WO2006030667A1

WO2006030667A1 - Transmitter, receiver, transmission method and transfer method

Info

Publication number: WO2006030667A1
Application number: PCT/JP2005/016311
Authority: WO
Inventors: Takashi Nishimura
Original assignee: Sharp Kabushiki Kaisha
Priority date: 2004-09-16
Filing date: 2005-09-06
Publication date: 2006-03-23
Also published as: JP3796507B2; JP2006086878A

Abstract

A device control unit (202) of a device A (201) judges that a device B (211) is a device not belonging to the same local network as the device A (201) when the packet length transmitted from the device A (201) to the device B (211) is 1500 bytes and the response packet to a packet having an IP fragment inhibited is an ICMP packet reporting that the packet length is too long or a response packet including data indicating that the device B (211) is a device not belonging to the same local network as the device A (201) and transmitted by the device B (211) when it has normally received a packet transmitted from the device A (201).

Description

Specification

Transmitter, receiver, transmission method and transmission method

Technical field

The present invention relates to a transmitter, a receiver, a transmission method, and a transmission method, and in particular, a device in which another device connected via a network belongs to the same local network as the own device. A transmitter, a receiver, a transmission method, and a transmission method for determining whether or not

Background art

[0002] Various contents such as software, moving pictures, still pictures, sounds and so on are digitized by progress of digital technology, high performance of personal computers etc. and rapid spread. These digitized contents are widely distributed on IP networks such as the Internet. Furthermore, the use of broadband lines such as ADSL and CATV has made it possible to distribute large-capacity content over IP networks compared to the past.

[0003] Since digitized content is easy to copy and move, and there is almost no deterioration during copying and moving, there is a problem that illegally copied and moved content is distributed on the IP network. ing. Therefore, standards are currently under consideration to permit copying and moving of content within the home (local network), and to prohibit others.

[0004] As a standard for distributing copy-controlled content on an IP network, the specification of transmission of copy-controlled content and the license management have made it possible to obtain Digital Transmission Licensing Administrator (DTLA). There are additional standards for applying DTCP, Digital Transmission Content Protection (IP) to IP (Internet Protocol) DTCP-IP (DTCP Volume 1 Supplement E Mapping DTCP to IP). A method of authenticating a remote device, which has been conventionally used when transmitting copy-controlled content using DTCP-IP, will be described.

[0005] FIG. 14 is a diagram showing from the start of authentication in DTCP-IP to the start of transmission of copy-controlled content. Device B (sink device) using DTCP-IP Device A (source device) power is also received when the copy-controlled content is received, and step (hereinafter simply “S” t, う) 1401! /, Device B possesses copy-controlled content Send an authentication request packet to device A.

[0006] The authentication request packet includes data of a random number value L) B and a device certificate (device certificate B) indicating that the device B is a device that is also approved for DTLA power. . The random number value is used to prevent a replay attack that impersonates the device B by illegally obtaining the content that the device B communicated previously and transmitting the same content, and the content changes with each authentication. The device certificate B is a digital signature of the contents including the public key of the device B using the DTLA private key.

[0007] In S1402, the device A transmits to the device B an ACK (acknowledgement) packet indicating that the authentication request packet has been received. When the device B does not receive the ACK packet shown in S 1402 after the device B transmits the authentication request of S 1401 and the certain period elapses, or the device B authenticates S 1401. When sending a request and not receiving an ICMP packet notifying that an error has occurred until a certain period of time has elapsed, when the device B retransmits the authentication request packet shown in S 1401 to the device A . Although this retransmission operation is omitted in the following description, it is the same for all ACK packets.

In S1403, the device A transmits a reply packet to the device B. This return packet also includes data of a random number value L) and a device certificate (device certificate A) indicating that the device A is a device authorized by the DTLA. In S1404, the device B transmits, to the device A, an ACK packet indicating that the S1403 return packet has been received.

Device A verifies whether the device certificate B included in the authentication request packet received from the device B is correct or not after transmitting the reply packet. As described above, since the device certificate B is digitally signed with the content including the device B's public key using the DTLA private key, the device certificate B can be decrypted by using the known DTLA public key. It is possible to verify whether or not is correct.

Device B has the correct device certificate A included in the reply packet received from device A. The verification of whether or not the object is done after the receipt of the reply packet. The device certificate A, like the device certificate B, is digitally signed by using the secret key of the DTLA and the contents including the public key of the device A, so the device can be decrypted by using the public key of the DTLA. It is possible to verify that certificate A is correct.

If it is determined that the device certificate received by the other device is also incorrect in either of the devices, it is determined that the device is not appropriate as the other device to exchange data using DTCP-IP, and the device is authenticated. Send a packet to notify failure and abort the current authentication process. In this case, transmission of copy-controlled content from device A to device B is not performed.

On the other hand, when the device certificate received by the other device is determined to be correct by both devices, the public key of the other device is obtained by both devices. In this case, transmission of copy-controlled content from the device A to the device B is performed after the authentication process. Before transmission of copy-controlled content from device A to device B takes place, the Diffie-Hellman key exchange algorithm (EC-DH) over Elliptic Cryptography is used and is temporarily shared only by both devices. A shared key is prepared.

