JP4589258B2 - Content storage device - Google Patents

Description

  The present invention relates to a content storage device, and more particularly to a content storage device capable of copying, moving, and deleting content within a valid range of recording and reproduction.

Today, when digital contents such as documents and images are stored, copy control may be performed at the time of moving contents from the viewpoint of preventing unauthorized use of data and protecting copyrights. In this copy control, for example, recording is possible at the primary storage destination (HDD recorder, PC, etc.), but if the content is moved to another medium (DVD-R, etc.), it must be made unplayable at the primary storage destination. Such control (copy once) may be performed.
If you simply erase the content file on the mass storage medium and disable playback, an unauthorized third party backs up the contents of the mass storage medium before disabling playback, and then backs up after disabling playback When the original content is restored using the medium that has been used, the content becomes illegally usable again.
Therefore, it is desired to provide a content storage device that makes it impossible to illegally use such content.

  In a content storage device that performs content copy control, one possible way to protect content is to physically protect the mass storage medium itself that stores content so that it is difficult to back up or perform unauthorized operations. Or using a special dedicated interface for access. A hard disk HDD is generally used as a large-capacity storage medium. However, if an access method for reading from and writing to the hard disk is not a general purpose, it is difficult for an unauthorized user to steal content data from the hard disk.

  In addition, there is a method in which only a valid content in the storage medium is controlled to be reproduced by holding a list of valid reproducible content for the content on the large-capacity storage medium in a special area. For example, in Patent Document 1, a list of invalid contents is stored in an area where it is difficult for an unauthorized user to access and falsify, and contents in the invalid contents list among contents on a large-capacity storage medium are not reproduced. An information recording method is described.

Further, there is a method in which the content itself and the content list are placed on an HDD accessible by the user, and only the alteration detection data (for example, hash value) is placed on a medium that is difficult for the user to access. In this case, if there is a contradiction between the content list on the HDD and the falsification detection data on the medium that is difficult to access by the user, it is determined that fraud has been performed and the reproduction of the content is stopped.
JP 2000-298974 A

However, if the access method and interface for the large-capacity storage medium are made special, general-purpose products cannot be used for the large-capacity storage medium, causing problems such as compatibility problems and increased costs.
In addition, when a content list is placed on a storage medium that is difficult to access without being placed on a large-capacity storage medium, it is difficult to use a general-purpose device that is generally known as an access method, and the storage capacity of this storage medium Increasing the value will increase the cost. Further, since the size of the content list generally increases in proportion to the number of contents, as the number of contents increases, the storage capacity required to record the content list also increases, resulting in an increase in cost.

  When the content list is placed on a large-capacity storage medium and the falsification detection data is placed on a storage medium that is difficult for the user to access, if the large-capacity storage medium is damaged for some reason, the large-capacity storage medium is backed up However, since the backed-up content list does not match the falsification detection data in the storage medium that is difficult to access by the user, it is impossible to reproduce the content that should have been originally reproduced.

  Therefore, the present invention has been made in consideration of the above circumstances, and allows backup of contents and restoration of backed-up data within the scope of a legitimate authority after ensuring legitimate copy control. It is an object to provide a low-cost content storage device.

  The present invention recorded a content input unit that inputs content, an input unit that inputs a control instruction for the content, a content recording unit that records the content, and a content list that includes information that identifies the content, and A secure memory in which a reproduction disable list including disabling information indicating that the content has been disabled and a content A and a recording instruction when the content A and a recording instruction are input include information specifying the time when the content A is input. When a recording control unit that stores the content A in the content recording unit and an instruction to move the content B to another recording medium are input, after the content B is copied to the other recording medium, The content B itself in the content recording unit and the specific information of the content B are deleted and the content There is provided a content storage apparatus characterized by comprising a movement control unit for recording disabling information tool B to reproduction disabling list.

In addition, when a content playback instruction is input by the input unit, the playback control unit is configured not to perform playback of the content when the disabling information of the content is recorded in the playback disabling list. A content storage apparatus characterized by further comprising: is provided.
According to this, even if illegal duplication or the like is performed, copy control within a valid range can be performed, reproduction of illegally copied content is not permitted, and content that can be backed up and played back with proper content A storage device can be provided.

In the invention, it is preferable that the disabling information includes a content identification number and information specifying the time when the movement control unit moves the content.
Further, when the movement control unit records the disabling information of the content B in the reproduction disabling list, if the maximum recording capacity of the reproduction disabling list secured in the secure memory is exceeded, the movement timing specifying information is referred to Then, after the oldest disabling information included in the reproduction disabling list is deleted, the disabling information of the content B is recorded.
According to this, the recording capacity of the reproduction disabled list can be made constant, and the cost of the apparatus can be reduced by suppressing the memory capacity.

In addition, when the reproduction disable list includes the reproduction disable list applicable information, and the movement control unit deletes the oldest disable information, information for specifying a movement time included in the old disable information Is set in the reproduction disable list applicable information, and information for specifying the input time of the content C included in the content list is determined from the reproduction disable list applicable information. Is smaller, the content C is not reproduced.
According to this, it is possible to prevent the reproduction of the content C that should have been disabled by the unauthorized backup and restore processing for the content C.

Further, when the remaining recording capacity of the reproduction disable list secured in the secure memory becomes smaller than a predetermined value, a warning notifying that the content currently recorded in the content recording unit should be backed up A warning output unit for outputting a message is further provided.
According to this, since a warning is issued to the user, it is not necessary to manage when the user takes a backup, and it is possible to prevent the content list from being unusable if the backup is performed within a predetermined period after the warning.

  In addition, the secure memory is a non-volatile memory, and reading and writing are permitted only by specific access means, and unauthorized access difficulty is ensured.

In the present invention, the input unit is a part for inputting control instruction data from the user, and the control instruction means, for example, a recording instruction, a reproduction instruction, a movement instruction, a backup instruction, and the like.
The content input unit is a part for inputting content composed of data, sound, images, and the like to be recorded. For example, the content input unit is a part for capturing content using a TV tuner or a network.
The content recording unit is a large-capacity recording device capable of recording content, and for example, a hard disk HDD is used. The content recording unit is roughly divided into an area for recording the content itself (content recording area) and an area for recording a content list including information for specifying the recorded content (content list recording area).
In the content recording area, the input content is stored as it is, or encrypted data obtained by encrypting the input content is stored.
In the content list recording area, a content list of contents stored in the content recording area is recorded. The content list is, for example, a list as shown in FIG. The content list includes information for specifying the content (content specifying information). The content specifying information includes, for example, a content ID and a key for encrypting the content for each content. In the content list, information for specifying the time when the content is input (input time specifying information) is recorded.

