decoding unit, i.e., in the case of i = j, S _k ′ ′ (I, j) = S _kij = S _K.

Thus, for each _{S kij (j = 1~n),} S k '' (i, j) = by S _kij (j = 1~n) checks whether or not satisfied, S _k '' (i , j) = S _kij the S _kij satisfying the (j = 1~n), can be obtained as the first session key S _K. The master key used this time corresponds to j giving S _kij .

This operation is expressed in C language using C language notation as follows.
for (i = 1; i <n + 1; i ++) {
DS1 [i] = DMK [i] (EM _ki (S _k ));
DS2 [i] = DSK [i] (E _Sk (S _k ));
if (DS1 [i] == DS2 [i])
{
SK1 = DS2 [i];
break;
}
else EXIT_MISMATCH;
}
The second line of the above procedure shows an operation of decoding E _Mki (S _K ) using M _ki and substituting it into DS1 [i].

The third line of the above procedure shows an operation of decoding E _Sk (S _K ) using S _ki and substituting it into DS2 [i].

  The fourth line of the above procedure shows an operation for determining whether DS1 [i] and DS2 [i] match.

  The ninth line of the above procedure shows the operation when DS1 [i] and DS2 [i] do not match.

For example, in the key determination circuit 120 of FIG. 6, the decryption circuit 112 first decrypts E _Mki (S _K ) with the master key M _kj with j = 1.
S _kij = D _Mkj (E _Mki (S _K ))
Get.

Next, the decoding circuit 112 decodes E _Sk (S _K ) with S _kij ,
S _k ″ = D _Skij (E _Sk (S _K ))
Get.

Next, the comparison circuit 121 compares S _k ″ and = S _kij, and if they match, the gate circuit 122 is controlled to hold S _kij (FIG. _6A ) or S _k ″ (FIG. 6B) is output as the first session key S _K.

If they do not match, the same operation is repeated while incrementing j by 1 until the first session key _SK is obtained.

After obtaining the first session key S _K As described above, in step S20, and is recorded in DVD101 by the DVD driving unit (not shown), the image data encrypted using the first session key S _K E _SK (Data) is read and taken into the encryption unit 107. At that time, the demodulation / error correction circuit 118 performs demodulation and error correction in the data. Then, E _SK (Data) is sent to the encryption unit 107 through the CPU BUS110.

Next, in step S21, the decoding unit 114a, the decoding circuit 112, the E _SK (Data) received via the CPU BUS 110, decrypted using the first session key S _K,
D _SK (E _SK (Data)) = Data
Thus, the encrypted image data can be decrypted to obtain plain data.

Then, for example, step S20 and step S21 are repeated until the data to be decoded (that is, E _SK (Data)) is completed or the process is requested to be stopped.

  When the image data Data obtained as described above is compressed in accordance with, for example, the data compression standard of MPEG2, it is decoded by the MPEG decoder circuit 115 and converted into an analog signal by the D / A conversion circuit 116. Then, it is sent to a video device such as a television (not shown) and reproduced.

  Note that any of step S11, step S12, and steps S13 and S14 may be executed first.

  Further, any of steps S15 and S17 and steps S16 and S18 may be executed first.

As for execution of step S20 and step S21, a method of sequentially performing one E _SK (Data) unit or a predetermined number of E _SK (Data) is read in step S20, temporarily stored in a buffer, etc. A method of decoding E _SK (Data) in the buffer in step S21 or a method of performing steps S20 and S21 in a pipeline process is conceivable.

Further, when the image data E _SK (Data) is transferred from the decoding circuit 112 to the MPEG decoder circuit 115, it may be transferred in one Data unit or a predetermined number of Data units.

  As described above, according to the present embodiment, as in the first embodiment, even if data flowing through the CPU BUS is stored, it cannot be reproduced or used.

  As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  In addition, according to the present embodiment, information directly indicating the master key used for encrypting the first session key recorded on the recording medium is unnecessary, and is determined in advance when recording on a DVD or the like. A master key can be selected and used as appropriate within the range. Another advantage is that a master key that can be used for each predetermined unit such as a DVD production / sales company can be assigned.

  Of course, in this embodiment as well, the circuit used for encryption and decryption can be designed separately from the core part of the playback part of a digital recording / playback device such as a DVD. Therefore, even if the encryption is broken, decryption is possible. It is only necessary to exchange the unit 114a (or the encryption unit 107 and the decryption unit 114a).

  In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. In addition, the decoding unit 114a has one decoding circuit, but two, three, four, or five decoding circuits may be provided. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent as a set.

  Also, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.

Next, as described above (Method 2), n E _MKi (S _K ) corresponding to all i = 1 to n are recorded on the DVD 101, and j is set to 1 to 1 in the decoding unit 114a. The operation of the present embodiment will be described with reference to the flowcharts of FIGS. 7 and 8 in the case of providing one M _kj as any one of n.