Device A generates a random number value “Xk” to obtain Xv = XkG. “G” is a specific point on the elliptic curve, “XkG” is a calculation on the elliptic curve, and “Xv” in the result is any point on the elliptic curve. The random number value “Xk” is held as secret information of the device A alone, S 1405, where the device A performs key exchange of information in which information of a predetermined format including “Xv” is signed by the secret key of the device A Send to Device B as a message. In step S1406, the device B transmits to the device A an ACK packet indicating that the key exchange message has been received.

Similarly, the device B generates a random value “Yk” to obtain Yv = YkG. The random number value “Yk” is held as secret information for only the device B, and in S1407, the device B uses as a key exchange message a signature of information of a predetermined format including “Yv” with the secret key of the device Β. Send to the rabbit. In step S1408, the device A transmits an ACK bucket to the device B indicating that the key exchange message has been received.

[0015] When both devices receive the key exchange message of the other device also, they obtain the key exchange message before S1405, and use the other device's public key to confirm the signature of the received key exchange message. After that, it is possible to obtain the point "Xv" or "Yv" that the partner device has sent.

[0016] In the device 、, the secret information "Xk" and the device B force "Yv" received and the force XkYv = XkYkG are calculated. The device B calculates YkXv = XkYkG from the secret information “Yk” and “Xv” received by the device A. This makes it possible to share the secret points of device A and device B only, and the X coordinate value of that point is used as the subsequent shared key. Since it is difficult to obtain “Xk” or “Yk” from “Xv” or “Yv”, devices other than device A and device B have secret points even if they know “Xv” or “Yv”. It is not possible to ask for "XkYkG". I can not know the shared key.

[0017] In S1409, the device A encrypts the unencrypted content based on the secret shared key, and transmits the encrypted content to the device B in S1410. In S141 1, the device B can decrypt the received encrypted content into the original content based on the secret shared key (Non-Patent Document 1 and Non-Patent Document 2).

[0018] Also, when device A tries to transmit copy-controlled content to device B using DTCP-IP, a copy network to which copy-controlled content device A belongs (eg, It is required to prevent outflow to devices other than home network. There is a method using RTT (Round Trip Time) as a technology to determine whether the device B is a device belonging to the same local network as the device A or not. In RTT, when device A transmits data to device B, and device B immediately transmits response data to device A when device B receives data from device A, device A transmits data. Force is also the time to receive response data.

Communication between devices not belonging to the same local network is characterized in that RTT is longer than communication between devices belonging to the same local network. Focusing on this feature, it is determined that the two devices do not belong to the same local network when the RTT is longer than a certain threshold time, and the two devices are identical when the RTT is shorter than a certain threshold time. There is a method to judge that it belongs to the local network (Non-patent literature 3) Special reference 1: Hitachi, Lta., Intel Corporation, Matsushita Electric Industrial co., Ltd., Sony Corporation, Toshiba Corporation, Digital Transmission Co ntent Protection Specification Volume 1 (Informational Version) Revision 1.3 ", [online], January 7, 2004, Internet URL: http: 〃 www.dtcp.com/data/info— 20 040107_dtcp_Vol_l_lp3.pdl)

Patent Literature 2: Hitachi, Ltd., Intel Corporation, Matsushita Electric Industrial Co., Ltd., Sony Corporation, Toshiba Corporation, DTCP Volume 1 Supplement E Mapping DTCP to IP (informational Version) Revision 1.0 ", [online], 2 003 , November 24, URL: http: 〃 www.dtcp.com/data/info— 20031124— dtcp— VISE— lpO.pdl)

Non Patent Literature 3: DTLA, "Work Plan for Localizing Transmissions, [online], September, 2003, [Search on July 30, 2004], Internet URL: http: 〃 www.dtcp.c om / data / Work—Plan—09092003.pdl)

Disclosure of the invention

Problem that invention tries to solve

However, the method of determining whether or not two devices belong to the same local network using the conventional RTT is expected to vary depending on the network configuration. The problem is that it is difficult to determine the appropriate threshold time.

The present invention has been conceived in view of the above-mentioned circumstances, and an object thereof is a device in which another device connected via a network belongs to the same local network as the own device. It is to provide a transmitter, a receiver, a transmission method, and a transmission method that can determine whether there is any.

Means to solve the problem

According to an aspect of the present invention to achieve the above-described object, a transmitter generates a transmission packet in which a fragment is inhibited according to an instruction, and a transmission generated by the packet generation unit. A packet transmission / reception unit that transmits a packet toward another device connected via the network and receives a response packet to the transmission packet, and a packet length of the response packet received by the packet transmission / reception unit is a predetermined packet length A packet analysis unit that analyzes whether the packet is a packet that indicates that it is longer or not, and a packet generation unit The device control unit further comprises: a device control unit that instructs generation of a transmission packet in which the pigment is prohibited, and determines whether other devices are devices belonging to the same local network as the own device. When the packet analysis unit analyzes that the response packet is a packet indicating that the packet length of the transmission packet is longer than a predetermined packet length, it is assumed that another device is not a device belonging to the same local network as the own device. It is characterized by judging

According to the present invention, the other device can be determined by analyzing whether the response packet to the transmission packet for which the fragment sent to the other device is prohibited is a packet indicating that the packet length is longer than a predetermined packet length. It can be determined whether the device belongs to the same local network as the own device or not.

