JP5154830B2 - Content distribution system - Google Patents

Description

  The present invention relates to a technique for transmitting and receiving digital data (hereinafter referred to as “content”), which is a copyrighted work such as a movie or music, and in particular, prevents copyright infringement acts that illegally copy content, and further illegally. The present invention relates to a technique for identifying a fraudulent device from the leaked content when the copied content leaks.

As personal use of content has become popular, so-called “pirated content”, in which content is illegally copied and generated, has come into circulation.
Patent Document 1 discloses a technique for identifying a client that has performed illegal copying from illegally copied content in a model in which content is distributed from a server to a client.

  Specifically, the server copies a plurality of scenes in the content, and embeds a different digital watermark (watermark) in each scene. Subsequently, the server encrypts each of the scenes in which different digital watermarks are embedded with a plurality of different encryption keys, and then distributes the content to the client. The client holds one of a plurality of keys, and can reproduce the content by decrypting the designated portion using the designated key.

When pirated content created by unauthorized copying is available, it is possible to identify the client that performed the unauthorized copying by extracting the digital watermark embedded in the pirated content.
US Pat. No. 6,285,774

However, it is assumed that the server side that should be trusted by the content holder originally performs fraud, and there is a request from the content holder to prevent fraud on the server side.
In recent years, a plurality of terminal devices held by users are connected to a network at home, and content is transmitted and received between the terminal devices. In such a case, each terminal device can be a server side (transmission side) or a client side (reception side), and therefore a mechanism for preventing fraud on the transmission side as well as the content reception side is necessary. It has become.

Here, with the technique described in Patent Document 1, it is possible to prevent fraud on the content receiving side, but there is a problem that fraud on the transmitting side cannot be prevented.
The present invention has been made in view of the above request and the above problems, and a content distribution system for preventing a transmitting apparatus that transmits content from impersonating a receiving apparatus that receives the content. The purpose is to provide.

Here, what is meant by “transmitting device impersonates as receiving device” will be described.
The transmission apparatus that has acquired the content from the content holder is expected to distribute the content through a regular distribution channel. If the content is created and leaked by illegally copying the content, it is transferred to the content holder. Since fraud is easily identified, it is usually difficult for the transmitting device to perform such fraud. However, it is possible for the transmitting apparatus to leak out pirated content in which information that is determined to have been created by the receiving apparatus is embedded by subsequent verification.

  In addition, when transmitting and receiving content between a plurality of terminal devices held by the user, the terminal device on the transmission side embeds information that is determined to have been fraudulent by the terminal device on the reception side through later verification. It is possible to create pirated content. In this case, in particular, since content is transmitted and received between end user terminal devices, the possibility of fraud is increased.

  Such a case is referred to as “the transmitting device impersonates the receiving device”.

  To achieve the above object, the present invention provides a content distribution system for transmitting and receiving content between a transmission device and a reception device, wherein the transmission device receives a plurality of public keys from the reception device. A key acquisition unit that acquires a plurality of identifiers for identifying each public key, a watermark embedding unit that embeds an identifier for identifying a different public key in each of a plurality of contents having the same content, and an identifier Encrypting each of the plurality of embedded contents based on a public key identified by an embedded identifier, and generating a plurality of encrypted contents; and Transmitting means for transmitting to the receiving device, the receiving device comprising a plurality of public keys, a plurality of identifiers identifying each public key, and the plurality of public keys. A key storage unit that stores one private key that is paired with one public key, a key transmission unit that transmits the plurality of public keys and identifiers to the transmission device, and a transmission device The content receiving means for receiving the plurality of encrypted contents, and the decrypting means for acquiring one content from the received plurality of encrypted contents based on the secret key.

  According to the above configuration, the transmission device transmits a plurality of encrypted contents in which different digital watermarks are embedded to the reception device. The receiving device can decrypt only one encrypted content among the plurality of encrypted contents received from the transmitting device. Since the transmitting device cannot know which public key the receiving device holds the private key, the transmitting device cannot specify one piece of content acquired by the receiving device.

  Therefore, the transmission device identifies one piece of content acquired by the reception device, and illegally copies only the content embedded with the same digital watermark as that included in the one piece of content acquired by the reception device, It is very difficult to prevent content that has been leaked and other digital watermarks embedded. Therefore, it is practically impossible for the transmitting device to impersonate the receiving device and leak pirated content.

  Further, the present invention is a receiving device that acquires content from a transmitting device, and includes a plurality of public keys, a plurality of identifiers for identifying each public key, and one public key among the plurality of public keys. A key storage unit that stores one private key that is paired with a key, a key transmission unit that transmits the plurality of public keys and identifiers to the transmission device, and a plurality of identical contents by the transmission device. In each piece of content, each identifier for identifying the plurality of public keys is embedded as a digital watermark, and further, a plurality of encrypted contents encrypted based on the public key identified by the embedded identifier, Content receiving means for receiving from the transmitting device, and decrypting means for acquiring one content based on the secret key from a plurality of encrypted contents received by the content receiving means. And wherein the door.

  According to this configuration, the receiving device transmits a plurality of public keys without informing the transmitting device, which is the content transmission source, which public key the private key held by itself is paired with. can do. This is based on the feature of the public key cryptosystem that the corresponding private key cannot be generated from the public key. Therefore, the receiving apparatus can prevent the transmitting apparatus from impersonating itself.

Here, the key storage means stores, for the secret key and the plurality of public keys, a plurality of certificates including a digital signature for each public key, each identifier, and each open key and each identifier. In addition, the key transmission unit may be configured to transmit the plurality of certificates to the transmission unit.
According to this configuration, since the receiving device transmits the public key certificate to the transmitting device, it is possible to transmit / receive content to / from the transmitting device using the public key and the private key that have been properly obtained. .

  Here, the plurality of encrypted contents are generated by encrypting a plurality of contents having the same contents using a plurality of different content keys as encryption keys. A plurality of encrypted contents keys and a plurality of encrypted content keys generated by using the plurality of public keys as encryption keys, and the decrypting means receives the public keys. One encrypted content key is identified based on the identifier to be identified, the identified encrypted content key is decrypted using the secret key, and one content is obtained using the decrypted content key You may comprise.

According to this configuration, the receiving apparatus encrypts content with a large data size using a content key as an encryption key and a common key encryption method, uses a content key with a small data size as a public key, and uses a public key as a public key. By encrypting with an encryption method, the processing load can be reduced.
Here, for each of a plurality of public keys not paired with the secret key, the key storage means further decrypts the ciphertext encrypted using each public key as an encryption key into a correct plaintext. A plurality of dummy secret keys that cannot be stored may be stored.

  According to this configuration, even if the information stored in the key storage unit of the receiving device is exposed to the outside by an unauthorized user, the key storage unit has a pair of a secret key and a public key. There are a plurality of stored information, and it is not immediately known which pair is a dummy pair. Therefore, safety is improved as compared with the case where only one secret key is held in the key storage means.

  Further, the present invention is a transmitting device that transmits content to a receiving device, and a key acquisition unit that acquires a plurality of public keys and a plurality of identifiers for identifying each public key from the receiving device. A watermark embedding unit for embedding one identifier as a digital watermark in each of a plurality of contents, and encrypting the plurality of contents embedded with an identifier based on a public key identified by the embedded identifier And an encryption means for generating a plurality of encrypted contents, and a transmission means for transmitting the plurality of encrypted contents to the transmission apparatus.

Here, the transmission device is a storage unit that stores the content, and a copy unit that replicates the content stored in the storage unit and generates the same number of contents as the public key received by the key reception unit You may comprise so that.
According to this configuration, since the transmitting device transmits a plurality of encrypted contents to the receiving device, the receiving device cannot know which digital watermark is embedded and impersonates the receiving device. Injustice cannot be done. Therefore, the transmitting device can claim the legitimacy of its own device when the receiving device performs fraud.

  Here, the encryption means encrypts each of the generated plurality of content keys using the plurality of public keys, and generates a plurality of content key generation units that generate a plurality of different content keys. A key encryption unit that generates an encrypted content key, and a content encryption unit that encrypts each of the plurality of contents using the plurality of encrypted content keys and generates the plurality of encrypted content You may comprise so that.

According to this configuration, the transmission device decrypts content with a large data size using a content key as a decryption key and a common key encryption method, and uses a content key with a small data size as a decryption key and a public key. By decrypting with an encryption method, the processing load can be reduced.
Further, the present invention is a key issuing device that issues a key to a receiving device that receives content from a transmitting device, wherein the key generating unit generates a plurality of key pairs including a secret key and a public key, Key storage means for storing a plurality of key pairs, key transmission means for transmitting one key pair and a plurality of public keys to the receiving device, and the key pair transmitted by the key transmission means. It is characterized by comprising key specifying means for writing specific information for specifying into the key storage means.

