JP4667235B2 - Data distribution / reception system and data distribution / reception method - Google Patents

Description

  The present invention relates to a broadcast content redistribution system and a system that re-encrypts data at the relay stage when transmitting data, and relates to a data distribution / reception system and a data distribution / reception method.

  In digital broadcasting, there are a method of receiving broadcast radio waves directly at each household and a method of receiving it at one-way relay equipment and relaying it through an optical fiber or a coaxial cable to reach each household. Each household uses the most appropriate method according to the situation of the building including the topography and surroundings.

  Since the digital broadcast video is digitally encoded as MPEG2-TS, it can be logically distributed by any communication as long as a stable throughput equal to or higher than the video encoding rate can be obtained. It is possible to distribute MPEG2-TS using the IP protocol used on the Internet. However, since the original purpose of use is different between the broadcast wave mainly for air propagation and the IP protocol, there is a technical problem in transmitting the broadcast wave on the communication path. Among them, there is a risk of falsification of content in the middle of distribution, which could not be considered by air propagation on the communication channel, and there is a possibility that even individuals who have no right to distribute content can redistribute content once received. There is a problem from the viewpoint.

  Conventionally, when broadcast waves are received directly at each household, it is not possible to tamper with in the middle or resend the content once stored by individuals on a broadcast scale on a personal scale due to frequency allocation and broadcasting equipment costs. There wasn't. With the development of broadband networks, it has become possible to distribute MPEG2-TS for broadcasting over the IP protocol and to redistribute it on high-performance personal computers. Is not enough.

In broadcasting, a conditional access system (Radio Industry Association ARIB STD-B25) is used. The following Patent Documents 1 and 2 consider the upward compatibility between the security strength and the conventional CAS (Conditional Access Systems), assuming that it is used for communication and that it is compatible with the recent improvement in computing power of computers. The described patent application has been filed.
JP 2005-051359 A JP 2005-051360 A

  Since communication such as the IP protocol is more likely to be exposed to external threats than air propagation, it is necessary to fully consider content protection.

  The present invention solves the above-mentioned problems, and in order to prevent unauthorized reading (wiretapping) and tampering during content transmission, encryption is performed with a scheme having a higher cryptographic strength than broadcast waves, so that, for example, safety in data communication is improved. An object of the present invention is to provide a data distribution / reception system and a data distribution / reception method that can maintain security strength substantially equal to or higher than that of broadcast waves even when different networks are connected.

  A data distribution / reception system according to the present invention for solving the above-described problems includes a primary transmission side device, a secondary transmission side device, and a reception side device, and performs common key encryption or public key encryption on a digital data transmission path. In the data distribution / reception system for transmitting the decryption information necessary for transmitting and decrypting the encrypted data, the primary transmission side device uses the first key of n bits, and the first layer encryption means And the first transmission encrypted data obtained by encrypting the data by using the second key different from the first key and the first key encrypted by the second layer encryption means. A second layer decryption unit configured to decrypt the encrypted first key transmitted from the second layer encryption unit of the primary transmission side device with a second key different from the key; And the first key decrypted by the second layer decryption means And a relay first layer decryption means for decrypting the primary transmission encrypted data transmitted from the primary transmission side apparatus, a m-bit third key of 1 bit or more, and the first key to synthesize n Secondary transmission side composite key generation means for generating a composite key larger than bits, and decryption data of the relay first layer decryption means by using the composite key generated by the composite key generation means to obtain secondary transmission encrypted data And a relay encryption means for encrypting the third key or the composite key with a fourth key different from the key. Receiving-side composite key generating means for obtaining a composite key based on a key obtained by decrypting the relay encryption key transmitted from the relay encrypting means of the next sending side apparatus; and relay first layer encryption means of the secondary sending side apparatus The secondary transmission encrypted data transmitted from the reception side It is characterized in that a receiving first layer decoding section that decodes retrieve the data by using the synthetic key obtained by Narukagi generating means.

  Further, a fifth key sharing means provided in the system for sharing a fifth key and a third layer encryption provided in the primary transmission side device for encrypting the second key with the fifth key And a third layer decryption unit provided in the secondary transmission side device for decrypting the key encrypted by the third layer encryption unit using the fifth key. Yes.