The information specifying the time when the content is input is, for example, “version information (Ver)” shown in FIG. 3 to be described later. The version information (Ver) is a numerical value starting from the initial value 1, and is information that is incremented by 1 every time the content list is changed. Therefore, the smaller the value of the version information (Ver), the older the content list, and the larger the value, the newer the content list.
The version information (Ver) is unique in the content list, and is information for specifying the timing of the last change process performed on the content list.

Disabling playback means that when content B subjected to copy control is moved to another recording medium, the content storage device on which the content B has been recorded cannot be played back. Means.
The reproduction disable list is a list as shown in FIG. 4 to be described later, and records information (referred to as disable information) that identifies the content disabled to be reproduced.
The information for specifying the disabled content includes information for identifying the content (content ID) and information for specifying the time when the content is moved (movement time specifying information).
Here, the information for specifying the time when the content is moved is “a version (Ver) of the content list when the content cannot be reproduced” as shown in FIG.

  The recording control unit, movement control unit, and reproduction control unit of the present invention correspond to the control unit of FIG. 1 to be described later, and a microcomputer comprising a CPU, ROM, RAM, I / O interface, timer, etc. is used. The function is realized by the CPU operating various hardware based on a control program stored in a ROM, a RAM, or the like.

In the present invention, the oldest disabling information included in the reproduction disabling list is information specifying the time when the content is moved among the disabling information included in the reproduction disabling list (reproducing content). This means that the version (Ver) of the content list when disabled is the oldest.
In other words, the oldest disable information is the one with the smallest value of the version (Ver) of the content list when the content is disabled to be reproduced.
For example, in the reproduction disable list of FIG. 5A described later, there are three pieces of content disable information, but the disable information of “10000” having the smallest version (Ver) of the content list is the oldest. Disabling information.
Further, “reproduction disable list applicable information” corresponds to “regeneration disable list applicable version (VS)” of FIG. 4 described later.

The “identification data” of the present invention is data that can identify “movement time specifying information” included in the deleted oldest disabling information. For example, the “movement time specifying information” Is a numerical value obtained by adding 1 to the version (Ver) of the content list.
Specifically, it is a numerical value (10001) shown in “Reproduction disable list applicable information (version)” in FIG. 5B, and the version (content list version of content 1005 which is the oldest disable information deleted) ( = 10000) plus 1 is identification data.

  Further, the warning output unit of the present invention is a part for visually or audibly informing a user of a warning message, and is a part for outputting characters, figures, sounds and the like. For example, a display device such as an LCD or CRT, a speaker, a printer, or the like corresponds to the warning output unit.

  According to the present invention, the content recording unit that records the content list and the secure memory that records the non-reproducible list are separately provided. Therefore, copy control within a valid range, and valid backup and backup data are provided. Playback control is possible.

Hereinafter, the present invention will be described in detail based on the embodiments shown in the drawings. In addition, this invention is not limited by this.
<Configuration Block of Embodiment 1 of the Invention>
FIG. 1 shows a schematic block diagram of an embodiment of a content storage apparatus according to the present invention.
As shown in FIG. 1, the content storage device of the present invention mainly includes a control unit 10, a storage unit 20, an input unit 30, a content input unit 31, an encryption unit 40, a warning output unit 70, a large capacity recording device (for example, , Hard disk HDD) 100 and secure memory (for example, flash memory) 200.

The control unit 10 is a part that controls the operation of each component of the apparatus, and is a part that implements the functions of the present invention by controlling various hardware based on a program stored in the storage unit 20. .
The storage unit 20 is, for example, a RAM or ROM, and is a part that temporarily or permanently stores information necessary for executing programs and various functions. Information that must not be erased after being rewritten is recorded in a nonvolatile memory such as a hard disk.

The input unit 30 is a part for inputting a control instruction from the user. For example, a button, a remote control, a mouse, and a keyboard correspond to the input unit 30.
The content input unit 31 is a part that captures all multimedia information (also referred to as content) such as images, sounds, and documents into this apparatus. For example, in a content storage device such as a DVD recorder, the tuner corresponds to the content input unit 31.
The encryption unit 40 is a part that encrypts input content. The encrypted content (also called encrypted data) is stored in the content recording area 110 of the hard disk HDD 100. The content can be encrypted by an encryption method such as AES, DES, or MULTI2.

The warning output unit 70 is a part that outputs a warning message that informs the user that backup should be performed, as will be described later, and a display device, a printer, or a speaker is used depending on the mode of outputting the warning message.
A hard disk (HDD) 100 is a large-capacity recording device that stores input content in a fixed manner.

  In the present invention, the HDD 100 mainly includes an area for storing the content itself (content recording area 110) and management information (content storage list or content list) indicating what content is currently stored in the area 110. And an area (content list recording area) for recording.

As described above, the secure memory 200 is a memory that is allowed to be read and written only by a specific access means, for example, special dedicated software, and is a memory that ensures the difficulty of unauthorized access. For example, it is a memory in which recorded information cannot be rewritten intentionally by the user. Further, it means a memory that is difficult to remove from the apparatus of the present invention, or a memory that has been devised to be destroyed if removed.
As the secure memory 200, a rewritable nonvolatile memory such as a flash memory is used.
In addition, data can be written to and read from the secure memory 200 only by a dedicated program stored in advance in a ROM or the like of this device.

The secure memory 200 mainly includes an area for storing the master key 50 and an area for storing the reproduction disabled list 600 (also referred to as a reproduction disabled content list).
The non-reproducible list 600 is a list in which information specifying content that has been once stored in the HDD 100 and has been moved to another recording medium (for example, a DVD) is recorded. Moving the copy-controlled content to another recording medium means disabling the content. Therefore, the information specifying the moved content indicates that the content has been disabled. Corresponds to disabling information.
The master key 50 is a key used when the contents of the content list 500 are encrypted. The information recorded in the secure memory 200 is also stored after being encrypted by the encryption unit 40 using the master key 50 so that it is difficult for a third party to access or analyze the information. Also good.

FIG. 3 shows an explanatory diagram of an embodiment of data stored in the hard disk 100 of the present invention.
The content list 500 in the hard disk 100 includes version information (Ver) 501, content number (CO) 502, content identification information 503 including a content ID and a content key (KEY), and a hash value (HA) 504. The content recording area 110 stores the input content (111, 112).

For example, when content (1000) is input from the input unit 30 described above, the content 1000 is encrypted with the content key and stored in the content recording area 110 of the hard disk 100, and the content 1000 is stored in the content storage list 500. Specific information 503 indicating that is stored on the hard disk is stored.
The version information (Ver) 501 is a number indicating a history of changes in contents recorded on the hard disk 100. For example, every time content is added, deleted, or moved, that is, every time the content list 500 is changed, the version information 501 is updated. As a general rule, 1 is added to update the version information.

