KR20010043582A - Copy-protection on a storage medium by randomizing locations and keys upon write access - Google Patents

Abstract

In a method for providing a copy protection service on a storage medium, preferably the location where data arranged in a plurality of blocks is stored is selected on a random basis by a controller (preferably embedded). By using an encryption key that critically depends on the location of the data on the storage medium, decryption of the replicated data becomes virtually impossible.

Description

COPY-PROTECTION ON A STORAGE MEDIUM BY RANDOMIZING LOCATIONS AND KEYS UPON WRITE ACCESS}

The present invention relates to a method for providing copy protection to a data storage medium, in particular a semiconductor memory module. As technology advances, the next generation of portable audio playback and recording devices will be based on semiconductor technology. The issue is based on considerations of weight, power and impact resistance.

Software providers, for example music publishers, require measures to prevent unauthorized duplication of information stored in a digital manner with little or no inconvenience to authorized users. . In addition, methods and systems should support business models such as lease, try-before-you-buy, and regulated replication (such as super distribution). A particular problem is raised by devices that can potentially access all the information on the storage medium without following the copy protection standards.

Conventional copy protection solutions use unique identification codes (ID) 'engraved' on the storage medium. At some point in time, such a configuration may be disadvantageous in terms of privacy. Moreover, as will be discussed later, methods that rely primarily on such IDs do not provide adequate protection against a replication configuration known as a 'replay attack'.

After all, it is an object of the present invention to provide a method and system for providing protection against replay attacks in a relatively economical manner requiring only ordinary signal processing equipment without necessarily employing a unique ID. .

The basic idea of such a copy protection method and system is that the data is encrypted using a key that is critically dependent on the location (s) where the data is stored, which makes it impossible to predict where the data will actually be stored on the record carrier. Combined with the way. Thus, duplication of data causes unpredictable changes in storage location, breaking the crucial relationship between the storage location and the encryption key. Thus, once the data has moved, this data can never be recovered if the ciphertext is strong enough, the random number generator is cryptographically strong, and any secret remains well hidden.

After all, an object of the invention is, above all, to provide an economical method of storing data on a storage medium in which the relationship between the encryption key and the storage location is disrupted in the duplication operation.

The present invention provides easy random access to any location within a memory, regardless of whether it is based on other entities such as bits, bytes or sectors having a uniform size related to the access width of the corresponding memory. It is particularly suitable for semiconductor memory modules.

Thus, in accordance with one aspect of the present invention, the present invention provides that data on a storage medium is encrypted using a key K that depends on the location (L ₁ , L ₂ , L ₃ ) of the data on the storage medium, and during each write operation. Data is stored at a location on a randomly selected storage medium.

The present invention also relates to a system configured to implement the method according to claim 1, a reproducing apparatus for reproducing a recording produced according to the method according to claim 1, and a recording medium manufactured according to the method according to claim 1. Moreover, another preferred aspect of the invention is described in the independent claims.

These objects of the present invention will become more apparent with reference to the embodiments described below.

In the drawings,

1 shows a conceptual two-player structure,

Figure 2 illustrates the mechanism of 'replay attack' in the prior art,

3 shows a schematic diagram of an embodiment of a storage medium,

4 shows an example of a file structure,

5a and 5b illustrate one embodiment of a method according to the invention and how it prevents a 'replay attack',

6a and 6b show another example of the method according to the invention.

Fig. 1 shows a conceptual two-playback device structure having two playback devices A and B and a removable module C which can be switched between these playback devices. As shown, these two playback devices have suitable means for inserting modules. In the remainder of the description, it is assumed that such a removable module can likewise be accessed using other means (eg, a PC based reader). Assuming playback devices A and B do not allow unauthorized duplication, such a configuration poses a risk of duplication of unauthorized data to the module. Although the present invention can be used in a broader sense, it describes a preferred embodiment in connection with a semiconductor audio playback device and module.

Within a few years, solid state audio (SSA) is expected to become the new standard for portable audio playback devices. This is mainly due to numerous advantages over weight, size, power usage and impact resistance over current solutions using disks or tapes. Currently available SSA playback devices combine 32-64 MB of flash memory with audio compression technology such as MPEG 1 Layer III (MP3) or AAC to achieve (almost) CD quality music playback time of up to 1 hour. do. However, due to the digital nature of these devices and the ease of duplication associated with them, the music industry demands adequate copyright protection.

One tool for copy protection of digital content is encryption. Although encryption itself does not prevent piracy, this encryption makes such a copy unusable, since the original content can only be retrieved by decrypting it with the appropriate key. As a result, playback of the content is limited to the device accessing the key. The purpose of a copy protection system is to manage keys so that illegal copying can be prevented, while not compromising the legitimate and intended use of the content.