  Also, sixth key sharing means provided in the system for sharing the sixth key, and relay third layer encryption provided in the secondary transmission side device for encrypting the fourth key with the sixth key. And a relay third layer decryption means for decrypting the key encrypted by the relay third layer encryption means using the sixth key.

  Also, a seventh key sharing means provided in the system for sharing a seventh key and a third layer encryption provided in the primary sending side device for encrypting the second key with the seventh key And a third layer decryption unit that is provided in the receiving side device and decrypts the key encrypted by the third layer encryption unit using the seventh key.

  Further, the sixth key and the seventh key are shared.

  The relay encryption unit of the secondary transmission side device encrypts the third key with the fourth key, and the reception side composite key generation unit of the reception side device uses the relay encryption of the secondary transmission side device. The relay encryption key transmitted from the means is decrypted using the fourth key to obtain the third key, and received from the second layer decryption means, and transmitted from the second layer encryption means of the primary sending side device. A second layer decryption means for decrypting the encrypted key using the second key to obtain the first key; a third key obtained by the reception second layer decryption means; and a second layer decryption means. It is characterized by comprising synthesizing means for synthesizing the obtained first key.

  Further, the secondary transmission side synthetic key generation means and the reception side synthetic key generation means are characterized by comprising bit concatenation means for concatenating the bit strings of the first key and the third key.

  The relay encryption key encrypted by the relay encryption unit of the secondary transmission side apparatus transmits an ECM transmission unit that transmits in the same format as the ECM format used in the broadcast transmission mode, or a unit that transmits as metadata. Alternatively, the transmission is performed using any one of the means for transmitting the first key superimposed on the second layer encryption means.

  Further, the relay encryption key of the relay encryption means of the secondary transmission side device is a relay second layer key synchronization generation means for generating a third key in synchronization with the secondary transmission side device and the reception side device, or Using either a fixed value or preset third key presetting means, or synchronous self-generating means for generating a third key in synchronism between the sending side apparatus and the receiving side apparatus based on the first key It is generated.

  Further, the sending side device in the system is characterized in that it is configured in multiple stages of third order or higher.

  The data distribution / reception method of the present invention includes a primary transmission side device, a secondary transmission side device, and a reception side device, and uses the common key encryption or the public key encryption in the digital data transmission path to transmit the encrypted data. In a data distribution / reception method for transmitting decryption information necessary for transmission and decryption, the primary transmission side device encrypts data using an n-bit first key and transmits the encrypted data. And a second layer encryption step of encrypting and transmitting the first key using a second key different from the first key, and the secondary transmission side device performs the second layer encryption. Using the second key decryption step of decrypting the encrypted first key transmitted in the step with a second key different from the key, and using the first key decrypted in the second layer decryption step, the primary transmission Primary transmission encrypted data transmitted from the side device A relay first layer decrypting step for decrypting, a secondary sending side composite key generating step for generating a composite key larger than n bits by combining the third key of m bits of 1 bit or more and the first key; Relay first layer encryption step for encrypting the decrypted data in the relay first layer decryption step with the composite key generated in the composite key generation step to generate secondary transmission encrypted data, and the third key or the composite A relay encryption step of encrypting the key with a fourth key different from the key, and the receiving side device receives the relay encryption key transmitted by the relay encryption step of the secondary sending side device A receiving-side composite key generation step for generating a composite key based on the decrypted key and a secondary sending encrypted data transmitted by the relay first layer encryption step of the secondary sending-side device Step It is characterized by obtained by decoding using the synthetic key to perform a reception first layer decoding step of retrieving data.

  The secondary transmission side apparatus executes a relay third layer encryption step of encrypting a fourth key used in the relay encryption step with a sixth key, and the primary transmission side apparatus performs the second transmission Performing a third layer encryption step of encrypting the second key used in the layer encryption step with a seventh key shared with the sixth key, and the receiving side device includes: A relay third layer decrypting step of decrypting the key encrypted in the relay third layer encrypting step using the sixth key to obtain a fourth key, and a third layer encrypting step of the primary sending side device And a third layer decryption step of decrypting the encrypted key using the seventh key to obtain a second key.

  With the above configuration, content can be protected at least as much as broadcast waves by re-encrypting communication stronger than broadcast. That is, by using the present invention, the security strength related to content protection when broadcasting content is distributed over a communication network can be made equal to or higher than that of a broadcast wave.