In step S 11, the first session key E _Sk (S _K ) encrypted by the first session key S _K itself recorded on the DVD 101 by a DVD drive device (not shown) is read and taken into the encryption unit 107. . At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

In step S12, n first session keys E _Mki (S _K ) (i = 1 to n) recorded on the DVD 101 by a DVD drive device (not shown) and encrypted using the master key M _ki. ) And read into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

On the other hand, in step S13, in the decryption unit 114a, the session key generation circuit 111 generates a second session key S _K ′ by inputting random numbers, for example, time information from a clock (not shown). Then, the decryption circuit 112 decrypts the generated second session key S _K ′ using the master key M _kj (where j is a predetermined one of 1 to n), and D _Mkj ( S _K ′) is generated and sent to the encryption unit 107 through the CPU BUS 110.

  As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.

In step S14, in the encryption unit 107, the encryption circuit 104 receives D _Mkj (S _K ′) received through the CPU BUS 110, the master key is the master key M _kj (where j is predetermined from 1 to n). Encryption). That is,
E _Mkj (D _Mkj (S _K ′)) = S _K ′
Thus, the second session key S _K ′ generated by the session key generation circuit 111 in the decryption unit 114a can be obtained.

Here, even if the second session key S _K ′ generated by the session key generation circuit 111 is stolen on the CPU BUS 110, it is not understood.

Next, in step S15, the encryption unit 107 uses the second session key S _K ′ obtained as described above to use the encrypted first session key E _Sk (S _K ) is encrypted to generate E _{SK ′} (E _Sk (S _K )), which is sent to the decryption unit 114a through the CPU BUS 110.

Similarly, in step S16, the encryption unit 107 uses the second session key S _K ′ obtained as described above to use the encrypted n first session keys E recorded on the DVD 101. _Mki (S _K ) is respectively encrypted to generate E _{SK ′} (E _Mki (S _K )), which is sent to the decryption unit 114 a through the CPU BUS 110.

Next, in step S17, in the decryption unit 114a, the decryption circuit 112 decrypts E _{SK ′} (E _Sk (S _K )) received through the CPU BUS 110 using the second session key S _K ′. ,
D _{SK ′} (E _{SK ′} (E _Sk (S _K ))) = E _Sk (S _K )
Get.

Similarly, in step S18, in the decryption unit 114a, the decryption circuit 112 uses the n E _{SK ′} (E _Mki (S _K )) received through the CPU BUS 110 by using the second session key S _K ′. Decrypt each
D _{SK ′} (E _{SK ′} (E _Mki (S _K ))) = E _Mki (S _K )
Get.

Here, for each of the n E _Mki (S _K ) (i = 1 to n) recorded on the DVD 101, the master key M _ki used to generate it is unknown, and the decryption unit It is difficult to know which one corresponds to the master key M _kj provided in 114a. Therefore, in step S19, it obtains the first session key S _K using the key judging circuit 120 as described below.

  First, the principle of the key determination process will be described.

First, all E _Mki (S _K ) (i = 1 to n) are decrypted with the master key M _kj .
S _kij = D _Mkj (E _Mki (S _K )) (i = 1 to n)
Is obtained. Here, any one of S _kij (i = 1 to n) is the first session key S _K.

Next, using the above E _Sk (S _K ), it is _checked which of the generated S _kij (i = 1 to n) is the first session key S _K.

Therefore, if E _Sk (S _K ) is decrypted with all the first session key candidates S _kij (i = 1 to n), respectively,
S _k ″ (i, j) = D _Skij (E _Sk (S _K ))
Is obtained.

Here, in the case of using the same master key M _kj and the master key M _ki used in generating the E _Mki (S _K) in a decoding unit, i.e., in the case of i = j, S _k ′ ′ (I, j) = S _kij = S _K.

Thus, for each _{S kij (i = 1~n),} S k '' (i, j) = by S _kij (j = 1~n) checks whether or not satisfied, S _k '' (i , j) = S _kij the S _kij satisfying the (j = 1~n), can be obtained as the first session key S _K. The master key used this time corresponds to i giving S _kij .

For example, in the key determination circuit 120 of FIG. 6, the decryption circuit 112 first decrypts E _Mki (S _K ) with the master key M _kj with i = 1.
S _kij = D _Mkj (E _Mki (S _K ))
Get.

Next, the decoding circuit 112 decodes E _Sk (S _K ) with S _kij ,
S _k ″ = D _Skij (E _Sk (S _K ))
Get.

Next, the comparison circuit 121 compares S _k ″ and = S _kij, and if they match, the gate circuit 122 is controlled to hold S _kij (FIG. _6A ) or S _k ″ (FIG. 6B) is output as the first session key S _K.

If they do not match, the same operation is repeated while increasing i by 1 until the first session key _SK is obtained.