The content number (CO) 502 indicates the number of content IDs stored in the content list 500. The content ID of the content specifying information 503 is unique information for specifying the content.
The content key (KEY) is a key for encrypting the content itself, and is simultaneously input from the input unit 30 when the content is input. It is assumed that the content key (KEY) recorded in the HDD 100 is encrypted with the master key 50. When using the content, the content key (KEY) is decrypted with the master key 50, and the content is decrypted with the decrypted content key (KEY).
In order to prevent unauthorized use of content, the content key (KEY) is different for each content. By using different content keys, it is possible to make reproduction impossible when using content keys of other content. The hash value (HA) 504 is information for preventing copy falsification and can be calculated by a conventionally used method.

  For example, the calculation SHA-1 is applied to the version information 501, the content number 502, and the content identification information 503 in the content list 500, and the numerical value obtained as a result is encrypted with the master key 50. The encrypted data is stored in the content list 500 as a hash value HA504. The validity of the content list 500 itself can be confirmed by the hash value HA504. That is, even if the content list 500 itself is illegally rewritten, since the hash value HA is encrypted with the master key 50 stored in the secure memory 200, a valid value cannot be written. If the hash value HA is different from the valid one, it can be regarded that the falsification has been made, and the reproduction or movement of the content can be prohibited.

  In the embodiment shown in FIG. 3, the two contents (1000, 1001) are currently encrypted in the respective content keys KEY (1100, 1101) and stored in the area 110. Further, in the content list 500, the specific information 503 of the content 1000 whose content ID is ID1 = 1000 and the content key is KEY1 = 1100, and the content 1001 whose content ID is ID2 = 1001 and whose content key is KEY2 = 1101 Specific information 503 is stored. Further, the version information 501 in the current state in which these contents are stored is Ver = 3, and the number of contents currently stored is stored as CO = 2.

In the case of FIG. 3, SHA-1 is calculated using information of Ver = 3, CO = 2, ID1 = 1000, KEY1 = 1100, ID2 = 1001 and KEY2 = 1101, and the calculation result is obtained as a master key 50. The result encrypted with is stored as a hash value HA504.
In order to prevent unauthorized use, it is preferable to encrypt not only the hash value HA but also the content key (KEY1, KEY2) with the master key 50.

  In addition, the content input from the content input unit 31 includes those that need copy control during movement and those that do not need copy control, but only those that need copy control are encrypted and stored on the hard disk. May be saved. Those that do not require copy control can be freely copied, erased, etc. any number of times, so there is no particular need for encryption, and the user may be able to set whether encryption is possible. Further, the content that does not need to be copy-controlled does not have to store the specific information 603 in the reproduction disable list 600 when moving.

FIG. 4 is an explanatory diagram of an embodiment of the reproduction disable list 600.
The reproduction disabling list 600 includes a content number (CC) 601, a reproduction disabling list applicable version (VS) 602, and disabling information (ID, Ver) 603 for specifying the reproduction disabling content.
The number of contents (CC) 601 is the number of contents disabling information stored in the list 600.
The content disabling information 603 includes a content identification number (content ID) and a version (Ver) of the content list 500 when the content is disabled to be reproduced.

The “reproduction disabling list applicable version VS” is information for checking whether or not the content list version Ver 502 is applicable, as will be described later in the reproduction processing or the like. For example, if there is still an empty area in the playback disable list 600 or if the disable information 603 (also referred to as an entry) has never been deleted from the playback disable list 600, this version VS is zero. To do.
Further, when the entry 603 has been deleted from the reproduction disabled list 600, the data (identification data) obtained by adding 1 to the version (Ver) included in the entry 603 deleted last among the deleted entries, The value of version VS is assumed.

In the case of FIG. 4, two contents (1005, 1006) are moved to another medium (for example, DVD), and the reproduction is disabled. Here, the number of contents disabled (CC) 601 is two. In addition, since this list 600 still has a free area, the reproduction disabled list applicable version (VS) 602 is zero.
Further, as the entry 603, the ID number (ID1 = 1005, ID2 = 1006) of the two contents (1005, 1006) and the version of the contents storage list when the contents are disabled to be reproduced (Ver1 = 10000, Ver2 = 1001) ) And are saved.
In the case of FIG. 4, since the version VS is zero, it indicates that no entry has been erased from the playback disable list 600, and all contents not shown in the playback disable list 600 can be played back. It means that.

Next, FIG. 5 shows an explanatory diagram of another embodiment of the reproduction disabled list. Here, a case where the version VS is not zero is shown.
FIG. 5A shows that the version VS is zero and before the entry of the content 1005 is deleted from the reproduction disable list 600, and three contents (1005, 1006, 1007) are disabled. Indicates the state.
FIG. 5B shows a state after the entry of the content 1005 is deleted. Here, since the version of the content 1005 is Ver1 = 10000, in FIG. 5B, a value 10001 obtained by adding 1 to this version (Ver1 = 10000) is set as a reproduction disable list applicable version VS.
In FIG. 5B, the disabling information 603 of the content 1008 is added to the playback disabling list 600.

  In the state of FIG. 5B, since the version VS is 10001, if the version (Ver) 501 of the content storage list 500 is equal to or higher than this VS (= 1001), it is included in the content storage list 500. Content that is not included in the playback disable list 600 can be played back.

FIG. 6 is an explanatory diagram of content backup processing. Here, all information (content 1000, content list 500) included in hard disk HDD 100 is copied to a different hard disk HDD 101.
The backup destination medium may be a writable portable medium (CD, DVD, etc.) in addition to the hard disk HDD.
Such a backup process is intended to allow the hard disk HDD 100 to return to a normal state at a certain date and time in the event of a failure. A request for backup processing is made based on an instruction from the user in principle, but is distinguished from content movement processing.
Therefore, when the backup process is performed, the information in the original backup source HDD 100 is not changed, and the reproduction disable list 600 is not changed.

<Outline Explanation of Reproduction Processing and Movement Processing of the Present Invention>
FIG. 2 is an explanatory diagram showing an embodiment of the content reproduction process and movement process of the present invention.
FIG. 2 (1) shows the initial state of the current content storage device. That is, it is assumed that the HDD 01 stores four contents (A, B, C, and D) and the version of the content list 500 is Ver = 4. Assume that nothing is recorded in the reproduction disable list 600.
Assume that the user inputs an instruction for content reproduction in the state of (1) in FIG. At this time, the CPU 10 checks whether the content list 500 is valid using the hash value HA. If it is valid, it is checked whether or not the specific information of the content requested to be reproduced exists in the content list 500, and even if it exists, the specific information of the content is included in the disabling list 600. Check if it is not. Only when the content requested to be reproduced is included in the content list 500 and not included in the disabling list 600, it is determined that reproduction is possible, and the content requested by the user is reproduced.
For example, reproduction is permitted when content C is requested to be reproduced, and reproduction is not performed when content E that is not in the content list 500 is requested to be reproduced.