(1) According to the invention described in claims 1 to 10, data can be encrypted by a method having a higher encryption strength than a broadcast wave, and security strength substantially equal to or higher than that of a broadcast wave is ensured. A system is possible. Also, since both the encryption key generated by the transmission system (primary transmission side apparatus) and the encryption key generated by the redistribution system (secondary transmission side apparatus) are used, both receive and decrypt the digital data. The receiver can decrypt the digital data only when the data is permitted.
(2) According to the second aspect of the present invention, the second key can be obtained safely in the primary transmission side device and the secondary transmission side device.
(3) According to the invention described in claim 3, the fourth key can be obtained safely in the secondary transmission side device and the reception side device.
(4) According to the invention described in claim 4, the second key can be obtained safely in the primary transmission side device and the reception side device.
(5) According to the invention described in claim 5, the system can be simplified by sharing the key to be used.
(6) According to the invention described in claim 7, it is possible to easily generate a composite key without performing a complicated calculation.
(7) According to the invention described in claims 11 and 12, data can be encrypted by a method having higher encryption strength than the broadcast wave, and security strength substantially equal to or higher than the broadcast wave is ensured. A possible method is obtained. Also, since both the encryption key generated by the transmission system (primary transmission side apparatus) and the encryption key generated by the redistribution system (secondary transmission side apparatus) are used, both receive and decrypt the digital data. The receiver can decrypt the digital data only when the data is permitted.
(8) According to the invention of the twelfth aspect, the steps to be executed can be simplified by sharing the key to be used.

Hereinafter, embodiments of the present invention will be described with reference to the drawings, but the present invention is not limited to the following embodiments.
Example 1 (equivalent to claim 1)
FIG. 1 shows the configuration of a system according to an embodiment of the present invention, where 1 is a primary transmission side device, 2 is a secondary transmission side device, and 3 is a reception side device. As an application of the present invention, in a system for transmitting decryption information necessary for transmission and decryption of encrypted data on a data transmission path, a security level of a certain level or higher is set on a transmission path in which an assumed threat differs during data transmission. High adaptability when required to keep. The secondary sending side device 2 is required to have a trust relationship with the primary sending side device 1 in order to decrypt the data encryption once.

  The encryption method used for the digital data transmission path can be realized by either common key encryption or public key encryption. Also, there is no particular limitation on the encryption key length.

  In FIG. 1, reference numeral 11 in the primary transmission side device 1 is a first layer encryption unit that encrypts digital data using a key K1 (first key) to obtain primary transmission encrypted data. Reference numeral 12 denotes a second layer encryption unit that obtains an encrypted key K1 '(encrypted first key) by encrypting the key K1 using the key K2 (second key).

  The secondary sending side device 2 21 obtains a key K1 by decrypting the key K1 ′ encrypted and sent out by the second layer encryption unit 12 of the primary side device 1 with the separately obtained key K2. It is a layer decoding part.

  22 is a relay that obtains digital data by decrypting the data encrypted by the first layer encryption unit 11 of the primary transmission side device 1 using the key K1 decrypted by the second layer decryption unit 21. This is a one-layer decoding unit.

  23 is a bit synthesis unit that generates a synthesized key K larger than n bits by synthesizing the 1-bit or more m-bit key K11 (third key) generated by the secondary transmission side device 2 and the key K1. (Secondary sending side synthetic key generating means).

  Note that it is considered highly realistic that the common key encryption has a key length of 56 or 64 bits as m bits and a key length of 128 bits as n bits. In the case of public key cryptography, m and n can be considered as combinations such as 512, 1024 or 1024, 2048, respectively.

  24 is a relay first layer encryption unit that encrypts the digital data decrypted by the relay first layer decryption unit 22 using the composite key K generated by the bit composition unit 23 and obtains secondary transmission encrypted data. It is.

  A relay second layer encryption unit (25) encrypts an m-bit key K11 (third key) with a relay second layer encryption key K22 (fourth key) to obtain a key K11 ′ (relay encryption key). Relay encryption means).

  The receiving side device 31 31 decrypts the key K11 ′ encrypted by the relay second layer encryption unit 25 of the secondary transmission side device 2 using the relay second layer encryption key K22 obtained separately. It is a receiving second layer decryption unit for obtaining the key K11.