After obtaining the first session key S _K As described above, in step S20~S22 as described above, by using the first session key S _K, from the encrypted image data E _SK (Data) Image data Data is taken out.

  As described above, the image data Data is decoded by the MPEG decoder circuit 115, converted into an analog signal by the D / A conversion circuit 116, and sent to a video device such as a television (not shown) for reproduction. The

  In the case of Method 2, any of Step S11, Step S12, Steps S13 and S14 may be executed first.

  Further, any of steps S15 and S17 and steps S16 and S18 may be executed first.

  Further, the steps S12, S16, S18, and S19 may be performed batchwise for n (encrypted) master keys recorded on the DVD, but batches for every predetermined number of master keys. It may be performed manually or sequentially for each master key.

Further, in the case of sequentially performing every third master key, the second session key S _K ′ may be generated for each master key.

As for execution of step S20 and step S21, a method of sequentially performing one E _SK (Data) unit or a predetermined number of E _SK (Data) is read in step S20, temporarily stored in a buffer, etc. A method of decoding E _SK (Data) in the buffer in step S21 or a method of performing steps S20 and S21 in a pipeline process is conceivable.

Further, when the image data E _SK (Data) is transferred from the decoding unit 114 to the MPEG decoder circuit 115, it may be transferred in units of one Data or in units of a predetermined number of Data.

  As described above, according to the present embodiment, as in the first embodiment, even if data flowing through the CPU BUS is stored, it cannot be reproduced or used.

  As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.

  In addition, according to the present embodiment, the first session key encrypted using a plurality of master keys and the first session key encrypted by the first session key itself are stored in the recording medium. There is an advantage that the master key built in the decryption unit can be assigned to a predetermined unit, for example, each manufacturer of the unit.

  Also in this embodiment, the circuit used for encryption and decryption can be designed separately from the core part of the playback part of a digital recording / playback device such as a DVD, as can be seen from FIG. Even so, it is only necessary to exchange the decryption unit 114b (or the encryption unit 107 and the decryption unit 114b).

  In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. The decoding unit 114a has one decoding circuit, but may be provided as two, three, four, or five decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.

  Also, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.

Next, as described above (Method 3), n E _MKi (S _K ) corresponding to all i = 1 to n are recorded on the DVD 101, and j is set to 1 to 1 in the decoding unit 114a. It will be described with the m number of M _kj to m (<n) type ones of n.

  Since the basic configuration, operation, and effect of this method 3 are the same as those of the above method 2, only the differences will be described here.

In the method 2 described above, a single master key M _kj (any one of j = 1 to n) is provided in the decryption unit 114a. In addition, m (≧ 2) master keys M _kj are prepared. Then, for m master keys M _kj (where j is any one of j = 1 to n), the order used for the above-described key determination is determined in the decryption unit 114b.

At first, since n E _MKi (S _K ) corresponding to all i = 1 to n are recorded on the DVD 101, if the master key having the highest use order in the decryption unit 114b is used, it is possible to obtain a first session key S _K, in this case, the same operation as the method described above 2.

Next, in method 3, if any master key is broken, the master key is disabled, and thereafter, E _MKi (S _K ) corresponding to the disabled master key is recorded on the DVD 101. Consider the case of not doing so.

Here, the master key has become unavailable, if order of use is not 1-position of the master key, it is possible to obtain a first session key S _K, also in this case, the same operation as the above-mentioned method 2 become.

On the other hand, when the master key with the first use order becomes unusable, E _MKi (S _K ) corresponding to the master key is not recorded on the DVD 101, so the master key with the first use order is used. even, it is impossible to obtain a first session key S _K at step S19 described above. In such a case, if the master key is not unusable by performing the same operation as the method 2 using the master key with the second use order in the decryption unit 114a, the first session it is possible to obtain a key S _K.

Below, even if the master key of the order of use r position is unusable, if there is one order of use is not disabled in the r + 1 and after position of the master key, the first session key S _K in the same manner Obtainable.

  In this way, the present decryption unit 114a can be used until all m (≧ 2) master keys determined in the decryption unit 114a become unusable.

  The operation of (Method 5) described above is the same as that of (Method 3).

  In the above (Method 4), since information corresponding to all master keys is not stored in the DVD 101, information corresponding to the master key selected in the decryption unit is not recorded on the DVD 101. Cannot be decrypted in the same manner as in the case of the above-described unusable, and the master key of the next usage order is selected and decryption is attempted. Therefore, the operation of (Method 4) is the same as that of (Method 3).

By the way, in the present embodiment, the second session key S _K ′ is used to encrypt and securely transfer information on the CPU BUS 110. This second session key S _K ′ was generated in the decryption unit 114a and transmitted to the encryption unit 107 by a procedure using the master key. At this time, in the present embodiment, it is assumed that one predetermined master key is registered in the encryption unit 107.