  Here, the key issuing device replaces each corresponding secret key with a dummy secret key for each of a plurality of public keys that are not transmitted in pairs with the corresponding secret key among the public keys transmitted to the receiving device. A dummy secret key generating means for generating the key transmission means, wherein the key transmitting means is configured to transmit a plurality of dummy key pairs comprising the one key pair and a public key and a dummy secret key to the receiving device. May be.

According to this configuration, the key issuing device sends a correct set of key pairs and a plurality of public keys, or a correct set of key pairs and a plurality of dummy key pairs to the receiving device that is the content transmission destination. give.
Therefore, the key issuing device is composed of a transmitting device and a receiving device, and in the content transmission / reception content distribution system using the public key and the secret key, the transmitting device includes a plurality of pieces generated based on the plurality of public keys. The encrypted content can be transmitted to the receiving device, and the receiving device decrypts one encrypted content without the transmitting device knowing which of the plurality of received encrypted contents is to be acquired. It is possible to provide a mechanism that can

  In addition, since the key issuing device can specify the correct key pair given to the receiving device, if pirated content leaks out in the content distribution system as described above, the system administrator can use the key issuing device. By obtaining information identifying the correct key pair given to the receiving device, the receiving device identifies the content to be acquired and determines whether the pirated content is leaked by the receiving device or the transmitting device can do.

Below, the content delivery system 1 which is embodiment of this invention is demonstrated in detail with reference to drawings.
<Overview>
Here, an outline of the content distribution system 1 will be described.
FIG. 1 is a system configuration diagram showing a configuration of the content distribution system 1. As shown in the figure, the content distribution system 1 includes a transmission device 10, a reception device 20, a key issuing device 30, a broadcast station device 40, a content outflow source identification device 50, and a recording medium 60. Here, the transmission device 10 and the reception device 20 are connected via a cable 70, and the transmission device 10, the reception device 20, the key issuing device 30, and the content outflow source identification device 50 are connected via the network 80. Are connected to each other.

Specifically, the broadcasting station device 40 is a device installed in a broadcasting station that broadcasts terrestrial digital broadcasting, and broadcasts content on a digital broadcasting wave.
Here, the terrestrial digital broadcast content broadcast from the broadcast station apparatus 40 is protected by a B-CAS (BS-Conditional Access System) system that is a copyright protection standard for broadcasting.

  Specifically, the transmission device 10 is a digital television receiver that receives terrestrial digital broadcasting, and receives the content broadcast from the broadcasting station device 40. The transmission apparatus 10 displays the content on the display after releasing the protection of the B-CAS method. Further, the transmission device 10 receives a verification key for verifying the validity of the certificate from the key issuing device 30. Then, the transmission device 10 receives the certificate from the reception device 20, and encrypts the content based on the received certificate to generate encrypted content. The transmission device 10 transmits the generated encrypted content to the reception device 20 via the cable 70. Here, the cable 70 is specifically an IEEE 1394 cable, and the transmission apparatus 10 and the reception apparatus 20 are encrypted protected in a DTCP (Digital Transmission Content Protection) format, which is an IEEE 1394 copyright protection standard. Send and receive content.

  Specifically, the receiving device 20 is a DVD recorder. First, the receiving device 20 receives a public key certificate and a private key from the key issuing device 30. Then, the reception device 20 transmits a public key certificate to the transmission device 10 and receives encrypted content encrypted based on the public key certificate from the transmission device 10. Thereafter, the receiving device 20 decrypts and uses the received encrypted content.

The recording medium 60 is specifically a DVD-RAM and stores so-called pirated content created by unauthorized copying.
<Configuration>
1. Transmitting device 10
FIG. 2 is a functional block diagram illustrating a functional configuration of the transmission device 10.

As shown in the figure, the transmission apparatus 10 includes a content reception unit 101, a transmission / reception unit 102, a verification key storage unit 103, a certificate verification unit 104, a content division / duplication unit 105, a watermark embedding unit 106, and a content key generation unit. 107, a first encryption unit 108, and a second encryption unit 109.
Specifically, the transmission device 10 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. The transmitting apparatus 10 achieves its functions by the microprocessor operating according to a computer program stored in a ROM, RAM, or hard disk. In addition, it is assumed that the transmission device 10 in the present embodiment is a digital television receiver that receives terrestrial digital broadcasting as described above.

Below, each functional block which comprises the transmitter 10 is demonstrated.
(1) Content receiving unit 101
The content receiving unit 101 receives the content distributed from the broadcasting station device 40 and outputs the received content to the content dividing / duplicating unit 105.
(2) Transmission / reception unit 102
The transmission / reception unit 102 includes a network connection unit and an IEEE 1394 connection unit. The transmission / reception unit 102 transmits / receives information to / from the key issuing device 30 via the network 80, and communicates with the reception device 20 via the cable 70. Send and receive information.

Specifically, the transmission / reception unit 102 receives a verification key from the key issuing device 30. Further, the transmission / reception unit 102 receives a plurality of certificates from the reception device 20 and transmits the encrypted content key set and the encrypted content to the reception device 20.
(3) Verification key storage unit 103
The verification key storage unit 103 receives the verification key from the transmission / reception unit 102 and stores the received verification key therein. The verification key is a key used to verify the validity of the certificate received from the receiving device 20.

(4) Certificate verification unit 104
The certificate verification unit 104 receives the certificate from the transmission / reception unit 101 and verifies the received certificate using the verification key stored in the verification key storage unit 103.
Specifically, the certificate verification unit 104 receives the certificate 1 (110) illustrated in FIG. 3A and the certificate illustrated in FIG. 3B from the reception device 20 via the transmission / reception unit 102 and the network 80. 2 (120) and certificate 3 (130) shown in FIG.

  As shown in FIG. 3, each certificate includes a public key ID, a public key, and a digital signature. Here, the digital signature “SIG1” included in the certificate 1 (110) is generated by the key issuing device 30 using the signature generation key for the public key ID “ID1” and the public key “PK1”. A digital signature generated based on a generation algorithm. Similarly, the digital signature “SIG2” included in the certificate 2 (120) is a digital signature generated for the public key ID “ID2” and the public key “PK2”, and is included in the certificate 3 (130). The digital signature “SIG3” is a digital signature generated for the public key ID “ID3” and the public key “PK3”.

  The verification key corresponds to the signature generation key used to generate each digital signature, and the certificate verification unit 104 uses the verification key to apply a signature verification algorithm corresponding to the signature generation algorithm to each digital signature. To verify the validity of each certificate. The generation and verification of the digital signature can be realized by a publicly known technique, and thus description thereof is omitted here.

Upon successful verification of all the certificates, the certificate verification unit 104 outputs the public key ID included in each certificate to the content division / replication unit 105 and the watermark embedding unit 106, and is included in each certificate. The public key ID and the public key to be output are output to the first encryption unit 108.
If the verification of the one or more certificates fails, the certificate verification unit 104 ends the process.
(5) Content division / replication unit 105
The content dividing / duplicating unit 105 receives content from the content receiving unit 101.

  The content dividing / duplicating unit 105 divides the received content into partial contents of a predetermined unit (for example, a picture unit). FIG. 4A is a diagram illustrating the content 140 divided by the content division / replication unit 105. The content 140 shown in the figure includes a plurality of partial contents (partial content A, partial content B, partial content C, partial content D, partial content E, partial content F,...).

  Upon receiving the public key ID from the certificate verification unit 104, the content dividing / duplicating unit 105 selects any one partial content from among the plurality of partial contents, and is the same as the number of received public key IDs. The selected partial content is duplicated so as to include the partial content. FIG. 4B is a diagram illustrating the content 150 after the partial content D is selected as an arbitrary partial content by the content dividing / duplicating unit 105 and the partial content D is duplicated. The content dividing / duplicating unit 105 receives the three public key IDs “ID1”, “ID2”, and “ID3” from the certificate verification unit 104, and therefore duplicates the partial content D to obtain the three partial contents. Content 150 including D is generated.

The content dividing / duplicating unit 105 outputs the copied content 150 to the watermark embedding unit 106.
(6) Watermark embedding unit 106
The watermark embedding unit 106 receives three public key IDs “ID1”, “ID2”, and “ID3” from the certificate verification unit 104. Further, the watermark embedding unit 106 receives the content 150 after the partial content D is copied from the content dividing / duplicating unit 105. The watermark embedding unit 106 embeds each public key ID as an electronic watermark in each of the three partial contents D.

FIG. 5A is a diagram schematically showing a process in which the watermark embedding unit 106 embeds the public key ID “ID1” in the partial content D as an electronic watermark to generate the partial content D1.
FIG. 5B is a diagram schematically showing a process in which the watermark embedding unit 106 embeds the public key ID “ID2” in the partial content D as an electronic watermark to generate the partial content D2.

FIG. 5C is a diagram schematically illustrating a process in which the watermark embedding unit 106 embeds the public key ID “ID3” as an electronic watermark in the partial content D to generate the partial content D3.
FIG. 4C is a diagram showing the content 160 after the digital watermark is embedded in each partial content D. The watermark embedding unit 106 outputs the content 160 to the second encryption unit 109.