Next, (2) of FIG. 2 shows a case where an instruction to move the stored content B to another medium CD is received. Here, the content B itself is copied to another medium CD, the content B itself is deleted from the content recording area, the specific information 503 of the content B is deleted from the content list 500, and the version (Ver) is changed from 4 to 5. Update.
Further, the disabling information 603 of the content B is stored in the reproduction disabling list 600. That is, the content ID of the content B and the version (Ver = 5) of the content list at the time of movement are stored.
In the state of (2) in FIG. 2, even if the content B itself is written in the content recording area 110 by unauthorized processing, and the specific information of the content B is written in the content list 500, a third party Since the disabling list 600 of the content B is recorded in the disabling list 600 of the secure memory 200 that cannot be easily accessed, the illegally written content B cannot be reproduced.
Hereinafter, the content B cannot be reproduced until (6) in FIG.

(3) in FIG. 2 shows a case where the backup process shown in FIG. 6 is requested in the state of (2) in FIG. Here, all the information in the hard disk HDD01 (contents A, C, D and information in the storage list 500) is copied to another hard disk HDD02. Both the hard disk HDD01 and the disabling list 600 are shown in FIG. It is the same as the state of 2).
FIG. 2 (4) shows a case where content E is newly recorded. Here, in addition to the recording of the content E itself, the version Ver of the storage list 500 is updated from 5 to 6.

FIG. 2 (5) shows a case where a problem occurs in the hard disk HDD01 and the contents of the HDD 02 that has been backed up are restored to the hard disk HDD01.
Here, the content of the hard disk HDD01 returns to the state of (3) in FIG. That is, the content E is erased, the contents A, C, and D exist, and the version Ver returns to 5. However, since the disabling list is not changed, it remains (4) in FIG. At this time, all the contents A, C, and D can be reproduced, but the contents B cannot be reproduced because the contents B are not included in the storage list.
In the conventional method in which the hash value HA (falsification detection data) is recorded on a medium that is difficult to access by the user, the content (A, C, D) that should have been reproducible cannot be reproduced. In the invention, the content (A, C, D) that may be permitted to be reproduced can be reproduced, and only the content B that should not be reproduced by the copy control can be prevented from being reproduced.
That is, content can be recorded / reproduced within the range of a legitimate authority.

(6) of FIG. 2 shows a case where the contents and the storage list at the time of FIG. 2 (1) are restored from the state of (5) of FIG. Since returning to the time of FIG. 2 (1), the version Ver of the storage list is 4.
In the state of (6) in FIG. 2, the three contents A, C, and D are not disabled to be reproduced, and can be normally reproduced. However, since the specific information is stored in the disabling list 600, the content B cannot be reproduced.
As described above, according to the present invention, backup of content is permitted within the scope of a legitimate authority, and only content that should be permitted to be played back is permitted without playback of content once disabled by movement. Reproduction is allowed.

Since the capacity of the secure memory 200 storing the reproduction disable list 600 shown in FIG. 4 is also finite, if the content movement is repeated many times, the recordable area disappears and the content disable information 603 is recorded. become unable. That is, simply adding the disabling information 603 limits the recording capacity of the disabling information 603 for content recorded in the disabling list 600.
For example, when the disabling list 600 has a capacity capable of recording 1000 content disabling information 603, the 1001st moving content disabling information 603 cannot be recorded. Therefore, when the disabling information 603 cannot be added to the disabling list 600, the disabling information (entry) 603 having the oldest version included in the list 600 is deleted.
Further, instead of deleting the disabling information 603 having the oldest version, the disabling information 603 of the newly disabled content is additionally recorded. According to this, the recording capacity of the reproduction disabled list 600 can be made constant.

However, when the disabling list 600 is controlled in this way, simply by using the content list 500 having the old version to restore the backup illegally, the disabling information 603 for the content having the old version is used. However, if it has already been deleted from the disabling list 600, it should be allowed to be reproduced but should be allowed to be reproduced.
Therefore, when the version (Ver) of the content list 500 is older than the applicable version VS of the reproduction disable list 600, it is considered that the old specific information 603 may be deleted from the reproduction disable list 600. Thus, the content existing in the content list 500 is prevented from being reproduced.
As a result, while allowing the capacity of the playback disable list 600 to be kept constant, it is possible to play back allowable content and disable playback of content once disabled.

<Description of processing when moving content>
FIG. 7 shows a flowchart of processing when moving content according to the present invention.
First, in step S1, it is checked whether or not there is an instruction to request content movement from the user. If there is a user movement instruction, the process proceeds to step S2.
In step S2, it is checked whether or not the content instructed to be moved can be reproduced. Whether or not playback is possible is a legitimate one that the content list has not been tampered with, and whether or not the version (Ver) is newer than the applicable version VS of the playback disable list 600, and This can be determined by whether or not the disabling information 603 exists. Details of the reproducibility check will be described later.

If reproduction cannot be performed, the process proceeds to step S7 and the process is terminated without performing the movement process, but the user may be informed that reproduction cannot be performed. On the other hand, if reproduction is possible, the process proceeds to step S3.
In step S3, it is checked whether or not the disabling information 603 of the content to be moved can be additionally written to the reproduction disabling list 600.
That is, it is checked whether there is an empty area in the reproduction disable list 600.
If there is a free area, the process proceeds to step S4, and as described in (2) of FIG. 2, the ID of the content to be moved and the version (Ver) of the content list 500 are disabled as the disabling information 603. Stored in the conversion list 600.

Next, in step S6, physical content movement processing is performed. Here, the requested content is copied to a portable medium (DVD), the content itself in the hard disk HDD is deleted, and the specific information 503 (ID and content key) of the content recorded in the content list 500 is deleted. KEY) is deleted, the version information (Ver) 501 of the content list 500 is updated (+1), and the hash value HA504 is recalculated.
On the other hand, if there is no free area in the disabling list 600 in step S3, the process proceeds to step S5.

In step S5, the disabling information (entry) 603 having the oldest version (Ver) in the disabling list 600 is deleted.
FIG. 8 shows an embodiment of a process for changing the reproduction disable list 600 when moving content according to the present invention.
In FIG. 8A, disabling information of two contents (1005, 1006) is recorded in the reproduction disabling list 600.
FIG. 8B shows the reproduction disabling list 600 after the disabling information of the content 1005 having the oldest version (10000) among the content information existing before the change is deleted. By this deletion process, it becomes possible to newly add content disabling information.

Thereafter, the process proceeds to step S4. Here, content disabling information 603 that is newly disabled by movement is added.
FIG. 8C shows the reproduction disabling list 600 after adding the disabling information 603 of content ID = 1007 after executing steps S5 and S4.
In addition, in the state of FIG. 8C, when the content disabling information 603 is further added by a new content movement request, the disabling information 603 having the oldest version from the reproduction disabling list 600 (FIG. 8 ( In c), the information 603) of the content 1006 is deleted, and new disabling information of the moved content is added.
The above is the content movement processing of the present invention.