Instead, a plurality of master keys are registered in the encryption unit 107, and the second session key S is used by using the procedure such as (Method 1) to (Method 5) described above using key determination. _K ′ may be transmitted from the decryption unit 114a to the encryption unit 107.

  For example, when the same master key registered in the decryption unit 114a is also registered in the encryption unit 107, the above (Method 5) is performed.

  When a plurality of master keys registered in the decryption unit 114a are registered in the encryption unit 107, the above (Method 3) is performed.

  Even when one master key is registered in the encryption unit 107, the procedure of (Method 2) described above can be used.

However, in these cases, the procedure of (Method 1) to (Method 5) is a procedure in which encryption and decryption are interchanged. That is, D _MKi (S _K ) and D _SK (S _K ) are transferred from the decryption unit 114 a to the encryption unit 107.

The configuration for safely transmitting the second session key S _K ′ from the decryption unit 114a to the encryption unit 107 via the CPU BUS 110 includes various configurations other than the configuration using the master key. Things are applicable. For example, the technique disclosed in “Nikkei Electronics No. 676 pp. 13-14 1996.11.18” can be applied. In this case, registration of the master key in the encryption unit 107 is not necessary.

(Third embodiment)
Next, a third embodiment will be described.

  This embodiment is, for example, a single DVD player.

  FIG. 9 is a block diagram showing a configuration of a system according to the second embodiment of the present invention. An example of the operation of this embodiment is shown in the flowchart of FIG.

  In the present embodiment, the part related to the operation of transferring the encryption key using the second session key between the encryption unit and the decryption unit is deleted from the configuration of the second embodiment.

  That is, as shown in FIG. 9, the system according to the present embodiment includes a DVD drive device (not shown) for reading data from the DVD 101, and a decoding unit 114b.

  The decryption unit 114b includes a decryption circuit 112, a key determination circuit 120, a demodulation / error correction circuit 117, and a demodulation / error correction circuit 118. In the present embodiment, it is assumed that the decoding unit 114 includes an MPEG decoder circuit 115 and a conversion circuit 116 that converts decoded image data from digital to analog.

  Here, the key determination circuit 120 includes a decryption circuit 112, a comparison circuit 121, and a gate circuit 122, as shown in one configuration example of FIG.

  9 and 6, the decryption unit 114b includes three decryption circuits 112 including the two decryption circuits 112 in the key determination circuit 120. Assume that there are two decoding circuits. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107 but may be provided on the side of the preceding unit or the like.

  It is assumed that the decryption unit 114b is formed as one independent IC chip.

  Also, a master key to be described later is registered (built in) in the decryption unit 114b. It is assumed that the master key is recorded in a secret area inside the chip so that the user cannot intentionally remove the master key so that the user cannot obtain it from the outside.

In this embodiment, the first session key is S _K , the second session key is S _K ′, the i-th one of the n types of master keys is M _ki (where i = 1 to n), Image data (however, a group of encrypted data) is represented by Data. These are all plaintext.

In Figure 1, the E generated by encrypting _MKI (S _K) using the master key M _ki the first session key S _K 102-1, 102-2 first the first session key S _K E _Sk (S _K ) generated by encrypting with one session key S _K itself, 103 indicates E _SK (Data) generated by encrypting image data Data using the first session key S _K. , 105 represents a master key M _kj , and 113 represents a first session key S _K.

Here, as in the second embodiment, the number of types of E _MKi (S _K ) generated by encrypting the first session key S _K recorded on the DVD 101 using the master key M _ki , Regarding the setting of the number of types of master keys M _{kj held in} the decryption unit 114b, for example, several methods can be considered as follows.

(Method 1) One E _MKi (S _K ) in which i is any one of 1 to n is recorded on the DVD 101, and n M _kj corresponding to all j = 1 to n are stored in the decoding unit 114b. Is provided.

(Method 2) On the DVD 101, n E _MKi (S _K ) corresponding to all i = 1 to n are recorded, and one M _kj in which j is any one of 1 to n in the decoding unit 114b. Is provided.

(Method 3) n E _MKi (S _K ) corresponding to all of i = 1 to n are recorded on the DVD 101, and j in the decoding unit 114b is m of 1 to n (2 <m <N) _Provide m M _kj types.

(Method 4) On the DVD 101, m master keys E _MKi (S _K ) are recorded and decrypted with m (2 <m <n) of i selected from 1 to n in advance. The unit 114b includes n master keys M _kj corresponding to all of j = 1 to n.

(Method 5) n master keys E _MKi (S _K ) corresponding to all i = 1 to n are recorded on the DVD 101, and n corresponding to all j = 1 to n is stored in the decryption unit 114b. _Number of master keys M _kj .

As shown in FIG. 3, on the DVD 101, one (in the case of the above (Method 1)) generated by encrypting the first session key S _K using the master key M _ki (in the case of (Method 1)) or a plurality (in the above case) E _MKI (S _K (method 2) to the case of (method 5))) is the innermost portion of the key recording area (lead-in area), the image data data using the first session key S _K It is assumed that E _SK (Data) generated by encryption is recorded in a data recording area (data area).

