RU2273894C2 - Device and method for recording/reproducing information - Google Patents

Abstract

FIELD: engineering of devices for recording and reproducing information.

SUBSTANCE: in tree-like system of keys distribution renewed data of main key and carrier key are transferred together with key renewal block. Key renewal block is such, that each one of devices, connected as leaves of tree-like structure, has leaf key and limited hub key. Concrete key renewal block may be generated for group, identified by certain hub, and assigned to group for limiting device, for which it is possible to renew key. Any device not belonging to group can not decode the key, due to that it is possible to provide protection of key distribution. In particular, in a system using main key with controlled generation, it is possible to distribute main key renewed by means of key renewal block.

EFFECT: minimized data distribution load.

9 cl, 55 dwg

Description

FIELD OF THE INVENTION

The present invention relates generally to an information recording apparatus, an information reproducing apparatus, an information recording method, an information reproducing method, an information storage medium and a program maintenance means, and in particular, to an information recording apparatus, an information reproducing apparatus, an information recording method, an information reproducing method, storage medium and service tool programs that use a key distribution method with a hierarchical tree structure to reduce message size, due to which the load on data distribution is minimized when it is necessary to update a key, such as a master key, a media key or the like. In particular, the present invention relates to an information recording device, an information reproducing device, an information recording method, an information reproducing method, an information storage medium and a program maintenance tool using a key distribution method in which each of the number n of recording / reproducing devices is located on each a tree sheet for distributing a necessary key, such as a master or key of a storage medium, for recording or reproducing content data in or from a storage medium ation across the recording medium or a communication line, and distributed so that the master key or media key is used by each recording / reproducing apparatus for recording or reproducing content data.

State of the art

In connection with recent advances in the development of digital signal processing technology, digital recording / reproducing devices and storage media are of primary importance. Using such a digital recording / reproducing device and a storage medium, it is possible to re-record and reproduce, for example, images or sound without compromising their quality. Since digital data can be copied many times without degrading image and sound quality, information carriers with illegally recorded digital data upon entry to the market deprive copyright holders of various contents, such as music, movies, etc., or legal distributors of the content, the profits that they would receive if it was impossible to illegally copy. To prevent such illegal copying of digital data, various systems for preventing illegal copying have recently been introduced into digital recording / reproducing devices and storage media.

As an example of the above systems for preventing illegal copying in an MD (mini-disk) drive (MD is a trademark), SCMS (Copy Sequence Management System) is used. SCMS operates so that on the data playback device side, audio data is output together with the SCMS signal from the digital interface (DIF), while on the data recording device side, audio data recording from the data playback device side is controlled based on the SCMS signal from the playback device side data, which prevents illegal copying of audio data.

In particular, this SCMS signal indicates that the audio data is data that can be freely copied, which can be freely copied many times, data for one-time copy, which can be copied only once, or data that is forbidden to be copied, copying of which is prohibited. On the data recorder side, when receiving audio data from the digital interface, a SCMS signal is detected transmitted along with the audio data. If the SCMS signal indicates that the audio data is free for data copying, then the audio data with the SCMS signal is recorded on the mini-disk. If the SCMS signal indicates that the audio data is data allowed for one copy, the audio data is converted to data prohibited for copying and the SCMS signal along with the audio data is recorded on the mini-disk. In addition, if the SCMS signal indicates that audio data is prohibited for copying data, then audio data is not recorded on the mini-disc. The SCMS signal helps prevent illegal copying of copyrighted audio data to the mini-disk drive unit.

However, SCMS is only effective when the data recorder itself is configured to control recording of audio data from the side of the data reproducing device based on the SCMS signal. Therefore, it is difficult for an SCMS system to support a mini-disk drive that is configured without being able to perform SCMS monitoring. For SCMS applications, for example, a DVD player uses a content scrambling system to prevent illegal copying of copyrighted data.

The content scrambling system is configured such that encrypted image data, audio data, and the like. are written to a DVD-ROM (read-only memory) and each licensed DVD player is given an encryption key to decrypt the encrypted data. A license is issued to a DVD playback device in accordance with predetermined rules of operation, excluding illegal copying, etc. Therefore, when using an encryption key, a licensed DVD player can decrypt the encrypted data recorded in the DVD-ROM to play video and audio data from the DVD-ROM.

On the other hand, an unlicensed DVD player cannot decrypt the encrypted data recorded in the DVD-ROM because it does not have an encryption key for the encrypted data. Thus, the content scrambling system does not allow a DVD player that does not meet the licensing conditions to play a DVD-ROM in which digital data is recorded in order to prevent illegal copying.

However, the content scrambling system used in the DVD-ROM is directed to a storage medium onto which the user cannot record data (hereinafter referred to as ROM storage medium), but not to any storage medium to which the user can record data (hereinafter referred to as RAM carrier).

Thus, copying all encrypted data recorded in the ROM medium, as it is, into the RAM medium creates a so-called pirated data publication that can be played back by a licensed DVD player.

To solve this problem, the applicant of the present invention proposed, as disclosed in Japanese Patent Application Laid-Open No. 224461 of 1999 (Japanese Patent Application No. 25310 of 1998), a method in which information for identifying each information carrier (hereinafter referred to as carrier identification information) is recorded with other data on the storage medium to provide access to the identification information of the storage medium in the storage medium only when the playback device that is to play the storage medium is licensed For media identification information.

According to this method, the data in the storage medium is encrypted with a private key (master key) obtained by licensing the media identification information, so that any unlicensed reproducing device cannot receive any meaningful data, even if it can read the encrypted data. It should be noted that the playback device licensed for media identification information has an operation mode restricting illegal copying.

A licensed playback device may access media identification information. Media identification information is unique to each information carrier. Even if a non-licensed playback device can copy all encrypted data recorded in such a storage medium to a new storage medium, then data recorded in this way onto a new storage medium cannot be correctly decrypted by an unlicensed playback device, as well as a licensed playback device. Thus, it is essentially possible to prevent illegal copying of data.

It must be recalled that in the above conventional system, the master key stored in the licensed device is usually the shared key for all devices included in the same system. The master key, common to many devices in the system, is stored to ensure playback by one device of an information medium having data recorded therein by another device in the system (to ensure mutual operation of the devices).

However, if an attacker successfully opens the device included in the system and extracts the master key, then the encrypted data recorded in the entire system can be decrypted and the entire system will be destroyed. To prevent this, if it becomes known that the opening of the device led to the disclosure of the master key, it is necessary to replace the master key with a new key, and the new master key must be issued to all devices included in the system, with the exception of the device that was opened. This measure can be performed most simply by issuing to each device a unique key (device key), encrypting a new master key with each of the device keys to create the corresponding value, and transmitting this value to each device through the storage medium. However, this increases the size of the message to be transmitted in proportion to the number of devices for which it is intended.

SUMMARY OF THE INVENTION

Accordingly, an object of the present invention is to remedy the above-mentioned disadvantages of the prior art by creating a system that uses a tree-like key distribution method to reduce message size, thereby minimizing the burden of distributing a new or updated key, such as a master key, a media key or the like That is, the aim of the present invention is to provide an information recording device, an information reproducing device, an information recording method, an information reproducing method, a recorded information medium and program maintenance means that use a key distribution method in which each of the number n of recording / reproducing devices is located on each leaf of the tree, for distributing a necessary key, such as a master key or a media key, for recording or reproducing content data with or to a storage medium via a storage medium or a communication line, and a master key or a media key thus distributed is used by each recording / reproducing device for recording or reproducing content data.

According to the first aspect of the present invention, an information recording device for recording information in an information medium can be created, the device comprising cryptographic means having a node key unique to each of the nodes included in the hierarchical tree structure, which includes many information recording devices as sheets of a tree structure, and a leaf key unique to each of the information recording devices, and which encrypts the data to be stored in the storage medium and; wherein the cryptographic means generates an encryption key based on the data for generating the encryption key embedded in the information recording apparatus for encrypting the data to be stored in the information medium; wherein the data for generating the encryption key is data that can be updated with at least a nodal key or a leaf key.

In the above information recording apparatus according to the present invention, data for generating an encryption key is a master key common to a plurality of information recording apparatuses.

In addition, in the above information recording apparatus according to the present invention, the data for generating the encryption key is a media key unique to a particular storage medium.

In addition, in the above information recording apparatus according to the present invention, the node key can be updated, that is, when the node key is updated, the key update unit (KRB) derived from encryption of the update key using at least a node key or leaf key at the lower stage of the tree structure for the information recording device in the sheet where it is necessary to update the data to generate the encryption key, and the cryptographic tool in the information recording device receives the update data for the encryption key generation data encrypted with the updated node key encrypts the key update unit to obtain the updated node key, and calculates the update data for the encryption key generation data based on the updated node key thus obtained.

In addition, in the above information recording apparatus according to the present invention, the key update unit is stored in the information medium and cryptographic means encrypts the key update unit read from the information medium.

In addition, in the above information recording apparatus according to the present invention, the data for generating the encryption key has a generation number as update information correlated with it, and the cryptographic means stores in the storage medium, as a generation number of the record, a data generation number for generating the encryption key, which were used when storing encrypted data in the storage medium.

In addition, in the above information recording apparatus according to the present invention, the following encryption procedures are selectively performed depending on whether or not the restriction of the reproducing apparatus is established: when the restriction of the reproducing apparatus is not established, a first encryption key is generated for the data to be stored in the storage medium, based on data for generating a first encryption key for encrypting data to be stored in the storage medium using the first encryption the oval key, and the data for generating the first encryption key is stored in the information medium, or when the restriction of the playback device is set, a second encryption key is generated for the data to be stored in the information medium based on data for generating the second encryption key embedded in the recording device information for encrypting data to be stored in the storage medium using a second encryption key.

In addition, in the above information recording apparatus according to the present invention, when the restriction of the reproducing apparatus is not established, the cryptographic means generates a unique title key from the master key, the generation of which is controllable, stored in the information recording apparatus, the disc identifier being an identifier unique to information carrier, title key unique to the data to be recorded in the information carrier, and device identifier, which is the identifier an identifier for an information recording device, and generates a first encryption key from a unique title key, or, when a playback device restriction is set, the cryptographic tool generates a unique title key from a master key, the generation of which is managed, stored in the information recording device, a disk identifier that is an identifier unique to the storage medium, a title key unique to the data to be recorded in the storage medium, and unique to I device key unique to the information recorder and generates the second encryption key from the title-unique key.

The above-mentioned information recording apparatus according to this invention further comprises a transport stream processing means for attaching an entry time stamp (ATS) to each of the discrete transport packets included in the transport stream, the cryptographic means generates a block key as an encryption key of the block data including more than one transport packets, each of which has an attached timestamp, and a block key as an encryption key is generated during data encryption data to be stored in the storage medium, based on the data for generating the encryption key and the starting number of the block, which is additional information unique to the data of the block, and includes an entry time stamp.

In addition, in said information recording apparatus according to the present invention, cryptographic means encrypts the block data to be stored in the information medium in accordance with the DES algorithm (data encryption standard).

The specified information recording device further provides interface means for receiving information to be recorded in the storage medium and for identifying copy control information attached to each of the packets included in the transport stream to determine, based on the copy control information, whether recording in the medium is possible information.

The specified information recording device further provides interface means for receiving information to be recorded in the storage medium and identifying the two-bit encryption mode indicator (EMI) as copy control information for determining, based on the EMI, whether or not recording to the storage medium is possible.

According to a second aspect of the present invention, an information reproducing device for reproducing information from an information medium can be created, the device comprising cryptographic means having a node key unique to each of the nodes included in the hierarchical tree structure, which includes many information recording devices as each of the sheets of the tree structure, and a leaf key unique to each of the information recording devices, and which decrypts the data, storing schiesya in the recording medium; wherein the cryptographic means generates a decryption key based on the data for generating the decryption key embedded in the information recording apparatus for decrypting the data stored in the information medium; wherein the data for generating the decryption key is data that can be updated with at least a nodal key or a leaf key.

In the above information reproducing apparatus according to the present invention, data for generating a decryption key is a master key common to a plurality of information recording devices.

In addition, in the above information reproducing apparatus according to the present invention, the data for generating the decryption key is a media key unique to a particular storage medium.

In addition, in the above information reproducing apparatus according to the present invention, the node key can be updated, that is, when the node key is updated, the key update unit (KRB) derived from encrypting the update key node with at least a node key or leaf key on the lower stage of the tree structure for the information reproducing device in the sheet where it is necessary to update the data to generate the encryption key, and the cryptographic means in the in the formation receives update data for decryption key generation data encrypted with the updated node key, encrypts the key update unit to obtain the updated node key, and calculates update data for the decryption key generation data based on the updated node key thus obtained.

In addition, in the above information reproducing apparatus according to the present invention, the key update unit is stored in the information medium and cryptographic means encrypts the key update unit read from the information medium.

In addition, in the above information reproducing apparatus according to this invention, the data for generating the decryption key has a generation number as update information correlated with it, and the cryptographic means reads from the storage medium, when decrypting the encrypted data from the storage medium, the generation number of the data to generate the encryption key that was used to encrypt the encrypted data, and generates a decryption key from the data to generate the decryption key The numbers corresponding to the generation number read in this way.

In addition, in the above information reproducing apparatus according to the present invention, the following procedures are selectively performed, each of which must be performed depending on whether or not the restriction of the reproducing device is set: when the restriction of the reproducing device is not set, the first decryption key for the encrypted data is generated, stored in the storage medium, based on the data for generating the first decryption key stored in the storage medium, encrypted is given the data is decrypted using the first decryption key, or when the restriction of the playback device is set, a second decryption key is generated for the encrypted data stored in the information medium based on the data for generating the second encryption key embedded in the information recording device, and the encrypted data is decrypted using the second decryption key.

In addition, in the above information reproducing apparatus according to the present invention, when there is no restriction of the reproducing apparatus, the cryptographic means obtains a generation-controlled master key stored in the information recording apparatus and obtains from the information medium a disk identifier that is an identifier unique to the medium information, a title key unique to the data to be decrypted, and a device identifier that is an identifier for a recording device si of information that recorded the encrypted data to generate a unique cover key from the master key, disk identifier, cover key, and device key, and the first decryption key from the unique cover key, or, when the playback device is limited, the cryptographic tool receives the main key with a controlled generation, stored in the information recording device, and a key unique to the device, unique to the information recording device and stored in it, and received from the nose For information, a disk identifier, which is an identifier unique to the storage medium, and a title key unique to the data to be decrypted, to generate a unique title key from the master key, a disk identifier, a title key and a device-unique key, and a second decryption key is generated from unique title key.

The above-mentioned information reproducing apparatus according to this invention further comprises a transport stream processing means for controlling data output based on an entry time stamp (ATS) attached to each of a plurality of transport packets included in the block data decrypted by cryptographic means, the cryptographic means generates block a key as a decryption key for block data that includes more than one packet, each of which has an attached time stamp and input, and generates a block key as a decryption key when decrypting encrypted data stored in the information medium based on data including data for generating a decryption key and a block starting number, which is additional information unique to the block data, and includes a stamp entry time.

In addition, in said information reproducing apparatus according to the present invention, a cryptographic means decrypts the encrypted data stored in the information medium in accordance with the DES algorithm.

The specified information reproducing device further provides interface means for receiving information to be recorded in the information carrier and for identifying copy control information attached to each of the packets included in the transport stream to determine, based on the copy control information, whether or not playback from the medium is possible information.

The specified information reproducing device further provides interface means for receiving information to be recorded in the information medium and for identifying a two-bit encryption mode indicator (EMI) as copy control information for determining, based on the EMI, whether or not playback from the information medium is possible.

According to a third aspect of the present invention, a method for recording information for recording information in an information medium can be created, the method comprising the steps of: updating the encryption key generation data to generate an encryption key for encrypting the data to be recorded in the information medium using at least a key unique for each of the nodes included in the hierarchical tree structure, which includes many different devices for recording information as each of the ists tree structure or a leaf key unique to each of the information recording devices; and generating an encryption key based on data for generating an encryption key for encryption, data to be stored in the storage medium.

In the above information device method according to the present invention, data for generating an encryption key is a master key common to a plurality of information recording devices.

In addition, in the above method of recording information according to this invention, the data for generating the encryption key is a media key unique to a particular storage medium.

In addition, in the above method of recording information according to the present invention, the node key can be updated, that is, when the node key is updated, the key update unit (KRB) derived from encrypting the updated node key with at least a node key or a leaf key the key at the bottom level of the tree structure for the information recording device in the sheet where it is necessary to update the data to generate the encryption key, and the update stage includes the steps of: receiving an updated nodal key and by encrypting the key update unit, and computing data to update the data to generate an encryption key based on the updated node key obtained in this way.

In addition, in the above method of recording information according to this invention, the data for generating the encryption key has a generation number as update information correlated with it, and the cryptographic step further comprises the step of storing the encrypted data in the information medium, while generating the generation number data for generating the encryption key that were used as the generation number of the record.

In addition, in the above method of recording information according to this invention, the cryptographic stage includes the following two procedures, one of which is selectively performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, the first encryption key for the data is generated to be stored in the storage medium, on the basis of the data for generating the first encryption key, the data to be stored in the storage medium is encrypted rmatsii, using the first encryption key, and stores the data for generating a first encryption key in the recording medium; and when the restriction of the reproducing device is set, a second encryption key is generated for the data to be stored in the information medium based on data for generating a second encryption key embedded in the information recording device, and the data to be stored in the information medium is encrypted using the second encryption the key.

In addition, in the above method of recording information according to this invention, the cryptographic stage includes the following two procedures: when the playback device is not limited, the cryptographic means generates a unique title key from the generation-controlled master key stored in the information recording device, the disc identifier, which is an identifier unique to the storage medium, a title key unique to the data to be written to the storage medium, and ide the device identifier, which is the identifier for the information recording device, and generates a first encryption key from a unique title key; and when the restriction of the playback device is established, the cryptographic means generates a unique title key from the master key with a controlled generation stored in the information recording device, a disk identifier that is an identifier unique to the information medium, a title key unique to the data to be recorded in the information medium , and a device-unique key, unique to the information recording device, and generates a second encryption key from the unique title key .