<Description of content playback processing>
FIG. 9 shows a flowchart of the content reproduction processing of the present invention.
In step S11, it is checked whether or not a content playback instruction has been input by the user.
If there is a reproduction instruction, the process proceeds to step S12, and the latest content list 500 on the hard disk HDD is searched. When there is only one content list 500, the content list 500 is selected.
However, when there are a plurality of content lists 500, such as when restoring from the backup destination HDD, the content list 500 with a newer version (Ver) is selected.

In step S13, it is checked whether the selected content list 500 is valid.
Here, whether it is valid or not is already recorded in the content list 500 and the hash value as a result of calculating SHA-1 of the data (501, 502, 503) of the content list 500 as shown in FIG. This is done by comparing the hash value HA504.
If there is an unauthorized alteration of the content list 500, the hash values do not match, so the processing is terminated without reproduction.
If the hash values match, the process proceeds to step S14.

In step S14, it is checked whether or not the value of the version information (Ver) 501 of the content list 500 is equal to or greater than the value of the reproduction disabled list application version (VS) 602 in the reproduction disabled list 600.
That is, the value of the version information 501 (V1) in the content list 500 is compared with the value of the version information 602 (VS) applicable to the reproduction disabled list in the specific information 603.
Here, if V1 ≧ VS, it is considered that there is no fraud, and the process proceeds to step S15. On the other hand, if V1 <VS, the version information of the current content list 500 is considered to be too old. Therefore, it is determined that there is a possibility that the version information has been tampered with by an unauthorized process, and the process ends without reproducing.

If it is determined that there is no fraud, it is checked in step S15 whether or not the content requested for reproduction exists in the content list 500. If it exists, the process proceeds to step S16, and if it does not exist, the process ends without reproducing.
In step S16, it is checked whether or not the content requested to be reproduced is included in the reproduction disable list 600.
If it is included, the content is not reproducible, and the process ends without replaying. If not included, the process proceeds to step S17, where reproduction is permitted and the requested content is reproduced.
By performing such playback processing, when content is restored illegally or when content that has already been moved is played back, playback is not permitted and only content that is stored in a normal state is played back. be able to.

<Relationship between movement processing and playback processing>
Here, the effectiveness of the movement process and the reproduction process of the present invention will be described with reference to examples.
[Case 1]
First, a case will be described in which content is further moved when there is no free space in the content reproduction disable list 600.
In this case, as already described in steps S5 and S4 in FIG. 7, the oldest entry 603 is deleted from the reproduction disabling list 600, and the disabling information 603 of the content to be moved is added.
As a result, regardless of whether or not there is a free area in the reproduction disable list 600, the content movement process can always be performed.

  On the other hand, when the reproducible content list or the non-reproducible content list is simply stored in a small-capacity secure memory area as in the prior art, a problem occurs when the recording area is full. For example, when a reproducible content list is stored, no problem occurs when the content is moved, but when the recording capacity of this list is exhausted, new content cannot be recorded. In this case, there is a method of deleting old contents at the time of recording. However, since old contents are not necessarily unnecessary for the user, it is not preferable to automatically delete the contents so that reproduction is impossible.

[Case 2]
A case where the hard disk contents backed up in advance when the hard disk HDD is damaged will be described.
FIG. 10 shows an explanatory diagram of the flow of processing when restoring backed up content.

First, assume that contents A and B are recorded. Next, the user backs up the contents A and B and the contents list 500 on the HDD in preparation for damage. At this time, the content list 500 on the HDD includes A and B.
Next, it is assumed that the user has moved the content B to another medium. At this time, the content B cannot be played back in this storage device, and the content B information 603 is stored in the playback disabled list 600.
After this, it is assumed that the backup data has been restored because the HDD has been damaged. When restored, the content list 500 including the contents A and B and A and B exists on the HDD.
When reproducing the content A in this example, the validity of the content list 500 is checked in step S13 according to the flowchart of FIG. If the user does not operate the backup data illegally, it is determined that there is no problem here.

Next, in step S14, it is checked whether the version Ver of the content list is greater than or equal to the reproducible list applicable version VS. In this case, if the reproducible list applicable version VS is 0, the content list Since the version Ver is always newer than that, it is determined to be valid. In step S15, since A and B are included in the content list, it is determined that content A can also be reproduced. As to whether or not it is included in the reproducible content list 600 in step S16, since the content A is not moved, the content A is not included in the reproducible content list 600.
As a result, the content A is determined to be reproducible and is reproduced as instructed by the user.

Next, consider a case where the content B is tried to be reproduced using the same backup data.
First, checking the validity of the content list 500 is determined to be valid without any problem. Next, it is also determined to be valid for checking whether the version Ver of the content list 500 is equal to or higher than the version VS applicable to the reproduction disabled list.
Since A and B are included in the content list 500, it is determined that the content B can be reproduced by checking whether it is included in the content list 500.
However, as to whether or not it is included in the non-reproducible content list 600, since content B is included in the non-reproducible list 600, it is determined that it cannot be reproduced. As a result, it is determined that the content B cannot be reproduced, and the reproduction is rejected.

On the other hand, in the conventional technology, when the entire reproducible content list or non-reproducible content list is simply held in a secure memory area, restoration is possible, but as in case 1, there is a problem that new recording cannot be performed. is there.
In addition, when only content list falsification detection information is placed in order to save a secure memory area as in the past, the content list including backup A and B generates falsification detection information in the secure memory area. Since the content list is different from the content list at the time, the information does not match during the tampering check, and it is determined that the tampering has occurred. Further, backup cannot be performed by such a method of placing only the content list falsification detection information.

[Case 3]
Here, a case where the moved content is restored illegally will be described.
FIG. 11 is an explanatory diagram showing restoration when the moved content specifying information 603 has been deleted from the reproduction disabled list.
If recording and moving are further repeated from the case of FIG. 10, information cannot be held in the playback disabled content list 600 and the specific information of the content B is erased from the playback disabled content list 600. It is assumed that an unauthorized user tries to reproduce the content B at this time.
Hereinafter, a reproduction process when data including A and B is restored will be described.

When the reproduction processing flowchart shown in FIG. 9 is executed using the restored content list 500, first, the validity check of the content list in step S13 is determined to be valid without any problem.
Next, in checking whether the content list version Ver is greater than or equal to the reproduction disable list applicable version VS (step S14), the content Ver version Ver of the content list 500 is greater than the content list version VS when the content B is moved. It is the previous one and the version value is small. Therefore, the check in step S14 is NO, and it is determined that reproduction is impossible.
That is, once moved, the content B is not reproduced even if it is restored as backup data, and can also be prevented from being reproduced by unauthorized tampering.

Next, a case will be described in which only the content list 500 is the latest one and only the content data is restored from the previously stored backup data, and then the content data A and B are reproduced.
FIG. 12 is an explanatory diagram in the case where the reproduction processing is performed using the latest content list 500.
When content is to be reproduced using the content list 500, first, the validity check of the content list 500 in step S13 is determined to be valid without any problem.