  Next, the operation of this embodiment will be described with reference to the flowchart of FIG. The operation of the present embodiment is obtained by deleting a part related to the operation of passing the encryption key between the encryption unit and the decryption unit using the second session key from the operation of the second embodiment. is there.

That is, in step S31, the first session key E _Sk (S _K ), which is recorded on the DVD 101 by the DVD drive device (not shown) and is encrypted with the first session key S _K itself, is read out, and the decryption unit 114b is read out. Into. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

In step S32, the first session key E _Mki (S _K ), which is recorded on the DVD 101 by a DVD drive device (not shown) and is encrypted using the master key M _ki , is read out, and is read into the decryption unit 114b. take in. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.

Next, in step S33, it obtains the first session key S _K using the key judging circuit 120.

Operation for obtaining the first session key S _K above, (method 1), (method 2), which varies (Method 3 Method 5), described in the already second embodiment also cases Since it is the same as that of a thing, description here is abbreviate | omitted.

After obtaining the first session key S _K, at step S34~S36 as described above, by using the first session key S _K, the image data Data from the encrypted image data E _SK (Data) Take out. The operations in steps S34 to S36 are the same as those in steps S20 to S22 (that is, in the first embodiment) already described in the second embodiment, except that image data Data is not transferred between the units via the CPU BUS. This is the same as steps S6 to S8) already described.

  As described above, the image data Data is decoded by the MPEG decoder circuit 115, converted into an analog signal by the D / A conversion circuit 116, and sent to a video device such as a television (not shown) for reproduction. The

  In the case of this method 3, either step S31 or step S32 may be executed first.

  In the case of (Method 2) and (Method 3 to 5), the steps S32 and S33 are performed for n (in the case of methods 2, 3, and 5) or m (in the case of method 4) recorded on the DVD. The (encrypted) master keys may be performed batchwise, but may be performed batchwise for each predetermined number of master keys, or may be performed sequentially for each master key.

As for execution of step S34 and step S35, a method of sequentially performing in units of one E _SK (Data), or a predetermined number of E _SK (Data) is read in step S20, temporarily stored in a buffer, etc. A method of decoding E _SK (Data) in the buffer in step S21 or a method of performing steps S20 and S21 in a pipeline process is conceivable.

Further, when the image data E _SK (Data) is transferred from the decoding unit 114 to the MPEG decoder circuit 115, it may be transferred in units of one Data or in units of a predetermined number of Data.

  According to the present embodiment, illegal copying of media can be prevented by illegal copying, and copyright can be protected.

  Further, according to the present embodiment, it is possible to appropriately select and use a master key within a predetermined range when recording on a DVD or the like. Alternatively, there is an advantage that a master key that can be used for each predetermined unit such as a DVD player manufacturer or a DVD production / sales company can be assigned and used.

  In this embodiment, the circuit used for encryption and decryption can be designed separately from the core of the playback portion of a digital recording / playback device such as a DVD as can be seen from FIG. Even so, it is only necessary to replace the decoding unit 114b.

  In the present embodiment, the decoding unit 114b has one decoding circuit, but may be provided as two or three decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.

  In addition, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.

  The first embodiment, the second embodiment (more specifically, three types of configurations), and the third embodiment (more specifically, three types of configurations) have been described above, but the present invention is limited to these. However, various modifications can be made.

  In each embodiment, the information recording medium is described as a DVD. However, the present invention can also be applied to other recording media such as a CD-ROM.

  In each embodiment, image data has been described as an example of information to be decoded. However, the present invention can also be applied to a reproducing apparatus for information in other forms such as voice, text, and a program.

In each embodiment, the data Data is image data, but a configuration in which the data Data is key information _Skt is also conceivable. That is, on a recording medium such as a DVD, in place of E _SK (Data), note of the E _SK (S _kt) and E _Skt (Data), shows the decoding unit 114 and 114a, in 114b in each of the embodiments According to the above procedure, S _kt can be obtained first, and E _Skt (Data) can be decrypted with this S _kt to obtain the actual content. Such key hierarchization can be performed over an arbitrary hierarchy.

  In each embodiment, the case where the information to be decoded is compressed according to the MPEG2 standard has been described as an example. However, the present invention is not limited to this, and the data may be compressed or encoded according to other standards. I do not care. In this case, another corresponding decoder circuit is provided instead of the MPEG decoder circuit 115. Further, it may not be encoded. In this case, the MPEG decoder circuit 115 is deleted.

  In addition, a plurality of types of decoding circuits are provided so that any of the data compressed by various methods (or data that does not need to be decoded) can be output, and these are used by switching appropriately (or not using them). It is also possible to configure. In this case, for example, a method of reading an identifier indicating a decoding to be used from a recording medium such as a DVD and selecting an appropriate decoding circuit or the like according to the identifier is conceivable.