  Reference numeral 32 denotes a second layer decryption unit which decrypts the encryption key K1 'encrypted and sent out by the second layer encryption unit 12 of the primary transmission side apparatus 1 using the key K2 obtained separately.

  Reference numeral 33 denotes a bit composition unit that obtains a bit composition key K by subjecting the key K1 decrypted by the second layer decryption unit 32 and the key K11 decrypted by the reception second layer decryption unit 31 to bit composition.

Reference numeral 34 denotes a reception first layer decryption unit that obtains digital data by decrypting the digital data encrypted by the relay first layer encryption unit 24 of the secondary transmission side apparatus 2 using the bit composition key K. .
Example 2 (corresponding to claim 2)
In the primary sending side device 1 and the secondary sending side device 2 in the first embodiment, the system is configured as shown in FIG. 2 in order to obtain the key K2 separately separately using a communication path or mail.

  FIG. 2 shows, as a more specific embodiment of FIG. 1, the primary transmission side device 1 by the broadcasting device 100, the secondary transmission side device 2 by the redistribution device 200, and the reception side device 3 by the reception device 300. The same parts as those in FIG. 1 are denoted by the same reference numerals.

  Note that Kw in FIG. 2 corresponds to K2 in FIG. 1 and represents the second key of the present invention. Ks corresponds to K1 (first key) in FIG. 1, Ks1 corresponds to K11 (third key) in FIG. 1, and Kw1 corresponds to K22 (fourth key) in FIG.

  In FIG. 2, it is provided as a key Km1 shared block for sharing the key Km1 (fifth key) with the third layer encryption unit 101 and the third layer decryption unit 201 at the time of system construction.

The third layer encryption unit 101 of the broadcasting device 100 encrypts the key Kw with the key Km1 and distributes the output to the redistribution device 200. The third layer decryption unit 201 of the redistribution apparatus 200 decrypts the key encrypted by the third layer encryption unit 101 with the key Km1 to obtain the key Kw. By these, the key used as the key Kw (K2 in the first embodiment of FIG. 1) can be obtained safely.
Example 3 (equivalent to claim 3)
In the secondary sending side device 2 and the receiving side device 3 in the first embodiment, the key K22 is configured as shown in FIG. That is, Kw1 is securely shared using the key Km3 (sixth key) to the relay third layer encryption unit 202 of the redistribution device 200 and the relay third layer decryption unit 302 of the reception device 300 at the time of system construction.

  The third layer encryption unit 202 of the redistribution apparatus 200 encrypts the key Kw1 using the key Km3, and transmits the encryption key information EMM3 to the reception apparatus 300.

  The relay third layer decryption unit 302 of the receiving apparatus 300 decrypts the encrypted Km1 (EMM3) using the key Km3.

  The relay second layer decoding unit 301 in FIG. 2 is a decoding unit that performs the same operation as the reception second layer decoding unit 31 in FIG.

By these, the key used as the key Kw1 (K22 in the first embodiment in FIG. 1) can be obtained safely.
Example 4 (equivalent to claim 4)
In the primary sending side device 1 and the receiving side device 3 in the first embodiment, the key K2 is configured as shown in FIG. That is, when the system is constructed, Kw is securely shared using the key Km2 (seventh key) to the third layer encryption unit 102 of the broadcast device 100 and the third layer decryption unit 303 of the reception device 300.

  The third layer encryption unit 102 of the broadcasting device 100 encrypts Kw using the key Km2, and distributes the encrypted key information EMM2 to the receiving device 300.

  In the reception device 300, the encrypted key Kw (EMM2) is decrypted by the third layer decryption unit 303 using the key Km2.

By these, the key used as the key Kw (K2 in FIG. 1) can be obtained safely.
Example 5 (equivalent to claim 5)
As another implementation method for separately obtaining the key K2 in the primary transmission side apparatus 1, the secondary transmission side apparatus 2 and the reception side apparatus 3 in the first embodiment, the key Km2 in the third embodiment and the key in the fourth embodiment are used. Km3 is shared.
Example 6 (equivalent to claim 6)
The composite key K of the secondary transmission side apparatus 2 in the first embodiment is configured to be encrypted with the key K22 in the relay second layer encryption unit 25 as shown in FIG.