  Next, in checking whether the version Ver of the content list 500 is equal to or higher than the version VS applicable to the reproduction disable list (step S14), since the content list 500 used here is the latest, the content list version Ver is applicable to the reproduction disable list. Version VS or higher is judged as valid.

Next, in the check of whether or not it is included in the content list 500 (step S15), since the content list 500 is backed up after the movement of B, the content B is not included. Therefore, it is determined that the content B that is not included in the content list 500 cannot be reproduced.
In the case of content A, A is included in the content list 500 and is not included in the reproduction disabled content list 600. Therefore, the content A can be reproduced without any problem.

In this invention, as in this case, it is possible to reproduce legitimate backup data while preventing unauthorized reproduction of moved content.
On the other hand, according to the method of the prior art, the old one is simply deleted when the capacity of the non-reproducible list becomes full.

  Considering the three cases as described above, the present invention can prevent unauthorized reproduction processing that could not be prevented in the past and can perform valid reproduction of backup.

  In the case where content is deleted from the HDD without being transferred to another medium, the content information is deleted from the content list 500 on the HDD and the content data on the HDD is deleted. This is because even if the data is restored from a backup or the like, there is no problem in content management even if the deleted content can be reproduced again. By limiting the content to be included in the non-reproducible content list 600 to cases where it is necessary to actively prohibit the replay, the frequency of updating the non-reproducible content list 600 can be reduced.

<Merge (join) processing of content list>
Here, content list merge processing will be described.
The content list merging process means a process of combining the content list 500 and the non-playable content list 600 to create a new content list 500.
For example, if you want to record / move from there after restore, be sure to perform a merge operation to create a new version of the content list. This is because when the restoration is performed, a plurality of different versions of the content list exist on the hard disk HDD, and management becomes complicated.

In order to realize the merging process, “the version when the content list was last created (or updated) (latest list version: called VNEW)” is stored in the secure memory 200.
The version information (Ver) 501 of the current content list 500 is compared with the latest list version VNEW, and if they match, no merge is performed, but if they do not match, merge processing is performed, and the content list 500 is updated. To the state. When the version of the content list is updated, the latest list version VNEW is updated, for example, at the timing of recording or moving the content.

FIG. 13 is a diagram for explaining the merge processing and change of the content list according to the present invention.
FIG. 13A shows the content list 500, the reproduction disabled list 600, and the latest list version VNEW 700 before the merge process.
Here, the version information (Ver) of the content list 500 is 10010, and specific information 503 of two contents (20000, 20001) is stored.
On the other hand, in the reproduction disabling list 600, disabling information 603 of three contents (20005, 20001, and 2303) is stored. Information of content ID = 2001 is recorded in both lists (500, 600). Also, it is assumed that a newer number (10030) than the version information (Ver) 501 of the content list 500 is stored in the latest list version (VNEW) 700.

When the merge process is executed in such a state, as shown in FIG. 13B, the two lists (500, 600) are organically combined, and a new content list 500 is created.
In FIG. 13B, the specific information 503 having the content ID 20001 existing in the reproduction disabled list 600 is deleted, and the version (Ver) 501 is a numerical value (10031) obtained by adding 1 to the latest list version VNEW. It has become.

FIG. 14 shows a flowchart of an embodiment of this merge process.
In step S51, the version information (Ver) 501 of the content list 500 on the hard disk HDD is read.
Next, in step S52, it is confirmed whether or not the read version information (Ver) is the latest. Specifically, the version information (Ver) is compared with the latest list version VNEW700 to check whether they match.

If they match, the version Ver of the current content list 500 is the latest, so the process ends without performing the merge process.
On the other hand, if they do not match, the process proceeds to step S53.
For example, in the case of FIG. 13A, the version information (Ver) 501 is 10010 and does not match the value (10030) of the latest list version (VNEW) 700, so the process proceeds to step S53.

In step S53, a display for inquiring whether or not to perform the merge process is displayed to the user, and an input about whether or not the merge process is possible is waited for by the user. If there is an instruction input for the merge process, the process proceeds to step S54, and if there is no instruction input, the process ends.
In step S54, the top entry (specific content identification information 503) of the content list 500 is read.

In step S55, it is checked whether or not the content ID of the read content identification information 503 is included in the reproduction disable list 600.
If it is included, the process proceeds to step S 57, and the read content identification information 503 is deleted from the content list 500.
If not included, the read content specifying information 503 is left as it is, and the process proceeds to step S56.

In the example of FIG. 13A, the specific information with the content ID = 20000 does not exist in the reproduction disabling list 600, and therefore remains.
In step S56, it is confirmed whether all the contents included in the content list 500 have been checked. If all are checked, the process proceeds to step S59. Otherwise, the process proceeds to step S58, the next content entry (specific information 503) is read, the process returns to step S55, and the processes from step S55 to S58 are repeated.
In step S59, the version information (Ver) 501 of the content list 500 is set to a value obtained by adding 1 to the latest list version (VNEW) 700.
In the case of FIG. 13A, the version information (Ver) 501 of the content list 500 is set to 10030 (latest list version: VNEW) + 1 = 10031.

The content list 500 created by such merge processing has the following properties.
(1) The relationship is that a version number greater than the latest version before merging is assigned, and even if recording or moving is performed using this merged content list, the larger the version number, the later processing is performed in time. Is preserved.
(2) In the latest version before merging, the moved / deleted content is not included in the merged content list.

  (1) is obvious from the processing procedure. In (2), if a content is deleted from the content list 500 by moving the content, the corresponding content information is always included in the non-reproducible content list 600, and therefore is always deleted from the content list 500 in the merge process. Therefore, the merged content list 500 always includes less content than the immediately preceding content list 500, and the merged content list 500 cannot be illegal.

  Conversely, consider a case where only the merge processing is performed and playback is attempted using the content table before merging. For example, after the merged content list 500 of FIG. 13B is created, playback is attempted using the content list 500 with version information (Ver) as 10011. In this case, since the content 20001 is included in the reproduction disabled list 600, it cannot be reproduced.

  Further, even if moving and recording are repeated until the content 20001 is deleted from the playback disabled content list 600, in that case, the content list 500 of version 10012 or lower is used by determining the version applicable to the playback disabled list. Can not be replayed. Since the version information of the entry included in the unreproducible content list 600 becomes larger as time elapses from the condition (1), the version before 10011 is not made reproducible after the content 20001 is deleted.

  Note that when checking whether the content list 500 is included in the unreproducible content list 600, an entry having a moving version older than the version of the content list 500 is not included in the content list 500. This comparison check may be omitted to speed up the processing. In the example of FIG. 13A, since the content 20005 in the disabled playback content list 600 has been moved / playback disabled in version 10000, it is determined that it is not included in the content list 500 of version 10010. . Therefore, it is not necessary to compare the content 20005 in the disabled content list 600 with each entry in the content list 500.