Here, the digital watermark is a technique for embedding watermark information in a still image, a moving image, audio data, or the like to the extent that humans cannot perceive it, and has a feature that the watermark information is not erased by processing or modification. Since the technique for embedding a digital watermark is already known, the description thereof is omitted.
(7) Content key generation unit 107
The content key generation unit 107 generates a content key for encrypting the content.

  Specifically, the content key generation unit 107 includes a content key Kt for encrypting the partial content in which the digital watermark is not embedded, a content key K1 for encrypting the partial content D1 in which the digital watermark is embedded, A content key K2 for encrypting the partial content D2 in which the digital watermark is embedded and a content key K3 for encrypting the partial content D3 in which the digital watermark is embedded are generated.

The content key generation unit 107 outputs the generated content keys Kt, K1, K2, and K3 to the first encryption unit 108 and the second encryption unit 109.
(8) First encryption unit 108
The first encryption unit 108 encrypts the content key generated by the content key generation unit 107 using the public key included in the certificate to generate encrypted content.

Specifically, the first encryption unit 108 receives the public key ID public keys PK1, PK2, and PK3 from the certificate verification unit 104. The first encryption unit 108 also receives the content keys Kt, K1, K2, and K3 from the content key generation unit 107.
The first encryption unit 108 uses the public key PK1, PK2, and PK3 as encryption keys and the encryption key Et for encrypting the partial content in which the digital watermark is not embedded. Three encrypted content keys E1 (PK1, Kt), E1 (PK2, Kt), and E1 (PK3, Kt) are generated. Here, the notation E1 (A, B) indicates that data B is encrypted using the key A in accordance with the encryption algorithm E1. Here, an example of the encryption algorithm E1 is RSA encryption.

  The first encryption unit 108 generates an encrypted content key E1 (PK1, K1) using the content key K1 for encrypting the partial content D1 as the encryption key and the public key PK1. Here, the partial content D1 is a partial content in which the public key ID “ID1” is embedded as a digital watermark, and the public key ID “ID1” is an ID for identifying the public key PK1.

  The first encryption unit 108 encrypts the content key K2 for encrypting the partial content D2 using the public key PK2 as an encryption key, and generates an encrypted content key E1 (PK2, K2). Here, the partial content D2 is a partial content in which the public key ID “ID2” is embedded as a digital watermark, and the public key ID “ID2” is an ID for identifying the public key PK2.

  Further, the first encryption unit 108 generates an encrypted content key E1 (PK3, K3) using the content key K3 for encrypting the partial content D3 as the encryption key and the public key PK3. Here, the partial content D3 is a partial content in which the public key ID “ID3” is embedded as a digital watermark, and the public key ID “ID3” is an ID for identifying the public key PK3.

The first encryption unit 108 generates the encrypted content key set 170 shown in FIG. 6 by associating the generated encrypted content key with the public key ID corresponding to the public key used as the encryption key.
The first encryption unit 108 transmits the generated encrypted content key set 170 to the reception device 20 via the transmission / reception unit 102 and the cable 70.

(9) Second encryption unit 109
The second encryption unit 109 receives the content 160 (see FIG. 4B) from the watermark embedding unit 106. The second encryption unit 109 also receives content keys Kt, K1, K2, and K3 from the content key generation unit 107.
The second encryption unit 109 applies the encryption algorithm E2 using the content key Kt as the encryption key for the partial content that is not embedded with the digital watermark among the partial content included in the content 160, thereby Content E2 (Kt, A), E2 (Kt, B), E2 (Kt, C), E2 (Kt, E), E2 (Kt, F),. An example of the encryption algorithm E2 is DES (Data Encryption Standard).

Also, the second encryption unit 109 generates the encrypted partial content E2 (K1, D1) using the partial content D1 included in the content 160 as the content key K2 as an encryption key.
Further, the second encryption unit 109 generates the encrypted partial content E2 (K2, D2) using the partial content D2 included in the content 160 by using the content key K1 as an encryption key.

In addition, the second encryption unit 109 generates the encrypted partial content E2 (K3, D3) using the partial content D3 included in the content 160 by using the content key K1 as an encryption key.
FIG. 7 is a diagram showing the encrypted content 180 composed of the encrypted partial content encrypted by the second encryption unit 109 as described above.

The second encryption unit 109 transmits the encrypted content 180 to the reception device 20 via the transmission / reception unit 102 and the cable 70.
2. Receiver 20
FIG. 8 is a functional block diagram functionally showing the configuration of the receiving device 20.
As shown in the figure, the receiving device 20 includes a transmission / reception unit 201, a key set storage unit 202, a first decryption unit 203, and a second decryption unit 204.

  Specifically, the receiving device 20 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. The receiving device 20 achieves its functions by the microprocessor operating according to a computer program stored in the ROM, RAM, or hard disk. In addition, as described above, the receiving device 20 in the present embodiment is a DVD recorder.

Below, each functional block which comprises the receiver 20 is demonstrated.
(1) Transmission / reception unit 201
The transmission / reception unit 201 includes a network connection unit and an IEEE 1394 connection unit. The transmission / reception unit 201 transmits / receives information to / from the key issuing device 30 via the network 80, and transmits / receives information to / from the transmission device 10 via the cable 70.

Specifically, the transmission / reception unit 201 receives a key pair from the key issuing device 30. The transmission / reception unit 201 transmits a certificate to the transmission device 10 and receives an encrypted content key set and encrypted content from the transmission device 10.
(2) Key set storage unit 202
The key set storage unit 202 receives the key set from the transmission / reception unit 201 and stores the received key set therein.

9 and 10 are diagrams illustrating specific examples of the key set that the receiving device 20 acquires from the key issuing device 30. FIG.
The key set 210 shown in FIG. 9 is composed of a certificate 1, a certificate 2, a certificate 3, and a private key 2 (SK2) associated with the certificate 2, and the obtained private key 2 is a certificate. A flag 211 indicating that the document 2 is supported is set.

  Here, as shown in FIG. 3A, the certificate 1 includes a public key ID “ID1”, a public key “PK1”, and a digital signature “SIG1”. Further, as shown in FIG. 3B, the certificate 2 includes a public key ID “ID2”, a public key “PK2”, and a digital signature “SIG2”. Further, as shown in FIG. 3C, the certificate 3 includes a public key ID “ID3”, a public key “PK3”, and a digital signature “SIG3”.

The public key PK2 and the secret key SK2 are key pairs that have a corresponding relationship.
10 includes a certificate 1, a certificate 2, a certificate 3, a dummy private key 1 (Dummy SK1) corresponding to the certificate 1, a private key (SK2) corresponding to the certificate 2, and a certificate. 3 is composed of a dummy secret key 3 (Dummy SK3) corresponding to 3. Here, the configurations of the certificate 1, the certificate 2, and the certificate 3 are as shown in FIG.

  Here, the dummy secret key 1 (Dummy SK1) is associated with the certificate 1, but actually there is no key data paired with the public key PK1, and it is dummy data. Similarly, the dummy secret key 3 (Dummy SK3) is associated with the certificate 3, but actually there is no key data paired with the public key PK3, and it is dummy data. Of the private keys included in the key set 220, only the private key 2 (SK2) forms a correct pair with the public key. Therefore, the key set 220 is set with a flag 221 indicating that the secret key that is correctly paired with the public key is the secret key 2.

The receiving device 20 performs the same processing regardless of which of the key set 210 and the key set 220 is acquired from the key issuing device 30. Therefore, hereinafter, the key setting device 210 receives the key set 210 from the key issuing device 30. Will be described as having been acquired.
The key set storage unit 202 stores all certificates (certificate 1, certificate 2, and certificate 3) included in the key set 210 when the receiving device 20 requests content from the transmitting device 10. Then, the data is transmitted to the transmission device 10 via the transmission / reception unit 201 and the cable 70.

(3) First decoding unit 203
The first decryption unit 203 receives the encrypted content key set 170 from the transmission device 10 via the transmission / reception unit 201 and the cable 70. The configuration of the encrypted content key set 170 is as shown in FIG.
When the first decryption unit 203 receives the encrypted content key set 170, the first decryption unit 203 obtains the public key ID (ID2) included in the certificate in which the flag is set from the key set 210 stored in the key set storage unit 202. Extract.

The first decryption unit 203 extracts the encrypted content key E1 (PK2, Kt) and the encrypted content key E1 (PK2, K2) identified by the extracted public key ID (ID2) from the key set 170, Further, the private key 2 (SK2) is read from the key set 210 stored in the key set storage unit 202.
The first decryption unit 203 uses the secret key 2 (SK2) as a decryption key, applies the decryption algorithm D1 to the encrypted content key E1 (PK2, Kt), and obtains the content key Kt. Similarly, the first decryption unit 203 uses the secret key 2 (SK2) as a decryption key, applies the decryption algorithm D1 to the encrypted content key E1 (PK2, K2), and obtains the content key K2. Here, the decryption algorithm D1 is an algorithm for converting a ciphertext encrypted using the encryption algorithm E1 into a plaintext.