The above method of recording information according to this invention further comprises a step of processing a transport stream for attaching an entry time stamp (ATS) to each of the discrete transport packets included in the transport stream; in the cryptographic stage, a block key is generated as an encryption key for block data including more than one transport packets, each of which has an attached entry time stamp, and generate a block key as an encryption key for data encryption, next to aschih conservation in the recording medium on the basis of data including data for generating the encryption key and the block seed, which is additional information unique to the block data, and includes an arrival time stamp.

In addition, in the specified method of recording information according to this invention, in a cryptographic step, the data to be stored in the storage medium is encrypted in accordance with the DES algorithm.

In the indicated information recording method according to the present invention, copy control information attached to each of the packets included in the transport stream is identified in the data to determine, based on the copy control information, whether or not writing to the storage medium is possible.

In the indicated information recording method according to the present invention, a two-bit encryption mode indicator (EMI) is identified as copy control information for determining, based on the EMI, whether or not writing to the information medium is possible.

According to a fourth aspect of the present invention, a method for reproducing information for reproducing information from an information medium can be created, the method comprising the steps of: updating data to generate a decryption key, from which a decryption key is generated to decrypt the encrypted data stored in the information medium using at least least node key, unique for each of the nodes included in the hierarchical tree structure, which includes many different playback devices maintaining information as each of the leaves of the tree structure, or leaf key, unique to each of the information reproducing devices; and generating a decryption key from the data to generate a decryption key updated in the update step to decrypt the data stored in the storage medium.

In the above method for reproducing information according to the present invention, data for generating a decryption key is a master key common to a plurality of information recording devices.

In addition, in the above method of reproducing information according to this invention, the data for generating the decryption key is a media key unique to a particular storage medium.

In addition, in the above method of reproducing information according to the present invention, the node key can be updated, that is, when the node key is updated, the key update unit (KRB) derived from encrypting the update key node with at least a node key or leaf the key at the bottom level of the tree structure for the information reproducing device in the sheet where it is necessary to update the data to generate the encryption key, and the cryptographic stage includes the stages of: encryption key update lock to obtain an updated node key; and calculating update data for the decryption key generation data based on the updated node key obtained in this way.

In addition, in the above method of reproducing information according to this invention, the data for generating the decryption key has a generation number as update information correlated with it, and in the cryptographic step is read from the storage medium when decrypting encrypted data from the storage medium, data generation number for generating the encryption key used to encrypt the encrypted data to generate the decryption key from the data to generate the decryption key The numbers corresponding to the generation number read in this way.

In addition, in the above method of reproducing information according to this invention, the cryptographic stage includes the following two procedures, each of which must be performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, then the first decryption key for encrypted data stored in the storage medium, based on data to generate the first decryption key stored in the storage medium, is encrypted This data is decrypted with the first decryption key, or when the playback device is set to restrict, then a second decryption key is generated for the encrypted data stored in the information medium based on the data for generating the second encryption key embedded in the information recording device, and the encrypted data decrypt using the second decryption key.

In addition, in the above method of reproducing information according to the present invention, when the restriction of the reproducing device is not established, a master key with a controlled generation is stored in the information recording device, and a disk identifier is obtained from the information medium, which is an identifier unique to the information medium , a title key unique to the data to be decrypted, and a device identifier that is an identifier for the information recording device that recorded o encrypted data, to generate a unique cover key from the master key, disk identifier, cover key, and device key, and the first decryption key from the unique cover key; and when the restriction of the playback device is established, then a master key with a controlled generation stored in the information recording device and a unique key for the device unique to the information recording device and stored in it are obtained, and a disk identifier is obtained from the information medium, which is an identifier unique for the storage medium, and a cover key unique to the data to be decrypted, for generating a unique cover key from the master key, disk identifier, title of the key and unique key device; and generating a second decryption key from the thus generated unique title key.

In the above method of reproducing information according to the present invention, the reproducing apparatus further comprises a transport stream processing means for controlling data output based on an entry time stamp (ATS) attached to each of a plurality of transport packets included in the decrypted block; and in the cryptographic stage, a block key is generated as a decryption key for block data including more than one packet, each of which has an attached timestamp, and a block key is generated as a decryption key when decrypting encrypted data stored in the storage medium based on data including data for generating the decryption key, and the initial number of the block, which is additional information unique to the block data, and includes an entry time stamp.

In addition, in the specified method of reproducing information according to this invention, the cryptographic tool decrypts the encrypted data stored in the storage medium in accordance with the DES algorithm.

In addition, in the specified method of reproducing information according to this invention, copy control information attached to each of the packets included in the transport stream is identified in the data to determine, based on the copy control information, whether or not playback from the storage medium is possible.

In addition, in the indicated information reproducing method according to the present invention, a two-bit encryption mode indicator (EMI) is identified as copy control information for determining, based on the EMI, whether or not playback from the information medium is possible.

According to a fifth aspect of the present invention, an information medium capable of recording information having a key update unit (KRB) stored therein, derived from encrypting the updated node key with at least a node key unique to each of the nodes included in the hierarchical tree, can be created. a structure that includes many different information recording devices as each of the sheets of the tree structure, or a leaf key unique to each of the inform recorders tion.

In addition, data derived from encryption with the updated nodal data key for generating the encryption key used in the information recording device for generating the encryption key for encrypting data to be stored in the information medium is included in said information medium according to the present invention.

In addition, the data carrier according to the present invention includes data derived from decryption using the updated nodal data key to generate the decryption key used in the information reproducing apparatus for generating the decryption key for decrypting the data stored in the information medium.

In addition, the data carrier according to the present invention stores information about data generation for generating an encryption key or decryption key.

According to a sixth aspect of the present invention, an apparatus for manufacturing an information medium for manufacturing an information medium can be created, the device comprising: a memory for storing a key update unit (KRB) derived from encryption of the updated node key using at least a node key unique to each from the nodes included in the hierarchical tree structure, which includes many different information recording devices as each of the sheets of the tree structure, or leaf key unique to each of the information recording devices; and a control unit for managing writing a key update unit (KRB) stored in the memory to the storage medium.

In addition, in said storage medium manufacturing apparatus, at least the information medium identifier and encrypted data for generating the encryption key or encrypted data for generating the decryption key are additionally stored in the memory, and the control unit controls recording at least the information medium identifier and the encrypted information in the information medium data for generating an encryption key; or encrypted data for generating a decryption key.

In addition, in the indicated device for manufacturing the information carrier, information on generation of data for generating an encryption key or data for generating an encryption key is additionally stored in the memory, and the control unit controls recording of generation information in the information carrier.

According to a seventh aspect of the present invention, a method of manufacturing an information medium can be created, comprising the steps of: storing in memory a key update unit (KRB) derived from encryption of an updated key node using at least a key key unique to each of the nodes included in the hierarchical tree structure, which includes many different information recording devices as each of the sheets of the tree structure, or leaf key, unique to each of the recording devices and formation; and writing to the storage medium of the key update unit (KRB) stored in the memory.

In addition, in this method of manufacturing a storage medium, at least the storage medium identifier and encrypted data for generating an encryption key or encrypted data for generating a decryption key are additionally stored in memory, and at least the storage medium identifier and encrypted data for generating are recorded in the storage medium encryption key or encrypted data to generate a decryption key.

In addition, in this method of manufacturing a storage medium, data generation information for generating an encryption key or data for generating a decryption key is additionally stored in memory, and the generation information is recorded in the storage medium.

According to an eighth aspect of the present invention, program maintenance means for servicing a computer program can be created, under which information is processed to write information to an information medium in a computer system, the computer program comprising the steps of: updating the encryption key generation data to generate the encryption key for encrypting data to be recorded in the storage medium using at least a nodal key unique to each of the nodes, including li ne in a hierarchical tree structure, which includes a plurality of different information recording devices as each of the sheets of the tree structure, or a leaf key unique to each of the information recording devices; and generating an encryption key based on the data to generate an encryption key for encrypting the data to be stored in the storage medium.

According to a ninth aspect of the present invention, a program maintenance tool for servicing a computer program can be created, under which information from a storage medium is reproduced in a computer system, the computer program comprising the steps of: updating data to generate a decryption key, from which a decryption key is generated for decrypting encrypted data stored in the storage medium using at least a nodal key unique to each of the nodes, including GOVERNMENTAL in a hierarchical tree structure, which are included in each of the sheets as a tree structure or a leaf key unique to each of the information reproducing device; and generating a decryption key from the data to generate a decryption key updated in the update step to decrypt the data stored in the storage medium.

According to the present invention, a key distribution method in a hierarchical tree structure is used to reduce the size of the message to be distributed needed to update the key. Namely, in the key distribution method, each of the number n of recording / reproducing devices is located on each of the leaves of the tree. The method is used to distribute the necessary key, such as a master key or media key, for recording or playing back content data to or from a storage medium, via a storage medium or a communication line, and the main key or media key thus distributed is used by each recording / reproducing device for recording or reproducing content data.

According to one of the modes of the present invention, the content to be recorded in the storage medium is formed from TS packets (transport stream) defined in MPEG-2 and recorded in the storage medium along with the entry time stamp, which is information about the time at which the packet is received by the device a record attached to each of the TS packets. ATS is, in a sense, random data from 24 to 32 bits. ATS stands for entry time stamp.

The number X of TS packets, each of which has an entry time stamp attached to it, is recorded in one block (sector) of the information medium. An entry time stamp attached to the first TS packet in each block included in the transport stream is used to generate a block key for encrypting data in the block.

Thus, the data in each block can be encrypted with a unique block key without the need to provide a special area for storing the key and access to any data except the main data during recording or playback.

Furthermore, in addition to the entry time stamp (ATS), copy control information (CCI) can be attached to the TS packet to be recorded, and ATS and CCI can be used to generate the block key.

It should be noted that the program maintenance means according to the eighth and ninth aspects of the present invention are, for example, means that serves a computer program in a form suitable for reading by a computer in a general-purpose computer system capable of executing various program codes. The tool is not limited to any special form, but can be any storage medium such as CD, FD, MO, etc., as well as a transmission medium such as a network.

The specified program maintenance tool determines the structural and functional interaction between the computer program and the means for performing the functions of a given computer program in a computer system. In other words, when the computer program is installed in the computer system through the program maintenance tool, it works in conjunction with the computer program to provide actions similar to those in other aspects of the present invention.

Brief Description of the Drawings

These and other objects, features and advantages of the present invention follow from the following detailed description of preferred embodiments of the present invention with reference to the accompanying drawings, in which:

figure 1 depicts a block diagram of the structure (1) of a device for recording / reproducing information according to this invention;

2 is a block diagram of the structure (2) of an information recording / reproducing device according to the present invention;

figa and 3B are graphical diagrams of the operations performed in the process of recording information in the device recording / reproducing information according to this invention;

4A and 4B are graphical diagrams of operations performed during information reproduction in an information recording / reproducing apparatus according to the present invention;

5 is a data format processed in an information recording / reproducing apparatus according to this invention,

6 is a block diagram of a means of processing a transport stream (TS) in a device for recording / reproducing information according to this invention;

7A-7C show a transport stream processed in an information recording / reproducing apparatus according to this invention;

Fig. 8 is a block diagram of a transport stream (TS) processing means in an information recording / reproducing apparatus according to the present invention;

Fig.9 is a block diagram of a means of processing a transport stream (TS) in a device for recording / reproducing information according to this invention;

10 is an example of additional information of block data processed in an information recording / reproducing apparatus according to this invention;

11 is a diagram of a tree structure for illustrating encryption of keys, such as a master key, a media key, etc., for a recording / reproducing device according to this invention;

12A and 12B are examples of a key update unit (KRB) used in distributing keys, such as a master key, a media key, etc., for a recording / reproducing apparatus according to this invention;

Fig - examples of the distribution of the decryption key, respectively, decryption using the key update unit for the main key in the recording / reproducing device according to this invention;

Fig - sequence of operations performed during decryption using the key update unit for the main key in the recording / reproducing device according to this invention;

Fig - sequence of operations performed when comparing the generation of the master key when recording content in the recording / reproducing device according to this invention;

FIG. 16 is a block diagram (1) of an encryption performed for recording data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be established;

FIG. 17 is a flowchart (2) of encryption performed for recording data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be established;

Fig. 18 is a flow chart of operations performed by recording data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

Fig. 19 is an example of generating a key unique to a disc in a recording / reproducing apparatus according to this invention;

Fig. 20 is a graphical diagram of operations performed when generating a unique title key in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

21 is an example of generating a unique title key in a recording / reproducing apparatus according to this invention in a system in which a restriction of a reproducing apparatus can be set;

Fig - generating a block key in a device for recording / reproducing information according to this invention;

FIG. 23 is a flowchart of decryption performed for reproducing data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

24 is a graphical diagram of operations performed during decryption for reproducing data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be established;

25 is a graphical diagram of operations performed when making a decision when reproducing data whether or not data can be reproduced in the information recording / reproducing apparatus according to the present invention in a system in which the limitation of the reproducing apparatus can be set;

FIG. 26 is a flowchart of operations performed when generating a unique title key for reproducing data in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

FIG. 27 illustrates examples of key distribution and decryption using a key update unit for a media key in a recording / reproducing apparatus according to the present invention; FIG.

FIG. 28 is a flow chart of operations performed during decryption using a key update unit for a media key in a recording / reproducing apparatus according to the present invention; FIG.

Fig is a graphical diagram of the operations performed when recording content using the key update unit for a media key in a recording / reproducing device according to this invention;

FIG. 30 is a flowchart (1) of encryption performed for recording data using a media key in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be established;

Fig - block diagram (2) of encryption performed to record data using a media key in the device for recording / reproducing information according to this invention in a system in which the restriction of the playback device can be set;

32 is a graphical diagram of operations performed by recording data using a media key in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

Fig. 33 is a block diagram of an encryption performed for reproducing data using a media key in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be established;

Fig. 34 is a graphical diagram of operations performed when reproducing data using a media key in an information recording / reproducing apparatus according to the present invention in a system in which a restriction of a reproducing apparatus can be set;

Fig. 35 is a graphical diagram of operations performed when making a decision when reproducing data using a media key whether or not data can be reproduced in the information recording / reproducing apparatus according to the present invention in a system in which the limitation of the reproducing apparatus can be established;

Fig. 36 is a structural block diagram of a recording / reproducing apparatus according to the present invention, in which a key update unit is received externally via a communication means or the like, and is stored in a storage medium;

Fig. 37 is a flowchart of a procedure according to which, in the recording / reproducing apparatus according to the present invention, a key update unit is received externally via a communication means or the like, and is stored in a storage medium;

Fig. 38 is a graphical diagram of operations performed when receiving an outside key update unit via a communication means or the like, and storing it in a storage medium in a recording / reproducing device according to this invention;

Fig. 39 shows a procedure in which, in the recording / reproducing device according to the present invention, the key is received from the outside of the key update unit via a communication means or the like, and stored in a storage medium;

40A and 40B are flowcharts of operations performed to control copying while recording data in an information recording / reproducing apparatus according to the present invention;

Figa and 41B are graphical diagrams of operations performed to control copying when reproducing data in the information recording / reproducing apparatus according to this invention;

Fig. 42 is a block diagram of a data processing system for processing data using software in an information recording / reproducing apparatus;

FIG. 43 is a block diagram of an apparatus for manufacturing an information medium that is used in a recording / reproducing apparatus according to the present invention; FIG.

Fig is a graphical diagram of the operations performed in the manufacture of the storage medium that is used in the recording / reproducing device according to this invention;

Fig. 45 is an example of a format for a key update unit used in a recording / reproducing apparatus according to the present invention;

figa-46C is the label for the key update unit used in the recording / reproducing device according to this invention.

BEST MODES FOR CARRYING OUT THE INVENTION

[System configuration]

Figure 1 schematically shows a block diagram of an embodiment of a device for recording / reproducing information according to this invention. The recording / reproducing device is generally indicated by 100. As shown in FIG. 1, the recording / reproducing device 100 comprises an input / output interface 120, an MPEG codec 130, an input / output interface 140 comprising a combination 141 of an analog-to-digital converter and a digital-to-analog converter , cryptographic unit 150, ROM 160 (read-only memory), central processing unit 170, memory 180, drive 190 for storage medium 195 and transport stream processing means 300 (TS processor). The components are connected to each other by a bus 110.

The input / output interface 120 receives digital signals included in each of various contents, such as an image, sound, program, or the like, supplied from the outside, and feeds them to the bus 110 as well as to the outside. The MPEG codec 130 decodes the MPEG MPEG-encoded data supplied via the bus 110, and outputs the MPEG-decoded data to the input / output interface 140 while performing MPEG encoding of the digital signals supplied from the input / output interface 140, and outputs the data to the bus 110 The input / output interface 140 includes a combination 141 of an analog-to-digital converter and a digital-to-analog converter. The input / output interface 140 receives the analog signals as external content, performs analog-to-digital data conversion, and outputs the digital signals thus obtained to the MPEG codec 130, while performing digital-to-analog conversion of the digital signals from the MPEG codec 130 and outputting the analog signals obtained therefrom .

The cryptographic unit 150 is, for example, a single-chip large integrated circuit. It encrypts or decrypts digital signals in content received via bus 110 and outputs data to bus 110. It should be noted that the cryptographic unit is not limited to a single-chip large integrated circuit, but may be a combination of various types of software or hardware. A software type cryptographic block will be further described below.

The ROM 160 stores a leaf key, which is a device key, unique, for example, for each recording / reproducing device or for a group of many recording / reproducing devices, and a nodal key, which is a device key, unique to many recording / reproducing devices or for many groups . The central processor 170 executes a program stored in the memory 180 to control the MPEG codec 130, the cryptographic unit 150, etc. The memory 180 is, for example, a non-volatile memory for storing, for example, a program to be executed by the central processor 170, and data necessary for the central processor 170 to operate. The drive 190 drives a storage medium 195 capable of recording digital data to read digital data from the information carrier 195, and outputs data to the bus 110, while simultaneously supplying digital data supplied via the bus 110 to the recording medium 195 for recording therein. It should be noted that the device 100 recording / playback can be performed so that the ROM 160 stores the program, while the memory 180 stores the keys of the device.