Preferably, the device control unit instructs the packet generation unit to generate a transmission packet in which a fragment is prohibited in an authentication step of packet transmission.

According to the present invention, it is possible to prevent the transmission packet from being transmitted toward the other device when the authentication fails.

Preferably, the device control unit stops instructing the packet generation unit to generate a transmission packet after determining that the other device is not a device belonging to the same local network as the own device. It is characterized by

According to the present invention, after it is determined that the other device is not a device belonging to the same local network as the device itself, the transmission packet is sent to the device itself as well. Can be reliably blocked.

[0028] Preferably, the packet length of the transmission packet in which the fragment is prohibited is 1500 bytes.

According to the present invention, there is provided a transmitter capable of determining whether another device connected via a network is a device belonging to the same local network as the own device. Can.

Preferably, the packet analysis unit further transmits a response packet received by the packet transmission / reception unit.

, And belongs to the same local network as the own device that transmits when another device receives the transmission packet normally, and analyzes whether it is a packet indicating that it is the device, The controller control unit is a packet indicating that the response packet in the packet analysis unit is a device that does not belong to the same local network as the own device that transmits when another device receives the transmission packet normally. When it is analyzed, it is determined that the other device is not a device belonging to the same local network as the own device.

According to the present invention, the response packet to the transmission packet in which the fragment transmitted to another device is inhibited is the same local network as the own device that transmits when the other device successfully receives the transmission packet. By analyzing whether it is a packet indicating that the device does not belong to the device, it can be determined whether the other device belongs to the same local network as the own device.

According to the present invention, it is possible to prevent the transmission packet from being transmitted to the other device when the authentication fails.

Preferably, after determining that the other device is not a device belonging to the same local network as the own device, the device control unit stops instructing the packet generation unit to generate a transmission packet. It is characterized by

Preferably, the packet length of the transmission packet in which the fragment is prohibited is 1500 bytes.

According to the present invention, it is possible to provide a transmitter capable of determining whether another device connected via a network is a device belonging to the same local network as the own device. Can.

[0038] According to another aspect of the present invention, the transmitter generates a transmission packet in which the packet length is changed by a predetermined length in accordance with the instruction, and the packet generation unit generates the transmission packet. A packet transmitting / receiving unit that transmits the transmitted packet to another device connected via the network and receives a response packet to the transmitted packet And a response time measurement unit that measures a response time from when a transmission packet is sent to another device until when a response packet to the transmission packet is received, and a length predetermined by the packet generation unit. The device control unit repeatedly instructs generation of a transmission packet in which the packet length is changed by a small amount, and determines whether another device belongs to the same local network as the own device. When the response time measured by the response time measurement unit changes stepwise for each specific packet length, the device control unit determines that the other device is not a device belonging to the same local network as the own device. It is characterized by

[0039] According to the present invention, the transmission packet whose packet length is changed by a predetermined length is transmitted to another device, and the response time until the response packet to the transmission packet is received. The relationship between the measured response time and the transmitted packet length can also be measured to determine whether other devices are devices belonging to the same local network as the device itself.

Preferably, the device control unit instructs the packet generation unit to generate a transmission packet in which the packet length is changed by a predetermined length in the authentication step of packet transmission.

According to the present invention, after it is determined that the other device is not a device belonging to the same local network as the device itself, the transmission packet is transmitted to the device itself as well. Can be reliably blocked.

[0044] Preferably, the specific packet length is 48 bytes.

According to the present invention, it is possible to provide a transmitter capable of determining whether other devices connected via a network are devices belonging to the same local network as the own device. [0045] According to another aspect of the present invention, the receiver includes a packet reception unit for receiving received packets transmitted from other devices connected via the network, and a packet transmission unit using the packet reception unit. The packet analysis unit analyzes whether or not the received packet received at a predetermined stage of the packet is a fragmented packet, and controls transmission and reception of packets with other devices, as well as with other devices. And a device control unit that determines whether or not the device belongs to the same local network as the own device, and the device control unit analyzes that the received packet is a fragmented packet by the packet analysis unit. At that time, it is characterized that it determines that the other device is not a device belonging to the same local network as the own device.

According to the present invention, another device belongs to the same local network as the own device by analyzing whether the received packet sent is also a fragmented packet. It can be determined whether the device is

Preferably, the predetermined phase of packet transmission is an authentication phase of packet transmission.

According to the present invention, it is possible to prevent the transmission packet from being sent to the other device itself when the authentication fails.

Preferably, after determining that the other device belongs to the same local network as the own device and determines that the device control device is the device, the device control unit performs control to stop transmission and reception of packets with the other device. It is characterized by

According to the present invention, after it is determined that the other device is a device not belonging to the same local network as the own device, the transmission packet is transmitted from the other device to the own device. Can be reliably blocked.