The first decryption unit 203 outputs the acquired content key Kt and content key K2 to the second decryption unit 204.
(4) Second decoding unit 204
The second decryption unit 204 receives the encrypted content 180 from the transmission device 10 via the transmission / reception unit 201 and the cable 70. The configuration of the encrypted content 180 is as shown in FIG. In addition, the second decryption unit 204 receives the content key Kt and the content key K2 from the first decryption unit 203.

The second decryption unit 204 decrypts each encrypted partial content included in the encrypted content 180 using the content key Kt and the content K2, and obtains the content.
More specifically, the second decryption unit 204 performs encrypted partial content E2 (Kt, A), E2 (Kt, B), E2 (Kt, C), E2 (Kt, E), E2 (Kt, F). ..,... Are generated by applying the decryption algorithm D2 using the content key Kt as a decryption key, thereby generating partial contents A, B, C, E, F,. For the encrypted partial content E2 (K2, D2), the partial key D2 is generated by applying the decryption algorithm D2 using the content key K2 as the decryption key. Here, the decryption algorithm D2 is an algorithm for converting a ciphertext encrypted using the encryption algorithm E2 into a plaintext.

Note that the second decryption unit 204 cannot know which of the partial contents D1, D2, and D3 can be decrypted with the content key K2. Therefore, the second decryption unit 204 attempts to decrypt in the order of the encrypted partial content E2 (K1, D1), the encrypted partial content E2 (K2, D2), and the encrypted partial content E2 (K3, D3). May be.
The second decryption unit 204 outputs the content including the decrypted partial contents A, B, C, D2, E, F,.

3. Key issuing device 30
FIG. 11 is a functional block diagram showing a functional configuration of the key issuing device 30.
As shown in the figure, the key issuing device 30 includes a key set generation unit 301, a key set transmission control unit 302, a verification key storage unit 303, a key transmission unit 304, and an outflow source identification information generation unit 305.

Specifically, the key issuing device 30 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. The key issuing device 30 achieves its function by the microprocessor operating according to a computer program stored in the ROM, RAM, or hard disk.
Below, each component of the key issuing apparatus 30 is demonstrated.

(1) Key set generation unit 301
The key set generation unit 301 generates a certificate and a private key corresponding to the certificate.
The certificates generated by the key set generation unit 301 are certificate 1 (110), certificate 2 (120), and certificate 3 (130) shown in FIG.
Here, generation of certificate 1 (110) and private key SK1 will be described as a specific example. The key set generation unit 301 first generates ID1 as the public key ID. Next, the key set generation unit 301 generates PK1 as a public key. At this time, the key set generation unit 301 generates a secret key 1 (SK1) that is paired with the public key PK1. Finally, the key set generation unit 301 generates a digital signature SIG1 for the ID1 and PK1 using the signature generation key. Then, the key set generation unit 301 generates a certificate 1 (110) including ID1, PK1, and SIG1.

Similarly, the key set generation unit 301 generates a certificate 2, a secret key 2 (SK2), a certificate 3, and a secret key 3 (SK3).
The key set generation unit 301 associates the certificate 1 with the private key 1 (SK1), the certificate 2 with the private key 2 (SK2), and the certificate 3 with the private key 3 (SK3), and sets the key set. Generate. The key set generation unit 301 outputs the generated key set to the key set transmission control unit 302.

Further, the key set generation unit 301 generates a verification key corresponding to the signature generation key used for generating the digital signature, and outputs the generated verification key to the verification key storage unit 303.
(2) Key set transmission control unit 302
When the key set transmission control unit 302 receives the key set from the key set generation unit 301, the key set transmission control unit 302 generates a key set in which a flag field is added to the received key set.

FIG. 12 is a diagram illustrating a data configuration of the key set 310 stored in the key set transmission control unit 302. Here, the key set 310 is provided with a flag field 311 for setting a flag in the key set generated by the key set generation unit 301.
The key set transmission control unit 302 transmits the key set to the receiving device 20 via the key transmission unit 304 and the network 80. At this time, the key set transmission control unit 302 transmits all the stored certificates. The certificate and all the private keys are not transmitted to the receiving device 20, but all the certificates and one private key are transmitted.

  The key set transmission control unit 302 selects one that transmits a certificate and a private key as a pair to the receiving device 20. The key set transmission control unit 302 sets a flag by writing “1” in the flag field corresponding to the selected pair. In FIG. 12, since the flag is set in the flag field corresponding to the certificate 2 and the private key 2 (SK2), the key set transmission control unit 302 sends the certificate 2 and the private key to the receiving device 20. 2 (SK2) is transmitted in pairs. That is, the data that the key set transmission control unit 302 transmits to the receiving device 20 is a certificate 1, a certificate 2, a secret key 2 (SK 2), and a certificate 3.

The key set transmission control unit 302 outputs the certificate and private key to be transmitted to the receiving device 20 to the key transmission unit 304.
Further, the key set transmission control unit 302 receives the public key ID “ID1” included in the certificate 1, the public key ID “ID2” included in the certificate 2, and the public key ID “ID3” included in the certificate 3. Output to the outflow source identification information generation unit 305. At this time, the key set transmission control unit 302 transmits to the receiving device 20 a pair of the certificate and the private key, and the public key ID (here, the certificate 2 and the private key 2 are included in the selected certificate). Since “ID2” is selected, information indicating that is added and output to the outflow source identification information generation unit 305.

(3) Verification key storage unit 303
The verification key storage unit 303 receives the verification key from the key set generation unit 301 and stores it inside. Then, the verification key storage unit 303 transmits the verification key to the transmission device 10 via the key transmission unit 304 and the network 80.
(4) Key transmission unit 304
The key transmission unit 304 is a network connection unit, and transmits data to the transmission device 10 and the reception device 20 via the network 80.

Specifically, the key transmission unit 304 transmits a verification key to the transmission device 10 and transmits a key set to the reception device 20. The key set referred to here is a key set 210 shown in FIG. 9, that is, a key set composed of certificate 1, certificate 2, secret key 2 (SK2), certificate 3, and flag 211. is there.
(5) Outflow source identification information generation unit 305
The outflow source identification information generation unit 305 receives the public key ID from the key set transmission control unit 302. Specifically, ID1, ID2, and ID3. Information indicating that the certificate 2 and the private key 2 are transmitted in pairs to the receiving device 20 is added to ID2.

The outflow source identification information generation unit 305 generates outflow source identification information 320 shown in FIG. 13 based on the received public key ID. The outflow source identification information 320 is a table in which the public key ID embedded as a watermark in the pirated content is associated with the outflow source device of the pirated content specified from the watermark.
The outflow source identification information generation unit 305 associates a public key ID (ID2) indicating a certificate transmitted in a pair with the private key with the receiving device 20 with respect to the receiving device 20, and other public key IDs (ID1) , And ID3) are associated with the transmission device to generate outflow source identification information 320.

The outflow source identification information generation unit 305 transmits the generated outflow source identification information 320 to the content outflow source identification device 50 via the network 80.
4). Content outflow source identification device 50
FIG. 14 is a functional block diagram functionally showing the configuration of the content outflow source identification device 50.

As shown in the figure, it includes a content data input unit 501, a content data holding unit 502, a watermark extraction unit 503, an outflow source specifying unit 504, and an outflow source output unit 505.
Specifically, the content outflow source identifying device 50 is a computer system including a microprocessor, a ROM, a RAM, a hard disk unit, and the like. The content outflow source identification device 50 achieves its function by the microprocessor operating in accordance with a computer program stored in a ROM, RAM, or hard disk.

Below, each component of the content outflow origin identification apparatus 50 is demonstrated.
(1) Content data input unit 501
Specifically, the content data input unit 501 is a DVD drive unit, and reads content data from the recording medium 60 that is a DVD-RAM. The content data input unit 501 outputs the read content data to the content data holding unit 502.

Here, the recording medium 60 is a recording medium on which pirated content created by unauthorized copying is recorded.
(2) Content data holding unit 502
The content data holding unit 502 receives content data from the content data input unit 501 and holds the received content data therein.

(3) Watermark extraction unit 503
The watermark extraction unit 503 extracts a watermark from the content data held in the content data holding unit 502. Note that the digital watermark extraction process can be realized by a known technique, and thus description thereof is omitted here.
The watermark extraction unit 503 outputs the watermark extracted from the content data to the outflow source identification unit 504.

(4) Outflow source identification unit 504
The outflow source specifying unit 504 receives the outflow source specifying information 320 from the key issuing device 30 via the network 80 in advance and holds it therein. The data structure of the outflow source identification information 320 is as shown in FIG.
The outflow source identifying unit 504 receives the watermark embedded in the content data that is the pirated content from the watermark extracting unit 503.

