JP4591755B2 - Installation program, storage medium, content reproduction apparatus, and tamper resistant module update method - Google Patents

Description

The present invention relates to an installation program , a storage medium, a content reproduction apparatus, and a tamper resistant module update method , and is suitable for application when updating a tamper resistant module, for example.

  In recent years, content providing services that provide content such as video and music to users' terminals via networks such as the Internet and various media are rapidly spreading. In such a content providing service, it is important to protect the copyright by preventing unauthorized copying or falsification of the provided content.

  Therefore, in such a content providing service, for example, by providing encrypted content, and installing dedicated software for decrypting and reproducing the encrypted content on a user terminal (for example, a personal computer), Some devices are designed to protect copyrights by preventing unauthorized use of content on terminals on which this dedicated software is not installed. Incidentally, the installation is to store software in an executable state in the storage unit of the terminal.

  However, even if the dedicated software is actually installed on the user's terminal in this way, if the software is analyzed and tampered with, there is a possibility that, for example, the encryption of the content is decrypted and used illegally.

  Therefore, in such dedicated software, a module with enhanced resistance to analysis and tampering is incorporated in a part thereof, and the module having such resistance is called a tamper resistant module. In the following description, strengthening resistance to analysis and tampering in this way is also called tamper resistance.

  In practice, as such a tamper-resistant module, for example, it is difficult to analyze and tamper with internal processing by generating a random number by itself and executing internal processing (for example, decryption processing of encrypted content) using the random number. (See, for example, Patent Document 1).

  By the way, even if such a tamper resistant module is used, it is difficult to say that it is impossible to analyze and tamper with it. For this reason, the provider of the content providing service needs to assume a case where the tamper resistant module is analyzed and falsified.

  For example, when a tamper-resistant module that has been tampered with is found, the business operator needs to immediately revoke (make unusable) the tamper-resistant module tampered with at the user terminal. Accordingly, a file for revoking the tamper-resistant module that has been tampered with (hereinafter, also referred to as a revocation file) is provided to the user terminal together with the content, so that the tamper-resistant module that has been tampered with is revoked.

Furthermore, the business operator needs to update the tamper-resistant module revoked at the terminal to a new tamper-resistant module that has not been analyzed and altered. Therefore, for example, an update server (hereinafter also referred to as an update server) is prepared, and a new tamper resistant module is downloaded from the server to the terminal for updating, or a CD-ROM on which the new tamper resistant module is recorded is stored by the user. To be distributed and updated.
Japanese Patent Laying-Open No. 2003-187091 (FIG. 2)

  However, in the conventional method, if a revoke file is provided to the terminal before a new tamper-resistant module is prepared after the tamper-resistant module is discovered, the terminal is not prepared until a new tamper-resistant module is prepared. Will not be able to use the dedicated software for playing content. For this reason, the business operator could not provide the revoke file to the terminal until a new tamper resistant module was actually prepared.

  As a result, there is a risk that damage caused by tamper-resistant modules tampered with before the new tamper-resistant module is prepared. Furthermore, even if a new tamper resistant module can be prepared, there is a problem that preparation of an update server, distribution of a CD-ROM, and the like require a great deal of cost and time.

  As described above, the conventional method has a problem in that it is difficult to quickly and easily update the tamper resistant module.

The present invention has been made in consideration of the above points, and intends to propose an installation program , a storage medium, a content reproduction apparatus, and a tamper resistant module update method that can update a tamper resistant module more quickly and easily. .

In the installation program of the present invention to solve such a problem, the computer part is contained software including the first tamper resistant module, the software by the software installer order to install the software on the computer A tamper resistant module for installing the second tamper resistant module in a computer when the first tamper module is revoked, including a process to install and a second tamper resistant module when the software is installed The process to memorize the installer was executed .

As a result, when the installation program is executed on the computer , the software having the first tamper resistant module is installed and the second tamper resistant module is installed when the installed first tamper resistant module is revoked. A tamper resistant module installer for storing the information is stored. Accordingly, when a first tamper resistant module that has been illegally analyzed and altered is found, a tamper resistant module installer stored in advance is executed, and the first tamper resistant module is converted to the second tamper resistant module. Therefore, the tamper resistant module can be updated without preparing an update server or CD-ROM.