The storage medium 195 is a means capable of storing digital information, such as one of the optical disks, including DVD, CD, etc., a magneto-optical disk, a magnetic disk, a magnetic tape or semiconductor memory devices, including RAM (RAM), etc. . In this embodiment, the storage medium 195 is removably mounted in the drive 190. However, it should be noted that the storage medium 195 can be integrated into the recording / reproducing device 100.

The transport stream processing means 300 (TS processor) extracts transport packets related to a given program (content), for example, from a transport stream having a plurality of television programs (contents) multiplexed therein, stores information about the time of occurrence of the extracted transport packet along with each a packet in the storage medium 195, and controls the appearance of the transport stream for reading from the storage medium 195 information. A further description of the processor 300 TS will be given below with reference to Fig.6 and the following figures.

For the transport stream, the entry time stamp (ATS) is set as the time of appearance of each of the transport packets in the transport stream. The appearance time is determined during encryption to prevent the failure of the terminal decoder of the transport stream system (T-STD), which is a virtual decoder defined in MPEG-2 systems, and during the reading of the transport stream, the appearance time is controlled by the input time stamp attached to each transport package. The processor 300 TS performs these types of control. For example, when writing transport packets to the storage medium, transport packets are recorded as source packets located without a gap between consecutive packets, and the time of appearance of each packet is kept unchanged, which provides control of the exit time of each transport packet during reading from the storage medium. A processor 300 TS attaches an entry time stamp (ATS) indicating the time at which each of the transport packets was received when data is recorded in the storage medium 195, such as a DVD.

In the recording / reproducing apparatus 100 according to the present invention, content including a transport stream in which an entry time stamp is attached to each transport packet is encrypted using a cryptographic unit 150, and the content encrypted in this manner is stored in the information medium 195. In addition, the cryptographic unit 150 decrypts the encrypted content stored in the information medium 195. A detailed description of this encryption and decryption will be given below.

It should be noted that in FIG. 1, the cryptographic unit 150 and the TS processor 300 are shown as separate units for ease of illustration and explanation, however, these functions can be integrated into a single-chip large integrated circuit or performed using a combination of software and hardware elements.

In addition to the structure shown in FIG. 1, the recording / reproducing apparatus according to the present invention may have the structure shown in FIG. 2. The recording / reproducing apparatus shown in FIG. 2 is indicated generally by 200. In the recording / reproducing apparatus 200, the information carrier 195 is removably mounted to the information medium interface 210 as a drive unit. Writing data to the information carrier 195 and reading data from it is also possible when it is used in another recording / reproducing device.

[Recording and playing back data]

Figures 3 and 4 show graphical diagrams of the operations performed when writing data to the storage medium in the recording / reproducing apparatus shown in Figures 1 or 2, and when reading data from the storage medium. To record digital signals as external content into the storage medium 195, the operations shown in the graphical diagram of FIG. 3A are performed. Namely, when digital signals as content (digital content) are supplied to the input / output interface 120 via the IEEE serial bus 1394 or the like, the input / output interface 120 receives the digital content and provides data to the processor 300 TS via the bus 110 in step S301.

In step S302, the TS processor 300 generates block data in which an entry time stamp is attached to each of the transport packets in the transport stream, and provides data to the cryptographic block 150 via the bus 110.

In step S303, the cryptographic unit 150 encrypts the received digital content and outputs the encrypted content to the drive 190 or the storage medium interface 210 via the bus 110. In step S304, the encrypted digital content is recorded to the storage medium 195 through the drive 190 or the storage medium interface 210. Here, the recording / reproducing apparatus exits the recording procedure. A description of encryption using the cryptographic unit 150 is given below.

It should be recalled that as a standard for the protection of digital content transmitted between devices via the IEEE 1394 serial bus, the protection “5CDTCP (protection of digital content transfer of five companies)” (referred to in the subsequent DTCP) by five companies, including Sony Corporation, which is the applicant of this invention. It provides that in the case of transferring digital content that is not free for copying between devices, the transmitter and receiver side must mutually confirm before transferring that the copy control information can be correctly processed, then the digital content is encrypted on the transmitting side for transmission, and encrypted digital content (encrypted content) is decrypted on the receiving side.

When transmitting and receiving data using this DTCP standard, the input / output interface 120 on the data receiving side receives encrypted content via the IEEE 1394 serial bus, decrypts the encrypted content in accordance with the DTCP standard, and then outputs the data as open or decrypted content to the cryptographic unit 150 (at step S301).

For encryption based on DTCP digital content, it is necessary to generate a time-varying key. The encrypted digital content including the encryption key used for encryption is transmitted via the IEEE 1493 serial bus to the receiving side, and the receiving side decrypts the encrypted digital content with the key included in the content.

More specifically, the DTCP standard provides that the initial key value and a flag indicating the key change time for encrypting digital content are included in the encrypted content. On the receiving side, the initial key value included in the encrypted content changes at the time indicated by the flag included in the encrypted content to generate the key that was used for encryption, and the encrypted content is decrypted with the key generated in this way. Namely, it can be considered that the encrypted content includes a key used to decrypt it, and this position should be fulfilled in the following description. In accordance with the DTCP standard, there is an information version, for example, a Web page identified by a URL (Unified Resource Locator), http://www.dtcp.com.

The following is a description of the recording of external analog signals as contents in a storage medium 195 with reference to the graphic circuit shown in FIG. 3B. When the input / output interface 140 receives the analog signals as content (analog content) in step S321, the process proceeds to step S322, where the combination 141 of the analog-to-digital converter and digital-to-analog converter performs analog-to-digital conversion of the analog content to create digital signals as content (digital content).

The digital content is supplied to the MPEG codec 130, which performs MPEG encoding of the digital content in step S323, namely, the encoding of the digital content by MPEG compression, and supplies the encoded content to the cryptographic unit 150 via the bus 110.

In subsequent steps S324, 325, and 326, operations similar to those performed in steps S302 and 303 of FIG. 3A are performed. Thus, the TS processor 300 attaches the entry time stamp to each of the transport packets, the cryptographic unit 150 encrypts the content, and the encrypted content obtained in this way is recorded in the storage medium 195. Here, the recording / reproducing apparatus exits the recording procedure.

The following is a description of the operations performed to reproduce content from the storage medium 195 information and output in the form of digital or analog content to the outside, with reference to the graphic diagram in figure 4. This is done according to the graphic diagram shown in FIG. 4A. First, in step S401, the encrypted content is read from the storage medium 195 using the drive 190 or the storage medium interface 210, and provided through the bus 110 to the cryptographic unit 150.

In step S402, the cryptographic unit 150 decrypts the encrypted content received from the drive 190 or the storage medium interface 210 and provides the decrypted data to the TS processor 300 via the bus 110.

In step S403, the TS processor 300 determines the exit time based on the entry time stamp attached to each of the transport packets included in the transport stream to perform control in accordance with the entry time stamp, and provides data to the input / output interface 120 via the bus 110. It should be noted that the processing operations in the processor 300 TS and the decryption of digital content in the cryptographic unit 150 will be further described below.

It should be noted that when digital content is delivered through the IEEE 1394 serial bus, the input / output interface 120 performs mutual authentication in step S404 with the communicating device, as mentioned above, in accordance with the DTCP standard, and then encrypts the digital content for transmission.

To read the contents from the storage medium 195 of information and output it in the form of analog content to the outside, the playback operations shown in the graphical diagram in FIG. 4B are performed.

Namely, in successive steps S421, 422 and 423, operations similar to those performed in steps S401, 402 and 403 of FIG. 4A are performed. Due to this, the decrypted digital content received from the cryptographic unit 150 is supplied to the MPEG codec 130 via the bus 110.

At step S424, the codec 130 performs MPEG decoding of the digital content, namely, extends the digital data, and feeds the data to the input / output interface 140. In step S425, the input / output interface 140 performs digital-to-analog conversion of the digital content subjected to MPEG decoding in the codec 130 in step S424 using a combination 141 of the analog-to-digital converter and the digital-to-analog converter. Then, the input / output interface 140 proceeds to step S426, where it outputs the analog content. On this, the recording / reproducing apparatus exits the reproducing procedure.

[Data Format]

The following is a description of the format of the data recorded in or read from the storage medium according to this invention, with reference to figure 5. A minimum module read or written to a storage medium according to this invention is called a block. One block has a size of 192 * X bytes (for example, X = 32).

According to the present invention, an entry time stamp (ATS) is attached to each packet (out of 188 bytes) of TS (transport stream) defined in MPEG-2 to create data from 192 bytes, and X of such data is considered to be one block. The entry time stamp is data of 24-32 bits indicating the entry time. As indicated above, ATS stands for entry time stamp. The entry time stamp is random data corresponding to the entry time of each packet. One block (sector) of the information carrier writes X TS packets (transport stream), each of which is attached to the entry time stamp. According to the present invention, an entry time stamp attached to the first of the TS packets in each of the blocks included in the transport stream is used to generate a block key that is used to encrypt data in each block (sector).

A key unique to each block is generated by generating an encryption block key based on a random entry time stamp. A key created in such a way that is unique to a block is used to encrypt each block. In addition, by generating a block key based on an entry time stamp, there is no need to provide a zone in the information medium for storing the encryption key for each block, and it becomes possible to efficiently use the main data zone in the information medium. In addition, during playback, there is no need to access data other than that contained in the main zone, which provides more efficient recording or playback.

It should be noted that the initial block number shown in FIG. 5 is additional information including an entry time stamp. The block starting number may also include copy control information (CCI) in addition to the entry time stamp. In this case, the copy control information and the entry time stamp are used to generate the block key.

It should be noted that according to this invention, most of the data in the content stored in the storage medium, such as DVD, is encrypted. As shown below in Fig. 5, m bytes (for example, m = 8 or 16 bytes) in the initial part of the block are recorded as open or not encrypted data, namely, as not encrypted, while the rest of the data (m + 1 and further ) are encrypted, since the length of the encrypted data is limited, since encryption is performed in modules of 8 bytes. It should be noted that if encryption was performed, for example, in modules of 1 byte, and not in modules of 8 bytes, then all data, except the initial number of the block, could be encrypted using a series of 4 bytes in the initial part of the block ( m = 4).

[Operations performed by TS processor]

The following is a detailed description of the ATS function. As indicated above, the ATS is an entry time stamp attached to each of the transport packets included in the transport stream to save the entry time of the TS packet.

Thus, when, for example, one or more transport packets included in a transport stream is extracted from a plurality of television programs (contents) multiplexed in a transport stream, they arrive at irregular intervals (see FIG. 7A). The time that each of the transport packets in the transport stream enters is important for the transport stream, and the entry time is determined during coding to prevent failures of the terminal of the transport stream system (T-STD), which is a virtual decoder defined in MPEG-2 systems (ISO / IEC 13818-1).

During playback of the transport stream, the entry time is controlled based on the entry time stamp attached to each transport packet. Therefore, when recording transport packets to the storage medium, it is necessary to save the entry time of the transport packet. When recording transport packets to a storage medium, such as a DVD, an entry time stamp is attached to each transport packet, indicating the entry time of each transport packet to be recorded on the storage medium.

6 is a flowchart illustrating operations performed by the TS processor 300 when recording a transport stream supplied via a digital interface to a storage medium such as a DVD. As shown in the figure, the transport stream is supplied in the form of digital data, such as digital broadcast signals, from a terminal 600 to a TS processor 300. As shown in FIGS. 1 or 2, a transport stream is supplied from terminal 600 via an input / output interface 120 or an input / output interface 140 and an MPEG codec 130.

The transport stream is supplied to a bitstream parser 602, which detects a PCR packet (program synchronization indicator) in the inbound transport stream. A PCR packet is a packet in which a PCR encoded as defined in MPEG-2 systems is encoded. PCR packets are encoded at time intervals of less than 100 ms. PCR represents the time when the transport packet arrives at the receiving side, with a frequency of 27 MHz.

Then, the 27 MHz phase lock (PLL) circuit 603 links the 27 MHz clock / recorder of the recording / reproducing device to the PCR of the transport stream. A time stamp generating circuit 604 generates a time stamp based on a 27 MHz clock. The block seed attachment circuit 605 attaches a time stamp to the transport packet indicating the time when the first byte of the transport packet enters the smoothing buffer 606 as an entry time stamp (ATS).

A transport packet with an entry time stamp attached to it leaves the terminal 607 via a smoothing buffer 606 and into a cryptographic unit 150, in which it: is encrypted, as will be further described below, and then is recorded in the information carrier 195 through the drive 190 (see Fig. 1) and media interface 210 (see FIG. 2).

7 shows, by way of example, the operations performed to record an incoming transport stream to a storage medium. On figa shows the input of transport packets included in a specific program (content). On the horizontal axis in FIG. 7A, a time base is shown indicating the time of the traffic flow. As shown in FIG. 7A, in this embodiment, the transport packets in the incoming transport stream come through irregular times.

On figv shows the output signal of the circuit 605 joining the initial number of the block. This circuit 605 attaches an initial block number including an entry time stamp indicating the arrival time of each of the transport packets of the transport stream to each of the transport packets and provides an initial packet. On figs shows the source packets recorded in the storage medium. As shown in FIG. 7C, source packets are written to the storage medium without a gap between successive packets. Due to this arrangement of the source packets without a gap between them, it is possible to effectively use the recording area in the storage medium.

FIG. 8 is a flowchart of a TS processor 300 illustrating a data processing procedure for reading a transport stream from an information medium 195. The transport packet, decrypted in a cryptographic block, which will be further described below, and having an entry time stamp attached thereto, is supplied from the terminal 800 to the initial block number separation circuit 801, where the entry time stamp and the transport packet are separated from each other. Here, a time generation circuit 804 is provided for calculating time based on a clock count of a clock generator 805 at a frequency of 27 MHz of a reproducing apparatus.

It should be noted that the first entry time stamp is set as the initial value in the time generation circuit 804. A comparator 803 is also provided here for comparing the entry time stamp with the current time supplied from the time generating circuit 804. An output control circuit 802 is also provided for issuing a transport packet to the MPEG codec 130 or the digital input / output interface 120 when the time generated by the time generating circuit 804 becomes equal to the time of the entry stamp.

Figure 9 shows the encoding of MPEG input audio-visual signals in the MPEG codec 130 of the recording / reproducing apparatus 100 and the encoding of the transport stream in the TS processor 300. Namely, FIG. 9 shows a flowchart of operations performed both in the MPEG codec 130 shown in FIGS. 1 or 2 and in the TS processor 300. Video signals are provided from terminal 901 to the MPEG video encoder 902.

An MPEG video encoder 902 encodes the input video signals into an MPEG video stream and provides data to a video stream buffer 903. MPEG video encoder 902 also provides MPEG video access module information to a multiplex manager 908. The "access module" of the video stream contains the type, number of encoded bits, and a decoding time stamp for each frame. The frame type is I / P / B frame information, and the decoding time stamp is information defined in MPEG-2 systems.

Audio signals are provided from terminal 904 to MPEG audio encoder 905. The MPEG audio encoder 905 encodes the input audio signals into the MPEG audio stream and outputs the data to the buffer 906. The MPEG audio encoder 905 also outputs the information of the MPEG audio stream access module to the multiplex manager 908. The audio stream access module is an audio frame, and the access module information contains the number of encoded bits and a decoding time stamp of each audio frame.

Both video access information and audio access information are supplied to the multiplexing manager 908, and it controls the encoding of the visual and audio streams based on the access module information. The multiplexing manager 908 includes a clock for generating a reference time of 27 MHz and thereby sets the packet encoding control information for the transport packet in accordance with T-STD, which is a virtual model of the decoder defined in MPEG-2. The packet encoding control information contains a type and the length of the stream to be packaged.

In the case where the packet encoding control information refers to video packets, the switch 976 is placed on their side and for reading the video stream of the video data from the buffer 903 from the payload length indicated by the packet encoding control information, and supplies the data to the transport packet encoder 909.

In the case where the packet encoding control information relates to audio packets, the switch 976 is placed on their side b to read the audio data stream from the buffer 906 from the payload length indicated by the packet encoding control information and supplies the data to the transport packet encoder 909.

In the case where the packet encoding control information relates to PCR packets, the transport packet encoder 909 receives the PCR supplied from the multiplexing manager 908 and outputs the PCR packets. To indicate that the packet encoding control information does not encode packets, nothing is supplied to the transport packet encoder 909.

To indicate that the packet encoding control information does not encode packets, the transport packet encoder 909 does not output packets. Otherwise, transport packets are created based on the packet encoding control information and are output. Therefore, the transport packet encoder 909 intermittently provides transport packets. An entry time stamp calculator 910 is also provided for calculating an entry time stamp indicating the time at which the first byte of the transport packet arrives at the receiving side based on the PCR supplied from the multiplexing manager 908.

Since the PCR (program synchronization indicator) supplied from the multiplexing manager 908 indicates the time at which the tenth byte of the transport packet defined in MPEG-2 arrives at the receiving side, the input stamp time is the byte time 10 bytes before the time indicated PCR

The block initial number attachment circuit 911 attaches an entry time stamp to each of the packets output by the transport packet encoder 909. A transport packet with an attached entry time stamp issued from the block initial number attaching circuit 911 is supplied to the cryptographic unit 150 through a smoothing buffer 912, where it is encrypted, as will be further described below, and then stored in the information medium 195.

To store on the information carrier 195, transport packets with an attached entry time stamp are located without a gap between them, as shown in FIG. 7C, and then stored on the information carrier 195 before encryption is performed in cryptographic unit 150. Even if the transport packets are located without a gap between them , then accessing the entry time stamp attached to each of the packets provides the ability to control the time of delivery of transport packets to the receiving side.