[0051] According to another aspect of the present invention, the receiver is connected to the packet generation unit for generating the transmission packet according to the instruction and the transmission packet generated by the packet generation unit via the network. A packet transmission / reception unit that transmits to another device and receives a reception packet transmitted from another device, and the reception packet received at a predetermined stage of packet transmission by the packet transmission / reception unit is fragmented Analyzes whether or not it is a packet whether or not it controls packet transmission / reception with other devices, and determines whether the other device is a device belonging to the same local network as the own device Equipment control When the packet analysis unit analyzes that the received packet is a fragmented packet, the device control unit belongs to the same local network as the own device. It is characterized by judging that it is an apparatus.

According to the present invention, the other device belongs to the same local network as the own device by analyzing whether or not the received packet transmitted by the other device is a fragmented packet. It can be determined whether or not there is a device that is present.

According to the present invention, when authentication fails, it is possible to prevent other device modules from transmitting reception packets to the own apparatus.

Preferably, after the device control unit determines that the other device is not a device belonging to the same local network as the own device, the other device is identical to the own device with respect to the packet generation unit. It is characterized by instructing generation of a packet notifying that the device is not belonging to the local network.

According to the present invention, by notifying another device that the device is not belonging to the same local network as the own device, the received packet is transmitted from the other device to the own device. Can be reliably prevented.

[0057] According to another aspect of the present invention, the transmission method includes a packet generation instructing step of instructing the packet generation unit for generating a transmission packet which forbids a fragment according to an instruction to generate the transmission packet; It is determined that the response packet has been received in the reception determination step, the reception determination step determining whether the response packet to the transmission packet transmitted to the other device is received or not, and the reception determination step. When the response packet is a packet indicating that the packet length of the transmission packet is longer than a predetermined packet length, the response packet is transmitted in the packet length determination step and the packet length determination step. When it is determined that the packet indicates that the packet length of the packet is longer than the predetermined packet length, the other device Characterized in that it comprises a determining device determining step that the have a have devices belong to the same local network and equipment.

According to the present invention, it is possible to transmit packets for which a fragment transmitted to another device is prohibited. It is possible to determine whether or not other devices are devices belonging to the same local network as the own device, depending on whether or not the response packet is a packet indicating that the packet length is longer than a predetermined packet length.

Preferably, the packet generation instructing step is characterized by instructing the packet generation unit to generate a transmission packet in which a fragment is prohibited in an authentication step of packet transmission.

According to the present invention, it is possible to prevent the transmission device from transmitting a transmission packet to another device when authentication fails.

Preferably, in the packet generation instructing step, after it is determined in the device determination step that the other device is not a device belonging to the same local network as the own device, the packet generation unit generates a transmission packet. It is characterized by stopping giving instructions.

According to the present invention, there is provided a transmission method capable of determining whether or not another device connected via the network is a device belonging to the same local network as the own device. be able to.

Preferably, when it is determined in the reception determination step that a response packet has been received, the response packet is the same local network as the own device that transmits when another device successfully receives the transmission packet. The apparatus further includes a packet determination step of determining whether the packet is a packet indicating that the device does not belong to the device. The device determination step is performed in the bucket determination step. When it is determined that the packet is a packet that indicates that the device does not belong to the same local network as the own device to be sent when it is received, the other device belongs to the same local network as the own device. It is characterized that it determines that it is an apparatus.

[0066] According to the present invention, the response packet to the new packet forbidding the fragment sent to the other device is transmitted when the other device receives the transmission packet normally. Device to determine whether it is a device that does not belong to the same local network as the device itself, whether or not other devices belong to the same local network as the device itself. it can.

Preferably, the packet generation instructing step is characterized by instructing the packet generation unit to generate a transmission packet in which a fragment is prohibited in the authentication stage of packet transmission.

Preferably, the packet generation instructing step is performed in the device determination step after the packet generation unit determines that the other device is not a device belonging to the same local network as the own device. It is characterized by stopping giving instructions to generate a transmission packet.

[0071] Preferably, the packet length of the transmission packet in which the fragment is prohibited is 1500 bytes.

According to the present invention, there is provided a transmission method capable of determining whether another device connected via a network is a device belonging to the same local network as the own device. be able to.

According to another aspect of the present invention, the transmission method repeats generation of the transmission packet to the packet generation unit which generates the transmission packet in which the packet length is changed by a predetermined length in accordance with the instruction. A packet generation instruction step of instructing, a reception judgment step of judging whether a response packet to a transmission packet transmitted to another device connected via the network has been received, and a reception judgment step. Note that when it is determined that a response packet has been received, a response time measurement step that measures the response time from when a transmission packet is sent to another device until the response packet for the transmission packet is received. Also, in the response time measurement step, when the response time measured changes stepwise for each specific packet length, the other device itself Belong to the same local network Wa click, Do, characterized in that it comprises a determining device determining step that the device and According to the present invention, the transmission packet in which the packet length is changed by a predetermined length is transmitted to another device, and the response time until the response packet to the transmission packet is received. The relationship between the measured response time and the transmitted packet length can also be measured to determine whether other devices are devices belonging to the same local network as the device itself.