  The outflow source specifying unit 504 specifies the outflow source device of the pirated content from the watermark and the outflow source specifying information 320. Specifically, the outflow source specifying unit 504 specifies the device associated with the watermark in the outflow source specifying information 320 as the outflow source device. Here, referring to FIG. 13, when the watermark extracted from the pirated content is any one of ID1 and ID3, the leaking source specifying unit 504 specifies that the leaking source device is the transmitting device 10, and When the watermark extracted from the pirated content is ID2, the outflow source device is identified as the receiving device 20.

The outflow source specifying unit 504 outputs the specified outflow source device name to the outflow source output unit 505.
Here, the reason why the fraudulent source device can be identified from the digital watermark embedded in the pirated content will be described.
The private key held by the receiving device 20 is only the private key 2 (SK2) paired with the public key PK2. Therefore, the receiving device 20 obtains the original content by decrypting the encrypted content composed of the partial contents A, B, C, D2, E, F,. I can do it. On the other hand, the receiving device 20 is composed of encrypted contents composed of partial contents A, B, C, D1, E, F,... And partial contents A, B, C, D3, E, F,. Since the encrypted content does not hold the corresponding secret key, it cannot be decrypted and the original content cannot be obtained. That is, “ID2” is always embedded as a watermark in the content acquired by the receiving device 20, and no other watermark is embedded.

  On the other hand, the transmitting apparatus 10 receives three certificates from the receiving apparatus 20, but the transmitting apparatus 10 holds a secret key corresponding to which certificate the receiving apparatus 20 has among the received three certificates. You can't know what you are doing. Therefore, the transmission device 10 cannot know the content that the reception device 20 can obtain by decoding. Therefore, it is impossible for the transmitting device 10 to impersonate the receiving device 20 and to leak out only the content composed of the partial contents A, B, C, D2, E, F,. If the transmitting device 10 leaks content including partial content (D1 or D3) other than the partial content D2 obtained by the receiving device 20 even once, it becomes evidence that the transmitting device 10 has performed fraud. It is very difficult to drain only D2 while avoiding the above.

Therefore, when the public key ID included in the pirated content is ID2, it is determined that the receiving device 20 is the source device, and when the public key ID included in the pirated content is ID1 and ID3. Therefore, it is possible to specify that the transmission device 10 is an outflow source device.
(5) Outflow source output unit 505
The outflow source output unit 505 includes a display.

Upon receiving the spill source device name from the spill source identification unit 504, the spill source output unit 505 generates screen information including the received spill source device name, and outputs the generated screen information to the display.
As a specific example, when the “source device” is received as the source device name, the source output unit 505 generates screen information 520 shown in FIG. The screen information 520 includes a comment that “the pirated content is leaked from the receiving device”. The screen information 520 shown here is an example.
<Operation>
1. Operation of Entire System FIG. 16 is a flowchart showing the operation of the entire content distribution system 1.

First, the content distribution system 1 performs key generation processing and key transmission / reception processing (step S101).
Next, the content distribution system 1 performs content transmission / reception processing (step S102).
If the pirated content is leaked, the content distribution system 1 performs content leak source identification processing (step S103).

2. Operation of Key Generation Processing and Key Transmission / Reception Processing FIG. 17 is a flowchart showing operation of key generation processing and key transmission / reception processing of the content distribution system 1. The operation shown here is the details of step S101 in the flowchart shown in FIG.
First, the key set generation unit 301 of the key issuing device 30 generates a certificate and a private key (step S201). Specifically, the key set generation unit 301 generates a certificate 1, a secret key 1 (SK1), a certificate 2, a secret key 2 (SK2), a certificate 3, and a secret key 3 (SK3). The data structure of certificate 1, certificate 2, and certificate 3 is as shown in FIG.

Next, the key set generation unit 301 generates a verification key used for verifying the digital signatures (SIG1, SIG2, and SIG3) included in each certificate generated in step S201. The verification key storage unit 303 stores the generated verification key (step S202).
The key transmission unit 304 of the key issuing device 30 transmits a verification key to the transmission device 10 via the network 80, and the transmission / reception unit 102 of the transmission device 10 receives the verification key (step S203). The verification key storage unit 103 of the transmission device 10 stores the received verification key (step S204).

The key set transmission control unit 302 of the key issuing device 30 stores the key set in which the certificate generated in step S201 is associated with the private key (step S205).
Next, the key set transmission control unit 302 selects one set of certificate and private key to be transmitted in pairs to the receiving device 20, and sets a flag in the flag column corresponding to the selected certificate and private key. (Step S206).

In the following, as illustrated in FIG. 12, the key set transmission control unit 302 selects the certificate 2 and the secret key 2 (SK2) as the certificate and the secret key to be transmitted in pairs to the receiving device 20. Will be described.
The key transmission unit 304 of the key issuing device 30 transmits a key set including the certificate 1, the certificate 2, the secret key 2 (SK2), and the certificate 3 to the reception device 20 via the network 80, and receives the reception device 20. The 20 transmitting / receiving unit 201 receives the key set (step S207). The key set storage unit 202 of the receiving device 20 stores the key set received in step S207 (step S208).

Subsequently, the key set transmission control unit 302 of the key issuing device 30 outputs the public key IDs “ID1”, “ID2”, and “ID3” to the outflow source identification information generation unit 305. At this time, “ID2” is added with information indicating that the certificate identified by “ID2” has been selected in step S206.
The outflow source identification information generation unit 305 associates “ID1” and “ID3” with the transmission device 10 and associates “ID2” with the information added with the reception device 20 as illustrated in FIG. The outflow source identification information 320 is generated (step S209).

The outflow source identification information generation unit 305 transmits the generated outflow source identification information 320 to the content outflow source identification device 50 via the network 80, and the outflow source identification unit 504 of the content outflow source identification device 50 The specific information 320 is received (step S210). The outflow source specifying unit 504 stores the outflow source specifying information 320 (step S211).
3. Operation of Content Transmission / Reception Processing FIGS. 18 and 19 are flowcharts showing the operation of content transmission / reception processing of the content distribution system 1. The operation shown here is the details of step S102 in the flowchart shown in FIG.

  First, the key set storage unit 202 of the receiving device 20 outputs all the certificates (certificate 1, certificate 2, and certificate 3) stored therein to the transmission / reception unit 201 (step S301). The transmission / reception unit 201 transmits the certificate 1, certificate 2, and certificate 3 to the transmission device 10 via the cable 70. The transmission / reception unit 102 of the transmission device 10 transmits the certificate 1, certificate 2, and Certificate 3 is received (step S302).

  The certificate verification unit 104 of the transmission apparatus 10 receives the certificate 1, the certificate 2, and the certificate 3 from the transmission / reception unit 102, and further reads the verification key from the verification key storage unit 103. The certificate verification unit 104 verifies all certificates using the verification key (step S303). Specifically, the certificate verification unit 104 extracts the digital signatures SIG1, SIG2, and SIG3 from the certificate 1, the certificate 2, and the certificate 3, respectively. The certificate verification unit 104 verifies the validity of each digital signature by applying a signature verification algorithm to the extracted digital signatures SIG1, SIG2, and SIG3 using the verification key.

In step S303, when the certificate verification unit 104 cannot verify the validity of one or more digital signatures (NO in step S304), the transmission apparatus 10 ends the process.
In step S303, when the certificate verification unit 104 has verified the validity of all the digital signatures (YES in step S304), the certificate verification unit 104
The public key IDs (ID1, ID2, and ID3) included in each certificate are output to the content dividing / duplicating unit 105 and the watermark embedding unit 106, and the public keys (PK1, PK2, and PK3) is output to the first encryption unit 108.

Upon receiving the public key ID from the certificate verification unit 104, the content dividing / duplicating unit 105 divides the content into a plurality of partial contents as shown in FIG. 4A (step S305).
Next, as shown in FIG. 4B, the content dividing / duplicating unit 105 duplicates the partial content D and has the same number (three) of partial contents as the number of public keys received from the certificate verification unit 104. D is generated (step S306). The content dividing / duplicating unit 105 outputs the content after duplicating the partial content D to the watermark embedding unit 106.

  When the watermark embedding unit 106 receives the content after the partial content D is copied from the content dividing / duplicating unit 105, the watermark embedding unit 106 receives the three partial content D included in the received content from the certificate verification unit 104. Three public key IDs are embedded as digital watermarks, and contents including three partial contents D1, D2, and D3 are generated (step S307). The watermark embedding unit 106 outputs the content embedded with the digital watermark to the second encryption unit 109.

Next, the content key generation unit 107 generates a content key Kt (step S308), and subsequently generates content keys K1, K2, and K3 (step S309). The content key generation unit 107 outputs the generated content keys Kt, K1, K2, and K3 to the first encryption unit 108 and the second encryption unit 109.
The second encryption unit 109 receives content from the watermark embedding unit 106, and receives content keys Kt, K1, K2, and K3 from the content key generation unit 107.

