JP4569535B2 - Data distribution system and server - Google Patents

Description

The present invention relates to a data distribution system and server, for example, through the public network, it can be applied to a data distribution system and server for distributing data, such as video.

  For example, there is a data distribution system that distributes moving image data such as a movie to a stream through a public network represented by the Internet. In such a data distribution system, since stream data is distributed using a public network, it is necessary to perform encryption processing related to the distribution data and redundancy processing to compensate for loss of transfer data on the network.

  Various schemes such as an encryption scheme using SSL (Security Sockets Layer) are used as the encryption scheme of the distribution data, and an example thereof will be briefly described with reference to FIG.

  In FIG. 2, first, the transmission side generates encrypted packets 1 to N using the encryption keys 1 to N for the plaintext packets 1 to N (N is a positive integer) that is stream data, and receives the packets. To the side. At this time, it is assumed that each of the encryption keys 1 to N used for each plaintext packet is changed by a calculation according to a predetermined rule. On the receiving side, when receiving the encrypted packets 1 to N from the transmitting side, the encrypted packet is decrypted using the decryption key, and the plaintext packets 1 to N are restored. At this time, there is a method of delivering the decryption key to the receiving side in advance before delivery or periodically delivering it.

  In addition, as a transfer data redundancy technique, for example, there is a method using FEC (Forward Error Correction). This redundancy method using FEC is redundant in advance in preparation for loss of transfer data on the network. This is a method of transferring data with data. As a method for generating this redundant data, for example, various redundant techniques such as parity bits and Reed-Solomon are used, but there are roughly two types.

  The first is a method in which redundant data is added to original data and the original data is distributed as it is. An example is shown in FIG. Here, the original packet indicates a packet including original data, and the redundant packet indicates a packet including redundant data. The sending side distributes the redundant packet to the receiving side together with the transmission of the original packet. When the original packet on the network is lost, the receiving side uses the redundant packet corresponding to the missing original packet to send the missing packet. It is a method to restore.

  The second is a method in which original data is converted into other data, and redundant data is given at that time. An example is shown in FIG. That is, as shown in FIG. 4, a predetermined data conversion process is performed on the original data, and the original data is converted into completely different data including redundant data and distributed as a redundant packet to the receiving side. On the receiving side, original data is generated based on the received redundancy-added packet. However, since the redundant data is included, the original data can be restored even if the packet is lost on the network.

  Patent Document 1 discloses a technique related to a data distribution system that distributes stream data using a public network. A cache server divides a plurality of stream data into minimum units for reproducing video, and It describes that encryption is performed for each divided minimum unit, and redundant data is given and distributed.

  Further, as a method for transferring moving image data using a network, generally, RTP (Real time Transport Protocol) / RTCP (RTP Control Protocol) is generally applied. In general, RTCP is not applied because the receiving side is an unspecified number and the amount of data increases. Further, as a redundancy method using FEC in the past, there is a technique for determining and changing the redundancy degree using statistical information based on the RTCP.

  In addition, RTP is a transfer protocol that realizes real-time distribution based on UDP, and RTCP transmits statistical information of data exchange between the transmission side and the reception side in order to realize RTP, This statistical information includes, for example, information such as the number of receptions, jitter, and number of losses.

JP 2001-202330 A

  By the way, in the above-described conventional data distribution system, the encryption technique and the redundancy technique as described above are used separately, and they are not linked on the distribution side and the reception side.

In recent years, moving picture data distribution service using the public network such as the Internet has rapidly spread, with the increase of the amount of data increases and distribution of the number of users, missing of the distribution data is likely to occur . When data loss in video streaming service is generated, the reception side becomes a disturbance of image, since the discomfort to the viewer, the missing data for moving image data distribution service is fatal. For this reason, it is strongly desired to sufficiently compensate for data loss.

  The FEC redundancy should be changed according to the network loss rate. However, when distributing to a large number of unspecified clients such as multicast broadcasting, RTCP is not applied, so network information cannot be obtained and the redundancy is changed. Information to be acquired cannot be obtained.

Therefore, it is possible to link the redundancy processing with the encryption processing, and to make it possible for the transmission side to recognize the reception status information regarding the data loss on the reception side, and to change the redundancy of the redundancy technique based on the reception status information. data distribution system and server is being sought.

In order to solve this problem, a data distribution system according to a first aspect of the present invention is a data distribution system in which a distribution server distributes data to one or more receiving terminals. (A) A server that notifies an encryption key used for encryption but, (a-1) and the encryption key generating means for the distribution data to generate for each distributing encryption key for encrypting data, (a-2) received based on the reception status information received from the receiving terminal Statistical processing means for obtaining the reception statistical information for each distribution data, and (A-3) notifying the distribution server of the encryption key of each distribution data and the reception statistical information of the reception side, and the encryption key of each distribution data (B-1) an encryption key receiving means for receiving the encryption key from the encryption key notifying means and reception statistical information on the receiving side, -2) Use the received encryption key (B-3) a redundancy processing means for performing redundancy processing with variable redundancy according to the received reception statistical information on the receiving side, and (B-3) -4) a distribution unit that distributes the distribution data subjected to the encryption process and the redundancy process, and (C) each receiving terminal receives (C-1) the distribution data distributed from the distribution unit. data receiving means, an encryption key communication means to transmit the reception status information with the encryption key acquisition request, receives an encryption key notified from the encryption key notification unit relative to (C-2) encryption key notification unit, ( C-3) It has a decryption processing means for decrypting the received distribution data using the received encryption key.