<Backup warning process>
In the present invention, the content list 500 becomes unusable when a long time has passed since it was backed up and the playback disabled list application version VS exceeds the version at the time of backup. Therefore, it is preferable to warn the user that the user should take a backup before that.
The warning is performed by the warning output unit 70 of FIG. 1 according to an instruction from the control unit 10.
Further, the warning message is output using characters, graphics, moving images, or sounds. For example, a message such as “Be sure to backup before moving content” is displayed on the CRT.

As a warning processing method, there is a method of simply counting the number of times of moving content and prompting the user to perform backup periodically. FIG. 15 is an explanatory diagram of one embodiment.
For example, if the content list 600 that cannot be reproduced becomes full when 100 movements are made in total, 90 times is set as a threshold, and the user is warned after performing content reproduction disabled 90 times (FIG. 15 ( b)). If the backup is performed here, there is no case where there is no content list usable for the backup which is the worst case if the next backup is further performed within 100 times. Here, it is assumed that the backup was performed at the time of warning, and then the warning is performed after 90 movement processes from there.
According to this, the content list 500 can always be used effectively by the user taking a backup at the time of warning.

In addition, when backup processing is performed via software that manages the device of the present invention,
(1) A warning is issued if the threshold is moved beyond the threshold after the last backup. (2) Control can be performed such that a warning is issued until the backup is actually executed.
FIG. 16 shows an example thereof. In this example, the movement is performed 90 times without first performing the backup in FIG. First, a backup warning is given to the user because a movement process equal to or greater than the threshold value has been performed at that time (FIG. 16B).

If the user does not back up, a warning is issued at the next movement or software startup (FIG. 16C).
Therefore, when the user makes a backup, the playback disabled list applicable version or the use position of the content list at the time of backup is saved (FIG. 16D). The storage destination of this information may be the secure memory 200 or the mass storage medium HDD.

After that, the control software of the storage device issues a warning when the movement (regeneration disablement) of the post-backup threshold (90 times) or more is performed (FIG. 16E). Even if the user makes a backup without issuing a warning, the applicable version of the playback disabled list or the use position of the content list at the time of backup is saved (FIG. 16 (f)), and from there Further, a warning is given when a movement (regeneration disablement) exceeding the threshold (90 times) is performed (FIG. 16 (g)).
As a result, a warning message is not output to users who voluntarily perform backups less frequently than the threshold, and messages can be output only to users who do not voluntarily backup.

<Other Example 2>
An embodiment in which a configuration related to copy control including an encryption unit and a secure memory according to the present invention is provided by special hardware (referred to as an add-on board) will be described.
FIG. 17 shows a configuration block diagram of a content storage apparatus having an add-on board. Here, a general-purpose computer such as a personal computer can be used as the content storage device.
The add-on board can be provided as a card-type board having a general-purpose interface.
17, the content storage device includes a control unit 10, a storage unit 20, an input unit 30, and a hard disk HDD 100, and mainly includes a content input unit 31, an encryption unit 40, and a secure memory 200, as in the configuration of FIG. An add-on board 300 is provided.

Each of these components is connected by an address bus and a data bus that are normally used in a personal computer or the like.
As the content input unit 31 and the encryption unit 40 included in the add-on board 300, those having almost the same configuration and function as those shown in FIG. 1 can be used.
As the secure memory 200, a flash memory can be used as in FIG. 1, but an SRAM or the like with a battery backup function may be used.
Further, the add-on board 300 may include a CPU 80 and a storage unit 90 so that the add-on board 300 itself can execute encryption processing and hash data generation processing. In this case, the encryption program, the reproducibility determination program, and the disabling list / content list processing program are stored in the secure memory 200.
The hard disk HDD 100 stores the content itself and the content list 500, and the secure memory 200 stores the reproduction disable list 600.

FIG. 18 shows a configuration diagram of data stored in the hard disk HDD of this embodiment.
The hard disk HDD has a recording area for the content storage list 500 and a content recording area 110, as in FIG.
In FIG. 18, the content storage list 500 includes version information 501, content number 502, and content specifying information 503. The content specifying information 503 includes movement information MOV in addition to the content ID and the content key KEY.

The movement information MOV is information including the number of times of movement to other media or range information of partial movement of content. The number of movements is information indicating how many times the medium has been moved. For example, it is information indicating that the content to be copy-controlled has moved “once for DVD” and “once for Blu-ray Disc (BD)”. This corresponds to the case where the copy control criterion permits a plurality of media to move a specified number of times.
The range information is information indicating the moved range when a part of the content can be moved. For example, in the case of content with a length of 2 hours, this is information indicating that the content portion for 1 hour from the beginning has already been moved to another medium.

<Recording process>
The recording process in the second embodiment will be described.
The recording process is performed by the CPU 10 controlling the add-on board 300 based on the program stored in the storage unit 20.
When recording content, the CPU 10 first acquires information about the content, and gives the content list 500 recorded on the hard disk HDD to the add-on board 300.
In the add-on board 300, the “content ID, content key KEY” of the content to be recorded is added to the given content list 500, and a new content list 500 is generated. The new content list 500 is stored in the hard disk HDD.
Further, when content is input from the content input unit 31 of the add-on board 300, the content itself is encrypted using the content key included in the content, and after performing a predetermined authentication process, the encrypted data is stored. And stored in the content area 110 of the hard disk HDD.
When recording new content, the movement information MOV in the content list 500 is set to a predetermined initial value.

<Move process>
Next, the movement process of the second embodiment will be described.
When moving, the content list 500 and the reproduction disabled content list 600 are updated.
There are two ways to create the reproduction disable list 600. There are a method for managing only “whether it has been moved” in the reproduction disable list 600 and a method for managing all movement information.
FIG. 19 shows an embodiment of a method for managing the reproduction disable list 600.

FIG. 19 (a) handles the reproduction disabled content list as holding only the information “whether it has been moved or not”. In the case of FIG. 19 (a), when moving the content, the corresponding content is added to the unreproducible content list 600 regardless of whether it is a partial move or a move to one of the movable media.
If the information to be moved is already in the reproduction disabled content list 600, only the version is updated.
At the time of reproduction, if the content list 500 given by the CPU is newer than the version information of the corresponding content included in the non-reproducible content list 600, the content list 500 is processed according to the information in the content list 500.

FIG. 19B holds all information related to movement of each content in the reproduction disabled content list 600. In this case, information regarding all the movements is processed according to the reproduction disabled content list 600.
In the case of FIG. 19A, when the latest content list disappears, there is a risk that the content that has been moved to a certain medium may not be completely reproducible, but the usage capacity may be small.
On the other hand, in the case of FIG. 19 (b), the latest content list disappears, and it is possible to retain information regarding movement even when restoration is performed from backup. For example, content that has been moved only to a DVD can be stored. It can be restored to a Blu-Ray disc (BD) so that it can be moved.