  The second encryption unit 109 encrypts the partial content D1 in which the watermark is embedded with the content key K1, encrypts the partial content D2 with the content key K2, and encrypts the partial content D3 with the content key K3. (Step S310). The second encryption unit 109 encrypts the partial content in which the watermark is not embedded with the content key Kt (step S311).

The encrypted content 180 shown in FIG. 7 is generated by the processing of step S310 and step S311.
The first encryption unit 108 receives public keys PK1, PK2, and PK3) from the certificate verification unit 104, and receives content keys Kt, K1, K2, and K3 from the content key generation unit 107.

The first encryption unit 108 encrypts the content key Kt using the public keys PK1, PK2, and PK3 as encryption keys, and three encrypted content keys E1 (PK1, Kt), E1 (PK2, Kt) And E1 (PK3, Kt) are generated (step S312).
Next, the first encryption unit 108 uses the public key PK1 as an encryption key, encrypts the content key K1, and generates an encrypted content key E1 (PK1, K1). Further, the first encryption unit 108 encrypts the content key K2 using the public key PK2 as an encryption key, and generates an encrypted content key E1 (PK2, K2). Further, the first encryption unit 108 encrypts the content key K3 using the public key PK3 as an encryption key, and generates an encrypted content key E1 (PK3, K3) (step S313).

The encrypted content key set 170 shown in FIG. 6 is generated by the processing of step S312 and step S313.
The transmission / reception unit 102 of the transmission apparatus 10 receives the encrypted content key set from the first encryption unit 108 and receives the encrypted content 180 from the second encryption unit 109.
The transmission / reception unit 102 transmits the encrypted content key set 170 and the encrypted content 180 to the reception device 20 via the cable 70. The transmission / reception unit 201 of the reception device 20 includes the encrypted content key set 170 and the encryption content. The encrypted content 180 is received (step S314).

The transmission / reception unit 201 outputs the received encrypted content key set 170 to the first decryption unit 203, and outputs the received encrypted content 180 to the second decryption unit 204.
Next, the first decryption unit 203 reads from the key set 210 stored in the key set storage unit 202 the public key ID (ID2) included in the certificate 2 for which the flag is set, and the corresponding private key 2 (SK2) is read (step S315).

The first decryption unit 203 extracts the encrypted content keys E1 (PK2, Kt) and E1 (PK2, K2) identified by the public key ID (ID2) read in step S315 from the encrypted content key set 170. (Step S316).
The first decryption unit 203 uses the secret key 2 (SK2) as a decryption key, decrypts the encrypted content keys E1 (PK2, Kt) and E1 (PK2, K2), and generates content keys Kt and K2. (Step S317). The first decryption unit 203 outputs the generated content keys Kt and K2 to the second decryption unit 204.

  Subsequently, the second decryption unit 204 includes encrypted partial contents E2 (Kt, A), E2 (Kt, B), E2 in which the digital watermark is not embedded among the encrypted partial contents included in the encrypted content 180. (Kt, C), E2 (Kt, E), E2 (Kt, F),... Are decrypted using the content key Kt as a decryption key to generate partial contents A, B, C, E, F,. To do. In addition, the second decryption unit 204 includes the encrypted partial content E2 (of encrypted partial content E2 (K1, D1), E2 (K2, D2), and E2 (K3, D3) embedded with a digital watermark. K2, D2) is decrypted using the content key K2 as a decryption key to generate a partial content D2.

As described above, the receiving apparatus 20 acquires content including partial contents A, B, C, D2, E, F,... (Step S318).
4). Operation of Content Outflow Source Identification Process FIG. 20 is a flowchart showing the operation of the content outflow source identification process of the content distribution system 1. The operation shown here is the details of step S103 in the flowchart shown in FIG.

The content leakage source identification process is a process performed to identify a fraudulent device from the content recorded on the recording medium 60 when the recording medium 60 on which the pirated content is recorded leaks.
First, the content data input unit 501 of the content outflow source specifying device 50 reads content data from the recording medium 60 (step S401), and outputs the content data to the content data holding unit 502. The content data holding unit 502 stores content data (step S402).

Next, the watermark extraction unit 503 extracts a digital watermark from the content data stored in the content data holding unit 502 (step S403), and outputs the extracted digital watermark to the outflow source identification unit 504.
The spill source identification unit 504 acquires the spill source identification information 320 shown in FIG. 13 from the key issuing device 30 in advance and stores it therein.

Upon receiving the public key ID extracted from the pirated content from the watermark extracting unit 503, the outflow source specifying unit 504 determines whether the received public key ID is ID1, ID2, or ID3.
When the public key ID is “ID1” or “ID3” using the spill source identification information 320 (“ID1 or ID3” in step S404), the spill source identification unit 504 uses the transmission device If the public key ID is ID2 (“ID2” in step S404), the source of the pirated content is specified as the receiving device 20 (step S405).

The outflow source identifying unit 504 outputs the device name of the device identified as the outflow source device to the outflow source output unit 505.
The outflow source output unit 505 generates screen information including the device of the outflow source device (step S407), and displays the generated screen information on the display (step S408).
<Other variations>
Although the present invention has been described based on the above embodiment, the present invention is not limited to the above embodiment, and the following cases are also included in the present invention.

(1) The above embodiment has a configuration in which content is transmitted and received between one transmission device 10 and one reception device 20, but the present invention is adapted for such peer-to-peer content transmission and reception. It is not limited, The structure which transmits / receives content to the several client apparatus from one server apparatus may be sufficient.
(2) In the above embodiment, the transmitting device 10 divides the content into partial contents, copies a part of the divided partial contents into a plurality of pieces, and sets the public key identifiers to the plurality of copied partial contents. However, the present invention is not limited to this configuration, and the transmission apparatus 10 is configured to copy the entire content and embed a public key identifier in each of the plurality of copied content. May be.

(3) In the above embodiment, moving image data in which video data and audio data are multiplexed is used as a specific example of content, but the content in the present invention is a concept including various digital data.
The contents in the present invention include, for example, documents and images created with moving images, still images, photographs, music, games, computer programs, electronic maps, electronic medical records, Word, PowerPoint, PDF (Portable Document Format), text data, etc. But it may be. A technique for embedding a digital watermark in text data is already known.

Or the content in this invention is not limited to the content which the receiver 20 acquires from the external broadcasting station apparatus 40, The receiver 20 may hold | maintain previously. That is, the content in the present invention is a concept including private content such as photographs and videos owned by individuals.
When the present invention is configured by a server-client system, the content in the present invention may be a bulletin board, SNS (Social Networking Service), or the like.

(4) In the above embodiment, the transmitting device 10 and the receiving device 20 transmit and receive content using a communication path called the cable 70. In the present invention, the content is transmitted and received via the communication path. Is not required. The content may be transmitted and received using a recording medium such as a DVD-RAM or an SD card without using a communication path.
In the above embodiment, stationary devices are used as specific examples of the transmitting device 10 and the receiving device 20, but in the present invention, the transmitting device 10 and the receiving device 20 are limited to stationary devices. For example, it may be a portable device that can be carried or software on a computer.

(5) In the above embodiment, the key issuing device 30 has been described using an example in which the key set 210 illustrated in FIG. 9 is transmitted to the receiving device 20, but the key issuing device 30 of the present invention is described. May be configured to transmit the key set 220 shown in FIG.
In this case, the key set generation unit 301 or the transmission control unit 302 of the key issuing device 30 replaces the secret key 1 (SK1) and the secret key 3 (SK3) with the dummy secret key 1 (Dummy SK1) and the dummy secret. The key 3 (Dummy SK3) may be generated, and the generated key set 220 including the dummy secret key 1 and the dummy secret key 3 may be transmitted to the receiving device 20.

(6) In the above embodiment, the receiving device 20 has been described as having three public key certificates as an example, but in the present invention, the number of public key certificates held by the receiving device 20 Of course, it is not limited to this.
(7) In the above embodiment, the receiving device 20 uses a flag as in the key set 210 shown in FIG. 9 and the key set 220 shown in FIG. However, in the present invention, the configuration using the flag is not essential.

In addition, the receiving device 20 may hold information for specifying a legitimate secret key in an area different from the key set. In this way, the receiving device 20 can prevent the secret key from being easily specified when the key set storage unit 202 is analyzed from the outside.
(8) The content distribution system 1 of the above embodiment has a configuration in which content is distributed across a plurality of copyright protection systems.