A server according to a second aspect of the present invention is a server that constitutes a data distribution system in which a distribution server distributes data to one or more receiving terminals, and notifies the encryption key used for encryption. (1) Distribution data an encryption key generating means for generating an encryption key for encrypting each distribution data, (2) obtaining the reception statistics of the reception side for each distribution data based on the reception status information received from the receiving terminal Statistical processing means, and (3) encryption key notifying means for notifying the distribution server of the encryption key of each distribution data and the reception statistical information on the receiving side, and notifying the reception terminal of the encryption key of each distribution data. It is characterized by.

  According to the present invention, the redundancy processing is linked with the encryption processing, and the reception status information regarding the data loss on the reception side can be recognized also on the transmission side, and the redundancy of the redundancy processing is determined based on the reception status information. Can be changed.

(A) First Embodiment Hereinafter, a description will be given of a first embodiment of a data distribution system and server of the present invention with reference to the drawings.

First embodiment, the data distribution system and server of the present invention, a case of application to a data distribution system for distributing stream data such as moving images.

(A-1) Configuration of First Embodiment FIG. 1 is a configuration diagram showing an image of the overall configuration of the data distribution system of the first embodiment, and FIG. 1 also shows main functional configurations of each component. ing.

  In FIG. 1, a data distribution system 10 according to the first embodiment includes a key server 11, a distribution server 12, and a receiving terminal 13 that can be connected to a network. In addition, although FIG. 1 shows the case where the number of receiving terminals 13 is one for convenience of explanation, the number of installed terminals is not limited. As the network, for example, a public network represented by the Internet is assumed, but a wired line, a wireless line, or a combination of a wired line and a wireless line may be used.

  The key server 11 generates an encryption key for encrypting distribution data (plaintext data) distributed by the distribution server 12, and distributes the encryption key 14 to the distribution server 12 and the receiving terminal 13 through the network. The key server 11 acquires reception status information at the reception terminal 13 from the reception terminal 13 through the network, and manages by performing statistical processing based on the reception status information.

  The reception status information of the receiving terminal 13 is RTCP information, which is shown as received packet loss information 15 in FIG. 1. The loss information 15 includes, for example, the number of received packets received by the receiving terminal 1, jitter, The number of lost packets on the public network among the received packets is included.

  As shown in FIG. 1, the key server 11 includes at least an encryption key management unit 111, an encryption key communication unit 112, and a statistical information management unit 113.

  The encryption key management unit 111 has a function for generating the encryption key 14, a function for managing the generated encryption key 14, and the like, generates the encryption key 14 at a predetermined generation timing, and transmits the generated encryption key 14 to the encryption key communication. This is given to the unit 112.

  For example, the encryption key management unit 111 manages the identification information of the moving image data distributed by the distribution server 12 and the multicast address for the distribution server 12 to distribute the moving image data. Using the encryption key generation process and the generated encryption key for each moving image data, the encryption key 14 is managed. Thereby, the encryption key 14 for the moving image data distributed by the distribution server 12 is managed.

  Here, the encryption method in the data distribution system 10 of the first embodiment is not particularly limited, and can be widely applied, for example, a common key encryption method, and the encryption algorithm is also particularly limited. However, existing encryption algorithms such as DEC, 3DEC, and AES can be applied. The encryption key 14 generated by the encryption key management unit 111 is a key applicable to the encryption algorithm employed in the data distribution system 10 of the first embodiment.

  In addition, the timing at which the encryption key management unit 111 generates the encryption key 14 is generated at predetermined time intervals such as every hour, or according to the content of the data such as a break in a program of moving image data. It is generated at the timing or at a timing according to the transmission status such as the number of data to be distributed.

  When the encryption key communication unit 112 receives the encryption key 14 from the encryption key management unit 111, the encryption key communication unit 112 acquires loss information (statistical information) 16 obtained by statistically analyzing the loss information on the receiving side managed by the statistical information management unit 113. 14 and loss information 16 that is statistical information thereof are provided to the encryption key communication unit 121 of the distribution server 12.