It should be noted that the size of the entry time stamp is not limited to 32 bits, but can range from 24 to 32 bits. The larger the length in bits of the entry time stamp, the longer the operating cycle of the entry time stamp stamp counter. For example, in the case where the time counter of the entry time stamp is a binary counter with an accuracy of 27 MHz, the entry time stamp of 24 bits will appear again after approximately 0.6 s. This time interval is long enough for a normal transport stream, since the packet interval of the transport stream is defined in MPEG-2 as a maximum of 0.1 s. However, the bit length of the entry time stamp may be more than 24 bits for sufficient tolerance.

Due to the indicated change in the length in bits of the entry time stamp, the configuration of the initial number of the block, which is additional data to the block data, can be of several types. Examples of the configuration of the starting number of the block are shown in FIG. 10. Example 1 in FIG. 10 is an initial block number when using a 32-bit entry time stamp. Example 2 in FIG. 10 is a seed when using a 30-bit entry time stamp and 2-bit copy control information (CCI). Copy control information indicates a monitored state of copying data having copy control information attached thereto. SCMS (Sequential Copy Management System) and CGMS (Copy Management System) are best known as copy management information. This copy control information indicates that data with copy control information attached to it is allowed for unlimited copying (free to copy), data is allowed to be copied only once (allowed for one-time copying), or data is prohibited for copying (data prohibited for copying) .

Example 3 shown in FIG. 10 is the initial block number when using a 24-bit entry time stamp, 2-bit copy control information and other 6-bit information. Other information can be selected from various types of information, such as information indicating the on / off operation of the Macrovision system, which is a copy control mechanism for analog video data when block starting number data is output in analog form.

[Tree structure for key distribution]

The recording / reproducing device shown in FIGS. 1 or 2 distributes for each of the other recording / reproducing devices included in the system, a master key necessary for recording data in the information medium or for reproducing data from the information medium, as will be described below. 11 shows a key distribution in a recording / reproducing apparatus in a recording system with a tree structure. The numbers 0 to 15 shown at the bottom of FIG. 11 indicate individual recording / reproducing devices. Thus, in FIG. 11, each of the sheets of the tree structure corresponds to each of the recording / reproducing devices (hereinafter referred to as “devices”).

At the time of manufacture (or during distribution), in each of the devices 0-15, a nodal key is stored that refers to the node from its own leaf to the root, and a leaf key for each leaf in a given source tree. “K0000” to “K1111” in the lower part of FIG. 11 are leaf keys, respectively, corresponding to devices 0-15, and “KR” in the uppermost node to “K111” in the lower nodes are nodal keys.

In the tree structure shown in FIG. 11, for example, device 0 has a leaf key K0000 and key keys K000, K00 and KR. The device 5 has a leaf key K0101 and key keys K010, K01, K0 and KR. The device 15 has a leaf key K1111 and nodal keys K111, K11, K1 and KR. It should be noted that the tree shown in Fig. 11 includes only 16 devices from 0 to 15 located in 4 steps, and is well balanced with respect to horizontal symmetry, however, it can include more devices located in it and have a different number of steps in different parts.

Recording / reproducing devices (devices) included in the tree structure shown in FIG. 11 include various types of recording / reproducing devices using various storage media such as DVD, CD, MD, memory stick, etc. . In addition, various application services coexist in the tree structure. The key distribution system shown in FIG. 11 is applicable when such different devices and applications coexist with each other.

In a system in which such devices and applications coexist, the part of the tree shown in a circle of dashed lines in FIG. 11 and including devices 0, 1, 2, and 3 is taken as a group in which devices use the same storage medium. For example, each of the devices included in the circleed group receives the encrypted common content transmitted from the content provider or the common master key, or provides encrypted content fee payment data to the provider or to the payment regulatory organization. The content provider, the organization regulating the payment, or the organization organizing the transfer of data collectively with each of the devices transmit data to the circled part in Fig. 11, i.e. into devices 0, 1, 2 and 3, forming one group. In the tree shown in FIG. 11, there are more than one such group.

It should be noted that the nodal key and the leaf key can be collectively managed using a specific key management center or using each of the groups, including the content provider, the organization that regulates the payment, etc., which leads to the need to have different data exchanges with each group. If, for example, these nodal and leaf keys were disclosed, then they are updated by the key management center, the supplier, the organization organizing the payment, etc.

In the tree structure shown in FIG. 11, four devices 0, 1, 2, and 3 included in one group share the common keys K00, K0, and KR as nodal keys. Due to this common use of node keys, for example, one common master key can only service devices 0, 1, 2 and 3. For example, by setting the node key K000 itself, which is used together as a master key, only devices 0, 1, 2 and 3 can set a common master key without receiving any new key. When distributed to devices 0, 1, 2, and 3 via the network or in the form of information stored in the storage medium, the value of Enc (K00, Kmaster) obtained by encrypting the new master key Kmaster with the K00 key, only devices 0, 1, 2, and 3 can analyze the value of Enc (K00, Kmaster) using the shared key key K00, which is owned by each of the devices, to obtain the main key Kmaster. It should be noted that the value of Enc (Ka, Kb) is data derived from Kb encryption using Ka.

If at time t it is discovered that, for example, the keys K0011, K001, K00, K0 and KR owned by device 3 were analyzed and opened by intruders (hackers), then it is necessary to disconnect device 3 from the system to protect data transmitted from the system and into the system (a group including devices 0, 1, 2, and 3). To do this, you need to change the nodal keys K001, K00, K0 and KR, respectively, to the new keys K (t) 001, K (t) 00, K (t) 0, K (t) R and you need to transfer the new keys to devices 0 , 1 and 2. It should be noted that K (t) aaa is the updated key of the Kaaa key in generation t.

The following is a description of the distribution of the updated key. The key is updated by supplying a table consisting of a data block called a key update block (KRB), as shown in FIG. 12A, to each of the devices 0, 1 and 2 through the network or as a record in the storage medium.

As shown in FIG. 12A, the key update unit is formed as a data unit having a data structure that can only update a device that needs to update the key. The example shown in FIG. 12A is a data block formed to distribute the updated generation n key node to devices 0, 1 and 2 included in the tree structure shown in FIG. 11. As follows from Fig. 11, devices 0 and 1 need updated node keys K (t) 00, K (t) 0 and K (t) R, while device 2 needs updated node keys K (t) 001 , K (t) 00, K (t) 0 and K (t) R.

As shown in FIG. 12A, the key update unit includes a plurality of encryption keys. The lower encryption key is Enc (K0010, K (t) 00l). This is the updated node key K (t) 001, encrypted with the leaf key K0010 of device 2. Device 2 can decrypt this encryption key with its own leaf key to obtain K (t) 001. The device 2 can also decrypt the encryption key Enc (K (t) 001, K (t) 00) at the next lower stage with the key K (t) 001, which it obtained by decrypting and thereby obtaining an updated node key K (t) 001. After that, the device 2 decrypts the encryption key Enc (K (t) 00, K (t) 0) in the next upper step in Fig. 12A to obtain the updated node key K (t) 0, and decrypts the encryption key Enc (K (t) 0, K (t) R) in the upper stage of FIG. 12A to obtain an updated encryption key K (t) R. On the other hand, for devices 0 and 1, there is no need to update the K000 key, however, it is necessary to update the K (t) 00, K (t) 0 and K (t) R keys. Devices 0 and 1 decrypt the encryption key Enc (K000, K (t) 00) in the third step above in FIG. 12A to obtain an updated node key K (t) 00. Consecutively, devices 0 and 1 decrypt the encryption key Enc (K (t) 00, K (t) 0) in the second step from FIG. 12A to obtain the updated node key K (t) 0, and decrypt the encryption key Enc (K ( t) 00, K (t) R) in the upper stage of FIG. 12A to obtain an updated key node K (t) R. Thus, devices 0, 1, and 2 can receive updated nodal keys K (t) 00, K (t) 0, and K (t) R. It should be noted that the “index” in FIG. 12A indicates the absolute address of the nodal key and the leaf key used as the decryption key.

The nodal keys K0 and KR at the upper stage of the tree structure shown in FIG. 11 do not need to be updated. In the case where it is only necessary to update the node key K00, the use of the key update unit shown in FIG. 12B ensures the distribution of the updated node key K (t) 00 to devices 0, 1 and 2.

The key update unit shown in FIG. 12B can be used to distribute a new master key for general use, for example, in a particular group. In particular, devices 0, 1, 2, and 3 in the group shown in the dashed circle in FIG. 11 use a specific storage medium and need a new common main key K (t) master. At this time, the node key K (t) 00, derived from updating the node key K00 common to devices 0, 1, 2, and 3, is used to distribute Enc (K (t), K (t) master) data derived from encryption new common master key K (t) master, together with the key update unit shown in figv. Using this distribution, data that cannot be decrypted in devices included in another group, for example, in device 4, can be distributed.

That is, devices 0, 1, and 2 can receive the master key K (t) master at time t by decrypting the encrypted data with K (t) 00 obtained by processing the key update unit.

[Distribution of the master key using the key update unit]

13 shows a procedure for obtaining a master key K (t) master at time t by device 0 receiving data Enc (K (t) 00, K (t) master), derivatives of encryption of the new common master key K (t) master using K (t) 00, and the key update unit shown in figv.

As shown in FIG. 13, device 0 generates a key key K (t) 00 by similarly processing the key update block from the key update block during t (the generation in which the key update block is stored) and the key key K000 previously stored in device. In addition, device 0 decrypts the updated master key K (t) master using the decrypted updated node key K (t) 00, encrypts it with its own leaf key K0000 for later use, and saves it. It should be noted that in the case where device 0 can reliably store the updated master key K (t) master, then there is no need to encrypt it with the leaf key K0000.

The following is a description of the process for obtaining an updated master key with links to the graphic diagram shown in FIG. It is assumed that the recording / reproducing device received the latest master key K (s) master at the time of delivery and securely stores it in its own memory (more precisely, in the form encrypted with its own leaf key).

When the storage medium having the updated master key K (n) master and the key update unit stored therein is installed in the recording / reproducing device, the latter first reads in step S1401 the generation number n of the master key K (n) master (hereinafter referred to as information about the generation number n of the previous record) from the storage medium. The storage medium has the generation number n of the main key K (n) master, previously recorded in it. The recorder / player then reads the encrypted master key C from its own memory. On stage S1402, it compares the number with its own generation of the encrypted master key generation number n indicated by the information about the number of n previous generation entry for deciding which of them is younger or older, or with generation n.

If the recording / reproducing device makes a decision in step S1402 that the generation n indicated by the information about the generation number n of the previous record is not younger than the generation from the encrypted master key stored in its own memory, i.e. if the generation from the encrypted master key C stored in the memory is the same or older than the generation n indicated by the generation number n of the previous record, the recorder / player jumps to steps S1403-1408 and exits from the master key update procedure. In this case, since there is no need to update the master key K (c) master (encrypted master key C) stored in the memory of the recording / reproducing device, the update is not performed.

On the other hand, if the recorder / player makes a decision in step S1402 that the generation n indicated by the information about the generation number n of the previous record is younger than the generation c of the encrypted master key C stored in the memory, i.e. if the generation from the encrypted master key C stored in the memory is older than the generation n indicated by the information about the generation number n of the previous record, the recorder / player proceeds to step S1403, where it reads the key update unit from the storage medium.

In step S1404, the recording / reproducing device calculates a key K (t) 00 for node 00 at the time (time t in FIG. 13) indicated by information about the generation number n of the previous record from the key update unit read in step S1403 of the sheet key ( K0000 for device 0 in FIG. 11) and nodal keys (K000 and K00 ... for device 0 in FIG. 11) stored in its memory.

In step S1405, it checks whether the key K (t) 00 is obtained in step S1404. If not, this means that the recording / reproducing device was excluded from the group in the tree structure at this time, and the recording / reproducing device jumps to steps S1406-1408 and leaves the main key update procedure.

If K (t) 00 was received, the recorder / player proceeds to step S1406, where it reads the value derived from the encryption of the master key at time t using Enc (K (t) 00, K (t) master), and it is K (t) 00 read from the information carrier. In step S1407, the recording / reproducing apparatus calculates K (t) master by decrypting the encrypted value with K (t) 00.

In step S1408, the recording / reproducing device encrypts K (t) master with its own leaf key (K0000 for device 0 in FIG. 11) and stores it in memory. Here, the recording / reproducing apparatus exits the master key update procedure.

It should be recalled that the master key is used in increasing order from time (generation) 0, however, each of the devices in the system should preferably be able to obtain, by calculating, the master key of the older generation from the master key of the new generation. Thus, the recording / reproducing device must have a one-way function f and generate the master key in the generation being verified by applying its own master key in the one-way function f the number of times corresponding to the difference between the generation of the master key and the generation of the necessary master key.

In particular, for example, in the case where the generation of the master key MK stored in the recording / reproducing device is generation i + 1, while the generation of the master key MK necessary for reproducing data (used in data recording) is generation i-1 then the recording / reproducing apparatus generates a master key K (i-1) master using two times the one-way function f and computing f (f (K (i + 1) master)).

In the case where the generation of the master key stored in the recording / reproducing apparatus is generation i + 1, while the generation of the necessary master key is generation i-2, the recording / reproducing apparatus generates the master key K (i-2) master with using twice the one-way function f and computing f (f (f (f (K (i + 1) master))).

A one-way function can be, for example, a hash function. In particular, the hash function can be, for example, MD5 (message profile 5), SHA-1 (reliable hash algorithm - 1), or the like. The organization that issues the keys defines the main keys K (0) master, K (1) master, K (2) master, ... K (n) master, with which you can pre-generate a generation older than the current generation, using one-way function. That is, first of all, the key K (N) master of generation N must be installed and a one-way function is applied to the key K (N) master once, due to which the main keys K (N-1) master, K (N -2) master, ..., K (1) master, K (0) master of previous generations. Master keys must be used one after the other, starting with the K (0) master of the earliest generation. It should be noted that it is assumed that the one-way function used to generate the master key of a generation older than the current generation is installed in all recording / reproducing devices.

As a one-way function, for example, public key cryptography can also be used. In this case, the key issuing organization must have a private key, which is based on public key cryptography, and issue a public key corresponding to the private key of each of all recording / reproducing devices. The organization issuing the keys must install the master key K (0) master of generation 0 and use the master keys, starting with the key K (0) master. That is, when the organization issuing the keys needs the main key K (i) master, which is lower than the main key of the first generation, then it will convert the main key K (i-1) master one generation before the key K (i) master using a personal a key for generating a master key K (i) master for use. Thus, the organization issuing the keys does not have to pre-generate the master key of generation N using a one-way function. Using such a key generation path, it is theoretically possible to generate a master key in all generations. It should be noted that if the recording / reproducing device has a master key for one generation, then it is able to convert the master key using a public key to obtain a master key for generations older than this generation.

The following is a description of the operations performed by the recording / reproducing apparatus for recording content into its own storage medium with reference to the graphic diagram shown in FIG. Content data is encrypted with a master key of one generation distributed from the content provider to each of the recording / reproducing devices via a network or storage medium.

First, in step S1501, the recording / reproducing apparatus reads pre-recorded information about generation number n from the storage medium. It receives a generation from the encrypted master key C stored in its own memory. In step S1502, the recording / reproducing device performs a comparison between the generation from the encrypted master key C and the generation n indicated by information about the generation number n of the previous record to determine which generation is younger or older, generation c or n.

If the result of the decision in step S1502 is that the generation from the encrypted master key C is not younger than the generation n indicated by the information about the generation number n of the previous record, namely, if the generation from the encrypted master key C stored in the memory is older, than the generation n indicated by the generation number information n of the previous record, the recording / reproducing apparatus jumps to step S1503, i.e. exits the procedure without writing content data.

On the other hand, if the decision result in step S1502 is that the generation c of the encrypted master key C stored in the memory of the recording / reproducing device is younger than the generation n indicated by the information about the generation number n of the previous record, namely, if the generation with the encrypted master key C stored in the memory is the same or earlier than the generation n, the above number information n previous generation recording, the recording / reproducing device proceeds to step S1503, where it is recorded content data.

[Encryption and recording of content data using a generation-controlled master key]

The following is a description of a procedure for encrypting content data using a generation-controlled master key and storing data in a storage medium in a recording / reproducing device. It should be noted that the block key is generated based on data including the generation-controlled master key, and the content data generated from the transport stream, as mentioned above, is encrypted with the block key and stored in the storage medium, as will be described below. In addition, two examples will be given: one in which data recorded in the storage medium by one recording / reproducing device can be reproduced in another reproducing device, and the other in which data cannot be reproduced in another reproducing device.

The following is a description with reference to the flowcharts of FIGS. 16 and 17 and the graphic diagram of FIG. 18. As an information carrier, an optical disk is subsequently adopted. In this embodiment, to prevent copying bit by bit of the data recorded in the storage medium, the disk identifier, as unique identification information for the storage medium, acts as a data encryption key.

First, a description is given of data encryption using a cryptographic unit 150 with reference to the flowcharts in FIGS. 16 and 17.

The recording / reproducing device 1600 reads the master key 1601, the device identifier 1631, and the device unique key 1632 stored in its own memory 180 (see FIGS. 1 and 2). The master key 1601 is a private key stored in a licensed recording / reproducing device. It is managed in accordance with the generation, as described above, and has a corresponding number. The master key is a shared key for a plurality of recording / reproducing devices, namely, for example, for devices surrounded by a dashed circular line in FIG. 11. A device identifier is an identifier for a recording / reproducing device 1600. This identifier is, for example, a sequence number previously stored in the recording / reproducing device. The device ID can be opened. A device-unique key is a private key unique to a recording / reproducing device 1600. It is set with a change from one recorder / player to another. These keys are stored in the memory of the device 1600 recording / playback.

The recording / reproducing apparatus 1600 checks whether the disc identifier 1603 is already recorded as identification information in the storage medium 1620, which is, for example, an optical disc. If it is determined that the disc identifier 1603 is recorded in the storage medium 1620, then the recording / reproducing apparatus 1600 reads it (as shown in FIG. 16). If not, then the recording / reproducing apparatus 1600 generates a disk identifier 1701 randomly or using a predetermined random number generation method, for example, using a cryptographic unit 150, and writes the identifier to the disk (as shown in FIG. 17). For each disk, only one such identifier (1603) of the disk must be available. So the disk identifier can be stored in the input zone or the like. drive.