Preferably, the packet generation instructing step is characterized by instructing the packet generation unit to generate a transmission packet in which the packet length is changed by a predetermined length in the authentication stage of packet transmission.

[0079] Preferably, the specific packet length is 48 bytes.

According to the present invention, it is possible to provide a transmission method capable of determining whether another device connected via the network is a device belonging to the same local network as the own device. .

[0080] According to another aspect of the present invention, the transmission method determines whether a reception packet transmitted from another device connected via a network is received or not. A step of determining whether or not the received packet is a fragmented packet when it is determined in the predetermined step of the packet transmission that the received packet is received in the step and the receiving determination step. If the received packet is determined to be a fragmented packet in the fragment determination step, the other device belongs to the same local network as the own device and is determined to be the device. Judgment step And.

According to the present invention, the other device belongs to the same local network as the own device depending on whether or not the received packet is a fragmented packet as well as the other device power. It can be determined whether or not it is force.

According to another aspect of the present invention, a transmission method generates a transmission packet in accordance with an instruction, a packet generation instructing step of instructing a packet generation unit to generate a transmission packet, and connecting via a network The received packet is received at a predetermined stage of packet transmission in a reception judgment step of judging whether or not the received packet transmitted by the other apparatus is received, and in the reception judgment step. When it is determined that the received packet is fragmented, it is determined whether the received packet is fragmented or not, and the received packet is fragmented in the fragment determination step. A device determination step of determining that another device is not a device belonging to the same local network as the own device when it is determined that there is Characterized in that it comprises.

According to the present invention, another device is a device belonging to the same local network as the own device depending on whether the received packet is a fragmented packet or not, and the other device is also a fragmented packet. It can be determined whether or not it is force.

Preferably, the predetermined stage of packet transmission is an authentication stage of packet transmission.

Preferably, in the device determination step, the packet generation instructing step determines that the other device is not a device belonging to the same local network as the own device.

And instructing generation of a packet notifying that the other device is not a device belonging to the same local network as the own device. According to the present invention, by notifying another device that the device is not belonging to the same local network as the own device, the received packet is transmitted from the other device to the own device. Can be reliably prevented.

Brief description of the drawings

FIG. 1 is a block diagram showing a schematic configuration of a network.

FIG. 2 is a block diagram showing a schematic configuration of a system in Embodiment 1.

FIG. 3A is a diagram showing a packet format when transmitting packets on various media.

FIG. 3B is a diagram showing a packet format when transmitting packets on various media.

FIG. 3C is a diagram showing a packet format when transmitting packets on various media.

[FIG. 4] This is a view showing an example of the authentication process performed in the authentication stage between the device A and the device B.

[FIG. 5] A flow chart showing the flow of processing executed by the device control unit of device A.

FIG. 6 is a diagram showing an example of an authentication process performed between the device A and the device B.

[FIG. 7] A flowchart showing the flow of processing executed by the device control unit of the device B.

[Fig. 8] This figure shows how IP packets are mapped to ATM packets in the case of ADSL using PPPoA.

FIG. 9A is a diagram showing the relationship between packet length and transmission time on various media.

FIG. 9B is a diagram showing the relationship between packet length and transmission time on various media.

FIG. 9C is a diagram showing the relationship between packet length and transmission time on various media.

FIG. 10 is a block diagram showing a schematic configuration of a system in a third embodiment.

[FIG. 11] A diagram showing an example of an authentication process performed between the device E and the device B.

FIG. 12 is a flowchart showing the flow of processing executed by the device control unit of device E.

[FIG. 13] A flowchart showing the flow of processing executed by the device control unit of device E.

[FIG. 14] A diagram showing from the start of authentication in DTCP-IP to the start of transmission of copy-controlled content. [FIG. 15] is an explanatory diagram of path MTU discovery.

FIG. 16 is an explanatory diagram of an IP fragment.

[FIG. 17A] A diagram showing the configuration of an IP header of IPv4 and IPv6.

[FIG. 17B] A diagram showing the configuration of an IP header of IPv4 and IPv6.

Explanation of sign

[0091] 101 local network, 102 to 105 devices, 111 local network, 112 to

115 equipment, 121 router, 131 router, 201 equipment A, 202 equipment control unit, 203 transmission packet generation unit, 204 packet transmission / reception unit, 205 reception packet analysis unit, 211 equipment B, 221 network, 411 nortor F, 1001 equipment E , 1002 帘 U 咅, 1003 received packet analysis unit, 1004 RTT measurement unit.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, I will not repeat the detailed explanation of them!

[About Path MTU Discovery and IP Fragments]

First, path MTU discovery and IP fragments, which are not related to the transmission of copy-controlled content, but which are the precursor technology of the present invention, will be described. There is a method to find the optimal value of MTU (Maximum Transmission Unit) as a means to speed up transmission on IP network between devices which do not belong to the same local network. The MTU represents the maximum value of packets that can be transmitted at one time. The method of finding the optimum value of MTU will be described using FIG. 15 and FIG.