  FIG. 5 shows a format example of the notification information notified from the encryption key communication unit 112 to the distribution server 12. As illustrated in FIG. 5, the notification information that the encryption key communication unit 112 notifies the distribution server 12 includes at least an encryption key change timing 31, a new encryption key 32, an average received packet number 33, and an average loss number 34. The encryption key change timing 31 indicates the timing at which the new encryption key 32 is newly applied, and is for synchronization between the video data distribution side and the reception side. The new encryption key 32 is a new encryption key. The average received packet number 33 and the average loss number 34 are statistical information obtained from statistics based on the loss information received from the receiving side.

  When the encryption key communication unit 112 receives the loss information 15 at the reception terminal 13 simultaneously with the acquisition request for the encryption key 14 from the reception terminal 13, the encryption key communication unit 112 provides the received loss information 15 to the statistical information management unit 113 and also performs encryption key management. The encryption key 14 managed by the unit 111 is given to the receiving terminal 13.

  The statistical information management unit 113 receives the loss information 15 received from the receiving terminal 13 from which the encryption key communication unit 112 has requested acquisition of the encryption key, from the encryption key communication unit 112, and based on the loss information 15, the reception status of the receiving side The statistical processing is performed on and the statistical information is managed.

  For example, the statistical information management unit 113 performs statistical processing on the reception status information of the receiving terminal 13 that is the receiving side of the moving image data to be distributed, using the identification information of the moving image data, the multicast address, and the like, and receives the receiving status information on the receiving side. I manage statistics.

  Therefore, when the encryption key communication unit 112 transmits the encryption key 14 to the distribution server 12, the loss information 16 that is the corresponding reception side statistical information is acquired based on the identification information of the moving image data and the multicast address. When the encryption key communication unit 112 receives the loss information 15 from the receiving terminal 13, the loss information 15 received based on the moving image data identification information or the multicast address is given to the statistical information management unit 113.

  The distribution server 12 is a server that distributes moving image data to the receiving terminal 13. As shown in FIG. 1, the distribution server 12 includes at least an encryption key communication unit 121, a plaintext packet generation unit 122, an encryption packet generation unit 123, a redundant packet generation unit 124, and a packet distribution unit 125.

  The encryption key communication unit 121 receives loss information (statistical information) 16 obtained by statistically analyzing the encryption key 14 and the loss information on the receiving side from the encryption key communication unit 112 of the key server 11. The encryption key communication unit 121 provides the received encryption key 14 to the encryption packet generation unit 123, and also provides the redundant packet generation unit 124 with loss information (statistical information) 16 obtained by statistically analyzing the loss information on the reception side.

  The plaintext packet generation unit 122 acquires plaintext data that is moving image data, converts the acquired plaintext data into a plaintext packet 17 having a format according to a predetermined communication method, and converts the plaintext packet 17 to the encrypted packet generation unit 123. To give.

  Here, as the moving image data acquired by the plaintext packet generation unit 122, for example, a file, input video, or compressed data such as MPEG can be applied. For example, the moving image data acquired from a content server (not shown) Data obtained by reading data stored in the storage unit can be applied.

  The encryption packet generation unit 123 receives the encryption key 14 received from the encryption key communication unit 121 and holds the encryption key 14. The encrypted packet generator 123 encrypts the plaintext packet 17 received from the plaintext packet generator 122 using the encryption key 14 to generate the encrypted packet 18, and gives the encrypted packet 18 to the redundant packet generator 124. It is. Here, as the encryption algorithm in the encryption packet generation unit 123, as described above, existing encryption algorithms such as DES, 3DES, and AES can be widely applied.

  The redundant packet generation unit 124 receives the loss information 16 of the receiving terminal 13 received from the encryption key communication unit 121 and receives the encryption packet 18 from the encryption packet generation unit 123. Then, the redundant packet generator 124 generates redundant data with the redundancy determined according to the received loss information 16 that is statistical information on the receiving side, and assigns the redundant data to the encrypted packet to provide the redundant / encrypted packet 19. Is generated. Further, the redundant packet sperm picture unit 124 gives the generated redundant / encrypted packet 19 to the packet distribution unit 125.

  Here, the redundancy is determined based on the loss information of the receiving terminal 13 received from the encryption key communication unit 121, and the determination method is to apply the existing technology in the redundancy processing using FEC. Can do.

  In this way, when generating redundant data, the redundancy can be determined based on the loss information 16 that is the reception side statistical information received from the key server 11, so that the loss information 16 that is the reception side statistical information. Therefore, the redundancy can be changed according to the number of times, and the redundancy processing according to the reception status on the receiving side can be performed. As a result, it is possible to take measures against packet loss on the network, so that packet loss at the receiving terminal 13 can be reduced and video disturbance can be reduced.

  When the packet distribution unit 125 receives the redundant / encrypted packet 19 from the redundant packet generation unit 124, the packet distribution unit 125 transmits the packet to a public network such as the Internet by multicast.

  The receiving terminal 13 is a receiving terminal that receives moving image data to be distributed. As illustrated in FIG. 1, the receiving terminal 13 includes at least an encryption key communication unit 131, a reception unit 132, a redundant packet restoration unit 133, an encryption packet decryption unit 134, and an image processing unit 135.