According to the present invention, the computer part is contained software including the first tamper resistant module, the process for installing the software by the software installer order to install the software on a computer, of the software A process of storing a tamper resistant module installer for installing the second tamper resistant module in a computer when the first tamper module is revoked, including the second tamper resistant module at the time of installation. When the first tamper resistant module that has been illegally analyzed and altered is found, the previously stored tamper resistant module installer is executed, and the first tamper resistant module is installed. Second tamper It is possible to update the module, the update server and the tamper resistant module can be updated without providing a CD-ROM, thus the installation program may update tamper resistant module further quickly and easily, storage medium, content A reproducing apparatus and a tamper resistant module updating method can be realized.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) Configuration of Content Reproducing Device In FIG. 1, reference numeral 1 denotes a content reproducing device capable of reproducing contents such as video and audio provided from a content providing service as a whole, and includes a CPU (Central Processing Unit) and a ROM (Read Only). Memory (RAM) and RAM (Random Access Memory) configuration control unit 2 reads out a control program such as an OS from storage unit 4 such as a hard disk drive connected via bus 3, and controls the whole in accordance with the read control program The content reproduction program is read from the storage unit 4 and the content is reproduced according to the read content reproduction program. The content reproduction software realized by the content reproduction program is also referred to as a software AV (Audio Visual) player hereinafter.

  In addition, the bus 3 includes an operation unit 5 such as a keyboard and a mouse for operating the content reproduction apparatus 1, a communication unit 6 communicating with a server on the network NT, and a recording medium RM such as a CD-ROM or DVD-ROM. A drive unit 7 that reads out recorded data, a display unit that displays video, and an output unit 8 that includes a speaker that outputs audio are also connected.

  That is, the control unit 2 downloads content from, for example, a server on the network NT via the communication unit 6 according to the operation of the operation unit 5, and reproduces this content with the software AV player read from the storage unit 4. The resulting video and audio are output from the output unit 8.

  Further, the control unit 2 reads content from, for example, a recording medium RM inserted in the drive unit 7, reproduces the content with a software AV player read from the storage unit 4, and outputs video and audio obtained as a result from the output unit 8. It is also made to output.

  Incidentally, content that is actually downloaded from a server on a network and content that is read from a recording medium are encrypted for copyright protection. For this reason, the software AV player incorporates a module (a tamper resistant module described later) for decrypting the encrypted content.

(2) Configuration of Software AV Player Next, the configuration of the software AV player that operates on the content reproduction apparatus 1 will be described. As shown in FIG. 2, the software AV player SP includes an application AP composed of modules for handling GUI (Graphical User Interface) screen display and content reproduction processing, decryption of encrypted content, content tampering check, And a tamper-resistant module TRM that handles copyright protection such as checking of usage conditions (reproduction period and number of times of copying) of content.

  In practice, this software AV player SP executed by the control unit 2 of the content reproduction apparatus 1 delivers the encrypted content to the tamper resistant module TRM via the application AP. In the tamper resistant module TRM, the encrypted content may be decrypted, the content may be checked for tampering, usage conditions may be checked, and the content delivered from the application AP may be played based on the check result. It is determined whether or not.

  When the tamper resistant module TRM determines that the content can be reproduced, it delivers the decrypted content to the application AP. When the decrypted content permitted to be reproduced is delivered from the tamper resistant module TRM, the application AP obtains, for example, video data and audio data by performing predetermined reproduction processing on the content, and the video data and audio Data and GUI screen data are supplied to the output unit 8.

  The output unit 8 displays video based on the supplied video data and GUI screen data on a display, and outputs audio based on the supplied audio data from a speaker. In this way, the content reproduction apparatus 1 obtains video data and audio data by decrypting and reproducing the encrypted content with the software AV player SP, and outputs video and audio based on the video data and audio data to the output unit 8. It is made to output via.

  Incidentally, the tamper resistant module TRM which is a part of the software AV player SP, for example, changes the reading order of the program code of the tamper resistant module TRM according to a predetermined rule, or performs a dummy operation during the execution of the program code. In other words, the program code itself is tamper resistant because it is encrypted by a predetermined encryption method.