<Reproduction processing>
Next, the reproduction process of the second embodiment will be described.
FIG. 20 shows a flowchart of the reproduction process using the reproduction disable list 600 shown in FIG.
Here, the reproduction disabling list 600 holds only the information “whether it has been moved” or not.
20, step S21 corresponds to step S11 in FIG. 9, and step S22 corresponds to the processing from step S12 to step S13 in FIG.
The validity verification of the content list in step S22 is performed based on the content list 500 after the add-on board 300 receives the content list 500 stored in the hard disk HDD from the CPU.
Here, description will be made assuming that the process up to the verification of the validity of the content list 500 has been properly completed.

First, in step S23, it is checked whether or not the content requested to be reproduced is included in the reproduction disable list 600. If it is included in the reproduction disabled list 600, the process proceeds to step S24, and the version recorded in the reproduction disabled list of the content is compared with the version of the content list 500.
If the version of the playback disable list 600 is newer, playback is not permitted. It is possible not to permit reproduction by not performing content decryption by the add-on board 300.
On the other hand, if the version of the playback disable list 600 is not new, the process proceeds to step S25, and playback processing is performed according to the information in the content list 500.

FIG. 21 shows a flowchart of the reproduction process using the reproduction disable list 600 shown in FIG. Here, the reproduction disable list 600 includes all pieces of movement information.
Steps S31 and S32 in FIG. 21 are the same as steps S21 and S22 in FIG. 20, respectively.
Next, in step S33, it is checked whether or not the content instructed to be reproduced is included in the reproduction disabled content list. If it is included, the process proceeds to step S34, and it is confirmed whether reproduction is impossible in all situations.
For example, once written on a DVD, if it can still be moved to a Blu-Ray disc (BD), it is treated as reproducible.
If it is not included in the non-reproducible content list 600, the process proceeds to step S35, the content list 500 is referred to, and a reproducibility is determined based on the criteria of the list 500 to perform replay processing.

The above is the reproduction processing of the second embodiment. According to this, based on the information in the content list 500 or the playback disabled list 600, playback processing within a valid range is possible.
In particular, in the case of the second embodiment, since management is performed for each destination medium and every time, it is possible to cope with situations other than simple playback incapability, and by using an add-on board to close important processing, There is an effect that it can be processed by the open CPU 10 and software on a general OS.

It is a schematic block diagram of Embodiment 1 of the content storage apparatus of the present invention. It is explanatory drawing of the movement process and backup reproduction | regeneration processing of a content of this invention. It is explanatory drawing of one Example of the preservation | save content of the hard disk HDD of this invention. It is explanatory drawing of one Example of the reproduction | regeneration disabling list | wrist of this invention. It is explanatory drawing of the change of the reproduction | regeneration disabling list | wrist of this invention. It is explanatory drawing of one Example of the backup process of this invention. It is a flowchart of one Example of the movement process of this invention. It is explanatory drawing of the change of the reproduction | regeneration disabling list | wrist of the movement process of this invention. It is a flowchart of the reproduction | regeneration processing of this invention. It is explanatory drawing of one Example of the restoration of backup data of this invention. It is explanatory drawing of one Example of the restoration of backup data of this invention. It is explanatory drawing of one Example of the restoration of backup data of this invention. It is explanatory drawing of the change of the content list of the merge process of the content list of this invention. It is a flowchart of one Example of the merge process of this invention. It is explanatory drawing of the backup warning with respect to the content list of this invention. It is explanatory drawing of the backup warning with respect to the content list of this invention. It is a structure block diagram of other Example 2 of the content storage apparatus of this invention. It is explanatory drawing of the data preserve | saved at the hard disk HDD of Example 2 of this invention. It is explanatory drawing of one Example of the reproduction | regeneration disabling list | wrist of Example 2 of this invention. It is a flowchart of the reproduction | regeneration processing of Example 2 of this invention. It is a flowchart of the reproduction | regeneration processing of Example 2 of this invention.

Explanation of symbols

10 Control unit (CPU)
20 Storage unit (RAM)
30 Input section (mouse, remote control)
31 Content input section (tuner)
40 Encryption unit 50 Master key 100 Hard disk HDD
110 Content recording area 200 Secure memory 300 Add-on board 500 Content storage list 501 Version information (Ver)
502 Number of contents (CO)
503 Content specific information (ID, KEY)
504 Hash value (HA)
600 Playback disabled list 601 Number of contents (CC)
602 Version that can be replay disabled list (VS)
603 Content identification information (ID, Ver)

Claims (4)

A content capture unit that captures content;
An input unit for receiving an input of a control instruction for the content;
A content recording unit for recording the contents the captured, and a content list including information identifying the content,
A reproduction disable list including information for identifying content for indicating that the content recorded in the content recording unit has been disabled and information for specifying when the content has been moved is recorded. Rewritable non-volatile secure memory,
The content acquisition unit content A is taken up by, and if the input of the recording instruction is received by the input unit, and records information identifying the time when the content A is incorporated in the content list, the content A a recording control unit that records the content recording portion,
If the movement instruction for moving to a different other recording medium is already Remembered content B to the content recording unit and the content recording portion of which is accepted by the input section, the content B the other recording medium After copying, the content B is deleted from the content recording unit, the information specifying the content B is deleted from the content list, and the information for identifying the content B and the time when the content B is moved are specified. A movement control unit for recording the disabling information of the content B including the information to be recorded in the reproduction disabling list ,
In the case where the movement control unit records the disabling information of the content B in the reproduction disabling list, and when the maximum recording capacity of the reproduction disabling list secured in the secure memory is exceeded, The oldest disabling information included in the reproduction disabling list is deleted with reference to the information specifying the time when the contained content is moved, and then the disabling information of the content B is not reproducible. A content storage device for recording in a computerized list . When the input of the playback instruction of the content by the input unit is received, when said disabling information of the reproduction instruction is content is recorded in the reproduction disabling list, the reproduction instruction has been content The content storage device according to claim 1 , further comprising a reproduction control unit configured not to perform reproduction. The replay disable list comprises replay disable list applicable information,
The movement control unit, if you delete the oldest disabling information from the reproduction disabling list, identification data capable of identifying information specifying the timing moved included in the deleted oldest disabling information If the information specifying the time when the content C included in the content list is input is smaller than the set information that is not applicable to the reproduction disable list, the content is set. 3. The content storage device according to claim 1, wherein C is not reproduced. The remaining recording capacity of the reproduction disabling list secured in the secure memory, when it becomes less than a predetermined value, a warning message indicating that it should back up to the content that is currently being recorded in the content recording unit an alarm output unit for outputting a content storage apparatus according to claim 1, 2 or 3, characterized in that it comprises further.

Images