  The encryption key communication unit 131 receives the encryption key 14 used for the moving image data from the key server 11 by requesting the key server 11 to acquire the encryption key including the identification information of the moving image data and / or the multicast address. The received encryption key 14 is given to the encrypted packet decryption unit 134. When the encryption key communication unit 131 requests the key server 11 to acquire an encryption key, the encryption key communication unit 131 also provides the key server 11 with packet loss information 15 indicating the reception status at the receiving terminal 13.

  The receiving unit 132 receives the redundant / encrypted packet 19 that is moving image data from the distribution server 12 through a public network such as the Internet, and gives the received redundant / encrypted packet 19 to the redundant packet restoring unit 133.

  The redundant packet restoring unit 133 receives the redundant / encrypted packet 19 from the receiving unit 132, extracts the encrypted packet 18 from the redundant / encrypted packet 19, and gives the encrypted packet to the encrypted packet decrypting unit 134. In addition, when the redundant packet restoration unit 133 detects that a packet loss or the like has occurred on a public network such as the Internet, the redundant packet restoration unit 133 performs encryption based on the redundant data included in the redundant / encrypted packet 19 received from the reception unit 132. The packet is restored.

  The encryption packet decryption unit 134 receives the encryption key 14 from the encryption key communication unit 131 and holds the received encryption key 14. In addition, when receiving the encrypted packet 18 from the redundant packet restoring unit 134, the encrypted packet decrypting unit 134 decrypts and decrypts the encrypted packet 18 using the encryption key 14. Then, the encrypted packet decrypting unit 134 gives the decrypted plaintext packet to the image processing unit 135.

  The image processing unit 135 receives the decrypted moving image data from the encrypted packet decrypting unit 134 and outputs a video using the moving image data.

(A-2) Operation of the First Embodiment Next, the operation of data distribution processing in the data distribution system 10 of the first embodiment will be described with reference to the drawings.

  First, the video data distribution service is started by a distribution request from the receiving terminal 13. In other words, the receiving terminal 13 sends a distribution request for the desired video data to the distribution server 12, and the distribution server 12 performs a predetermined authentication process and a search process for the requested video data in the same manner as the existing data distribution service. Etc. are performed. Thereby, the distribution server 12 distributes the moving image data requested by the receiving terminal 13 to the receiving terminal 13 whose authentication result is valid by multicast.

(A-2-1) Encryption Key 14 Notification Process The process in which the key server 11 notifies the distribution server 12 of the encryption key 14 will be described with reference to FIG.

  The encryption key management unit 111 of the key server 11 generates the encryption key 14 at a certain generation timing (S11, S12). The generation timing of the encryption key 14 is, for example, every predetermined time such as every hour, the timing according to the content of the data such as a break of a program of moving image data, the number of data to be distributed, etc. Or the timing according to the transmission status.

  When the encryption key management unit 111 generates the encryption key 14, the generated encryption key 14 is given to the encryption key communication unit 112. At this time, the encryption key communication unit 112 acquires loss information (statistical information) 16 obtained by statistically analyzing the loss information on the receiving side managed by the statistical information management unit 113 (S13).

  When the encryption key communication unit 112 acquires the encryption key 14 and the loss information 16 that is statistical information on the receiving side, the encryption key communication unit 112, for example, in the format shown in FIG. (S14), and notifies the distribution server 12 of the notification information (S15).

  In addition, when the notification information including the encryption key 14 and the loss information 16 which is statistical information on the receiving side is given from the key server 11 to the distribution server 12, the encryption key communication unit 121 of the distribution server 12 stores the received encryption key 14 In addition to being provided to the encrypted packet generation unit 123, the received loss information 16 is provided to the redundant packet still picture unit 124.

  Next, a process in which the key server 11 notifies the receiving terminal 13 of the encryption key 14 will be described with reference to FIG.

First, the encryption key Communication unit 131 of the receiving terminal 13 a request to obtain the encryption key for encryption key Communication unit 112 of the key server 11. At this time, the encryption key Communication unit 131 of the receiving terminal 13 notifies to the key server 11 also loss information 15 as the receiving situation at the reception terminal 13.

  When the key server 11 receives the loss information 15 simultaneously with the encryption key acquisition request from the receiving terminal 13 (S21), the encryption key communication unit 112 of the key server 11 gives the received loss information 15 to the statistical information management unit 113. Then, the statistical information management unit 113 performs statistical processing (S22).

For example, the encryption key acquisition request from the receiving terminal 13 includes the identification information of the moving image data, encryption key manager 111, encryption key communications unit corresponding encryption key based on the identification information of this video data 112. In addition, the statistical information management unit 113 also performs statistical processing of the reception status on the receiving side for each moving image data based on the identification information of the moving image data included in the encryption key acquisition request.