  As a result, the reception second layer decryption unit 31 of the reception side apparatus 3 uses the key K22 to decrypt the relay encryption key transmitted from the secondary transmission side apparatus 2 to obtain the composite key K. Therefore, the bit synthesis unit 33 and the second layer decoding unit 32 in FIG. 1 can be omitted.

  FIG. 4 shows a processing flow of the entire system configured as shown in FIG. The upper part of FIG. 4 shows the flow of key information processing, and the lower part shows the flow of data processing.

  First, in the primary transmission side device 1, the second layer encryption unit 12 encrypts and transmits the key K1 with the key K2 (step S1a), and the first layer encryption unit 11 encrypts the data with the key K1 (step S1a). Step S1b).

  Further, the second layer decryption unit 21 of the secondary transmission side device 2 separately obtains the key K2 (step S2a), and the reception second layer decryption unit 31 of the reception side device 3 separately obtains the key K22 (step S3a).

  Next, the second layer decryption unit 21 of the secondary transmission side device 2 decrypts the encrypted key K1 using the key K2 (step S2b), and the bit synthesis unit 23 synthesizes the keys K11 and K1. A composite key K is generated (step S2c), the relay second layer encryption unit 25 encrypts the composite key K with the key K22, and transmits the encrypted composite key (relay encryption key) (step S2d). .

  Further, the relay first layer decryption unit 22 decrypts the primary transmission encrypted data transmitted from the primary transmission side apparatus 1 by using the key K1 (step S2e), and encrypts the decrypted data again by the composite key K. And transmit (step S2f).

  Next, in the reception side device 3, the reception second layer decryption unit 31 decrypts the encrypted composite key (relay encryption key) transmitted from the secondary transmission side device 2 by using the key K22 (Step S1). S3b), the reception second layer decryption unit 31 decrypts the secondary transmission encrypted data transmitted from the secondary transmission side apparatus 2 by using the composite key K (step S3c), and the encrypted communication is completed.

In the system shown in FIG. 1, the same components as those in FIG. 3 are processed in the same manner as in FIG.
Example 7 (equivalent to claim 7)
The operation of the bit synthesis units 23 and 33 of the first embodiment can be realized by concatenating the bit strings of the keys K1 and K11. Although it is possible to perform a complex operation here, bit string concatenation is basically sufficient for improving security.
Example 8 (equivalent to claim 8)
The following method is adopted as a transmission block of the key K11 (relay encryption key) encrypted by the relay second layer encryption unit 25 of the secondary transmission side apparatus 2 of the first embodiment.

  That is, when using the broadcast, it is transmitted as an ECM format used in the broadcast transmission system (ECM1 in FIG. 2).

In communication, methods such as transmission as metadata or transmission by superimposing on the second layer encryption unit 12 for transmission of the key K1 are conceivable.
Example 9 (equivalent to claim 9)
Instead of transmitting the key K11 encrypted using the relay second layer encryption unit 25 of the secondary transmission side apparatus 2 of the first embodiment, the secondary transmission side apparatus 2 and the reception side apparatus 3 are synchronized. The primary sending side device 1 and the receiving side device 3 are synchronized based on the relay second layer key synchronization generating unit that generates the key K11, the fixed value or the preset key K11 presetting unit, or the key K1. One of the synchronous self-generating units that generates the key K11 is used.
Example 10 (equivalent to claim 10)
In the first to ninth embodiments, this system is configured by the primary transmission side, secondary transmission side, and reception side devices. However, the transmission system is multi-stage, the tertiary transmission side device, the fourth transmission side. It is possible to expand in multiple stages.
Example 11 (equivalent to claim 11)
The primary transmission side device 1, the secondary transmission side device 2, and the reception side device 3 of the first embodiment cooperate to realize the following method. That is, the primary transmission side apparatus 1 performs encryption with a 64-bit common key (K1) as encryption of data such as video. Then, the secondary sending side device 2 temporarily decrypts it with the same key (K1) as the common key (K1) of the primary sending side device 1, and then continues the 64-bit common key (K1) of the primary sending side device 1 ) Is further combined with 64 bits of key information (K11), and data such as video is encrypted again as a 128-bit common key (K) and transmitted to the receiving side apparatus 3. In the receiving side device 3, the key information (K11) added in the secondary sending side device 2 and the 64-bit common key (K1) in the primary sending side device 1 are synthesized by the same method as the secondary sending side device 2. Using the key (K).