Then, the recording / reproducing apparatus 1600 generates a disc-unique key 1602 from the master key and the disc identifier (as indicated at 1602). As shown in FIG. 19, a key unique to the disk is generated using one of the following two methods. Namely, in one method (example 1), the main key and disk identifier are substituted into the hash function using the block encryption function and the substitution result is used. In another method (example 2), data that is derived from combining bit by bit of the master key and disk identifier is substituted into the SHA-1 hash function defined in FIPS 180-1 to provide 160 bits and only data of the required length of 160 is used bit output.

Then, a unique title key is generated for each record (as indicated in position 1604) according to a random law or using the specified method of generating random numbers in cryptographic unit 150 (see Figs. 1 and 2), and is written to disk 1620.

In addition, a flag is set that indicates which titles (data) can be played back only in the recording / reproducing device that recorded the data (a restriction of the playback device is set), or that the data can also be played back in any other recording / reproducing device (restriction of the playback device not set), namely the restriction flag of the playback device (as shown at 1633), and is written to disk 1620 (as shown at 1635). In addition, the recording / reproducing device 1600 extracts the device identifier as device identification information (as shown at 1631) and writes it to the disk 1620 (as shown at 1634).

Additionally, the recording / reproducing apparatus 1600 obtains the master key generation number / which it uses, namely the generation number (record generation number n) of the master key stored in its own memory (as shown at 1650), and stores it as numbers 1651 generation records in the medium (disk) 1620 information.

The disk has a data management file in which information is stored, which title is formed from the data and where the data is from, and in which the title key 1605, the playback device restriction flag 1635, the device identifier 1634 and the master key generation number 1651 (recording generation number n) can be stored .

It should be noted that the storage medium 1620 has a generation number of a previous record previously recorded therein, and only content encrypted with a master key of a generation younger or the same as the generation number of the previous record stored in the storage medium 1620 can be reproduced. A description of this system will be given below in the description of data reproduction.

Then a unique title key is generated either from a combination of a key unique to the disk, a title key and a device identifier, or from a combination of a key unique to the disk, a title key and a key unique to the device.

Namely, in the case when there is no restriction for the playback device, a unique title key is generated from a unique key for the disk, title key and device identifier. On the other hand, when a restriction is set for the playback device, a unique title key is generated from a key unique to the disk, a title key and a key unique to the device.

In particular, a unique title key is generated as in Example 1 or Example 2 shown in FIG. In example 1, the title key, a unique key for the disk and device identifier (when the restriction of the playback device is not set), or a unique key for the device (when the restriction of the playback device is set) are inserted into a hash function based on the block encryption function, and the substitution result is used as a unique title key. In Example 2, data generated by combining bit by bit of the master key, disk identifier, and device identifier (when the restriction for the playback device is not set) or a key unique to the device (when the restriction for the playback device is set) is inserted into the SHA-1 hash function defined in FIPS 180-1, and from the output data of 160 bits obtained as a result of the substitution, the required data length is used as a unique title key.

As mentioned above, a key unique to a disk is generated from the master key and a disk identifier, and then a unique title key is generated from a key unique to the disk, title key and device identifier, or from a title key and a key unique to the device. However, it should be noted that a unique title key can be generated directly from the master key, disk identifier, title key and device identifier, or a key unique to the device without using a key unique to the disk, or the key equivalent to the unique title key can be generated from the master key, identifier drive and device identifier (when the restriction for the playback device is not set) or a unique key for the device (when restrictions are set playback device) without using the title key.

It should be recalled that in the case of using one of the transmission formats defined, for example, in the above 5CDTCP standard, data is transmitted in some cases in the form of MPEG-2 TS packets. When, for example, a set-top box that has received satellite broadcasts transmits broadcast to the recorder using the 5CDTCP transmission format, the set-top box should preferably transmit, also on the IEEE 1394 serial bus, MPEG-2 TS packets transmitted along the satellite broadcast path, since it is not required data conversion.

The recording / reproducing apparatus 1600 receives the content data to be recorded as TS packets and the TS processor 300 attaches an entry time stamp to each TS packet, which is information indicating the time at which the TS packet was received. It should be noted that, as mentioned above, the initial block number attached to the block data may consist of a combination of an entry time stamp, copy control information, and other information.

The number X (for example, X = 32) of the TS packets, to each of which an entry time stamp is attached, are adjacent to each other to form one data block (as shown at the top of FIG. 5). As shown in the lower parts of FIGS. 16 and 11, bytes 1-4 in the initial part of the block data filed for encryption are separated (in a selector 1608) to provide an initial block number including an input time stamp of 32 bits. A block key is generated, which is the encryption key for the data in the block (as shown in position 1607), from the initial number of the block and the previously generated unique title key.

On Fig shows an example of generating a block key. FIG. 22 shows two examples of generating a block key of 64 bits from an initial block number of 32 bits and a unique title key of 64 bits.

In Example 1, shown in the upper half of FIG. 22, an encryption function is used, the key length of which is 64 bits, and the input and output are 64 bits, respectively. A unique title key is used as the key for this function, a combination of the initial number of the block and a constant of 32 bits is substituted into the encryption function, and the substitution result is accepted as a block key.

Example 2 uses the SHA-1 hash function defined in FIPS 180-1. The combination of a unique title key and the initial block number is substituted into the SHA-1 hash function, and the output from 160 bits is reduced to 64 bits when, for example, only the lower 64 bits are used. These 64 bits are used as a block key.

The above is a description of examples of generating a block key in which a key unique to the disk, a unique title key, and a block key are generated. However, a block key can be generated from a master key, a disk identifier, a title key and a block starting number for each block and a device identifier (when the playback device restriction is not set) or a device unique key (when the playback device restriction is set) without generating a disk-unique key and unique title key.

The block key generated in this way is used to encrypt the block data. As shown in the lower parts of FIGS. 16 and 17, bytes 1-m (for example, m = 8) in the initial part of the block data, including the initial number of the block, are separated (in the selector 1608) so as not to be encrypted, but the bytes from (m + 1) are encrypted to the last (as shown at 1609). It should be noted that m bytes that are not encrypted include the first to fourth bytes as the starting number of the block. Bytes from m + 1 and further data of the block allocated in the selector 1608 are encrypted (as shown in position 1609) in accordance with the encryption algorithm specified in the cryptographic unit 150. The encryption algorithm may be, for example, DES (data encryption standard) defined in FIPS 46-2.

When the length of the block (the size of the input / output data) in the encryption algorithm used is 8 bytes, as in DES, then all the data of the block, including bytes (m + 1) and the following without a remainder, can be encrypted, for example, at X = 32 and m is a multiple of 8.

Namely, in the case when X TS packets are stored in one block, the size of the input / output data of the encryption algorithm is L bytes, and n is an arbitrary natural number defining X, m and L so that 192 * X = m + n * L, which makes the processing of the residue unnecessary.

The encrypted bytes (m + 1) and further data of the block are combined with the first non-encrypted bytes 1-m of the data of the block using the selector 1610 and stored as encrypted content 1612 in the storage medium 1620.

Using the above operations, the content is encrypted block by block with a block key generated from the initial number of the block, including the generation-controlled master key and the entry time stamp, and stored in the storage medium.

As indicated above, since the content data is encrypted with a generation-controlled master key and stored in the storage medium, the data can be decrypted or the storage medium can be reproduced in any other recording / reproducing device only when the generation of the other recording / reproducing device is at least the same as a generation of a recording / reproducing device that recorded content data in a storage medium or younger than a generation of a master key used in recording content data.

When the restriction of the playback device is not set, the block key is generated based on the identifier of the device. On the other hand, when the restriction of the playback device is set, the block key is generated based on the key unique to the device. When the restriction of the playback device is set, the playback data can only be played back in that recording / reproducing device that recorded the data.

Namely, when the restriction for the reproducing device is not set, the block key, which is the key to use for encrypting the block data, is generated from the data including the device identifier, and the device identifier is stored in the storage medium. Therefore, a playback device that intends to reproduce content from the storage medium can obtain a device identifier from the storage medium installed therein, and thus generates a similar block key. Thus, the block data can be decrypted. However, when a restriction is set for the playback device, the block key, which is the key to use for encrypting the block data, is generated from data including a key unique to the device. Since this device-unique key is a private key that changes from one device to another, it cannot be obtained by another device. In the case when the data of the block is encrypted to be stored in the storage medium, the data are not written to the storage medium having a key unique to the device stored in it. Therefore, since the same key unique to the device cannot be obtained even if the storage medium having the encrypted block data stored in it is installed in another playback device, an encryption key for decrypting the data block cannot be generated, and thus the data blocks cannot be decrypted for playback. It should be noted that playback operations will be further described below.

Below with reference to FIG. 18, a description will be made of the sequence of operations performed in the TS processor 300 for attaching the entry time stamp, and the sequence of operations performed for encryption in the cryptographic unit 150 when recording data. In step S1801 of FIG. 18, the recording / reproducing device reads a master key, a device identifier that identifies the recording / reproducing device, and a device-unique key stored in its own memory 180.

In step S1802, the recording / reproducing apparatus checks whether the disc identifier is already recorded as the identification information in the storage medium. If it is determined that it has been recorded, the recording / reproducing apparatus reads out the disc identifier in step S1803. If not, the recording / reproducing apparatus generates a disc identifier according to a random law or using a predetermined method, and writes it in step S1804 to the disc. Then, in step S1805, the recording / reproducing apparatus generates a unique key for the disc from the master key and the disc identifier. A key unique to the disk is generated using, for example, the SHA-1 function defined in FIPS 180-1, or a hash function based on the block encryption function, as mentioned above.

In step S1806, the recording / reproducing apparatus retrieves a title key unique to each record, a restriction flag of the reproducing apparatus, a device identifier that is identification information for the apparatus, and a generation number of the master key and writes them to a disc. Then, in step S1807, the recording / reproducing device generates a unique title key from a disk-unique key, a title key and a device identifier (when the restriction for the reproducing device is not set) or a key unique to the device (when the restriction for the reproducing device is set).

On Fig shows a sequence of operations performed when generating a unique title key. At step S2001, the cryptographic unit 150 determines whether the restriction of the playback device should be set based on the instruction data entered by the user of the recording / reproducing device, or restricting the use of information attached to the content.

If the result of the determination made in step S2001 is No, namely, if no restriction has been set for the playback device, the recording / reproducing device proceeds to step S2002, where it generates a unique title key from the drive’s unique key, title key and device identifier .

If the result of the determination made in step S2001 is Yes, namely, if a restriction is set for the playback device, the recording / reproducing device proceeds to step S2003, where it generates a unique title key from a key unique to the disk, a title key and unique to the device a key using the SHA-1 hash function or a hash function based on the block encryption function.

In step S1808, the recording / reproducing apparatus receives the data to be re-encrypted of the content data to be recorded in the form of TS packets. In step S1809, the TS processor 300 attaches an entry time stamp to each TS packet, which is information indicating the time at which the packet was received. Alternatively, the TS processor 300 attaches to each TS packet a combination of copy control information, entry time stamp and other information. Then, in step S1810, the recording / reproducing apparatus receives TS packets, one after the other, an entry time stamp attached to each of them, and determines whether the number X (for example, X = 32) of TS packets forming one block or identification data indicating that the last packet has been accepted. When one of the above conditions is met, the recorder / player proceeds to step S1811, where it locates X TS packets or TS packets up to the last adjacent to each other to form one data block.

Then, in step S1812, the cryptographic block 150 generates a block key, which is the key for encrypting data in the specified block, from 32 bits (the initial number of the block including the entry time stamp) in the initial part of the block data and the unique title key generated in step S1807.

In step S1813, the block data generated in step S1811 is encrypted with a block key. As mentioned above, bytes (m + 1) to the last byte in the block data are encrypted. The encryption algorithm is, for example, DES (data encryption standard) defined in FIPS 46-2.

At step S1814, the encrypted block data is recorded in the storage medium. At step S1815, it is determined whether or not all data has been recorded in the storage medium. When all the block data is recorded, the recorder / player exits the recording procedure. If not, the recording / reproducing apparatus returns to step S1808, where it processes the remaining data.

[Decryption for reproducing recorded data using a master key with controlled generation]

Below, with reference to the flowchart of FIG. 23 and the flowchart of FIGS. 24-26, a description of operations performed for decryption to reproduce encrypted content recorded in the storage medium as described above is described.

A description of the sequence of operations performed during decryption and reproduction is given with reference to the flowchart of FIG. 23 and the graphic diagram of FIG. 24. In step S2401 of FIG. 24, the recording / reproducing device 2300 reads the disc identifier 2302 and the generation number of the previous record from the disc 2320, the master key 2301, the device identifier 2331 as the device identifier, and the device unique key 2332 from its own memory. As follows from the preceding description of the recording procedure, the disc identifier is an identifier unique to the disc recorded previously in the disc, or an identifier generated by the recording / reproducing device and recorded in the disc.

The generation number 2360 of the preceding record is generation information unique to the disc as a storage medium. The generation number of the preceding recording is compared with the generation number of the master key with which the data was recorded, namely, the recording generation number 2350, to decide whether the data can be reproduced. The master key 2301 is a private key stored in a licensed recording / reproducing device, the generation of which is managed. The device identifier is an identifier unique to the recording / reproducing device, and the key unique to the device is a private key unique to the recording / reproducing device.

Then, in step S2402, the recording / reproducing device 2300 reads the title key for data to be read from the disc, as well as the identifier of the recording / reproducing device that recorded the data, the playback device restriction flag set in accordance with the data, and the generation number (Generation No.) the master key used to write data, i.e. 2350 generation record number. Then, in step S2403, the recording / reproducing apparatus determines whether the data to be read can be reproduced. The sequence of operations for making this decision is shown in detail in FIG.

In step S2501 of FIG. 25, the recording / reproducing apparatus determines whether it is younger or older, the generation of the previous recording read in step S2401, or the number of the recording generation read in step S2402. In the case where the decision result shows that the generation indicated by the generation number of the record is not younger than the generation indicated by the generation number of the previous record, i.e. if the generation indicated by the generation information of the data recording is older than the generation indicated by the generation information of the previous recording, the recording / reproducing apparatus decides that the data cannot be reproduced, and jumps through steps S2404-2409 and exits the procedure without reproducing data . Therefore, in the case when the content recorded in the storage medium was encrypted with a master key, the generation of which is older than the generation indicated by information about the previous recording, then data is not allowed to be reproduced and reproduction is not performed.

Thus, the above procedure serves to make the decision that the data encrypted and recorded in the storage medium using an old-generation key by a recording device that did not receive the key of the latest generation, since its illegality was revealed, and to prohibit the reproduction of any storage medium, into which data was recorded by such an illegal recorder. Thus, it is possible to exclude the use of an illegal recording device.

On the other hand, when the decision result in step S2501 shows that the generation indicated by the generation number of the record is younger than the generation indicated by the generation number of the previous record, namely, if the generation indicated by the generation information of the data recording is the same or more younger than the generation indicated by the generation information of the previous record, and therefore the contents recorded in the storage medium were encrypted with a master key, the generation of which is younger than the reinforcement indicated by the generation number of the previous recording, the recording / reproducing apparatus proceeds to step S2502, where it receives the generation information of the encrypted master key C stored in its own memory and compares between the generation of the encrypted master key and the generation indicated by the generation information encryption, to decide which generation is younger or older than the other.

If the decision result in step S2502 indicates that the generation of the master key C stored in the memory is not younger than the generation indicated by the generation information of the recording, namely, if the generation of the master key C stored in the memory is older, than the generation indicated by the generation information of the recording, the recording / reproducing apparatus decides that the contents cannot be reproduced, jumps to steps S2404-2409 and exits the procedure without reproducing the contents.

If the decision result in step S2502 shows that the generation of the master key C stored in the memory is younger than the generation indicated by the recording generation information, i.e. if the generation of the master key C is the same or younger than the generation indicated by the generation information of the recording, the recording / reproducing apparatus proceeds to step S2503, where it checks whether the data it intends to read is recorded in the restriction mode of the reproducing apparatus.

In step S2503, the recording / reproducing apparatus determines whether the restriction information of the reproducing apparatus indicated by the restriction flag of the reproducing apparatus means that “Restriction of the reproducing apparatus is set”. If it is determined that “Restriction of the playback device is set”, the recording / reproducing device proceeds to step S2504, where it determines whether the condition “Device ID read from the storage medium matches the ID of the playback device itself” is satisfied. If there is a match, the recording / reproducing device decides that the data in question can be reproduced. If the restriction information of the playback device indicated by the restriction flag of the playback device indicates that “Restriction of the playback device is set”, and when “The device identifier read from the storage medium does not match the identifier of the playback device itself,” the recording / reproducing device makes a decision that data cannot be played.

If the decision result shows that data can be reproduced, the recorder / player proceeds to step S2404, where it generates a unique key for the disk from the disk identifier and the master key (as shown at 2303), as described below. The data obtained by combining the bit by bit of the master key and the disk identifier is, for example, inserted into the SHA-1 hash function defined in FIPS 180-1, and only the required data length from the output is 160 bits long, obtained as a result of substitution, Used as a key unique to the disk. As an alternative solution, the master key and disk identifier are substituted into a hash function that uses the block encryption function, and the substitution result is used as a key unique to the disk. The master key used in this case is the key read from the storage medium in step S2402, and the generation of which is indicated by the generation number of the data record. If the recording / reproducing device has a master key, the generation of which is younger than the master key generation, then it can generate using any method described above the generation master key indicated by the recording generation number, and additionally generate a key unique to the disk using the generated key image of the master key.