Most memory modules for semiconductor multimedia storage applications have massive flash memory and onboard controllers. The controller may or may not be integrated, and a number of individual memory chips may be employed on the module. Examples of such multimedia memory modules include memory sticks (Sony), smart media (SSFDC forums), miniature cards (MC forums), compact flashes (PCMCIA forums), and multimedia cards (MMC associations). . Moreover, these devices can be thought of as block devices similar to hard disk drives, in which memory access is generated by addressing sectors (usually 512 bytes) on the module. In fact, some of the modules listed above use the ATA interface standard, which is used to connect hard disks or other peripherals to a PC. Such a configuration makes it possible to easily (by bit) copy the contents of such a memory module using a PC. The remaining modules use a dedicated interface and instruction set, but are still block based, ie individual sectors on the module can be addressed and modified.

In the following, it is assumed that the SSA playback device uses a removable memory module that can also be accessed by other means (e.g., a PC based reader).

Basically, there are two approaches to copy protection. The first way is to connect the audio to a particular playback device by giving each individual playback device a unique password that is used as a key to encrypt the audio. Thus, audio stored on a memory module by one playback device is played back only in that playback device. Of course, this is very annoying when someone has multiple SSA playback devices. Thus, there is a need for being able to play music stored on a memory module, regardless of the SSA device used to download music on the module. However, what should be avoided is that the user can duplicate the audio content to other modules and play back from these two modules.

One known solution is to insert a unique identification code (ID) that can be read by the application inside the memory module but is not changeable. This identification code can then be used to generate a unique encryption key for the module.

Another known solution is to take advantage of defects in the memory module that occur naturally as a result of the fabrication process used to fabricate cheap but high storage flash memories. The location of these natural defects is probably unique for each module and can itself serve as the 'fingerprint' of the device. Similarly, a unique key unique to the module can be generated.

However, these known solutions require a unique identification code and thus do not provide protection against replay attacks. A 'replay attack' is one in which unauthorized copies are made from one system (system 1) to another (system 2), even after the original replica's period expires, but without unauthorized (but not replayable) on system 2. A replica is a form of replication that can be used to restore a reproducible copy over and over on System 1. 2 illustrates this in more detail. Each system includes a unique identification code, indicated as ID1 for System 1 and ID2 for System 2, and includes a file whose content is stored in a sequence of a plurality of separate blocks. In this example, the data on rights and uses on the original copy is encrypted using a key and secret S derived from ID1. In the 'pre-purchase' or lease business model, further access to the data is denied after a certain time period or after a certain number of uses. The replication of the data to the system with the unique identification code ID2 (second step in FIG. 2) does not make a usable copy since the identification code does not match the code ID1. However, this copy is exactly the same (in bits) as the original. It can be copied back from system 2 to system 1 at any time, and a copy of one copy can be used again. This allows a fraudulent user to maintain a replica on System 2 that can be repeatedly copied on System 1 where the replica can be used. Thus, after acquiring content on a 'pre-purchase' basis, the fraudulent user replicates data from system 1 to system 2 to maintain the 'trial' status, and iteratively copy it back from system 2 to system 1 Done. Thus, 'test trial before purchase' becomes 'try-indefinitely'. Similarly, such a configuration can be used to pay only once for a lease and retain the replica forever.

In order to use storage effectively, it is necessary to implement a file system to organize and access user data. By treating the memory module as a block device, the creation and management of the file system is left to the application. In a PC environment where the operating system already has built-in file system support, this is a logical choice. By supporting the ATA standard, this support can be reused for memory modules without any modification. However, in a stand-alone device such as an SSA playback device, when the memory module takes a block device approach, the burden on file system details is placed on the application. Thus, stand-alone (portable) applications that require the storage of multimedia content can be built more efficiently when the controller on the memory module handles file system details.

3 shows a schematic diagram of a memory module embodiment 20. For simplicity, the electromechanical interface to the playback device is not shown in detail in the drawings. Storage area 30 has an access time that is almost independent of the physical storage location. The controller 22 controls access to the storage in a strict sense. Shown therein are a number of subsystems such as host interface 24, memory interface 26 and file system 28. External writing and internal selection to the memory are also shown. The following functions must exist inside the Application Program Interface (API). For memory formatting, an optimal volume number uniquely fixed or connected by wiring, or a random number generated each time a command is executed, is output. Such values are changed only when executing the formatting command, thereby destroying all data on the device. Copy protection itself does not need this number explicitly. To create a file, a reusable file ID is generated for later reference to that file. When writing a block, a sector number corresponding to a random selection from the free block list is generated. Depending on the implementation, the sector number that can be generated may be the actual sector number in which the data itself was stored during the write operation or the sector number stored during the next write operation. In particular, this is possible for semiconductor audio devices without significant time loss since the flash memory is not hindered by the seek time as usual in disk based systems. Moreover, such random selection helps to flatten wear across the entire device. The application can use or discard the sector number returned by the block write command as needed. When reading a block, the file ID controls outputting the data itself and the sector number of the current or next block to be read.