Specifically, the broadcasting station device 40 that broadcasts the Japanese terrestrial digital broadcasting transmits the content in a form protected by the B-CAS (BS-Conditional Access System) system, which is a copyright protection standard for broadcasting, The transmitting apparatus 10 that is a television receiver of the B2 cancels the content protected by the B-CAS method and displays it on the display.
When transmitting content to the receiving device 20, the transmitting device 10 releases the content protected by the B-CAS method, and protects it again in the DTCP (Digital Transmission Content Protection) format that is the IEEE 1394 copyright protection standard. Thereafter, the transmission apparatus 10 transmits the content to the reception apparatus 20 using an IEEE 1394 standard cable (cable 70).

  When receiving the content on the DVD-RAM medium, the receiving device 20 receiving the content releases the content protected in the DTCP format, and performs CPRM (Content Protection) which is a copyright protection standard on the DVD-RAM. Protect again in “For Recordable Media” format. Thereafter, the receiving device 20 records the content on the DVD-RAM medium.

Here, the B-CAS format, the DTCP format, and the CPRM format are copyright protection standards with different operating organizations. Therefore, when an illegally copied content is found in such a system, first, it is necessary to grasp which content protection standard has been analyzed by an unauthorized person.
According to the present invention, it is possible to specify the device that created the pirated content, and also to specify the content protection standard analyzed by the user.

(9) In the above embodiment, the transmission device 10 has a configuration for receiving the verification key from the key issuing device 30, but the present invention is not limited to this configuration. The verification key may be configured to be written in advance when the receiving device 10 is manufactured. In this case, the transmission device 10 does not need to be connected to the key issuing device 30 via a network.
(10) In the above embodiment, the content outflow source identification device 50 has a configuration for identifying the outflow source device based on the public key ID extracted from one pirated content. That is, when the public key ID embedded in the pirated content is “ID2” based on the spill source identification information 320 illustrated in FIG. 13, the spill source identification unit 504 of the content spill source identification device 50 receives the reception device 20. Is identified as an outflow source device, and when the public key IDs are “ID1” and “ID3”, the transmission device 10 is identified as the outflow source device. However, the present invention is not limited to this configuration.

In the present invention, the content spill source identification device 50 may be configured to identify a spill source device after obtaining a plurality of pirated content and extracting a digital watermark from the plurality of pirated content.
More specifically, the content outflow source identification device 50 extracts public key IDs from a plurality of pirated contents, and the plurality of extracted public key IDs include “ID1”, “ID2”, and “ID3”. If the transmission device 10 is identified as an outflow source device, and the extracted public key IDs are all “ID2”, the reception device 20 is identified as the outflow source terminal. You may comprise. This is because the receiving device 20 cannot obtain the content in which “ID1” and “ID3” are embedded, and only the transmitting device 10 has “ID1”, “ID2”, and “ID3” embedded therein. This is because the stored content is retained.

FIG. 21 is a flowchart showing an operation of content outflow source identification processing by the content outflow source identification device 50 in this case.
It is assumed that the content outflow source identification device 50 holds a predetermined number N therein in advance.
The content outflow source identifying device 50 reads content data from the recording medium on which the pirated content is recorded (step S501), and stores the read content data therein (step S502).

The content outflow source identification device 50 extracts the public key ID embedded as a digital watermark from the stored content data, and stores the extracted public key ID therein (step S503). Then, the content outflow source identification device 50 increments the number of read contents indicating the number of read pirated contents (step S504).
The content outflow source identification device 50 determines whether or not the number of read contents matches N. If the read content number does not match N (NO in step S505), the content outflow source specifying device 50 returns to step S501 and continues the processing. If the number of read contents matches N (YES in step S505), the content outflow source specifying device 50 reads the stored N public key IDs (step S506).

Then, the content outflow source identification device 50 has all the N public key IDs “ID2” or the N public key IDs include “ID1”, “ID2”, and “ID3”, respectively. Judgment is made.
When the N public key IDs are all “ID2” (YES in step S507), the content outflow source specifying device 50 specifies that the outflow source is the receiving device 20 (step S508).

When the N public key IDs include “ID1”, “ID2”, and “ID3” (NO in step S507), the content outflow source specifying device 50 specifies that the outflow source is the transmitting device 10. (Step S509).
Thereafter, the content outflow source identification device 50 generates screen information indicating the outflow source device (step S510), and displays the generated screen information on the display (step S511).

(11) In the present invention, the digital watermark embedded in the content may not be the public key identifier itself as long as the correspondence between the public key identifier and the watermark information can be obtained.
For example, the key issuing device creates “ID1 → 97, ID2 → 25, ID3 → 52” as the correspondence table, and passes it along with the key pair to the receiving device. Then, the receiving device passes the correspondence table to the transmitting device. The transmitting apparatus may be configured to embed values (97, 25, 52) corresponding to the key as digital watermarks in the content.

(12) Further, the present invention may be configured such that in a system including a plurality of receiving devices, the transmitting device embeds an electronic watermark in the plurality of partial contents.
For example, a receiving device that holds a secret key corresponding to ID1 is ... A, B, C, D9, E7, F ..., and a receiving device that holds a secret key corresponding to ID2 is ... A, B, C, D2 , E5, F,..., ID3 can receive a receiving apparatus that can obtain A, B, C, D5, E2, F,. This makes it possible to reduce the number of contents to be copied on the transmission device side.

Here, the transmitting apparatus may embed the same thing in a plurality of places instead of embedding the digital watermark in only one place.
For example, a receiving device corresponding to ID1 corresponds to A, B, C, D1, E1, F,..., And a receiving device corresponding to ID2 corresponds to A, B, C, D2, E2, F. The receiving device may obtain A, B, C, D3, E3, F,. As a result, even if an error occurs during the digital watermark reading process in the content outflow source identification device, the outflow source device can be traced with high probability.

  (13) In the present invention, the digital watermark embedded in the content may be a part of the digital key identifier, not the public key identifier itself. For example, it may be the lower 10 bits of the public key identifier. In this case, since the same digital watermark is embedded from different public key identifiers, there is a possibility that the leaked source of the pirated content cannot be specified by one leaked source specifying process. However, it is possible to narrow down by repeating the outflow source specifying process a plurality of times, and finally it is possible to uniquely specify the outflow source device. The merits of this configuration are as follows: (a) Even if a third party extracts the digital watermark of the content, the entire public key identifier cannot be grasped, so that privacy can be protected. . (B) Even when the digital watermark technique is limited (for example, only about several tens of bits can be embedded), the same effect as that of the above embodiment can be realized.

  (14) Also, the digital watermark to be embedded in the content is not the public key identifier itself, but is embedded by, for example, encrypting the public key identifier using the public key of the server device (or the common key of the common key cryptosystem). You may do it. With this configuration, even if a third party extracts a digital watermark from the content, the public key identifier cannot be grasped, and thus the receiving apparatus holds which secret key. I can not judge.

This makes it possible to realize safer content distribution. Furthermore, if a stochastic cipher using random numbers (for example, ElGamal cipher) is used as the public key cryptosystem in the above embodiment, a different ciphertext is output every time even for the same message, thereby realizing higher security. be able to.
(15) The digital watermark technique used in the above embodiment cannot be used to infer an algorithm for embedding a watermark from an algorithm for extracting a watermark, other than a symmetrical watermark technique that can infer an algorithm for embedding a watermark from an algorithm technique for extracting a watermark. Asymmetrical water mark technology may be used.

In this case, only the algorithm for extracting the watermark is taught to the content outflow source identification device, and only the algorithm for embedding the watermark is taught to the transmission device, so that the algorithm for embedding the watermark does not leak from the content outflow source identification device. Therefore, higher safety can be realized.
(16) In the present invention, information (copyright protection method ID or terminal ID) for identifying the transmission device and / or the reception device may be included as a digital watermark embedded in the content. Further, such information may be added to the header portion or footer portion of the content. This makes it easier to track the source device in the content source device.

(17) Further, the present invention may be a system in which a receiving device transmits content to another receiving device.
In this case, by embedding a plurality of digital watermarks in the same content, the pirated content leakage source device can be traced as in the above embodiment.
Further, in this case, the following device may be added.

(A) A digital watermark such as the number of generations and the number of copies may be added to the content.
(B) The transmission apparatus may determine a portion where the digital watermark is not embedded and embed the digital watermark therein.
(C) For example, a digital watermark may be embedded in a place that is uniquely obtained from information (for example, a terminal ID) about the transmission device and the reception device using a one-way function.

(D) A digital watermark may be embedded in order from the top (A) of the content.
(E) Each receiving apparatus may use a different digital watermark embedding method. Alternatively, each receiving apparatus may use different digital watermark embedding parameters (such as a frequency band).
(F) The above (a) to (e) may be combined. For example, in the same content protection method, digital watermarks may be embedded in order from the beginning of the content (A, B, C,...), And different digital watermark embedding methods may be used between different content protection methods.

(18) The present invention may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.
The present invention also provides a computer-readable recording medium such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc). ), Recorded in a semiconductor memory or the like. The digital signal may be recorded on these recording media.

In the present invention, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network represented by the Internet, a data broadcast, or the like.
The present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program.