  When the statistical information management unit 113 performs statistical processing on the reception status on the reception side based on the received loss information, the encryption key communication unit 112 notifies the reception terminal 13 of the encryption key 14 (S23).

  When the key server 11 transmits the encryption key 14 to the reception terminal 13, the encryption key communication unit 131 of the reception terminal 13 gives the received encryption key 14 to the encryption packet decryption unit 134.

  In FIG. 7, the notification of the encryption key 14 from the encryption key communication unit 112 to the receiving terminal 13 has been described as being performed after the statistical processing of the statistical information management unit 113. However, the notification of the encryption key 14 is the statistical processing. Parallel processing may be performed, or statistical processing may be performed after notification of the encryption key 14.

(A-2-2) Data distribution processing accompanied by encryption processing and redundancy processing The distribution server 12 that has acquired the encryption key 14 and the loss information 16 from the key server 11 as described above, Deliver data. Hereinafter, a description will be given with reference to FIG.

  In the distribution server 12, when the moving image data requested by the receiving terminal 13 is given to the plaintext packet generator 122, the moving image data is converted into a plaintext packet 17 by the plaintext packet generator 122. The moving image data is obtained from, for example, a file, input video, or compressed data such as MPEG.

  When the plaintext packet 17 generated by the plaintext packet generator 122 is given to the encrypted packet generator 123, the plaintext packet 17 is encrypted by the encrypted packet generator 123 using the encryption key 14 according to a predetermined encryption algorithm, It is converted into an encrypted packet 18.

  When the encrypted packet 18 generated by the encrypted packet generator 123 is given to the redundant packet generator 124, the redundant packet generator 124 generates redundant data by FEC redundancy, and the redundant / encrypted data to which the redundant data is added. A packet 19 is generated. Note that the redundancy by FEC redundancy at this time is determined by a predetermined redundancy determination method in accordance with the loss information 16 that is statistical information on the receiving side received from the key server 11.

  When the redundant / encrypted packet 19 generated by the redundant packet generating unit 124 is given to the packet distributing unit 125, the redundant / encrypted packet 19 is distributed to the public network by multicast by the packet distributing unit 125.

  In this way, the moving image data subjected to the encryption process and the redundancy process can be distributed to the receiving terminal 13 through the public network.

  On the other hand, the receiving terminal 13 that receives the moving image data distributed from the distribution server 12 receives the moving image data as follows. Hereinafter, a description will be given with reference to FIG.

  When the moving image data distributed from the distribution server 12 reaches the receiving unit 132 of the receiving terminal 13 through the public network, the receiving unit 132 receives the redundant / encrypted packet 19 based on the multicast address of the received packet.

  When the received redundant / encrypted packet 19 is given to the redundant packet restoring unit 133, the redundant packet restoring unit 133 restores the encrypted packet 18. At this time, when the occurrence of loss of moving image data is detected on a public network such as the Internet, the redundant packet restoring unit 133 restores the encrypted packet 18 based on the redundant data included in the received redundant / encrypted packet 19. .

  When the encrypted packet 18 from the redundant packet restoring unit 133 is given to the encrypted packet decrypting unit 134, the encrypted packet 18 is decrypted by the encrypted packet decrypting unit 134 according to a predetermined encryption algorithm using the encryption key 14, and the plaintext packet 17 Is decrypted.

  When the plaintext packet 17 decrypted by the encrypted packet decryption unit 134 is given to the image processing unit 135, the image processing unit 135 performs predetermined image processing and outputs moving image data.

(A-3) Effect of the First Embodiment As described above, according to the first embodiment, the reception side provides statistical information on the reception side on the reception side and provides the reception side with statistical information on the reception side. In addition, by providing a key server that provides an encryption key to the reception side, the distribution side performs redundancy processing that can change the redundancy according to reception statistical information on the reception side in cooperation with the encryption processing. Data loss on the network can be reduced.

(B) Second Embodiment Next, a second embodiment of a data distribution system and server of the present invention with reference to the drawings will be described.

The second embodiment, like the first embodiment, the data distribution system and server of the present invention, a case of application to a data distribution system for distributing stream data such as moving images.

(B-1) Configuration of Second Embodiment FIG. 8 is a configuration diagram showing an image of the overall configuration of the data distribution system of the second embodiment, and FIG. 8 also shows main functional configurations of each component. .

  In FIG. 8, the data distribution system 20 of the second embodiment is also configured to have a key server 21, a distribution server 22, and a receiving terminal 23 that can be connected to a public network such as the Internet.

  The key server 21 includes an encryption key management unit 211 and an encryption key communication unit 212, and the encryption key management unit 211 generates and manages encryption keys, as in the first embodiment. The encryption key communication unit 212 transmits the encryption key 24 generated by the encryption key management unit 211 to the distribution server 22.

  The distribution server 22 includes an encryption key communication unit 221, a plaintext packet generation unit 222, an information insertion unit 223, an encryption packet generation unit 224, a redundant packet generation unit 225, a packet distribution unit 226, and an RTCP reception unit 227. Is.