Then, in step S2405, the recording / reproducing device generates a unique title key, as described below with reference to FIG. In step S2601, the cryptographic unit 150 determines whether or not the restriction of the reproducing apparatus is set based on the restriction flag of the reproducing apparatus read from the disc. If the playback device restriction information indicated by the read playback device restriction flag 2335 indicates that “Playback device restriction is set” and “Device identifier 2334 read from the storage medium matches the identifier 2331 of the playback device itself”, or if the playback device restriction information indicated by flag 2333 of the restriction of the playback device, indicates that the "Restriction of the playback device is not set", then the data but play. If the playback device restriction information indicated by the playback device restriction flag 2333 indicates that “Playback device restriction is set” and “Device identifier 2334 read from the storage medium does not match the identifier 2331 of the playback device itself,” the data cannot be reproduced.

The reason the data cannot be reproduced is because the block key for decrypting the data cannot be generated because the data was encrypted with the block key generated from the device’s unique key for the data recording / reproducing device and the recording / reproducing device other than the recording / reproducing device that recorded the data do not have the same key unique to the device.

If it is possible to reproduce data, a unique title key is generated from a combination of a key unique to the disk, a title key and a device identifier, or a combination of a key unique to the disk, a title key and a key unique to the device.

Thus, when the restriction of the playback device is not set, a unique title key is generated from the unique key for the disk, title key and device identifier. When the restriction of the playback device is set, then a unique title key is generated from a key unique to the disk, a title key and a key unique to the playback device itself. To generate a unique title key, you can use the SHA-1 hash function or a hash function based on the block encryption function.

The description below is given with reference to the graphic diagram shown in FIG. If the decision result in step S2601 is No, namely, if the restriction of the playback device is not set, then the recording / reproducing device proceeds to step S2602, where it generates a unique title key from a drive-unique key, title key and device identifier.

If the decision result in step S2601 is Yes, namely, if the restriction of the playback device is set, then the recording / reproducing device proceeds to step S2603, where it generates a unique title key from a key unique to the disk, a title key and a key unique to the device using SHA-1 hash functions or a hash function based on the block encryption function.

As mentioned above, a key unique to a disk is generated from a master key and a disk identifier, and a unique title key is generated from a combination of a key unique to a disk, a title key and a device identifier, or from a combination of a title key and a device-unique key. However, a unique title key can be generated directly from the master key, disk identifier, title key or device identifier or a device-unique key without using a key unique to the disk, or you can generate a key equivalent to a unique title key from the master key, disk identifier, and device identifier ( when the restriction of the playback device is not set) or a key unique to the device (when the restriction of the playback device is set Ia) without using the title key.

Then, in step S2406, the recording / reproducing device reads the data of the block of encrypted content 2312 from the disk by priority, separates in step S2407 the initial block number of 4 bytes in the front of the block data in the selector 2310, and generates a block key from the block starting number and unique title the key generated in step S2405.

The block key can be generated in accordance with the above with reference to Fig.22. That is, a block key of 64 bits can be generated from an initial block number of 32 bits and a unique title key of 64 bits.

Above, a description was given of generating a unique key for a disk, a unique title key, and a block key. However, it should be noted that a block key can be generated for each block from the master key, disk identifier, title key, initial block number and device identifier (when the playback device restriction is not set) or a key unique to the device (when the playback device restriction is set) without generating a unique key for the disk and a unique title key.

At step S2408, the encrypted block data is decrypted with the block key thus generated (as shown at 2309) and output as decrypted data to the selector 2308. It should be noted that the decrypted data includes an entry time stamp attached to each of the transport packets included in the transport the stream, and the stream is processed based on the entry time stamp in the specified TS processor 300. After that, the data can be used, for example, to display an image or to play music.

Thus, the content encrypted by the blocks and stored in the storage medium can be decrypted for playback using the block key generated from the initial number of the block, including the entry time stamp, in blocks. The recording / reproducing apparatus decrypts the encrypted data of the block and, in step S2409, determines whether all the data has been read. If all the data has been read, the recorder / player exits the procedure. If not, the recording / reproducing apparatus returns to step S2406, where it reads the remaining data.

[Processing using a media key valid only for a storage medium]

In the above embodiment, the key update unit is used to transmit the master key to each recorder / player, and this master key is used to record or play back data from or to the recorder / player.

The master key is valid for each data record in its generation. The recording / reproducing device that has received the master key of the generation can decrypt the data that was recorded in this generation and in the earlier generation in the system to which the recording / reproducing device belongs. However, since the nature of the master key is such that it is valid for the entire system, the successful discovery of the master key by any attacker negatively affects the entire system.

However, as the key to be transmitted using the media key update unit, you can use a media key that is valid only for the media, and not the master key, valid for the entire system. The following is a description of using a media key instead of a master key (second embodiment). However, it should be noted that only the differences of the second embodiment from the above first embodiment will be described.

Similarly to FIG. 13, FIG. 27 shows the use by the device 0 at time t of the key update unit stored in the information medium of the sheet key K0000 previously recorded therein and the key keys K000 and K00 to generate the updated key key K (t) 00, and obtaining a new key K (t) media based on the updated node key K (t) 00. The K (t) media key is used when recording and playing back data to and from the storage medium.

It should be noted that the generation number n of the preceding record, shown in FIG. 27, is not necessarily necessary, but is given as an option, since the media key does not have a generation younger or senior, as is the case for the master key.

For example, when a storage medium is installed in each recording / reproducing device for recording or reproducing data, the recording / reproducing device calculates a key K (t) media for the storage medium and uses it for subsequent access to the storage medium, as shown in the graphical diagram in FIG. .28.

The reading of the key update unit in step S2801 and the processing of the key update unit in step S2802 in FIG. 28 are similar to the operations performed in steps S1403 and 1404 in FIG.

At step S2803, the recording / reproducing device reads the encrypted data Enc (K (t) 00), K (t) media) derived from the encryption of the key K (t) media with the node key K (t) 00 from the storage medium, and encrypts the data in step S2804 to obtain a media key. If the recording / reproducing device is excluded or withdrawn from the group in the tree structure shown in FIG. 11, then it cannot receive the media key and thereby cannot record or reproduce data from the information medium.

The following is a description of writing data to a storage medium. However, since the media key does not have the concept of a generation younger or older as a master key, it is impossible to verify whether or not to record data by comparing generations of generation information of a previous recording and a master key stored in the recording / reproducing device itself, as shown on Fig, and it is necessary to determine if the media key is obtained using the above processing, whether it is possible to record data using the sequence of operations shown in Fig.29. As shown in the graphical diagram in FIG. 29, it is determined in step S2901 whether the media key is received, and only when the media key is received, the contents are recorded in step S2902.

[Recording data using a media key valid only for a storage medium]

The following is a description of the recording of content data with reference to the flowcharts in FIGS. 30 and 31 and the graphic diagram in FIG.

As in the first embodiment, in this second embodiment, the storage medium is an optical disk. In addition, for the second embodiment, it is true that to prevent copying bit by bit of data from the storage medium, the disk identifier, as identification information unique to the storage medium, is used as a key for encrypting data.

FIGS. 30 and 31 are similar to FIGS. 16 and 17 for the first embodiment, except that the media key is used instead of the master key and the recording generation number indicating the generation of the master key is not used. The difference between FIGS. 30 and 31 is similar to the difference between FIGS. 16 and 17, and it refers to a disc identifier record. Namely, when recording the data shown in FIG. 30, the disc identifier is not recorded, while when recording the data shown in FIG. 31, the disc identifier is recorded.

FIG. 32 shows a data record in this embodiment in which a media key is used. Namely, the block diagram in FIG. 32 corresponds to a graphical diagram for the first embodiment shown in FIG. The following is a description of basically the differences between the operations shown in FIG. 32 and those performed in the first embodiment.

In step S3201 in FIG. 32, the recording / reproducing apparatus 3000 reads the device identifier and a device-unique key stored in its own memory, as well as the K (t) media key computed and stored earlier in step S2804 in FIG. 28.

In step S3202, the recording / reproducing apparatus 3000 checks whether the disc identifier is already stored in the information medium 3020 (optical disc). If the disc identifier is already stored, then the recording / reproducing apparatus 3000 reads the disc identifier in step S3203 (as in FIG. 30). If the disc identifier is not stored, then the recording / reproducing apparatus 3000 generates a disc identifier randomly or using a predetermined method and writes it to the disc in step S3204 (as in FIG. 31). Only one drive identifier must be available per drive. Thus, the disc identifier can be stored in the input area or the like. drive. In any case, the recording / reproducing apparatus 3000 proceeds to step S3205.

In step S3205, the recording / reproducing apparatus 3000 uses the master key and the disc identifier read in step S3201 to generate a key unique to the disc. A key unique to the disk can be generated using the media key instead of the master key, in the same way as in the first embodiment.

Then, the recording / reproducing apparatus 3000 proceeds to step S3206, where it generates a title key unique to each recording, randomly or using a predetermined method, and writes it to a disc. At the same time, the device 3000 writes to the disc the restriction flag of the playback device as information indicating whether it is possible to play the title (data) only in the device that recorded them (when the restriction of the playback device is set), or can be played on any other device ( when the restriction of the playback device is not set), and the device ID of the recording / reproducing device 3000 itself.

The disk has a data management file in which information is stored about which title is formed from which data and where the data is from, and in which the title key, the playback device restriction flag and the device identifier can be stored.

The operations in steps S3207-3215 are similar to the operations performed in steps S1807-1815 in FIG. 18, therefore, their description is not repeated.

It should be noted that it was indicated above that a key unique to a disk is generated from a media key and a disk identifier, and a unique title key is generated from a key unique to a disk, a title key and a device identifier, or from a title key and a device unique key, however a unique title key can be generated directly from a media key, disk identifier, title key and device identifier or a device-unique key without using a device-unique key, and you can generate a key equivalent to a unique title key from the media key, disk identifier and device identifier (when the restriction of the playback device is not set) or unique to the device key (when the restriction of the playback device is set) without using the title key.

The media key can be used, as described above, to write data to the storage medium.

[Reproduction of data using a media key valid only for a storage medium]

The following is a description of the reproduction of data recorded as described above with reference to the flowchart of FIG. 33 and the graphical diagram of FIG. 34.

FIG. 33 is similar to FIG. 23 for the first embodiment, except that a media key is used in place of the master key, and the recording generation number is not used.

In step S3401 in FIG. 34, the recording / reproducing apparatus 3000 reads the disc identifier from the disc 3420, which is the storage medium, and the identifier of the device unique to the device itself, a key unique to the device, which is a key unique to the device itself, and a media key calculated and temporarily stored earlier in step S2804 in FIG. 28, from its own memory.

It should be noted that if the recording / reproducing device 3400 cannot obtain a media key even after performing the operations shown in FIG. 28 with a storage medium inserted therein, it exits the procedure without attempting to reproduce any data.

Then, in step S3402, the recording / reproducing device 3400 reads a title key for data to be read from the disk, a device identifier for the data recording device, and a playback device restriction flag for data.

Then, in step S3403, the recording / reproducing device 3400 determines whether data can be reproduced. The operations performed in step S3403 are shown in detail in FIG. 35.

In step S3501, the recording / reproducing device 3400 determines whether a media key can be obtained. If the media key cannot be obtained, then the data cannot be reproduced. If the media key can be obtained, then the device 3400 recording / playback goes to step S3502. The operations performed in steps S3502 and 3503 are similar to those performed in steps S2503 and 2504 in FIG. 25. When the restriction flag of the playback device indicates that “Restriction of the playback device is set”, as well as a device key for the device that reads the data read from the storage medium in step S3503 and a device identifier for the recording / reproducing device 3400 read from the memory in step S3401, together mean that "The device that recorded the data is not a playback device", the recording / reproducing device 3400 decides that the "Data cannot be played" jumps over S3404-3409 of the stage and out of the procedure without reproducing the data. In any other case other than the above, the recording / reproducing device 3400 decides that “Data can be reproduced”, and proceeds to step S3404.

The operations performed in steps S3404-3409 are similar to those performed in steps S2404-2409 in FIG. 29, and therefore, their description will not be repeated.

It should be noted that in the above description, a key unique to a disk is generated from a media key and a disk identifier, and a unique title key is generated from a key unique to a disk, a title key and a device identifier, or from a title key and a key unique to a device, however a unique title key can be generated from a media key, a disk identifier, a title key and a device identifier or a device unique key without using a device unique key, and You can generate a key equivalent title-unique key from the media key, disc ID and the device identifier (not a limitation when reproducing device) or the device unique key (when the restricted playback device) without using the title key.

Data can be recorded in the storage medium and reproduced from the storage medium in the above manner.

[Saving the recording / reproducing apparatus of the key update unit (KRB) in the storage medium]

It should be recalled that in the example shown and described above, the key update unit is previously stored in the information carrier, however, the recording / reproducing device 3600 can record the key update unit that it received from any other device via the input / output interface 120 or 140 , modem 3601 or the like, in the storage medium upon first recording of data in the storage medium or upon each recording of data in the storage medium, as shown in FIG.

That is, for example, in the first embodiment, the recording / reproducing device can be configured to receive in advance a key update unit and a master key encrypted with nodal keys via an input / output interface 120 or 140, a modem 3601, or the like. and storing them in its own memory 180, as shown in FIG. 37, and then processing the data when writing content data to the storage medium, as shown in the graphical diagram in FIG. 38.

Below, a description is made with reference to Fig. 38. In step S3801, the recording / reproducing device checks whether the key update unit has already been recorded in the storage medium to which data is to be recorded. If it is determined that the key update unit has already been recorded in the storage medium, the recorder / player jumps to step S3802 and exits the procedure (proceeds to the data recording procedure). If, as a result of the check, it is established that the key update unit is not recorded in the storage medium, the recording / reproducing device proceeds to step S3902, where it writes the key update unit and the encrypted master key stored in its own memory 180 to the storage medium as shown in Fig. 39. After completing this recording, the recorder / player proceeds to record the content data.

The specified method is not limited to recording data using a master key, but can be used to record data using a media key, as in the second embodiment.

[Copy control when recording data]

To protect the profit of the copyright holder, a licensed device must manage the copying of content.

That is, when writing content to a storage medium, it is necessary to check whether or not to copy the contents, and only write data that can be copied. In order to reproduce content from the storage medium and output data, it is also necessary to protect the content from illegal copying in the future.

The following is a description of the operations of the recording / reproducing apparatus shown in FIGS. 1 and 2 for recording or reproducing such content while controlling copying with reference to the graphic circuits shown in FIGS. 40 and 41.

First, to record the external contents of digital signals in a storage medium, write operations are illustrated, illustrated in the graphical diagram shown in FIG. 40A. The following is an example of a description of the operations in FIG. 40A with respect to the recording / reproducing apparatus 100 shown in FIG. The input / output interface 120 receives, in step S4001, the contents of the digital signals (digital content) via the IEEE 1394 serial bus or the like, and the recording / reproducing apparatus proceeds to step S4002.

In step S4002, the input / output interface 120 determines whether the supplied digital content can be copied. That is, in the case where the content received by the input / output interface 120 is not encrypted (for example, open or non-encrypted content is supplied to the input / output interface 120 without applying the above DTCP standard), it is decided that the content can be copied.

In this case, it is assumed that the recording / reproducing apparatus 100 is a DTCP compliant device and records data in accordance with the DTCP standard. The DTCP standard defines a 2-bit copy mode indicator (EMI) as copy control information. When the copy mode indicator is 00V (B indicates that the preceding value is a binary number), this means that the contents can be freely copied (free copy). When the copy mode indicator is 01V, this means that the contents cannot be copied beyond the specified limit (limited copying). In addition, when the copy mode indicator is 10V, this means that the contents can be copied once (single copy). When the copy mode indicator is 11V, it means that the contents are prohibited for copying (forbidden copying).

The signals supplied to the input / output interface 120 of the recording / reproducing device 100 comprise a copy mode indicator. When the copy mode indicator means “free copy” or “single copy”, it is decided that the contents can be copied. On the other hand, when the copy mode indicator means “limited copying” or “forbidden copying”, it is decided that the contents cannot be copied.

If the result of the decision in step S4002 is that the content cannot be copied, then the recording / reproducing apparatus 100 skips steps S4003-4005 and exits the recording procedure. Therefore, in this case, the content is not copied to the storage medium 195.

If the result of the decision in step S4002 is that the content can be copied, then the recording / reproducing apparatus 100 proceeds to step S4003. Then, in steps S4003-4005, the recording / reproducing apparatus 100 sequentially performs operations similar to those in steps S302, 303, and 304 of FIG. 3A. That is, the TS processor 300 attaches an entry time stamp to each TS packet included in the transport stream, the cryptographic unit 150 encrypts the data, and the encrypted data from the cryptographic unit 150 is recorded in the storage medium 195. Here, the recording / reproducing apparatus exits the recording procedure.

It should be noted that the copy mode indicator is included in the digital signals supplied to the input / output interface 120. In the case where digital content is recorded in the storage medium 195, a copy mode indicator or information indicating a copy control status similar to a copy mode indicator (for example, included copy control information defined by the DTCP standard or the like) is recorded together with the digital content .

Typically, information indicating a one-time copy is converted to “limited copy” and recorded to prohibit copying beyond a specified limit.

The recording / reproducing apparatus of the present invention records copy control information, such as a copy mode indicator (EMI), included copy control information (CCI), i.e. attached to TS packets. That is, as in Examples 2 and 3 of FIG. 10, 32 bits are attached to each TS packet, including 24-30 bits of the travel time stamp and copy control information, as shown in FIG. 5.

To record the external contents of the analog signals into the storage medium, a recording procedure is performed, represented by the graphical diagram in FIG. 40B. The following is a description of the recording procedure shown in FIG. 40B. The content of the analog signals (analog content) is supplied in step S4011 to the input / output interface 140. Then, the recording / reproducing apparatus proceeds to step S4012, where it determines whether it is possible to copy the received analog content.

At step S4012, a decision is made based on whether or not the signals received by the input / output interface 140 contain a Macrovision signal and a CGMS-A signal (copy quantity control system for analog signals). When recording VHS tape on a tape, the Macrovision signal is noise. If the Macrovision signal is included in the signals received by the input / output interface 140, then a decision is made that the analog content cannot be copied.