Here, the key synthesis in the secondary transmission side apparatus 2 is more secure than the primary transmission side apparatus 1 and the secondary transmission side apparatus 2 in terms of the security strength between the secondary transmission side apparatus 2 and the reception side apparatus 3. In order to improve, it is considered effective to concatenate, for example, a 64-bit key K11 in the secondary transmission side apparatus 2 to the common key K1 of the primary transmission side apparatus 1 to make a 128-bit common key. It is done.
Example 12 (equivalent to claim 12)
A method using common key encryption as encryption and decryption of the fifth embodiment is conceivable. That is, the key Km3 (sixth key) used for encryption and decryption in the relay third layer encryption unit 202 and relay third layer decryption unit 302 in FIG. 2, and the third layer encryption unit 102 and third layer The decryption unit 303 shares the key Km2 (seventh key) used for encryption and decryption.
(Example 13)
An embodiment in which broadcast contents are redistributed using the entire configuration of the first to twelfth embodiments will be described with reference to FIG. In FIG. 5, the same parts as those of FIG. 5 differs from FIG. 2 in that the second layer decoding unit 21 and the third layer decoding unit 201 are composed of broadcast CAS (Conditional Access Systems) # 1, and the relay second layer decoding unit 301 and the relay third The layer decoding unit 302 is configured by redistribution CAS # 2, the second layer decoding unit 32 and the third layer decoding unit 303 are configured by broadcast CAS # 2, and the bit synthesis unit 33, redistribution CAS # 2 and broadcast CAS # are configured. 2 is configured by redistribution CAS # 1.

  Broadcast CAS # 1 is a system linked to the broadcast apparatus 100 for the redistribution apparatus 200, and broadcast CAS # 2 is a system linked to the broadcast apparatus 100 for the reception apparatus 300.

(Sending)
The video or the like sent out from the broadcasting device 100 is encrypted by the first layer encryption unit 11 with the content encryption key Ks and sent or broadcast (Ks is K1 in FIG. 2). The usual update of the key Ks is normally performed in seconds. The key Ks is encrypted by the second layer encryption unit 12 with the key Kw (Kw is K2 in FIG. 1) for each broadcasting apparatus 100, and is transmitted or broadcast. It is assumed that the key of broadcast CAS # 1 for redistribution apparatus 200 is written in advance as Km1, and the key of broadcast CAS # 2 for reception apparatus 300 is written in Km2 before the use of the service. The keys Km1 and Km2 are used as keys when changing the key Kw.

(Re-delivery)
In the redistribution device 200, the first layer decryption unit 22 decrypts the content such as the video encrypted by the broadcasting device 100 with the key Ks. A key Ks1 that is synchronized with the change period of the key Ks is generated, and the keys Ks and Ks1 are combined by the bit combining unit 23. If the composite function is expressed as ◯, it becomes KsｓKs1.

  As a simple and effective method of the synthesis function, bit concatenation || can be considered. That is, the combined key is Ks || Ks1, and the decrypted data is encrypted again by the relay first layer encryption unit 24 using the Ks || Ks1. The re-encrypted data such as video is distributed to the receiving device 300.

  Further, the key Ks1 is encrypted with the key Kw1 of the redistribution apparatus 200 and distributed as ECM1 (relay encryption key). If the keys Ks and Ks1 are 64 bits used in broadcasting, the composite key Ks || Ks1 becomes 128 bits.

(Receive)
The receiving device 300 decrypts the ECM1 encrypted with the key Kw1 by using the key Kw1 of the redistribution CAS # 2. The key Ks1 is extracted as the decryption result. On the other hand, the encrypted key Ks included in the ECM sent from the broadcast apparatus 100 is decrypted using the key Kw of the broadcast CAS # 1 (2), and the result is extracted. The extracted key Ks and the key Ks1 are subjected to bit composition by the same bit composition method as the bit composition of the redistribution apparatus 200.

  The bit composition method is a condition that the redistribution apparatus 200 and the receiving apparatus 300 are in the same system and are synchronized. If the bit composition unit performs simple bit concatenation, the re-distribution CAS is configured by forming the re-distribution CAS # 2 area with a tamper-resistant IC card, etc. The top is considered not so different. When bit composition is also performed inside the tamper resistant, redistribution CAS # 1 including broadcast CAS # 2 is required. Many CASs are often composed of IC cards. When the redistribution CAS # 1 includes the broadcast CAS # 2, the IC card is held inside the redistribution CAS # 1 and is more physically than the IC card. It is necessary to mount in a large shape.