4 shows an example of a file structure distributed in a plurality of blocks, each block having a size of a single sector of 512 bytes. The first block contains information about the file, while the rest contain the file data itself. The above structure blocks the creation of a bitwise copy of the module, unless a modification facility is provided for each sector. Copying to an intermediate storage location and subsequent copying of the data on the module (which constitutes the 'replay attack' described above) copy the data to a completely different location. This in itself provides some protection against duplication. Copy protection is further provided by encrypting the data block with a key derived from the secret and derived from the location where the corresponding data is stored (e.g. preferably the sector number). The latter information can be derived from the block write function that returns the sector number of the next file sector. Since this information is not available for the first block, the latter information can be used for less sensitive data. This limitation is overcome by having the file creation function return the sector number of the first sector in the file where the data itself (e.g., file information) can be recorded. For reading, the current or next sector number is available before reading the actual data, so that the application can calculate the appropriate decryption key in time. Thus, the encryption key combines a storage location with a method that makes it impossible to predict this location. The cloning process changes the storage location, which breaks the relationship between the location and the decryption key. At this time, the secret used in the derivation of the key may be a secret shared worldwide among all playback devices or derived from other methods known to those skilled in the art.

5a and 5b show a method according to the invention. Each time data block is recorded, and the controller 22 writes the data to a randomly selected location. In Figs. 5A and 5B, these positions are indicated by L ₁ , L ₂ , and the like. The data is encrypted using a key that depends on the secret S and location L _i or a combination of location L _i (for example, the location of the block being recorded, or the location of the previous block, or the location of the previous block being recorded, etc.). do.

Making a copy of the data in the memory module changes the location of the data irretrievably (see Figure 5b). In fact, this happens twice. Thus, the duplicate copy of the replica has data whose position (L ₁ ″, L ₂ ″ etc.) does not match the argument required for proper decryption of the data. Thereafter, the copy of the replica cannot be decrypted and cannot be used. Accordingly, the 'regeneration attack' is prevented.

6A and 6B illustrate one embodiment of the invention in which all data is encrypted using key K (which may consist of a single key or blocks of multiple keys), which key itself is positioned L ₁ as an argument. , L ₂ , L _3, and the like, are encrypted and stored with a key K 'corresponding to the output of a hash function having a secret S. Thus K 'depends on the position of the data block, in this case the entire sequence in which the data block is written. Since the positions L ₁ , L ₂ , L ₃ change unpredictably upon each write access, the result of the hash function H and the corresponding key K 'change. When the content is duplicated and recopyed, the playback device cannot recover the key (as in the method shown in Figs. 5A and 5B) because K 'becomes uncorrectable. Thus, any replay attack fails. Therefore, the copying process can be economically avoided without requiring only ordinary signal processing equipment and requiring a unique identification code. The present invention offers the possibility of copy protection without the need for a unique identification code. This arrangement does not preclude the use of such code for other reasons or for additional protection.

Further, data may be arranged in groups of a plurality of blocks, and the groups of the plurality of blocks are recorded at random positions. The same configuration as described above may be used for groups of a plurality of blocks instead of a single block. 'Random position' within the scope of the present invention means in its broadest sense a position that cannot be predicted in advance for all intended purposes. The term 'for all due purposes' is hereafter referred to as obtaining random numbers, or the use of location usually consists of several kinds of algorithms. Almost really random, ie almost evenly distributed throughout the memory module, is desirable to flatten wear on the device. Preferably, the method is applied to all or almost all data inside the memory module, but the present invention also includes embodiments in which the method is applied only to a part of the data inside the memory module. This may for example be advantageous in terms of operating speed. The present invention is not limited to using only one encryption method. When data is divided into a plurality of groups, an embodiment using different dependences of the above encryption method on different encryption methods and locations may be used for different groups. Such a configuration reduces the risk of unauthorized decryption. The controller cannot be installed inside the system separately from the memory module, but preferably a control for allowing a random position to be selected can be integrated inside the memory module. Such a configuration makes it difficult to circumvent the above method or to influence the selection of the location of the data.

In a method for providing a copy protection service on a storage medium, preferably the location where data arranged in a plurality of blocks is stored is selected on a random basis by a controller (preferably embedded). By using an encryption key that critically depends on the location of the data on the storage medium, decryption of the replicated data becomes virtually impossible.

Claims (10)

In the method for providing a copy protection service on a storage medium, The data on the storage medium is encrypted using keys E {L _i , S}, K ′ depending on the location L _i of the data inside the memory module, and the data is randomly selected for each write operation. Recorded at a location on the medium. The method of claim 1, Wherein the data is arranged in a plurality of blocks with sector numbers, and during each block write, the sector number for the current or next block is randomly selected from the free block list. The method according to claim 1 or 2, Data on a storage medium is arranged in a plurality of blocks, wherein one block is encrypted using a key depending on the position of one or more blocks. The method of claim 3, wherein Wherein one block is encrypted using a key that depends on the location of the block. The method of claim 3, wherein Wherein one block is encrypted using a key depending on the position of the previously written block. The method of claim 3, wherein Wherein one block is encrypted using a key that depends on the location of all blocks. The method of claim 1, And said storage medium is a removable semiconductor memory module (C). A system configured to implement a method as claimed in claim 1 and having a control for selecting a location at random. A reproduction apparatus for reproducing data from a storage medium having data manufactured according to the method of claim 1. A storage medium manufactured according to the method of claim 1 and having a control unit for randomly selecting a location.