FIG. 15 is an explanatory diagram of path MTU discovery. FIG. 16 is an explanatory diagram of an IP fragment. Referring first to FIG. 15, device A 1501 is connected to device B 1504 via router C 1502 and router D 1503. The MTU between the device A1501 and the router C1502 is 1500 bits, the MTU between the norator C1502 and the norator D1503 is 1000 bits, and the MTU between the norator D1503 and the device B1504 is 1500 bytes.

For example, assume that the device A 1501 transmits a packet having a packet length of 1500 bytes illustrated in FIG. 16A to the device B 1504. When router C1502 receives a packet, router C 1502 tries to transmit the received packet to the router D 1503 ahead of it. Since the MUT between the router CI 502 and the router D 1503 is 1000 bytes, it is possible to transmit a packet with a packet length of 1500 bytes as it is. Can not. Therefore, router C1502 divides the packet with a packet length of 1500 bytes shown in FIG. 16 (a) into a packet with a packet length of 1000 bytes and a packet with a packet length of 520 bytes shown in FIG. 16 (b). Send to This packet division performed by the router C 1502 is called a fragment (IP fragment), which causes a reduction in throughput.

[0095] In order to eliminate the generation of IP fragments, a minimum MTU (called a path MTU) on the path from the device A1501 to the device B1504 is found, and the device A1501 initially forces packets with the same packet length as the path MTU. You can send it. The method of finding this Path MTU is called Path MTU Discovery (RFC1191, 1981). The method of finding the path MTU will be described again with reference to FIG.

[0096] First, as shown in Fig. 15 (a), the device A 1501 sets the D flag to prohibit the IP fragment with the bucket length (for example, 1500 bytes) of the maximum MTU that can be handled by the own device. 1) send the packet to device B1504. Here, the D flag for prohibiting IP fragments will be described with reference to FIG.

[0097] FIG. 17A and FIG. 17B are diagrams showing the configuration of IP headers of IPv4 and IPv6. Figure 17A shows the configuration of the IP header of IP version 4 (RFC 791, called IPv4), and prohibits IP fragments. The D flag 1701 is assigned to 1 bit in the IP header. When the D flag 1701 is "0", it indicates that the IP fragment is permitted, and when "1", it indicates that the IP fragment is prohibited. Figure 17B shows the configuration of the IP header of the next-generation IP version 6 (called RFC2460, called IPv6). The IPv6 IP header does not contain the bit corresponding to the D flag. However, since IPv6 prohibits IP fragments, it is always equivalent to the D flag being "1".

Referring again to FIG. 15, apparatus A 1501 transmits a packet having a packet length of 1500 bytes and prohibiting an IP fragment to apparatus B 1504. When router C1502 receives the packet, router C1502 can not send the packet to router D1503 without IP fragmentation, but the IP fragment of the packet is prohibited, so the bucket is Can not be sent to router D1503. In this case, router C1502 discards the packet received from device A1501, and reports that the packet length is longer than the MTU (1000 bytes) between router C1502 and router D1503. ICMP (Internet Control Message Protocol, RFC 792) The packet is sent to device A1501 (Fig. 15 (b)). This ICMP bucket contains information that the maximum MTU that the router C 1502 can handle is 1000 bytes.

The device A 1501 which has received the ICMP packet transmits a packet directed to the device B 1504 this time with a packet length of 1000 bytes and prohibiting an IP fragment (FIG. 15 (c)). The router C 1502 that has received the packet transmits the received packet to the router D 1503 this time. In this way, the device A 1501 can know that the path MTU to the device B 1504 is 1000 bytes. Note that if there is a path with several MTUs of smaller routers S. More MTUs! ルータ MTUs in the middle, but even if the ICMP packets shown in Fig. 15 (b) are sent, Fig. 15 (c A negative MTU can be found by repeating the transmission of a packet with the packet length of) shortened.

[0100] Also, although it is not related to the transmission of copy-controlled content, ATM (Asynchronous Transfer Mode) is often used as a backbone when connecting the local network to the Internet! Focusing on the method, it is also considered to find the optimum value of MTU when ATM cellization is considered. This is because the payload length of the ATM cell is 48 bytes, and when the payload length is less than 48, the padding for the lack of 48 bytes is performed. The padded packet is not a valid packet, which causes a reduction in throughput. A method of measuring throughput is used to find the ヽ MTU where this padding does not occur.

[0101] Techniques such as Path MTU Discovery and IP Fragmentation described above are described in the following documents.

[0102] "Internet Control Message Protocol", [online], September 1981, RFC 792,

[Search on July 30, 2004], Internet URL: http: www.ietf.org/rfc/rfc0792.t xt>

"INTERNTE PROTOCOL", [online], September 1981, RFC 791, [2004] Search July 30], Internet URL: http: 〃 www.ietf.org/rfc/rfc0791.txt>

S. Deering et. Ai, 'Internet Protocol Version 6 (IPv6) Specification, [online]

, December 1998, RFC 2460 [Search on July 30, 2004], Internet URL: htt p: // www.ietf.org/rfc/rfc2460.txt)

J. Mogul et. Al, "Path MTU Discovery", [online], November 1990, RFC 19

91, [Search on July 30, 2004], Internet URL: http: www.ietf.org/rfc/rfcl l

91.txt)

J. McCann et. Al, "Path MTU Discovery for IP version 6, [online], August 1996, RFC 1981, [Search on July 30, 2004], Internet URL: http: 〃 ww w.ietf. org / rfc / rfcl981.txt>

"On the fastest MTU considering ATM cellization", [online], [search on July 30, 2004], Internet URL: http://www.geocities.jp/hamdah 3502213 / osugi.osg. htm)

[Embodiment 1]

A device (sender) that belongs to a network in a home (local network) based on technologies such as the path MTU mentioned above and IP fragments, and tries to transmit copy-controlled content to other devices. When doing so, how to prevent copy-controlled content from leaking out to other devices (receivers) outside the home network will be explained in detail.