(3) Content Configuration Next, the content configuration provided by the content providing service via the network NT or the recording medium RM will be described. As shown in FIG. 3, the content CT includes an encrypted content data CD, a key (hereinafter also referred to as a content key) CK for decrypting the encrypted content data CD, and the content CT. A content file CF in which usage condition information SD indicating usage conditions is stored, and a revocation file RF in which information for revoking a tamper resistant module TRM that has been tampered (hereinafter also referred to as revocation information) RD is stored. Consists of two files.

  By the way, when at least one tamper-resistant module TRM that has been actually tampered with is found, the tamper-resistant module TRM that has already been circulated has the same version as the tamper-resistant module TRM that has been tampered with (that is, a similar method) All tamper-resistant products have a risk of being tampered with.

  Therefore, in the present embodiment, all of the tamper resistant module TRM having the same version as the tamper resistant module TRM that has been tampered with is revoked, and the version of the revocation information RD stored in the revocation file RF includes any version. The revocation of the tamper resistant module TRM is described.

  Here, how to revoke a specific version of the tamper resistant module TRM will be described.

  The content key CK stored in the above-mentioned content file CF is encrypted, and the first key described in the revoke information RD stored in the revoke file RF (hereinafter referred to as the first revoke key). Called to be decrypted by RK1.

  Further, the first revoke key RK1 is also encrypted, and can be decrypted with the second revoke key RK2 described in the revoke information RD. Further, the second revoke key is also encrypted, and the revoke information RD describes for each version of the tamper resistant module TRM what is the key key that can decrypt the second revoke key RK2.

  For example, if there are three types of tamper-resistant modules TRM that are currently distributed, 1.0, 2.0, and 3.0, and a tamper-resistant module TRM that has been tampered with has not yet been found, it is provided with the content file CF In the revocation information RD of the revocation file RF to be executed, for example, a key key for decrypting the second revocation key RK2 by the version 1.0 tamper resistant module TRM is stored in the version 1.0 held by the tamper resistant module TRM of version 1.0. 1.0 key (hereinafter also referred to as a module key) MK1, and a key key for decrypting the second revoke key RK2 by the version 2.0 tamper-resistant module TRM is version 2.0. Module key MK2 unique to version 2.0 held by the tamper resistant module TRM Certainly, the key key for decrypting the second revoke key RK2 by the version 3.0 tamper resistant module TRM is the module key MK3 unique to version 3.0 held by the version 3.0 tamper resistant module TRM. It is noted.

  Therefore, in this case, the second revoke key RK2 can be decrypted by the module keys MK1, MK2, and MK3 held by itself in all versions of the tamper resistant module TRM, so that all versions of the tamper resistant module TRM decrypted The first revoke key RK1 can be decrypted with the revoke key RK2, the content key CK can be decrypted with the decrypted first revoke key RK1, and the content data CD can be decrypted with the decrypted content key CK.

  On the other hand, for example, when an altered version 2.0 of the tamper resistant module TRM is found, the second revoke key RK2 is subsequently used in the version 2.0 tamper resistant module TRM as shown in FIG. The revoke file RF from which the information indicating what the key key for decrypting is deleted is provided.

  As a result, only the version 2.0 tamper-resistant module TRM cannot decrypt the second revoke key RK2, and as a result, the content data CD cannot be decrypted. As a result, the control unit 2 of the content reproduction apparatus 1 can recognize that the tamper resistant module TRM of the currently installed software AV player SP is of an illegally tampered version, and revokes it. Yes. Thus, a specific version (in this case, version 2.0) of the tamper resistant module TRM can be revoked.

  It should be noted that once the control unit 2 of the content reproduction apparatus 1 has revoked a certain version of the tamper-resistant module TRM, it will continue to revoke this version of the tamper-resistant module TRM regardless of the provided revocation file RF. Has been made.

(4) Configuration of Installation Program By the way, when the tamper-resistant module TRM altered in this way is revoked, the content playback apparatus 1 naturally uses the software AV player SP until a new tamper-resistant module TRM is provided. The content CT cannot be reproduced.

  Therefore, in the present embodiment, tamper resistant modules TRM having different versions are prepared, and these are incorporated in advance in the installation program of the software AV player SP.