  The distribution server 22 receives transmission status information based on RTCP with a plurality of receiving terminals 23 selected from the plurality of receiving terminals 23 that are multicast destinations, and performs redundancy based on the received reception status information. Determine the degree. In FIG. 8, the reception status information based on this RTCP is shown as loss information 25, and this loss information 25 includes, for example, the number of received packets, jitter, loss number, and the like.

  In addition, the method of selecting a receiving terminal that makes an RTCP response is not particularly limited. For example, there is a method of selecting based on the value of the lower 1 byte of the MAC address. Identification information indicating that the terminal 23 is an RTCP receiving terminal group (hereinafter referred to as RTCP receiving terminal group identification information) is provided so that the terminal 23 can be recognized between the receiving server 23 and each receiving terminal 23.

  The encryption key communication unit 221 receives the encryption key 24 from the encryption key communication unit 212 of the key server 21 and gives the received encryption key 24 to the encryption packet generation unit 224.

  The plaintext packet generation unit 222 converts the acquired moving image data into the plaintext packet 26 and gives it to the information insertion unit 223.

  The information insertion unit 223 inserts the encryption key 24 and the RTCP receiving terminal group identification information between the plaintext packet 26 and the plaintext packet 26 when the encryption key 24 is updated, and generates an encrypted packet generation unit as a plaintext packet 27 with information. 224.

  The information insertion unit 223 manages the RTCP receiving terminal group identification information for each image data or each multicast address, and when the encryption key 24 is updated, together with the encryption key 24, the corresponding RTCP receiving terminal group identification information. insert.

  Thereby, when the new encryption key 24 is updated, the new encryption key 24 can be transferred to the receiving terminal 23 together with the distribution of the moving image data, and the RTCP receiving terminal group identification information is inserted, whereby the RTCP receiving terminal The transmission of the loss information 25 based on RTCP is urged from the reception terminal 23 belonging to the group, and the loss information 25 of the reception terminal 23 can be acquired at that timing.

  The encryption packet generation unit 224 encrypts the plaintext packet 26 or the plaintext packet 27 with information from the information insertion unit 223 using the encryption key 24, and gives the encryption packet 28 to the redundant packet generation unit 225.

  The redundant packet generation unit 225 receives the encrypted packet 28 from the encrypted packet generation unit 224, adds redundant data created by the FEC redundancy processing to the encrypted packet 28, and generates a redundant / encrypted packet 29.

  The packet distribution unit 226 sends the redundant / encrypted packet 29 generated by the redundant packet generation unit 225 to the public network by multicast.

  The reception terminal 23 includes a reception unit 232, a redundant packet restoration unit 233, an encrypted packet decryption unit 234, an image processing unit 235, and an RTCP transmission unit 226.

  The receiving unit 232 receives moving image data distributed from the distribution server 22 through the public network.

  The redundant packet restoration unit 233 extracts the encrypted packet 28 from the received redundant / encrypted packet 29. When the packet loss is detected on the public network, the redundant data included in the redundant / encrypted packet 29 is extracted. Based on the above, the encrypted packet 28 is restored.

  The encryption packet decryption unit 234 uses the encryption key 24 to decrypt and decrypt the encryption packet 28 restored by the redundant packet restoration unit 233. When the decrypted plaintext packet 26 includes the encryption key 24 and the RTCP receiving terminal group identification information, the encrypted packet decrypting unit 234 holds the encryption key 24 and transmits the RTCP receiving terminal group identification information by RTCP transmission. This is given to the unit 26.

  The image processing unit 235 performs predetermined image processing based on the plaintext packet 26 received from the encrypted packet decryption unit 234 and outputs moving image data.

  The RTCP transmission unit 236 holds RTCP reception terminal group identification information when the own reception terminal 23 is a reception terminal of an RTCP response, and is based on the RTCP reception terminal group identification information received from the encrypted packet decryption unit 234. Thus, it is determined whether or not the own receiving terminal 23 belongs to the RTCP receiving terminal group. When the own receiving terminal 23 belongs to the RTCP receiving terminal group, loss information 25 based on RTCP is transmitted to the distribution server 22.

(B-2) Operation | movement of 2nd Embodiment Next, the data delivery operation | movement of the data delivery system 20 of 2nd Embodiment is demonstrated in detail, referring drawings.

(B-2-1) Notification process of personal identification key 24 The process in which the key server 21 notifies the distribution server 22 of the encryption key 24 will be described with reference to FIG.

  The encryption key management unit 211 of the key server 21 generates the encryption key 24 at a certain generation timing (S31, S32). The generation timing of the encryption key 24 is, for example, every predetermined time such as every hour, the timing according to the content of data such as a break of a program of moving image data, the number of data to be distributed, etc. Or the timing according to the transmission status.