FIG. 1 is a block diagram showing a schematic configuration of a network. The local networks 101 and 111 are, for example, local networks configured by Ethernet (registered trademark) or wireless LAN. In Fig. 1, it is assumed that at least one local network is a home network. Here, it is assumed that the local network 101 is a home network.

The local network 101 is also configured with, for example, the device 102, the device 103, the device 104, and the device 105. The local network 111 is configured of, for example, the device 112, the device 113, the device 114, and the device 115 and the like. The devices 102 to 105, etc. and the devices 112 to 115, etc. are, for example, a computer, a digital power on digital video camera, a DVD recorder. It is a device that can transmit and receive digitally encoded content represented by da. As described above, the devices 102 to 105, etc. belonging to the local network 101, which is a home network, allow copying and moving of copy-controlled content. On the other hand, between the devices 102 to 105 belonging to the local network 101 and the devices 112 to 115 belonging to the local network 111, the copy and move of the copy-controlled content is unacceptable.

Local network 101 is connected to local network 111 via, for example, router 121 and router 131 (the Internet). As a result, the device of the local network 101 (for example, the device 102) is copy-controlled with the device (for example, the device 112) of the local network 111 so that exchange of contents becomes possible!

Although not shown in FIG. 1, the local network 101 and the local network 111 are also connected to other local networks and the like through the router 121 and the router 131 and the like.

For example, when device 102 of local network 101 tries to transmit copy-controlled content to another device, the copy-controlled content leaks to devices other than local network 101 to which device 102 belongs. In order to prevent this, the device 102 needs to determine whether the other device belongs to the same local network 101 as the device 102.

[0108] Hereinafter, when a device belonging to a home network tries to transmit copy-controlled content to another device, it is possible to use a device other than the home network to which the device with copy control content belongs. How to determine whether a device belongs to the same home network as another device and determines whether it is a device that does not leak to other devices I will explain in detail.

FIG. 2 is a block diagram showing a schematic configuration of a system in the first embodiment. The system is composed of a device A 201, a device B 211 and a network 221. Here, the device A 201 will be described as a device (sender) that transmits copy-controlled content, and the device B 211 will be described as a device (receiver) that receives copy-controlled content. The network 221 may be a local network constructed by Ethernet (registered trademark) or a wireless LAN depending on whether the device B 211 belongs to the same local network as the device A 201 and is a device that belongs to the same local network. , The Internet, etc. Here, it is assumed that the role network is a home network.

[0111] When device A201 tries to transmit copy-controlled content to device B211, in order to prevent the copy-controlled content from leaking out to a device other than the local network to which device A201 belongs, The device A 201 determines whether the device B 211 belongs to the same local network as the device A 201 or not before transmitting the copy-controlled content to the device B 211 (authentication step).

The device A 201 includes a device control unit 202, a transmission packet generation unit 203, a packet transmission / reception unit 204, and a reception packet analysis unit 205. Since the device B211 has the same configuration as the device A201, the device A201 will be mainly described here.

The device control unit 202 of the device A 201 is a portion that controls the overall operation of the device A 201.

The device control unit 202 determines the generation of a packet to be transmitted to the device B 211 or the like based on the internal state of the device A 201 and the analysis result input from the packet analysis unit 205 described later. Direct the generation of

When device A 201 tries to transmit copy-controlled content to device B 211, the device B 211 checks whether it is a device belonging to the same local network as device A 201. The device control unit 202 of A201 generates a confirmation packet (a reply packet etc. to be described later) for confirming whether or not the device B211 belongs to the same local network as the device A201 in the authentication stage. Command to the transmission packet generation unit 203 of FIG.

The transmission packet generation unit 203 of the device A 201 generates a packet according to an instruction from the device control unit 202, and outputs the generated packet to the packet transmission / reception unit 204 of the device A 201. The packet transmission / reception unit 204 of the device A 201 transmits the packet input from the transmission packet generation unit 203 of the device A 201 to the device B 211 connected via the network 221. In addition, the packet transmission / reception unit 204 of the device A 201 sends a response packet to the transmitted packet. The packet received as a packet is output to the received packet analysis unit 205 of the device A 201. The receiving buckett analysis unit 205 of the device A201 analyzes the packet length of the packet, the presence or absence of a flag, the type of packet, etc. input from the buckett transmitting / receiving unit 204 of the device A201, and outputs the analysis result to the device control unit 202 of the device A201. Do.