  The configuration of the key determination circuit 120 of FIG. 6 shown in the second embodiment and the third embodiment is an example, and various other configurations can be considered.

Further, various other configurations for using E _SK (S _K ) as key determination information are conceivable. For example, D _SK (S _K ) is used as information used for key determination, and the key determination circuit 120 _decrypts E _Mki (S _K ) read from a recording medium such as a DVD by using the stored master key M _{kj. kij} = D _Mkj (E _Mki (S _K )) is obtained, and this S _kij is decoded by S _kij itself to obtain S _k ″ ′ = D _Skij (S _kij ). Next, this S _k ′ ′ And D _SK (S _K ) read from a recording medium such as a DVD are compared. If they match, the first session key S _K = S _kij is determined to be correct and output.

In addition, as another example of the key determination information, information obtained by performing encryption or decryption twice or more, for example, E _SK (E _SK (S _K )), D _SK (D _SK (S _K )), or each various things can be considered such as those corresponding to E _Mki (S _K) providing the _{E Mki (E Mki (S K} )).

In each embodiment, the key obtained by decryption using the procedure shown in (Method 1) to (Method 5) based on the key determination information is that the first session key is correct. However, by recording all E _Mki (S _K ) in the order of i on a recording medium such as a DVD and registering i and M _ki in association with each other in the decryption unit, key determination is performed. Information, a key determination procedure, and a configuration therefor can be omitted. When M _ki for a certain i becomes unusable, it is desirable to store information indicating invalidity instead of E _Mki (S _K ) in a recording medium such as a DVD.

Next, referring to FIG. 11, a DVD-ROM is taken as an example, and a disc manufacturer (assuming a manufacturer that produces DVDs of works such as movies and music) and a player manufacturer using the above-described third embodiment. (A single DVD player manufacturer) and a key management method by a key management organization that manages a master key will be described. In addition to content, Data may be key information as described above (the description of encryption, decryption, etc. using this key information _Skt when Data is key information _Skt is omitted). To do). In FIG. 11, a computer used for processing or the like is omitted.

  FIG. 12 is a diagram for explaining a system for encryption. The encryption circuits 301, 312, and 303 in FIG. 12 may be mounted on the same device (computer or the like) or on a different device (computer or the like). In the latter case, the device Information is exchanged between them. The encryption circuits 301, 312, and 303 can be configured by hardware or software.

Here, n master keys E _MKi (S _K ) corresponding to all of i = 1 to n are recorded on the DVD of (Method 3) described above, and j is stored in the DVD player (decoding unit 114b). A case will be described in which m master keys M _kj having m (2 <m <n) types selected in advance from 1 to n are provided. Note that the master key M _kj is exclusively assigned to the DVD player manufacturer. Here, n = 100 and m = 10.

Also, here, a method of recording E _SK (S _K ) on the DVD is used as the key determination information (the portion 302 in FIG. 12 indicates the key determination information as E _SK (S _K ). Is the case).

First, the key management organization 200 stores the master key M _Ki (i = 1 to 100). It is desirable to set an extra number for the master key in order to make a new entry for a player maker or for a backup in the event of a break.

In the key management organization 200, a master key M _Ki (i = 1 to 100) is exclusively assigned to each player maker 201 to 203. For example, as shown in FIG. 11, the master key to the player maker A M _Ki (i = 10~19) and the master key M _Ki (i = 20~29) to the player manufacturer B, the master key to the player manufacturer C M _Ki (I = 30 to 39) is assigned. The assigned master key is sent from the key management organization 200 (computer, etc.) to each player maker (computer, etc.) via a communication medium or a recording medium. At that time, it is desirable to securely deliver the data using encryption communication or the like.

  Each player maker individually manages a master key assigned from the key management organization 200. Each player maker uses the assigned master key to manufacture and sell a DVD player having the configuration shown in the third embodiment.

  On the other hand, here, it is assumed that the master key plain data is not passed from the key management organization 200 to the disk makers 221 to 223.

First, each disk manufacturer (referred to as “a”) determines the first session key S _k by itself (for example, determined for each disk), and passes the first session key S _k to the key management organization 200. The key management organization 200 encrypts the received first session key S _k with all the master keys M _Ki (i = 1 to 100) to obtain E _Mki (S _K ) and (i = 1 to 100). (The encryption circuit 301 in FIG. 12 is used). Then, the key management organization 200 _passes E _Mki (S _K ), (i = 1 to 100) to the disk manufacturer a.

  In the same manner as described above, information is exchanged between the key management organization 200 (computer, etc.) and the disk manufacturer (computer, etc.) using the assigned master key using a communication medium or a recording medium, etc. It is desirable to do it safely.