  When the encryption key management unit 211 generates the encryption key 24, the generated encryption key 14 is given to the encryption key communication unit 212 and notified to the distribution server 22 from the encryption key communication unit 212 (SS33).

  When the encryption key 24 is given from the key server 21 to the distribution server 22, the encryption key communication unit 221 of the distribution server 22 gives the received encryption key 24 to the encrypted packet generation unit 224.

  Further, the receiving terminal 23 requests the moving image data distribution service and receives the encryption key 24 to be used first from the key server 21 or the distribution server 22 when the receiving terminal 23 is authenticated. After that, when the password 24 is updated, the new encryption key 24 is acquired as will be described later.

(B-2-2) Data Distribution Processing with Encryption Processing and Redundancy Processing Next, moving image data distribution processing in the distribution server 22 will be described with reference to FIG.

  Similar to the first embodiment, when moving image data is given to the plaintext packet 222, the moving image data is converted into a plaintext packet 26. The moving image data is obtained from, for example, a file, input video, or compressed data such as MPEG.

  The plaintext packet 26 generated by the plaintext packet generation unit 222 is normally given to the encryption packet generation unit 224, but the encryption key 24 is updated, and the key server 21 notifies the distribution server 22 of the new encryption key 24. Then, the new encryption key 24 and the receiving terminal group identification information that makes an RTCP response are inserted between plaintext packets by the information insertion unit 223.

  Here, FIG. 10 is a diagram for explaining a state in which the new encryption key 24 and the RTCP receiving terminal group identification information are inserted by the information inserting unit 223. As shown in FIG. 10, it is assumed that the new encryption key 24 and the RTCP receiving terminal group identification information are inserted between a plaintext packet and a plaintext packet.

  At this time, the place where the new encryption key 24 and the RTCP receiving terminal group identification information are inserted needs to be before the new encryption key 24 is applied. The position may be a position before a predetermined time or a position before a predetermined number of packets. It is assumed that the new encryption key 24 inserted by the information insertion unit 223 includes timing information for applying the new encryption key 24.

  In the encrypted packet generation unit 224, the plaintext packet 26 or the plaintext packet 27 with information is encrypted by the encryption key 24 according to a predetermined encryption algorithm.

  When the encrypted packet 28 encrypted by the encrypted packet generation unit 224 is given to the redundant packet generation unit 225, redundant data with redundancy corresponding to the loss information 25 received by the RTCP reception unit 227 is generated. A redundant / encrypted packet 29 is generated by being added to the encrypted packet.

  In this way, the distribution server 22 can change the redundancy according to the loss information 25 based on RTCP received from the reception terminals 23 belonging to the RTCP reception terminal group, so that the redundancy according to the reception situation on the reception side Can be processed.

  The generated redundant / encrypted packet 229 is distributed by the packet distribution unit 226 by multicast or the like.

  On the other hand, the receiving terminal 23 that receives the moving image data distributed from the distribution server 22 receives the moving image data as follows. Hereinafter, a description will be given with reference to FIG.

  When the moving image data distributed from the distribution server 22 reaches the receiving unit 232 of the receiving terminal 23 through the public network, the receiving unit 232 receives the redundant / encrypted packet 29 based on the multicast address of the received packet.

  When the received redundant / encrypted packet 29 is given to the redundant packet restoring unit 233, the redundant packet restoring unit 233 restores the encrypted packet 28. At this time, when the occurrence of loss of moving image data is detected on a public network such as the Internet, the redundant packet restoring unit 233 restores the encrypted packet 28 based on the redundant data included in the received redundant / encrypted packet 29. .

  When the encrypted packet 28 from the redundant packet restoration unit 233 is given to the encrypted packet decryption unit 234, the encrypted packet 28 is decrypted by the encrypted packet decryption unit 234 using the encryption key 24 according to a predetermined encryption algorithm, and the plaintext packet 26 Is decrypted.

  Then, when the plaintext packet 26 decrypted by the encrypted packet decryption unit 234 is given to the image processing unit 235, the image processing unit 235 performs predetermined image processing and outputs moving image data.

  Here, in the encrypted packet decryption unit 234, when the decrypted plaintext packet includes the new encryption key 24 and the RTCP receiving terminal group identification information, the new encryption key 24 is held in the encrypted packet decryption unit 234. The RTCP receiving terminal group identification information is given to the RTCP transmitting unit 236.

  In the RTCP transmission unit 236, when the own reception terminal 23 belongs to the RTCP reception terminal group based on the RTCP reception terminal group identification information, the RTCP transmission unit 22 transmits the loss information 25 based on the RTCP to the RTCP reception unit 227.

(B-3) Effects of Second Embodiment As described above, according to the second embodiment, the same effects as those of the first embodiment can be obtained. That is, the distribution side can perform redundancy processing that can change the redundancy according to the reception statistical information of the reception side in cooperation with the encryption processing, thereby reducing data loss on the network. Can do.