The CGMS-A signal is a CGMS signal used to control the copying of digital signals, and is used to control the copying of analog signals. He indicates that the contents can be freely copied or copied once or cannot be copied (free copying, single copying and forbidden copying).

Therefore, if the CGMS-A signal is included in the signal received by the input / output interface 140 and means “free copy” or “one-time copy”, then it is decided that the analog content can be copied. When the CGMS-A signal means “forbidden copying”, it is decided that the analog content cannot be copied.

In addition, when neither Macrovision nor the CGMS-A signal is included in the signals received by the input / output interface 140, it is decided that the analog content can be copied.

If it is decided in step S4012 that the analog content cannot be copied, then the recording / reproducing apparatus 100 jumps through steps S4013-4017 and leaves the recording procedure. Therefore, in this case, the content is not recorded in the storage medium 195.

If it is determined in step S4012 that the analog content can be copied, the recorder / player proceeds to step S4013. Then, in steps S4013-4017, operations similar to those performed in steps S322-326 of FIG. 3B are sequentially performed, the contents are converted to digital content and then subjected to MPEG encoding, transport stream processing and encryption are performed for recording to the storage medium. Here, the recording / reproducing apparatus exits the recording procedure.

It should be noted that when the analog signals that are pleasing to the input / output interface 140 include the CGMS-A signal, the CGMS-A signal is also recorded in the storage medium when the analog content is recorded in the storage medium. Namely, the CGMS-A signal is recorded in place of copy control information or other information shown in FIG. 10. Typically, information indicating “one-time copying” is converted to “limited copying” to prevent copying beyond a predetermined limit. However, such a conversion is not performed provided that the system has a rule according to which copy management information "one-time copy" should not be converted to "limited copy", but should be interpreted as "limited copy".

[Copy control when playing data]

Then, the content is read from the storage medium and output as digital content to the outside, as shown in the graphical diagram in Fig. 41A. The following is a description of the operations shown in figa. First, in steps S4101, 4102 and 4103, operations similar to those performed in steps S401, 402 and 403 of FIG. 4A are performed, while the encrypted content read from the storage medium is decrypted using a cryptographic unit 150 and transport stream processing is performed. After performing this processing, digital content is supplied to the input / output interface 120 via the bus 110.

In step S4104, the input / output interface 120 determines whether it is possible to subsequently copy the digital content filed therein. Namely, in the case where the digital content supplied to the input / output interface 120 does not include a copy mode indicator or information indicating a copy control status (copy control information) similar to a copy mode indicator, it is decided that the content can be copied to subsequent.

In the case where the digital content supplied to the input / output interface 120 includes, for example, a copy mode indicator, namely, in a case where the copy mode indicator was recorded in accordance with the DTCP standard during data recording, and if the copy mode indicator ( recorded indicator of the copy mode) means "free copying", it is also decided that the contents can be copied later. When the copy mode indicator indicates "limited copy", it is decided that the contents cannot be copied later.

It should be recalled that the usually recorded copy mode indicator does not mean “one-time copy” and “forbidden copy”, since the value of the copy-only indicator “one-time copy” is converted to “limited copy” during data recording, and digital content having the value of the copy mode indicator "forbidden copying" is not recorded in the storage medium. However, the conversion of the copy mode indicator may not be performed provided that the system has adopted the rule that the “one-time copy” copy control information should not be converted to “limited copy” for recording, but should be interpreted as “limited copy”.

If it is decided in step S4104 that the content can be copied later, the input / output interface 120 proceeds to step S4105, where it outputs the digital content to the outside and leaves the playback procedure.

If it is decided in step S4104 that the contents cannot be copied in the future, then the input / output interface 120 proceeds to step S4106, where it issues in accordance with the DTCP standard or the like. digital content in a form that cannot be copied and exits the playback procedure.

That is, in the case where the recorded EMI means “forbidden copying”, as indicated above (or if the system defines a rule that the “one-time copy” copy management information should not be converted to “limited copying for recording, but should be interpreted as“ forbidden copying ", and EMI written under that condition means" one-time copying)), then the contents are prohibited for further copying.

Thus, the input / output interface 120 performs mutual authentication with the communicating device in accordance with the DTCP standard. If the communicating device is legal (a DTCP compliant device), then the input / output interface 120 encrypts the digital content and outputs the data.

Then, to reproduce the contents from the storage medium and output the data in the form of analog content, reproduction is performed in accordance with the graphic circuit in FIG. 41B. The following is a description of the playback operations with reference to figv. In steps S4111-4115, operations similar to those performed in steps S421-425 of FIG. 4B are performed. Namely, encrypted content is read and decrypted, processed by TS, MPEG decoding, and digital-to-analogue conversion. The analog content thus obtained is received by the input / output interface 140.

In step S4116, the input / output interface 140 decides whether the delivered content can be copied subsequently. Namely, in the case when copy control information recorded along with the recorded content is not detected, a decision is made that the content can be copied later.

In the case where the copy mode indicator (EMI) or copy control information was recorded during recording of contents in accordance with, for example, the DTCP standard, and if the copy mode indicator or copy control information indicates “free copy”, it is decided that the content can be copied later.

In the case where the copy mode indicator or control information indicates “limited copying”, or in the case where the rule is adopted in the system that the “one-time copy” copy control information should not be converted to “limited copying” for recording, but should be interpreted as “limited copying” and if the copy mode indicator or copy control information recorded under these conditions means “one-time copying”, it is decided that the contents cannot be feast later.

In addition, in the case where the analog content supplied to the input / output interface 140 includes the CGMS-A signal, namely, in the case where the CGMS-A signal was recorded along with the contents during the recording of the contents, and if the CGMS-A signal denotes "free copying", it is decided that the analog signal can be copied subsequently. When the CGMS-A signal indicates “forbidden copying”, it is decided that the analog content cannot be copied subsequently.

If it is decided in step S3416 that the analog content can be copied subsequently, the input / output interface 140 proceeds to step S4117, where it outputs the analog signals received therein unchanged and leaves the playback procedure.

If it is decided in step S4116 that the analog content cannot be copied subsequently, the input / output interface 140 proceeds to step S4118, where it outputs the analog signals received therein in such a way that the content cannot be copied, and exits playback procedures.

Namely, in the case where the copy control information, such as the recorded copy mode indicator, indicates “limited copy” as above (as an alternative solution, in the case where the rule is adopted in the system that the “one-time copy” copy control information is not should be converted to “limited copy” for recording, and should be understood as “limited copy”, and if copy control information, such as a copy mode indicator recorded under these conditions x, means "one-time copy"), then the contents are prohibited for further copying.

Thus, the input / output interface 140 connects the Macrovision signal and the CGMS-A signal indicating “prohibited copying” to the analog content and outputs the analog signal to the outside. In the case where the signal CGMS-A means, for example, “forbidden copying”, the contents are prohibited for further copying. Thus, the input / output interface 140 modifies the CGMS-A signal into “forbidden copying” and outputs it together with the analog contents to the outside.

As indicated above, by controlling the copying of the contents during recording or reproduction of the contents, it is possible to prevent the copying of the contents outside the permitted range for the contents (illegal copying).

[Data processor structure]

It should be noted that the above sequence of operations can be performed using hardware or using software. Namely, the cryptographic unit 150 may be formed from one large integrated encryption / decryption circuit, and cryptography, namely the encryption / decryption performed by the cryptographic unit 150, may be performed by a general purpose computer or by a single-chip microcomputer executing the corresponding program. Similarly, the TS processor 300 may be replaced by software. To perform sequences of operations for processing a transport stream using software, a program including software is installed in a general-purpose computer, single-chip microcomputer, or the like. On Fig shows an example of the structure of one embodiment of a computer in which a program is installed to perform a sequence of operations.

The program can be pre-recorded on the hard drive 4205 and in the ROM 4203 as a storage medium included in the computer. Alternatively, the program can be saved (written) temporarily or permanently to a removable storage medium 4210, such as a floppy disk, CD-ROM (read-only CD), MO (magneto-optical disk), DVD (digital versatile disk) , magnetic disk, semiconductor memory, or the like. Such a removable storage medium 4210 may be created as so-called batch software.

It should be recalled that the program can be installed on a computer from the above removable storage medium 4210, or transferred from a download site to a computer using a radio network via a digital broadcast satellite, or transferred to a computer via cable through a network such as a local area network , Internet or the like, the computer receives the program transmitted in this way using its communication unit 4208 and installs it on the built-in hard drive 4205.

As shown, the computer includes a central processor 4202. The central processor 4202 is connected to an input / output interface 4211 via a bus 4201. When the central processor 4202 receives an instruction from a user input unit 4207, such as a keyboard, mouse, or the like, via an interface 4211 I / O, then it runs the program stored in ROM 4203.

Alternatively, the central processor 4202 loads into RAM 4204 to execute a program stored in a hard disk 4205, a program transmitted from a satellite or network, received by the communication unit 4208 and installed on the hard disk 4205, or a program read from a removable medium 4210 information installed on the 4209 drive and installed on the 4205 hard drive.

Thus, the central processor 4202 performs the operations shown in the above graphic circuits, or the operations shown in the above flowcharts. The central processor 4202 outputs the results of these operations from the output unit 4206, such as a liquid crystal display (LCD) or loudspeaker, or transfers them from the communication unit 4208, or writes them to the hard disk 4205 via the input / output interface 4211, as needed.

It should be noted that operations or processes for describing a program that ensures that a computer performs various operations may not always be performed in the same time sequence as in graphic circuits, but may contain operations that are performed in parallel or individually (for example, parallel processes or object processes).

A program may be a program that can be executed by a single computer or in a decentralized manner by a plurality of computers. In addition, the program may be a program that can be transferred to a remote computer for execution.

The above description of the present invention with reference to an example in which a cryptographic unit formed from a single-chip large integrated circuit encryption, decryption, encrypts and decrypts the contents. However, it should be noted that the content encryption / decryption unit may be one software module, which is to be executed using, for example, the central processor 170 shown in FIGS. 1 and 2. Similarly, the operations of the TS processor 300 can be performed by one software module. , which is to be performed using the Central processor 170.

[Device and method for manufacturing a storage medium]

The present invention also provides a device and method for manufacturing the above information carrier according to the present invention. The following is a description of the device and method.

On Fig shows a device for manufacturing a disk, which also records the identifier of the disk, the key update unit and the encrypted master key or media key in the storage medium.

The device for manufacturing a disk shown in FIG. 43 records a disk identifier, a key update unit, and an encrypted master key or a media key in a storage medium already assembled during the assembly process (not shown), as well as the generation number n of the previous record of the main key in the medium information on need.

A device for manufacturing a disk 4300 comprises a memory 4302 in which a disk identifier, a key update unit and an encrypted master key or a media key, or any other storage medium, an information medium interface 4303, which writes and reads to and from information medium 4350, are stored an input / output interface 4304, which is an interface for other devices, a controller 4301 that controls the above components, and a bus 4305 that connects these components to each other.

In the example shown in FIG. 43, the memory 4302 and the storage medium interface 4303 may be external devices connected to the disk manufacturing device 4300.

The disk identifier, key update unit, encrypted master key and generation number n of the previous record are issued, for example, by the key issuing center (not shown) and are previously stored in the internal or external memory.

The disk identifier, the key update unit, and the encrypted master key or media key stored in the memory 4302 are recorded in the storage medium through the media interface 4303 of the controller 4301. It should be noted that the generation number n of the previous record is recorded in the storage medium as needed.

The disk identifier, key update unit, encrypted master key or media key stored in the memory 4302, and the generation number n of the previous record can be previously stored in the memory 4302, as mentioned above, and can also be sent, for example, from the key issuing center via the interface 4304 input / output.

On Fig shows a sequence of operations performed in a method of manufacturing a storage medium according to this invention for manufacturing a storage medium and recording a disk identifier, a key update unit, an encrypted key update unit or media key and generation number n of the previous record in the storage medium.

In the method of manufacturing the storage medium, first, in step S4401 of FIG. 44, a storage medium such as a DVD, CD or the like is assembled using a well-known assembly method (not shown).

Then, in step S4402, the recording / reproducing apparatus shown in FIG. 43 writes to the manufactured information medium a disk identifier, a key update unit, and an encrypted master key or medium key. The recording / reproducing apparatus also records, if necessary, the generation number n of the previous record in the storage medium.

After the above manufacturing process has been completed, the storage medium having the disc identifier, a key update unit and an encrypted master key or media key recorded in it is delivered from the factory. If necessary, the storage medium is also delivered from the factory with the recorded number and generation of the previous record.

[Key update block format]

On Fig shows an example format of a key update unit (KRB). In the Version format, 4501 identifies the version of the key update block. "Depth" 4502 indicates the number of steps in the hierarchical tree of the key update unit for the device for which the storage medium is intended. “Data pointer” 4503 indicates the position of the data part in the key update unit, and “Label pointer” 4504 indicates the position of the part of the label. "Signature Index" 4505 indicates the position of the signature. In the “data part” 4506, data is derived from encryption, for example, key keys to be updated.

The “tag part” 4507 is a tag indicating the geometry of the encrypted node keys and leaf keys stored in the data part. Below is a description of the label attachment rule with reference to FIG. 46, which shows an example of transmitting a key update unit described above with respect to FIG. 12A. Current data are shown in the right table in FIG. The address of the top node included in the current encryption key is taken as the address of the top node. In this case, since the top node address contains the root key update key K (t) R, it is equal to “KR”.

As shown in FIG. 46, the data Enc (K (t) 0, K (t) R) at the top step in the encryption key occupy the position in the hierarchical tree shown on the left side of the figure. The closest data to the data Enc (K (t) 0, K (t) R) are the data Enc (K (t) 00, K (t) 0) in the lower left position of the previous data. When there is no data, the label is set to 0. When there is data, the label is set to 1. The label is set as {left (L) label, right (R) label}. Since there is data to the left of the topmost data Enc (K (t) 0, K (t) R), the label Lmark = 0. There is no data to the right of the data Enc (K (t) 0, K (t) R), therefore, the label Rmark = 1. In this way, a label is set for all data to form a series of data and a series of labels shown in FIG. The nodes in the tree should preferably be processed using the “first width” or “first depth” method. In the “first width” method, nodes of the same step are processed first in the width direction. In the “first depth” method, nodes of the same step are processed first in the depth direction.

Below is a further description of the format of the key update unit with reference to FIG. The “signature” in the format is an electronic signature made, for example, by a key issuing center, a payment regulating organization, or the like, which issued a key update unit. The device that has received the key update unit confirms by verification of the signature that the received key update unit is a unit issued by a legitimate organization issuing the key update unit.

The above is a detailed description of the present invention in relation to specific embodiments of the invention. However, it is obvious that the options for implementation can be modified or changed by specialists in this field of technology without departing from the scope and ideas of this invention. Namely, since the invention is disclosed by way of examples, the embodiments should not be interpreted in a restrictive manner. This invention is essentially defined in the claims below.

Industrial applicability

As indicated above, since the updated data of the master key and the media key are transmitted all together with the key update unit using the tree-like key distribution system, the information recording / reproducing apparatus according to this invention can only transmit or distribute keys to be decrypted to the device to which you need to update the keys, and thus you can reduce the size of the message to be distributed. In addition, a key that can only be decrypted by a specific device group defined by a tree structure and which cannot be decrypted by any other device that is not part of a group can be distributed using a shortened message, so that key distribution or delivery is protected.

According to this invention, the key to be transmitted to each of the recording / reproducing devices using the tree-based key distribution system can be a master key that can be shared in a system defined by a specific group included in the tree structure or a media key unique to each medium information. By generating a key update unit unique to each recording / reproducing device or information carrier and delivering it to them via a network or medium, it is possible to simply and reliably update the key.

Thus, according to this invention, it is possible to build a system for recording / reproducing information in which it is possible to exclude illegal copying (against the will of the copyright holder) of copyrighted data, such as movies, music, etc.

Using a system that uses a generation-controlled master key and in which you can distribute a master key that is updated with a key update unit, you can generate a unique key block oriented to a device that can update an updated master key that is encrypted and distributed along with key update unit. Thus, according to the present invention, it is possible to generate an encrypted master key, which can only be decrypted by a device in need of updating the master key, and reliably update the master key without performing normal authentication with each device.

In addition, in the information recording / reproducing device and in the information recording / reproducing method according to the present invention, not only encryption is performed using a master key with a controlled generation or a media key, but also encryption with an adjustable restriction of the playback device is used to store data in the information medium. Thanks to such a system, data is recorded in the storage medium by using a key unique to the device to act on the encryption key, with which the data was encrypted when the restriction of the playback device was set (data can only be played back by the limited playback device). In the case when the restriction of the playback device is not set, use the device identifier to influence the encryption key with which the data was encrypted, while the data to be recorded in the storage medium is encrypted. In addition, since the device identification information for the data recording device and information indicating what was used to record the data, the playback device restriction mode or the playback device non-restriction mode (playback device restriction flag) is recorded in the storage medium, only the device , knowing a key unique to the device and recording data, can decrypt the data, the code set the playback device restriction. When the restriction of the playback device is not set, then any device can decrypt the data using the device identification information (device ID) for the device that recorded the data.

The device and method for recording / reproducing information according to this invention, provide the generation of an encryption block key for block data based on an entry time stamp, which is random data corresponding to the arrival time of each packet. Thus, you can generate a unique key that changes from one block to another, use a different encryption key for each block, and thereby increase protection against cryptanalysis of data. By generating a block key based on the entry time stamp, there is no need to provide an area for storing an encryption key for each block in the storage medium, and thereby it is possible to more effectively use the area for basic data. In addition, during recording or reproduction of data, access to data other than the main data is not required, whereby recording or reproduction can be performed more efficiently.