In the disk manufacturer a, E _Mki (S _K ), (i = 1 to 100), E _SK (S _K ), and E _SK (Data)) are recorded on the DVD 231 and sold. The operation to obtain the E _SK to encrypt the S _K with S _K itself (S _K) is a method of performing a disk maker side, and a method of performing encryption as well as key management organization 200 side by the master key (The encryption circuit 312 of FIG. 12 is used). Further, at least the content is encrypted by the disc manufacturer (using the encryption circuit 303 in FIG. 12).

In the disk maker a, for example, the S _K, manages the received E _Mki (S _K) and E _SK is the key judgment information (S _K) and E _SK (Data) (or Data).

  The same applies to other disk manufacturers.

If it is discovered that the master key has been broken, DVDs will be produced without using the broken master key. For example, when the master key of i = 19 is broken, E _Mki (S _K ) corresponding to 99 pieces of i = 1 to 18, 20 to ₁₀₀ is recorded on the DVD.

  Further, when it is discovered that the master key has been broken, it is desirable that the player manufacturer to which the broken master key is assigned thereafter manufactures and sells the DVD player except this. . For example, when the master key of i = 19 is broken, the player manufacturer A manufactures and sells a DVD player using the master key of i = 10-18.

  Further, a DVD player having an i = 19 master key already sold may be used as it is. However, the master key of i = 19 may not be provided by unit replacement or the like.

  Accordingly, it is possible to manage the master key safely and effectively, distribute the risk of unauthorized master key decryption, and allow the system to function safely and effectively even after master key decryption.

  The present invention is not limited to the embodiment described above, and can be implemented with various modifications within the technical scope thereof.

The block diagram which shows the structure of the system which concerns on the 1st Embodiment of this invention. A flowchart showing the operation of the embodiment The figure which shows an example of the format which stores the encryption key and the encryption data in a recording medium The figure for demonstrating the case where data is preserve | saved from CPUBUS. The block diagram which shows the structure of the system which concerns on the 2nd Embodiment of this invention. The figure which shows the example of an internal structure of a key determination part A flowchart showing the operation of the embodiment A flowchart showing the operation of the embodiment The block diagram which shows the structure of the system which concerns on the 3rd Embodiment of this invention. A flowchart showing the operation of the embodiment Illustration for explaining the key management method Diagram for explaining encryption

Explanation of symbols

101 ... DVD, 102, 202 ... first session key encrypted using a master key, 103, 203 ... image data encrypted using the first session key, 104 ... encryption circuit, 105 ... Master key, 106 ... second session key, 107 ... encryption unit, 108 ... second session key decrypted using the master key, 109 ... master key encrypted using the second session key 110 ... CPU BUS, 111 ... session key generation circuit, 112 ... decryption circuit, 113 ... first session key, 114, 114a, 114b ... decryption unit, 115 ... MPEG decoder circuit, 116 ... Digital / analog conversion circuit, 209 ... Line for copying to medium, 210 ... Line for copying from CPU BUS to another medium, 211 ... Digital storage medium, 200 ... Key management organization 201-203 ... Player manufacturer, 221-223 ... Disk manufacturer, 231- 233 ... DVD, 301, 312, 303 ... encryption circuit

Claims (12)