  Further, according to the second embodiment, reception status information based on RTCP is received from a specific receiving terminal among an unspecified number of receiving terminals. As a result, it is not necessary to receive reception status information from an unspecified number of receiving terminals, so that the redundancy can be varied according to the reception status of the specific receiving terminal while preventing an increase in the amount of data. The corresponding redundancy processing can be performed.

(C) Other Embodiments (C-1) In the first and second embodiments, the key servers 11 and 21 have been described as generating encryption keys. However, the distribution servers 12 and 22 generate encryption keys. May be.

  In the first embodiment, when the distribution server 12 generates an encryption key, the encryption key generated by the distribution server 11 may be notified to the key server 11.

(C-2) In the first and second embodiments, the distribution servers 12 and 22 have been described as performing redundancy processing on plaintext packets after encryption processing. However, the order of these processing is reversed. The encryption process may be performed after the redundancy process.

(C-3) In the first and second embodiments, the key server and the distribution server are described as physically different devices. However, if they can be connected to each other, the physically same device is A key server and a distribution server may be provided.

  Further, as long as each functional configuration included in the key server and the distribution server can be connected to each other, they may be distributed on the network even if they do not exist in the same server.

(C-4) The processing realized by the key server, distribution server, and receiving terminal described in the first and second embodiments is a processing program created so that hardware resources such as a CPU can realize these processing. This is software processing realized by executing. Therefore, the key server, the distribution server, and the receiving terminal are realized by reading the processing program stored in the recording medium or reading the processing program stored in the hard disk. Note that the functions described in the first and second embodiments may be realized as hardware.

1 is an overall configuration diagram of a data distribution system according to a first embodiment. It is explanatory drawing explaining the conventional encryption process. It is explanatory drawing explaining the conventional redundancy process. It is explanatory drawing explaining the conventional redundancy process. It is a format figure of the notification information which notifies the encryption key of 1st Embodiment. It is a flowchart which shows the notification process of the notification information from the key server of 1st Embodiment to a delivery server. It is a flowchart which shows the notification process of the encryption key from the key server of 1st Embodiment to a receiving terminal. It is a whole block diagram of the data delivery system of 2nd Embodiment. It is a flowchart which shows the notification process of the encryption key from the key server of 2nd Embodiment to a delivery server. It is explanatory drawing explaining the mode of the insertion of the information by the information insertion part of 2nd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 and 20 ... Data delivery system, 11 and 21 ... Key server, 12 and 22 ... Delivery server, 13 and 23 ... Receiving terminal, 111 and 211 ... Encryption key management part, 112 and 212 ... Encryption key communication part, 113 ... Statistics Information management unit 121 and 221 ... Encryption key communication unit, 122 and 222 ... Plain text packet generation unit, 123 and 224 ... Encryption packet generation unit, 124 and 225 ... Redundant packet generation unit, 125 and 226 ... Packet distribution unit, 223 ... Information insertion unit, 227 ... RTCP reception unit, 131 ... encryption key communication unit, 132 and 232 ... reception unit, 133 and 233 ... redundant packet restoration unit, 134 and 234 ... encryption packet decryption unit, 135 and 235 ... image processing unit, 236 ... RTCP transmission unit.

Claims (2)

In a data distribution system in which a distribution server distributes data to one or more receiving terminals,
The server that notifies the encryption key used for encryption
Encryption key generation means for generating an encryption key for encrypting distribution data for each distribution data;
A statistical processing means for determining the reception statistics of the reception side for each distribution data based on the reception status information received from each of the receiving terminal,
Notifying the distribution server of the encryption key of each distribution data and the reception statistical information on the receiving side, and encryption key notification means for notifying the reception terminal of the encryption key of each distribution data,
The delivery server is
An encryption key receiving means for receiving the encryption key from the encryption key notifying means and the reception statistical information on the receiving side;
Encryption processing means for performing encryption processing of distribution data using the received encryption key;
Redundancy processing means for performing redundancy processing with variable redundancy according to received reception statistical information;
Distribution means for distributing distribution data subjected to encryption processing and redundancy processing;
Each of the above receiving terminals
Distribution data receiving means for receiving distribution data distributed from the distribution means;
An encryption key communication means to transmit the reception status information with the encryption key acquisition request, receives the encryption key notified from the encryption key notification unit to said encryption key notification unit,
A data distribution system comprising: decryption processing means for decrypting received distribution data using the received encryption key. In a server that constitutes a data distribution system in which a distribution server distributes data to one or more receiving terminals, and that notifies an encryption key used for encryption,
Encryption key generation means for generating an encryption key for encrypting distribution data for each distribution data;
A statistical processing means for determining the reception statistics of the reception side for each distribution data based on the reception status information received from each of the receiving terminal,
The encryption key notifying means for notifying the distribution server of the encryption key of each distribution data and the reception statistical information on the receiving side, and notifying the reception terminal of the encryption key of each distribution data, Server.

Images