  Incidentally, different versions of the tamper resistant module TRM are provided with different tamper resistance. For example, different rules for changing the reading order of the program code are generated or are executed during the execution of the program code. The types of dummy operations and the execution timing are generated differently, or the program code itself is generated using different encryption methods.

As shown in FIG. 5, the installation program IP includes an application AP and a tamper resistant module TRM _n of version n (for example, 2.0), and an installer for installing them as a software AV player SP (hereinafter referred to as “installed software IP player SP”). Software AV player installer SI) SI and version n + 1 (for example, 3.0) tamper resistant module TRM _{n + 1} and an installer for installing it (hereinafter also referred to as tamper resistant module installer) TI And are incorporated. Note that the application AP and the tamper-resistant modules TRM _n and TRM _{n + 1} are preferably compressed and encrypted, for example, and incorporated in the installation program IP.

In practice, as shown in FIG. 6, the installation program IP is recorded on a recording medium RM such as a CD-ROM by a business operator and provided to the user of the content reproduction apparatus 1. When the installation program IP is executed on the content reproduction apparatus 1, the software AV player installer SI installs the application AP and the tamper resistant module TRM _n as the software AV player SP in the storage unit 4 of the content reproduction apparatus 1. Further, the tamper resistant module installer TI is copied to the storage unit 4.

That is, by executing this installation program IP, the software AV player SP having the tamper resistant module TRM _n of version 2.0 is installed in the storage unit 4 of the content reproduction apparatus 1, and the tamper resistant version 3.0 is installed. The tamper resistant module installer TI for installing the module TRM _{n + 1} is copied.

Then, as shown in FIG. 7, for example, a version 2.0 tamper-resistant module TRM _n was found to be falsified, and a revoke file RF indicating this is provided together with the content file CF, for example, via the network NT. Then (step SP1), the control unit 2 of the content playback apparatus 1 revokes the version 2.0 tamper-resistant module TRM _n according to the revoke file RF (step SP2), and version 3.0 tamper-resistant. The tamper resistant module installer TI for installing the module TRM _{n + 1} is activated (step SP3).

As a result, the tamper resistant module TRM _{n + 1} of version 3.0 is installed (step SP4), and as a result, the tamper resistant module TRM of the software AV player SP is automatically updated from version 2.0 to 3.0.

  Thus, when an altered version of the tamper resistant module TRM is found, the control unit 2 of the content playback apparatus 1 immediately revokes this version of the tamper resistant module TRM, and at the same time this version of the tamper resistant module TRM. Can be updated to a tamper resistant module TRM of a tamper resistant version different from the tamper resistant module TRM (that is, a tamper resistant module TRM that has not been tampered with yet).

(5) Operation and Effect In the above configuration, the content reproduction apparatus 1 installs the software AV player SP including the application AP and the version n tamper resistant module TRM _n and also installs the version n + 1 tamper resistant module TRM _{n + 1} . An installation program IP for causing the storage unit 4 to copy the tamper-resistant module installer TI for executing is installed.

As a result, the software AV player SP having the tamper resistant module TRM _n is installed in the storage unit 4 of the content reproduction apparatus 1, and the tamper resistant module installer TI for installing the tamper resistant module TRM _{n + 1} is copied. The

Then, when the revoke file RF indicating that the tamper resistant module TRM _n of the version n is found to have been found is provided, the content reproduction device 1 responds to the revoke file RF according to the version n resistance of the version n. Revokes the tamper module TRM _n and activates the tamper resistant module installer TI to install the tamper resistant module TRM _{n + 1} of the version n + 1.

Thus the content reproducing apparatus 1, the version in the case where n those tampered tamper resistant module TRM _n of is found, immediately tamper resistant module TRM n + ₁ has not been tampered with tamper resistant module TRM _n of the tampered version n Can be updated.

According to the above configuration, when installing the software AV player SP in which the version n tamper resistant module TRM _n is installed, the version n tamper resistant module TRM _n is updated to the version n + 1 tamper resistant module TRM _{n + 1.} The tamper resistant module installer TI is also installed, so that when the tamper resistant module TRM _n of version _n is analyzed and found to have been tampered with, the tamper resistant module installed in advance is detected. the installer TI launch, it is possible to update the tamper resistant module TRM _n this version n version n + 1 in the tamper-resistant module _{TRM n + 1,} the tamper-resistant module without providing the update server, a CD-ROM or the like You can update the RM, thus it is possible to update the tamper resistant module TRM more quickly and easily.