A first encryption means for encrypting data with a first key;
Second encryption means for respectively encrypting the first key with a plurality of predetermined second keys;
Third encryption means for encrypting the first key with the first key itself;
A plurality of data encrypted with the first key generated by the first encryption means and a plurality of data encrypted with the plurality of second keys generated by the second encryption means. And a recording means for recording the first key and the first key encrypted by the first key generated by the third encryption means on a recording medium. Encryption device.   The recording means records data encrypted with the first key in a data area part of the recording medium, and a plurality of first keys encrypted with the plurality of second keys, 2. The encryption apparatus according to claim 1, wherein the first key encrypted with the first key itself is recorded in a lead-in area portion of the recording medium. A first encryption means for encrypting data with a third key;
Second encryption means for encrypting the third key with a first key;
Third encryption means for encrypting each of the first keys with a plurality of predetermined second keys;
A fourth encryption means for encrypting the first key with the first key itself;
Data encrypted with the third key generated by the first encryption means, and a third key encrypted with the first key generated by the second encryption means; A plurality of first keys respectively encrypted with the plurality of second keys generated by the third encryption means, and the first key itself generated by the fourth encryption means An encryption apparatus comprising: recording means for recording the first key encrypted in step 1 on a recording medium.   The recording means records data encrypted with the third key in a data area portion of the recording medium, the third key encrypted with the first key, and the plurality of second keys. A plurality of first keys each encrypted with two keys and a first key encrypted with the first key itself are recorded in a lead-in area portion of the recording medium. 4. The encryption device according to 3.   5. The encryption apparatus according to claim 1, wherein the data is video or music content, and the recording medium is a DVD. MPEG2 data encrypted with the first key, a first key encrypted with two or more predetermined second keys, and a first key encrypted with the first key itself are recorded. Read from the read medium, the first key encrypted with the two or more predetermined second keys, the first key encrypted with the first key itself, and the own device First decryption means for decrypting the first key by a predetermined method using the second key recorded so that it cannot be taken out from the inside;
Second decryption for decrypting the MPEG2 data encrypted with the first key read from the medium with the decrypted first key input from the first decryption means And
E Bei and MPEG2 decoder means for decoding the MPEG2 data decoded by the second decoding means,
The first decryption means, when decrypting the first key by the predetermined method, is one of the first keys respectively encrypted with the two or more predetermined second keys. Is decrypted with the second key recorded in the device so as not to be taken out from the outside, and the first key candidate obtained thereby and the first key encrypted with the first key itself are encrypted. Determining whether or not the first key that is the source of the key matches the first key encrypted with the second key until the match is obtained in the determination. If the match is obtained in the determination, the first key candidate for which the determination has been made or the first key encrypted with the first key itself is used as the first key. Output the first key obtained by decrypting with one key candidate,
The first decryption means decrypts the first key candidate value and the first key encrypted with the first key itself as the determination by using the first key candidate. Whether or not the obtained value matches, or the value obtained by encrypting the first key candidate with the first key candidate and the first key itself It has been first key value and the information reproducing apparatus according to claim and this is what is to determine whether or not to match. An encryption method in an encryption device comprising a first encryption means, a second encryption means, a third encryption means, and a recording means,
A first step of encrypting data with a first key by the first encryption means;
A second step of encrypting the first key with a plurality of predetermined second keys by the second encryption means;
A third step of encrypting the first key with the first key itself by the third encryption means;
A plurality of data encrypted by the recording means using the first key generated in the first step and a plurality of data encrypted using the plurality of second keys generated in the second step. And a fourth step of recording the first key encrypted with the first key itself generated in the third step onto a recording medium. Encryption method.   In the fourth step, the recording means records the data encrypted with the first key in a data area part of the recording medium, and a plurality of data encrypted with the plurality of second keys, respectively. The encryption method according to claim 7, wherein the first key encrypted by the first key and the first key encrypted by the first key itself are recorded in a lead-in area portion of the recording medium. An encryption method in an encryption device comprising a first encryption means, a second encryption means, a third encryption means, a fourth encryption means, and a recording means,
A first step of encrypting data with a third key by the first encryption means;
A second step of encrypting the third key with the first key by the second encryption means;
A second step of encrypting the first key with a plurality of predetermined third keys by the third encryption means;
A fourth step of encrypting the first key with the first key itself by the fourth encryption means;
The recording means encrypts the data encrypted with the third key generated in the first step and the third key encrypted with the first key generated in the second step. And a plurality of first keys respectively encrypted with the plurality of second keys generated in the third step and the first key itself generated in the fourth step And a fifth step of recording the recorded first key on a recording medium.   In the fifth step, the recording means records the data encrypted with the third key in the recording means in a data area part of the recording medium, and the encrypted with the first key. A lead-in area portion of the recording medium includes a third key, a plurality of first keys encrypted with the plurality of second keys, and a first key encrypted with the first key itself. The encryption method according to claim 9, wherein the encryption method is recorded.   The encryption method according to any one of claims 7 to 10, wherein the data is video or music content, and the recording medium is a DVD. An information reproduction method in an information reproduction apparatus comprising a first decoding means, a second decoding means and an MPEG2 decoder means,
The first decryption means encrypts the MPEG2 data encrypted with the first key, the first key encrypted with two or more predetermined second keys, and the first key itself. The first key that is read from the medium on which the first key is recorded and encrypted with the two or more predetermined second keys and encrypted with the first key itself A first step of decrypting the first key by a predetermined method using the first key thus recorded and the second key recorded so as not to be taken out from the outside in the device;
MPEG2 data encrypted with the first key read from the medium by the second decryption means is input to the first decrypted MPEG2 data input from the first decryption means. A second step of decrypting with a key;
A third step of decoding the MPEG2 data decoded by the second decoding means by the MPEG2 decoder means ;
In the first step, the first decryption means is encrypted with the two or more predetermined second keys when decrypting the first key by the predetermined method. One of the first keys is decrypted with the second key recorded in the device so as not to be taken out from the outside, and the first key candidate obtained thereby and the first key itself Determining whether or not the first key that is the source of the first key encrypted in step 1 matches is encrypted with the second key until the match is obtained in the determination. When the match is obtained in the determination, the first key candidate that has been determined or the first key itself is encrypted. Outputting the first key obtained by decrypting the first key with the first key candidate,
In the first step, the first decryption means, as the determination, uses the first key candidate value and the first key encrypted with the first key itself as the first key. Whether or not the value obtained by decryption with the key candidate of the first key candidate matches, information reproducing method comprising the this a first value of key encrypted with the first key itself is intended to determine whether to match.

Images