Claims (58)

1. An information recording device for recording information in an information medium, the device comprising cryptographic means having a node key unique to each of the nodes included in the hierarchical tree structure, which includes many information recording devices as each of the leaves of the tree structure, and a leaf key unique to each of the information recording devices, and which encrypts the data to be stored in the storage medium; wherein the cryptographic means generates an encryption key based on the data for generating the encryption key embedded in the information recording apparatus for encrypting the data to be stored in the information medium; and wherein the data for generating the encryption key is data that can be updated with at least a nodal key or a leaf key; and recording means for recording data encrypted with cryptographic means in a storage medium. 2. The device according to claim 1, characterized in that the data for generating the encryption key is the main key common to many information recording devices. 3. The device according to claim 1, characterized in that the data for generating the encryption key is a media key unique to a particular storage medium. 4. The device according to claim 1, characterized in that the nodal key can be updated; when the nodal key is updated, the key update unit (KRB) is distributed, which is derived from encrypting the nodal update key with at least the nodal key or leaf key at the lower level of the tree structure, to the information recorder in the sheet where it is necessary to update the data to generate encryption key; and cryptographic means in the information recording apparatus receives update data for the encryption key generation data encrypted with the updated node key, encrypts the key update unit to obtain the updated node key, and calculates the update data for the encryption key generation data based on the updated node key obtained in this way. 5. The device according to claim 4, characterized in that the key update unit is stored in the storage medium and cryptographic means encrypts the key update unit read from the storage medium. 6. The device according to claim 1, characterized in that the data for generating the encryption key has a generation number as update information correlated with it; and the cryptographic means stores in the storage medium, as the generation number of the record, the data generation number for generating the encryption key that was used to store the encrypted data in the storage medium. 7. The device according to claim 1, characterized in that the following encryption procedures are selectively performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, the first encryption key is generated for the data to be stored in the storage medium, based on the data for generating the first encryption key for encrypting the data to be stored in the storage medium using the first encryption key, and the data for generating Vågå encryption key stored in the recording medium; and when the restriction of the reproducing device is established, a second encryption key is generated for the data to be stored in the information medium based on data for generating a second encryption key embedded in the information recording device to encrypt data to be stored in the information medium using the second encryption the key. 8. The device according to claim 7, characterized in that the cryptographic tool performs the following depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, the cryptographic tool generates a unique title key from the master key, the generation of which is controlled stored in the information recording device, a disk identifier that is an identifier unique to the information medium, a title key unique to the data, under lying records in the storage medium, and the identifier of the device, which is the identifier for the information recording device, to generate the first encryption key from a unique title key; and when the restriction of the reproducing apparatus is established, the cryptographic means generates a unique title key from a master key with a controlled generation stored in the information recording apparatus, a disk identifier that is an identifier unique to the information medium, a title key unique to the data to be recorded to the information medium, and a device-unique key, unique to the information recording device, for generating a second encryption key from the unique title key. 9. The device according to claim 1, characterized in that it further comprises a transport stream processing means for attaching an entry time stamp (ATS) to each of the discrete transport packets included in the transport stream; wherein the cryptographic tool generates a block key as an encryption key for the block data, including more than one transport packet, each of which has an attached entry time stamp; and the cryptographic means generates a block key as an encryption key when encrypting the data to be stored in the storage medium based on data including data for generating the encryption key and a block starting number, which is additional information unique to the block data, and includes a time stamp entrance. 10. The device according to claim 1, characterized in that the cryptographic means encrypts the data to be stored in the storage medium in accordance with the DES algorithm (data encryption standard). 11. The device according to claim 1, characterized in that there is provided interface means for receiving information to be recorded in the storage medium; wherein the interface means identifies the copy control information attached to each of the packets included in the transport stream to determine, based on the copy control information, whether or not writing to the storage medium is possible. 12. The device according to claim 1, characterized in that there is provided interface means for receiving information to be recorded in the storage medium; wherein the interface means identifies a two-bit encryption mode indicator (EMI) as copy control information for determining, based on the EMI, whether or not writing to the storage medium is possible. 13. An information reproducing device for reproducing information from an information medium, including reproducing means for reproducing information from an information medium, wherein a device having a node key is unique to each of the nodes included in the hierarchical tree structure, which includes many information recording devices in the quality of each of the leaves of the tree structure, and a leaf key unique to each of the information recording devices, contains a cryptographic tool for races ifrovki encrypted data stored in the recording medium; wherein the cryptographic means generates a decryption key based on the data for generating the decryption key embedded in the information recording apparatus for decrypting the data stored in the information medium; and wherein the data for generating the decryption key is data that can be updated with at least a nodal key or a leaf key. 14. The device according to item 13, wherein the data for generating the decryption key is the main key common to many information recording devices. 15. The device according to item 13, wherein the data for generating the decryption key is a media key unique to a particular storage medium. 16. The device according to item 13, wherein the nodal key can be updated; is distributed when the node key is updated, the key update unit (KRB), derived from the encryption of the node update key using at least the node key or leaf key in the lower step of the tree structure, to the information reproducing device in the sheet where it is necessary to update the data for generating encryption key; and cryptographic means in the information recording apparatus receives update data for decryption key generation data encrypted with the updated node key, encrypts the key update unit to obtain the updated node key, and calculates update data for the decryption key generation data based on the updated node key thus obtained. 17. The device according to item 13, wherein the key update unit is stored in the storage medium and cryptographic means encrypts the key update unit read from the storage medium. 18. The device according to item 13, wherein the data for generating the decryption key has a generation number as update information correlated with it, and the cryptographic tool reads from the storage medium when decrypting encrypted data from the storage medium the data generation number for generating the encryption key that were used to encrypt the encrypted data, and generates a decryption key from the data to generate a decryption key corresponding to the number debris. 19. The device according to item 13, characterized in that the following decryption procedures are selectively performed, each of which must be performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, the first decryption key for encrypted data is generated stored in a storage medium, based on data for generating a first decryption key stored in a storage medium for decrypting encrypted data with a first key decryption; and when the restriction of the reproducing device is set, a second decryption key is generated for the encrypted data stored in the information medium based on the data for generating a second encryption key embedded in the information recording apparatus for decrypting the encrypted data with the second decryption key. 20. The device according to claim 19, characterized in that the cryptographic tool, depending on whether or not the restriction of the playback device is installed, performs the following: when the restriction of the playback device is not set, the cryptographic tool receives a master key with a controlled generation stored in the recording device information, and receives from the information medium a disk identifier that is an identifier unique to the information medium, a title key unique to the data to be decrypted, and a device identifier, which is an identifier for an information recording device that records encrypted data, for generating a unique title key from a master key, a disk identifier, a title key, and a device key, and a first decryption key from a unique title key; and when the restriction of the playback device is established, the cryptographic means receives a master key with a controlled generation stored in the information recording device and a device-unique key unique to the information recording device and stored in it, and obtains from the storage medium a disk identifier that is an identifier, unique to the storage medium, and a cover key unique to the data to be decrypted to generate a unique cover key from the master key, identifying Ator disc, title key and device-unique key and the second decryption key is generated from a unique title key. 21. The device according to item 13, characterized in that it further comprises means for processing a transport stream for controlling data output based on an entry time stamp (ATS) attached to each of a plurality of transport packets included in the block data decrypted using cryptographic means; wherein the cryptographic tool generates a block key as a decryption key for block data including more than one packet, each of which has an attached entry time stamp; and a block key is generated as a decryption key when decrypting encrypted data stored in the information medium based on data including data for generating a decryption key and a block starting number, which is additional information unique to the block data including an entry time stamp. 22. The device according to item 13, wherein the cryptographic tool decrypts the encrypted data stored in the storage medium in accordance with the DES algorithm. 23. The device according to item 13, wherein the interface means for receiving information to be recorded in the storage medium is further provided; wherein the interface means identifies the copy control information attached to each of the packets included in the transport stream to determine, based on the copy control information, whether or not playback from the storage medium is possible. 24. The device according to item 13, wherein the interface means for receiving information to be recorded in the storage medium is further provided; wherein the interface means identifies a two-bit encryption mode indicator (EMI) as copy control information for determining, based on the EMI, whether or not playback from the information medium is possible. 25. A method of recording information for recording information in an information medium, the method comprising the steps of updating data to generate an encryption key for generating an encryption key for encrypting data to be recorded in the information medium using at least a key key unique to each of the nodes included in the hierarchical tree structure, which includes many different devices for recording information as each of the leaves of the tree structure, or leaf key, unique th for each of the information recording devices; generating an encryption key based on data for generating an encryption key for encrypting data to be stored in the storage medium; and writing encrypted data to the storage medium. 26. The method according A.25, characterized in that the data for generating the encryption key is the master key common to many information recording devices. 27. The method of claim 25, wherein the data for generating the encryption key is a media key unique to a particular storage medium. 28. The method according A.25, characterized in that the key can be updated; when the node key is updated, the key update unit is distributed, which is derived from encryption of the node update key using at least the node key or leaf key at the lower level of the tree structure to the information recording device in the sheet where data needs to be updated to generate the encryption key; and the update step includes the steps of obtaining an updated node key by encrypting the key update unit and computing update data for the data to generate an encryption key based on the updated node key obtained in this way. 29. The method of claim 25, wherein the data for generating the encryption key has a generation number as update information correlated with it, and the cryptographic step further comprises the step of storing the information in the storage medium while storing the encrypted data in the storage medium, data generation number to generate the encryption key that were used as the record generation number. 30. The method according A.25, characterized in that the cryptographic stage includes the following two procedures, one of which is selectively performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, then generate the first encryption key for the data to be stored in the storage medium, based on the data for generating the first encryption key, the data to be stored in the storage medium is encrypted with the first encryption key and data for generating the first encryption key is stored in the storage medium; and when the restriction of the reproducing device is set, a second encryption key is generated for the data to be stored in the information medium based on data for generating a second encryption key embedded in the information recording device, and the data to be stored in the information medium is encrypted using the second encryption the key. 31. The method according to item 30, wherein the cryptographic stage, depending on whether or not the restriction of the playback device is set, performs the following: when the restriction of the playback device is not set, the cryptographic tool generates a unique title key from the master key with a controlled generation, stored in the device for recording information, the identifier of the disk, which is an identifier unique to the information carrier, a title key unique to the data to be recorded in the nose the information identifier, and the identifier of the device, which is the identifier for the information recording device, and generates a first encryption key from a unique title key; and when the restriction of the reproducing device is established, the cryptographic means generate a unique title key from the master key with a controlled generation stored in the information recording device, a disk identifier that is an identifier unique to the information medium, a title key unique to the data to be recorded in the information medium , and a device-unique key, unique to the information recording device, and generates a second encryption key from the unique title key . 32. The method according A.25, characterized in that it further comprises the step of processing a transport stream for attaching an entry time stamp (ATS) to each of the discrete transport packets included in the transport stream in the cryptographic stage: generate a block key as an encryption key for block data, including more than one transport packet, each of which has an attached entry time stamp, and generate a block key as an encryption key when encrypting data to be stored in a medium and information, based on data including data for generating the encryption key, and the initial number of the block, which is additional information unique to the data of the block, and includes an entry time stamp. 33. The method according A.25, characterized in that at the cryptographic stage, the data to be stored in the storage medium is encrypted in accordance with the DES algorithm. 34. The method according A.25, characterized in that the copy control information attached to each of the packets included in the transport stream is identified in the data to determine, based on the copy control information, whether or not recording to the storage medium is possible. 35. The method according A.25, characterized in that identify the two-bit indicator of the encryption mode (EMI) as the copy control information to determine on the basis of EMI, whether or not recording in the storage medium is possible. 36. A method of reproducing information for reproducing information from an information medium, the method comprising the steps of reproducing information from an information medium; data updates to generate the decryption key, from which the decryption key is generated to decrypt the information read from the storage medium using at least a node key unique to each of the nodes included in the hierarchical tree structure, in which each tree leaf is included as a structure or leaf key unique to each of the information reproducing devices; and generating a decryption key from the data to generate a decryption key updated in the update step to decrypt the data stored in the storage medium. 37. The method according to clause 36, wherein the data for generating the decryption key is the main key common to many information recording devices. 38. The method according to clause 36, wherein the data for generating the decryption key is a media key unique to a particular storage medium. 39. The method according to clause 36, wherein the nodal key can be updated; when the nodal key is updated, a key update unit (KRB) is distributed, which is derived from encrypting the nodal update key with at least the nodal key or leaf key at the lower level of the tree structure to the information reproducing device in the sheet where it is necessary to update the data to generate the encryption key; and the cryptographic step includes encrypting the key update unit to obtain the updated node key and calculating the update data for the decryption key generation data based on the updated node key thus obtained. 40. The method according to clause 36, wherein the data for generating the decryption key has a generation number as update information correlated with it, and in the cryptographic stage is read from the storage medium when decrypting encrypted data from the storage medium, the data generation number for generating the encryption the key used to encrypt the encrypted data to generate the decryption key from the data to generate the decryption key corresponding to the number thus read generations. 41. The method according to clause 36, wherein the cryptographic stage includes the following two procedures, each of which must be selectively performed depending on whether or not the restriction of the playback device is set: when the restriction of the playback device is not set, then the first decryption key is generated for encrypted data stored in the storage medium, based on the data for generating the first decryption key stored in the storage medium, encrypted data is decrypted using the first wow decryption key; and when the restriction of the playback device is set, a second decryption key is generated for the encrypted data stored in the information medium based on the data for generating the second encryption key embedded in the information recording device, and the encrypted data is decrypted using the second decryption key. 42. The method according to paragraph 41, wherein the cryptographic stage includes the following two procedures: when the restriction of the playback device is not established, then a master key with a controlled generation is stored in the information recording device, and a disk identifier is also obtained from the storage medium, which is an identifier unique to the information medium, a title key unique to the data to be decrypted, and a device identifier that is an identifier for the information recording device by writing its encrypted data to generate a title-unique key from the master key, disc ID, title key and device key and the first decryption key from the title-unique key; and when the restriction of the playback device is established, then a master key with a controlled generation stored in the information recording device and a unique key for the device unique to the information recording device and stored in it are obtained, and a disk identifier is obtained from the information medium, which is an identifier unique for the storage medium, and a cover key unique to the data to be decrypted, for generating a unique cover key from the master key, disk identifier, title of the key and unique key device; and generating a second decryption key from the thus generated unique title key. 43. The method according to clause 36, wherein the playback device further comprises a transport stream processing means for controlling data output based on an entry time stamp (ATS) attached to each of a plurality of transport packets included in the decrypted block; and in the cryptographic stage, a block key is generated as a decryption key for block data including more than one packet, each of which has an attached entry time stamp; and generating a block key as a decryption key when decrypting encrypted data stored in the information medium based on data including data for generating a decryption key and a block starting number, which is additional information unique to the block data, and includes an entry time stamp. 44. The method according to clause 36, wherein the encrypted data stored in the storage medium is decrypted in accordance with the DES algorithm. 45. The method according to clause 36, wherein the copy control information that is attached to each of the packets included in the transport stream is identified in the data to determine, based on the copy control information, whether or not playback from the storage medium is possible. 46. The method according to clause 36, wherein a two-bit encryption mode indicator (EMI) is identified as copy control information for determining based on EMI whether or not playback from the information medium is possible. 47. A storage medium capable of recording information having a key update unit (KRB) stored therein, derived from encryption of the updated node key using at least a node key unique to each of the nodes included in the hierarchical tree structure in which many different information recording devices are included as each of the leaves of the tree structure, or a leaf key unique to each of the information recording devices. 48. The storage medium according to item 47, wherein the data is derived from encryption using the updated nodal data key to generate the encryption key used in the information recording device to generate the encryption key to encrypt the data to be stored in the storage medium. 49. The storage medium according to item 47, wherein the data is derived from decryption using the updated node data key to generate the decryption key used in the information reproducing device to generate the decryption key to decrypt the encrypted data stored in the storage medium. 50. The storage medium according to item 47, wherein the information about the generation of data is stored to generate an encryption key or decryption key. 51. An information processing device for recording information in an information medium, the device comprising a memory for storing a key update unit (KRB) derived from encryption of an updated node key using at least a node key unique to each of the nodes included in a hierarchical tree structure, which includes many different information recording devices as each of the leaves of the tree structure, or leaf key, unique to each of the information recording devices; and a control unit for managing writing a key update unit (KRB) stored in the memory to the storage medium. 52. The device according to § 51, wherein the memory further stores at least the identifier of the storage medium and encrypted data to generate the encryption key or encrypted data to generate the decryption key; and the control unit controls writing to the storage medium at least the identifier of the storage medium or encrypted data to generate an encryption key or encrypted data to generate a decryption key. 53. The device according to paragraph 51, wherein the memory further stores information about the generation of data to generate an encryption key or data to generate a decryption key, and the control unit controls the recording of generation information in the storage medium. 54. A method of processing information for recording information in a storage medium comprising the steps of storing in memory a key update unit (KRB) derived from encryption of an updated node key using at least a node key unique to each of the nodes included in the hierarchical tree a structure that includes many different information recording devices as each of the leaves of the tree structure or leaf key unique to each of the information recording devices; and writing to the storage medium of the key update unit (KRB) stored in the memory. 55. The method according to item 54, wherein the memory further stores at least the identifier of the information medium and encrypted data to generate the encryption key or encrypted data to generate the decryption key and write to the information medium, at least the identifier of the medium information and encrypted data for generating an encryption key; or encrypted data for generating an encryption key. 56. The method according to item 54, wherein the memory further stores information about the generation of data to generate an encryption key or data to generate a decryption key and control the recording of generation information in the storage medium. 57. A storage medium containing a computer program, under the control of which the computer performs the steps of updating the data to generate an encryption key for encrypting the data to be written to the storage medium using at least a nodal key unique to each of the nodes included in the hierarchical a tree structure, which includes many different devices for recording information as each of the leaves of the tree structure, or leaf key, unique to each of the devices Isi information; and generating an encryption key based on the data to generate an encryption key for encrypting the data to be stored in the storage medium. 58. A storage medium containing a computer program under which the computer performs the steps of updating data to generate a decryption key, from which a decryption key is generated to decrypt the encrypted data stored in the storage medium using at least a nodal key unique to each from nodes included in the hierarchical tree structure, which includes various devices for reproducing information as each of the leaves of the tree structure, or leaf a key unique to each information reproducing apparatus; and generating a decryption key from the data to generate a decryption key updated in the update step to decrypt the data stored in the storage medium.

Images