In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, and executed by another independent computer system. It is good.
(19) A part or all of the constituent elements constituting each device of the present invention may be constituted by one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip, and specifically, a computer system including a microprocessor, ROM, RAM, and the like. . A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program. Further, the method of circuit integration is not limited to LSI, and may be realized with a dedicated circuit. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used.

Furthermore, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied as a possibility.
(20) A part or all of the constituent elements constituting each device of the present invention may be constituted by an IC card that can be attached to and removed from each device or a single module. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the super multifunctional LSI described above. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.

  (21) The above embodiment and the above modifications may be combined.

  INDUSTRIAL APPLICABILITY The present invention is particularly useful as a technique for preventing copyright infringement in an industry that distributes digital data that is a copyrighted work such as a movie or music.

1 is a system configuration diagram showing a configuration of a content distribution system 1. FIG. 3 is a functional block diagram functionally showing the configuration of a transmission device 10. FIG. (A) It is a figure which shows the data structure of the certificate 1. FIG. (B) It is a figure which shows the data structure of the certificate 2. FIG. (C) It is a figure which shows the data structure of the certificate 3. FIG. (A) It is a figure which shows the content 140 divided | segmented into the partial content of predetermined length (before copying). (B) It is a figure which shows the content 150 after copying the partial content D. FIG. (C) It is a figure which shows the content 160 after embedding a watermark in the partial content D. FIG. The watermark embedding unit 106 schematically shows a process of generating the partial contents D1, D2, and D3 by embedding the public keys ID “ID1”, “ID2”, and “ID3” in the partial content D as digital watermarks. It is a figure. 6 is a diagram illustrating a data configuration of an encrypted content key set 170 transmitted from a transmission device 10 to a reception device 20. FIG. It is a figure which shows the encrypted content 180 transmitted to the receiver 20 from the transmitter 10. FIG. 3 is a functional block diagram functionally showing the configuration of a receiving device 20. FIG. 4 is a diagram illustrating a data configuration of a key set 210 acquired by the receiving device 20 from the key issuing device 30. FIG. 4 is a diagram illustrating a data configuration of a key set 220 acquired by the receiving device 20 from the key issuing device 30. FIG. 3 is a functional block diagram functionally showing the configuration of a key issuing device 30. FIG. It is a figure which shows the data structure of the key set 310. It is a figure which shows the data structure of the outflow origin specific information 320. FIG. 3 is a functional block diagram functionally showing the configuration of a content outflow source identification device 50. FIG. It is a figure which shows the screen information 520 output to the spill source output part 505. FIG. It is a flowchart which shows operation | movement of the content delivery system 1 whole. It is a flowchart which shows operation | movement of a key production | generation process and a key transmission / reception process. 20 is a flowchart showing an operation of content transmission / reception processing, continued from FIG. 19 is a flowchart showing an operation of content transmission / reception processing, continued from FIG. It is a flowchart which shows the operation | movement of content outflow origin specific processing. It is a flowchart which shows the operation | movement of the modification of a content outflow origin specific process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Content distribution system 10 Transmitting apparatus 20 Receiving apparatus 30 Key issuing apparatus 40 Broadcast station apparatus 50 Content outflow origin specific apparatus 60 Recording medium 70 Cable 80 Network 101 Content receiving part 102 Transmission / reception part 103 Verification key memory | storage part 104 Certificate verification part 105 Content Division / duplication unit 106 Watermark embedding unit 107 Content key generation unit 108 First encryption unit 109 Second encryption unit 201 Transmission / reception unit 202 Key set storage unit 203 First decryption unit 204 Second decryption unit 301 Key set generation unit 302 Key set transmission control unit 303 Verification key storage unit 304 Key transmission unit 305 Outflow source identification information generation unit 501 Content data input unit 502 Content data holding unit 503 Watermark extraction unit 504 Outflow source identification unit 505 Outflow source output unit

Claims (8)

A content distribution system for transmitting and receiving content between a transmission device and a reception device,
The transmitter is
A key acquisition means for acquiring a plurality of public keys and a plurality of identifiers for identifying the public keys from the receiving device;
Watermark embedding means for embedding an identifier for identifying a different public key as a digital watermark in each of a plurality of contents of the same content;
Encryption means for encrypting each of the plurality of contents embedded with an identifier based on a public key identified by the embedded identifier, and generating a plurality of encrypted contents;
Transmitting means for transmitting the plurality of encrypted contents to the receiving device;
The receiving device is:
Key storage means for storing a plurality of public keys, a plurality of identifiers for identifying each public key, and a secret key paired with one of the plurality of public keys ,
Key transmitting means for transmitting the plurality of public keys and identifiers to the transmitting device;
Content receiving means for receiving the plurality of encrypted contents from the transmitting device;
A content distribution system comprising: decrypting means for acquiring one content from the plurality of received encrypted content based on the secret key. A receiving device that acquires content from a transmitting device,
Key storage means for storing a plurality of public keys, a plurality of identifiers for identifying each public key, and a secret key paired with one of the plurality of public keys ,
Key transmitting means for transmitting the plurality of public keys and identifiers to the transmitting device;
Each identifier for identifying the plurality of public keys is embedded as a digital watermark in a plurality of contents having the same content by the transmitting device, and further encrypted based on the public key identified by the embedded identifier. Content receiving means for receiving a plurality of encrypted contents from the transmitting device;
A receiving apparatus comprising: decrypting means for acquiring one content from a plurality of encrypted contents received by the content receiving means based on the secret key. The key storage means is
For each of the secret key and the plurality of public keys, each public key, each identifier, and a plurality of certificates including a digital signature for each public key and each identifier are stored,
The receiving apparatus according to claim 2, wherein the key transmitting unit transmits the plurality of certificates to the transmitting unit. The plurality of encrypted contents are generated by encrypting a plurality of contents having the same contents using a plurality of different content keys as encryption keys,
The content receiving means receives the plurality of encrypted contents and the plurality of content keys generated by using the plurality of public keys as the encryption keys.
The decryption means identifies one encrypted content key based on the identifier for identifying the public key, decrypts the identified encrypted content key using the secret key, and uses the decrypted content key The receiving apparatus according to claim 3, wherein one content is acquired. The key storage means
For each of a plurality of public keys that do not form a pair with the secret key, a plurality of dummy secret keys that cannot decrypt a ciphertext encrypted using each public key as an encryption key into a correct plaintext. The receiving device according to claim 3, wherein the receiving device is stored. A content receiving method used in a receiving device that acquires content from a transmitting device,
The receiving device is:
A storage unit, a key transmission unit, a content reception unit, and a decryption unit. The storage unit includes a plurality of public keys, a plurality of identifiers for identifying the public keys, and a plurality of public keys. one of the secret key that makes the one public key and a pair of inner stores,
The content receiving method includes:
A transmitting step in which the key transmitting means of the receiving device transmits the plurality of public keys and identifiers to the transmitting device;
The content receiving means of the receiving device uses the transmitting device to embed each identifier for identifying the plurality of public keys as a digital watermark in a plurality of contents having the same content, and further by using the embedded identifier. A content receiving step of receiving, from the transmitting device, a plurality of encrypted contents encrypted based on the identified public key;
It said decoding means of the receiving device, a plurality of the encrypted content received by the content receiving step, based on the secret key, the content receiving method which comprises a decoding step of obtaining the first content. A computer-readable recording medium that records a computer program used by a receiving device that acquires content from a transmitting device,
The receiving device is:
A storage unit, a key transmission unit, a content reception unit, and a decryption unit. The storage unit includes a plurality of public keys, a plurality of identifiers for identifying the public keys, and a plurality of public keys. one of the secret key that makes the one public key and a pair of inner stores,
The computer program is
Causing the key transmitting means of the receiving device to execute a transmitting step of transmitting the plurality of public keys and identifiers to the transmitting device ;
In the content receiving means of the receiving device, each identifier for identifying the plurality of public keys is embedded as a digital watermark in a plurality of contents of the same content by the transmitting device, and further, by the embedded identifier Executing a content reception step of receiving a plurality of encrypted contents encrypted based on the identified public key from the transmission device;
A recording medium that causes the decryption unit of the receiving apparatus to execute a decryption step of acquiring one content based on the secret key from a plurality of encrypted content received in the content reception step. An integrated circuit used in a receiving device that acquires content from a transmitting device,
Key storage means for storing a plurality of public keys, a plurality of identifiers for identifying each public key, and a secret key paired with one of the plurality of public keys ,
Key transmitting means for transmitting the plurality of public keys and identifiers to the transmitting device;
Each identifier for identifying the plurality of public keys is embedded as a digital watermark in a plurality of contents having the same content by the transmitting device, and further encrypted based on the public key identified by the embedded identifier. Content receiving means for receiving a plurality of encrypted contents from the transmitting device;
An integrated circuit comprising: decrypting means for obtaining one content from a plurality of encrypted contents received by the content receiving means based on the secret key.

Images