Further, according to the present invention, when a version n of the tamper resistant module TRM _n is found, the t version of the tamper resistant module TRM _n immediately altered without causing the user to perform any troublesome operations. Can be automatically updated to a tamper-resistant module TRM _{n + 1} that has not been tampered with and can be improved, and the convenience at the time of updating can also be improved.

(6) Other Embodiments In the above-described embodiment, the case where the content CT provided by the content providing service is configured by two files of the content file CF and the revoke file RF will be described. However, the present invention is not limited to this. For example, as shown in FIG. 8, the content CT may be configured by one content file CF by storing the revoke information RD in the content file CF.

  In the above-described embodiment, the revoke information RD includes the first revoke key RK1, the second revoke key RK2, and the module keys MK1, MK2, as different key information (restriction information) for each version of the tamper resistant module TRM. The case where MK3 is written and a specific version of the tamper-resistant module TRM is revoked depending on whether or not this key information is present has been described. However, the present invention is not limited to this, for example, the revocation information RD The tamper resistant module TRM corresponding to this identifier may be revoked by writing an identifier for identifying the tamper resistant module TRM to be revoked. Incidentally, as this identifier, for example, an ID (Identify) number or a manufacturing number that is different for each tamper-resistant module may be used. In this case, not only for each version but also for each tamper-resistant module can be revoked.

In the above embodiment, the revoke information RD, for example, version key key is key information for decrypting the second Ribokuki RK2 in tamper resistant module TRM _n of n is, version n tamper resistant module TRM _n of Although but has dealt with the case where it has been noted that the version n unique module key MK _n for holding, the present invention is not limited to this, the key key for decrypting the second Ribokuki RK2 is, the revoked directly It may be written in the information RD.

  Further, in the above-described embodiment, the case where two versions of the tamper resistant module TRM of version n and version n + 1 are incorporated in the installation program IP has been described. However, the present invention is not limited to this, and the three versions The above tamper resistant module TRM may be incorporated. In practice, the tamper resistant modules TRM can be updated by the number of tamper resistant modules TRM to be incorporated. Therefore, the larger the number of tamper resistant modules TRM to be incorporated, the more effective the analysis and tampering of the tamper resistant module TRM.

  Furthermore, in the above-described embodiment, the case where the installation program IP is recorded on the recording medium RM as the storage medium has been described. Actually, as the recording medium RM, for example, a magnetic disk (floppy disk or the like), magnetic It is possible to use a tape, an optical disk (DVD, DVD-RAM, CD-ROM, CD-R (Recordable) / RW (ReWritable), etc.), a magneto-optical disk (MO (Magneto-Optical disk), etc.), a semiconductor memory, etc. The present invention is not limited to this. For example, the present invention may be stored in advance in the storage unit 4 of the content reproduction apparatus 1 or may be downloaded via the network NT.

  Further, in the above-described embodiment, as a tamper resistant method in the tamper resistant module TRM, the reading order of the program code of the tamper resistant module TRM is changed according to a predetermined rule, or a dummy operation is performed during the execution of the program code. However, the present invention is not limited to this, and any combination thereof may be used. Tamper resistance may be realized by various methods.

  Furthermore, in the above-described embodiment, the case where the tamper resistant module TRM that is a part of the software AV player SP is updated has been described. However, the present invention is not limited to this, and various other types such as software that handles electronic money, for example. The present invention may be used when updating the tamper resistant module TRM incorporated in the software.

  Furthermore, in the above-described embodiment, the information processing apparatus includes the communication unit 6 as a communication unit that receives the revoke information RD as the identification information together with the content data CD, and the control unit 2 as the identification unit, the activation unit, and the update unit. However, the present invention is not limited to this, and various other configurations may be used.

  The present invention can be widely used for software having a tamper resistant module.