  Alternatively, it is considered that the broadcast CAS # 1 and 2 are composed of SIM (UIM) cards, which is effective for saving the mounting area.

(Rounding)
Since MPEG2-TS has a fixed frame length, when a 128-bit block encryption key is used, a remainder of 128 and a fraction of a bit that is a multiple of 8 bits remain. The fraction processing generally uses the OFB-8 mode of the block encryption key, and can be realized by using the same means in the present invention.

  As described above, according to the embodiment of the present invention, the security strength related to content protection when broadcasting content is distributed over a communication network can be made equal to or higher than that of a broadcast wave. Further, since both the encryption key generated by the transmission system (primary transmission side apparatus) and the encryption key generated by the redistribution system (secondary transmission side apparatus) are used, both receive and decrypt the digital data. The receiver can decrypt the digital data only when the data is permitted.

1 is a system block diagram illustrating an example embodiment of the present invention. The block diagram of the system which shows the other embodiment of this invention. The block diagram of the system which shows the other embodiment of this invention. The flowchart which shows the flow of a process of the example of an embodiment of FIG. Block diagram of an embodiment in which the present invention is applied to a system for redistributing broadcast content

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Primary transmission side apparatus, 2 ... Secondary transmission side apparatus, 3 ... Reception side apparatus, 11 ... 1st layer encryption part, 12 ... 2nd layer encryption part, 21, 32 ... 2nd layer decryption part, 22 ... First layer decryption unit, 23, 33 ... Bit synthesis unit, 24 ... Relay first layer encryption unit, 25 ... Relay second layer encryption unit, 31 ... Reception second layer decryption unit, 34 ... Reception first Layer decryption unit, 100 ... broadcast device, 101,102 ... third layer encryption unit, 200 ... redistribution device, 201,303 ... third layer decryption unit, 202 ... relay third layer encryption unit, 301 ... relay unit 2-layer decoding unit, 303... Relay third-layer decoding unit.

Claims (12)

A primary transmission side device, a secondary transmission side device, and a reception side device are provided, and decryption information necessary for transmission and decryption of encrypted data is transmitted using a common key encryption or a public key encryption on a digital data transmission path. In the data delivery / reception system,
The primary transmission side device uses primary transmission encrypted data obtained by encrypting data by first layer encryption means using a first key of n bits, and a second key different from the first key. And transmitting the encrypted first key obtained by encrypting the first key by the second layer encryption means,
The secondary sending side device is:
Second layer decryption means for decrypting the encrypted first key transmitted from the second layer encryption means of the primary sending side device with a second key different from the key;
Relay first layer decryption means for decrypting primary transmission encrypted data transmitted from the primary transmission side device using the first key decrypted by the second layer decryption means;
A secondary sending side synthetic key generating means for generating a synthetic key larger than n bits by synthesizing the first key with an m-bit third key of 1 bit or more;
Relay first layer encryption means for encrypting the decrypted data of the relay first layer decryption means with the composite key generated by the composite key generation means to generate secondary transmission encrypted data;
Relay encryption means for encrypting the third key or the composite key with a fourth key different from the key,
The receiving side device
Receiving side composite key generation means for obtaining a composite key based on a key obtained by decrypting the relay encryption key transmitted from the relay encryption means of the secondary transmission side device;
The secondary transmission encrypted data transmitted from the relay first layer encryption means of the secondary transmission side apparatus is decrypted using the composite key obtained by the reception side composite key generation means, and the data is extracted. A data distribution / reception system comprising: a first layer decoding unit. A fifth key sharing means provided in the system for sharing a fifth key;
A third-layer encryption means provided in the primary transmission-side device, for encrypting the second key with the fifth key;
3. A third layer decryption unit provided in the secondary transmission side device, wherein the key encrypted by the third layer encryption unit is decrypted using the fifth key. The data delivery / reception system according to 1. A sixth key sharing means provided in the system for sharing the sixth key;
A relay third layer encryption unit provided in the secondary transmission side device, and encrypts the fourth key with the sixth key;
The data distribution / transmission unit according to claim 1, further comprising: a relay third layer decryption unit that decrypts the key encrypted by the relay third layer encryption unit using the sixth key. Receiving system. A seventh key sharing means provided in the system for sharing the seventh key;
A third-layer encryption means provided in the primary transmission-side device, for encrypting the second key with the seventh key;
The third-layer decrypting means provided in the receiving-side apparatus, wherein the key encrypted by the third-layer encrypting means is decrypted using the seventh key. Distribution / reception system for listed data.   5. The data delivery / reception system according to claim 4, wherein the sixth key and the seventh key are shared. The relay encryption means of the secondary transmission side device encrypts the third key with the fourth key,
The reception-side composite key generation means of the reception-side device decrypts the relay encryption key transmitted from the relay-encryption key generation means of the secondary transmission-side device using the fourth key, and obtains the third key. Receiving second layer decoding means,
Second layer decryption means for decrypting the encryption key transmitted from the second layer encryption means of the primary sending side device using the second key to obtain the first key;
2. The data distribution according to claim 1, further comprising a synthesizing unit that synthesizes the third key obtained by the receiving second layer decoding unit and the first key obtained by the second layer decoding unit. -Receiving system.   2. The data transmission method according to claim 1, wherein the secondary transmission side synthetic key generation unit and the reception side synthetic key generation unit include a bit concatenation unit that concatenates the bit strings of the first key and the third key. Delivery / reception system.   The relay encryption key encrypted by the relay encryption unit of the secondary transmission side device is transmitted using the same format as the ECM format used in the broadcast transmission method, or transmitted as metadata, or 2. The data distribution / reception system according to claim 1, wherein the data distribution / reception system is transmitted using any one of means for transmitting the first key superimposed on the second layer encryption means.   The relay encryption key of the relay encryption means of the secondary transmission side device is a relay second layer key synchronization generation means for generating a third key in synchronization with the secondary transmission side device and the reception side device, or a fixed value Alternatively, it is generated by using either a third key presetting means for presetting or a synchronous self-generating means for generating a third key in synchronization between the sending side device and the receiving side device based on the first key. The data delivery / reception system according to claim 1.   The data delivery / reception system according to any one of claims 1 to 9, wherein a sending side device in the system is configured in multiple stages of three or more orders. A primary transmission side device, a secondary transmission side device, and a reception side device are provided, and decryption information necessary for transmission and decryption of encrypted data is transmitted using a common key encryption or a public key encryption on a digital data transmission path. In the data distribution / reception method,
The primary transmission side device encrypts data using an n-bit first key and transmits the encrypted data, and a first layer encryption step;
Performing a second layer encryption step of encrypting and transmitting the first key using a second key different from the first key;
The secondary sending side device is:
A second layer decryption step of decrypting the encrypted first key transmitted by the second layer encryption step with a second key different from the key;
A relay first layer decryption step of decrypting the primary transmission encrypted data transmitted from the primary transmission side device using the first key decrypted in the second layer decryption step;
A secondary sending side synthetic key generation step of generating a synthetic key larger than n bits by synthesizing the m-bit third key of 1 bit or more and the first key;
A relay first layer encryption step for encrypting the decrypted data in the relay first layer decryption step with the composite key generated in the composite key generation step to generate secondary transmission encrypted data;
Performing a relay encryption step of encrypting the third key or the composite key with a fourth key different from the key,
The receiving side device
A receiving-side composite key generation step for obtaining a composite key based on a key obtained by decrypting the relay encryption key transmitted by the relay encryption step of the secondary transmission side device;
The secondary transmission encrypted data transmitted in the relay first layer encryption step of the secondary transmission side device is decrypted using the composite key obtained in the reception side composite key generation step to extract data. A data delivery / reception method comprising: performing a first layer decoding step. The secondary transmission side device executes a relay third layer encryption step of encrypting a fourth key used in the relay encryption step with a sixth key,
The primary sending side device executes a third layer encryption step of encrypting a second key used in the second layer encryption step with a seventh key shared with the sixth key,
The receiving side device decrypts the key encrypted in the relay third layer encryption step of the secondary sending side device using the sixth key to obtain a fourth key;
And performing a third layer decryption step of decrypting the key encrypted in the third layer encryption step of the primary transmission side device using the seventh key to obtain a second key. Item 12. A data delivery / reception method according to Item 11.

Images