It is a basic diagram which shows the structure of a content reproduction apparatus. It is a basic diagram which shows the structure of a software AV player. It is a basic diagram which shows the structure of content (before the tamper-resistant module tampered with being discovered). It is a basic diagram which shows the structure of a content (after the tamper-resistant module tampered with was discovered). It is a basic diagram which shows the structure of an installation program. It is a chart figure showing execution of an installation program. It is a chart figure which shows the update of a tamper resistant module. It is a basic diagram which shows the structure of the content in other embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Content reproduction apparatus, 2 ... Control part, 3 ... Bus, 4 ... Memory | storage part, 5 ... Operation part, 6 ... Communication part, 7 ... Drive part, 8 ... Output part, AP ... ... Application, CF ... Content file, CT ... Content, IP ... Installation program, NT ... Network, RM ... Recording media, SI ... Software AV player installer, SP ... Software AV player, TI ... Endurance Tamper module installer, TRM ... Tamper resistant module.

Claims (8)

On the computer,
Portions including the software including the first tamper resistant module, the process for installing the software by the software installer order to install the software on the computer, during the installation of the software, the second tamper-resistant module An installation program for storing a tamper resistant module installer for causing the computer to install the second tamper resistant module when the first tamper module is revoked . The second tamper resistant module is compressed and encrypted and included in the tamper resistant module installer.
The installation program according to claim 1. Portions including the software including the first tamper resistant module, and software installer in order to install the software on a computer, including a second tamper-resistant module, the first tamper module is revoked A tamper resistant module installer for installing the second tamper resistant module in the computer when the software is installed, and a process of installing the software by the software installer in the computer and the tamper resistant module at the time of installing the software. storing the installation program for executing a process of storing the module installer
A computer-readable storage medium. Portions including the software including the first tamper resistant module, the process for installing the software by the software installer order to install the software in the content reproducing apparatus, during the installation of the software, the second resistance When the first tamper module including the tamper module is revoked, the content reproduction device executes a process of storing a tamper resistant module installer for installing the second tamper resistant module in the content reproduction device. by running the installation program for, as well as install the software in the storage unit, and a control unit for storing the tamper resistant module installer in the storage unit,
A communication unit that receives identification information for identifying an unauthorized tamper-resistant module together with content data;
With
The control unit
When reproducing the content data via the software, identify whether the first tamper resistant module in the software is an unauthorized tamper resistant module according to the identification information received together with the content data , When the first tamper resistant module is identified as an unauthorized tamper resistant module, the first tamper resistant module is revoked and the tamper resistant module installer is activated to store the second tamper resistant module in the memory. Content playback apparatus to be installed in the unit. The content data is encrypted so that it can be decrypted by the first and second tamper resistant modules.
The identification information includes restriction information for restricting decryption of the content data by an unauthorized tamper resistant module.
Content playback apparatus according to 請 Motomeko 4. The identification information includes key information for decrypting the content data by a legitimate tamper resistant module,
The control unit
When the key information corresponding to the first tamper module does not exist in the identification information, the first tamper resistant module is identified as an unauthorized tamper resistant module.
Content reproducing apparatus according to 請 Motomeko 5. The identification information includes an unauthorized tamper resistant module identifier,
The control unit
When the identifier of the first tamper resistant module matches the identifier in the identification information, the first tamper resistant module is identified as an unauthorized tamper resistant module.
Content playback apparatus according to 請 Motomeko 4. Portions including the software including the first tamper resistant module, the process for installing the software by the software installer order to install the software on the computer, during the installation of the software, the second tamper-resistant module An installation program for causing a computer to execute a process of storing a tamper resistant module installer for causing the computer to install the second tamper resistant module when the first tamper module is revoked. And the step of installing the software in the storage unit and storing the tamper resistant module installer in the storage unit ,
Together with the content data, and Luz step to receive the communication unit identification information for identifying an unauthorized tamper resistant module,
When the control unit reproduces the content data via the software, whether or not the first tamper resistant module in the software is an unauthorized tamper resistant module according to the identification information received together with the content data. If the first tamper resistant module is identified as an unauthorized tamper resistant module, the first tamper resistant module is revoked and the tamper resistant module installer is activated to execute the second tamper resistant module. A tamper- resistant module update method comprising: installing a tamper module in the storage unit .

Images