The device control unit 202 of the device A 201 determines whether the device B 211 belongs to the same local network as the device A 201 based on the analysis result input from the received packet analysis unit 205. If the device control unit 202 determines that the device B 211 belongs to the same local network as the device A 201 and determines that the device B 211 is a device, the device control unit 202 aborts the authentication process and does not transmit the copy-controlled content to the device B 211. On the other hand, when determining that the device B 211 belongs to the same local network as the device A 201, the device control unit 202 transmits the copy-controlled content to the device B 211 after the authentication process is completed.

The following specifically describes how the device control unit 202 of the device A201 determines whether the device B211 belongs to the same local network as the device A201.

Next, types of packet format will be described with reference to FIG. 3A, FIG. 3B and FIG. 3C. Figures 3A, 3B and 3C illustrate packet formats when transmitting packets on various media.

[0119] FIG. 3A shows a packet format when transmitting a packet on Ethernet (registered trademark). FIG. 3B shows a packet format when transmitting a packet on a wireless LAN (IEEE802.11). Figure 3C shows the packet format when transmitting packets on ADSL or FTTH using PPPoE (PPP over Ethernet (registered trademark), FRC2516).

As shown in FIG. 3A, the packet format for transmitting a packet on Ethernet (registered trademark) is Ethernet (registered trademark) header 301, IP header 302, IP payload 303, and FCS (Frame Check Sequence) 304. Force is composed! When transmitting a packet on Ethernet (registered trademark), the maximum value (maximum MTU) of the packet that can be transmitted at one time is 1500 Ny and the packet length of the IP header 302 and the IP payload 303 is 150. It will be within 0 bytes.

As shown in FIG. 3B, the packet format for transmitting a packet on a wireless LAN (IEEE 802. 11) is: 802. 11 header 311, LLC / SNAP field 312, IP header 31 3, IP payload 314 and FCS315 are configured. The maximum MTU for sending packets on a wireless LAN (IEEE802.11) is 2304 bytes, and the combined packet length of the LLCZSNAP field 312, the IP header 313 and the IP payload 314 is within 2304 bytes. When transmitting a packet on a wireless LAN (IEEE802.11), it is possible to make the MTU 1500 bytes in accordance with Ethernet (registered trademark). In this case, as shown in FIG. 3B, the total packet length of the IP header 313 and the IP payload 314 is within 1500 Nt.

As shown in FIG. 3C, when transmitting a packet on ADSL or FTTH using PPPoE, the packet format is transmission path dependent header 321, ISP dependent header 322, PPPoE field 323, PPP field 324, IP header 325, IP payload 326 and FCS 327 are also configured. When transmitting a packet by ADSL etc. using PPPoE, the maximum MTU is 1500 bytes, and the packet length including the ISP dependent header 322, the PPPoE field 323, the PPP field 324, the IP header 325 and the IP payload 326 is It will be less than 1500 bytes. Since the ISP-dependent header 322, the PPPoE field 323, and the PPP field 324 have finite sizes, the combined packet length of the IP header 325 and the IP payload 326 is always less than 1500 bytes.

Generally, Ethernet (registered trademark) and a wireless LAN are used for communication between devices belonging to the same local network. Therefore, a packet having a packet length (the size of the combined IP header and IP payload) transmitted by a certain device can reach other devices without being IP fragmented on the way.

On the other hand, in communication between devices which do not belong to the same local network, generally, ADSL or the like using PPPoE is used. Therefore, a packet with a packet length of 1500 bytes (the combined size of the IP header and the IP payload) sent by one device can not reach other devices if it is not fragmented IP in the middle! /.

As described above, communication between devices not belonging to the same local network is generally performed In ADSL, etc. using PPPoE, which has been used for this purpose, a packet with a packet length of 1500 bytes can not reach other devices without IP fragmentation on the way. The device control unit 202 determines whether or not the device B 211 is a device belonging to the same network as the device A 201. Again referring to FIG.

When the device A 201 tries to transmit the copy-controlled content to the device B 211, the device control unit 202 of the device A 201 sends a packet length of 1500 bytes to the transmission packet generation unit 203 of the device A 201 at the authentication stage. , And instructs to generate a packet in which the value of D flag is set to "1" (IP fragment is prohibited).

The packet with a packet length of 1500 bytes may be a dummy packet for confirmation or a packet in which the packet length is 1500 bytes by padding after the packet to be originally sent.

When the device B211 belongs to the same local network as the device A201, as described above, the device A201 and the device B211 are generally connected by Ethernet (registered trademark) or a wireless LAN. ing. Therefore, it is possible to set the path MTU of the network 221 between the device A 201 and the device B 211 to 1500 bytes. In this case, a packet having a packet length of 1500 bytes in total of the IP header and the IP payload transmitted from the device A201 can reach the device B 211 without being IP-fragmented in the network 221.

When the device B 211 receives a packet transmitted from the device A 201 normally, it always sends a predetermined response packet indicating that the packet has been received normally to the device A 201. This response packet may include, for example, data indicating that the device B 211 belongs to the same low power network as the device A 201 and indicates that the device B 211 is a device.

The device control unit 202 of the device A 201 indicates that the analysis result input from the received packet analysis unit 205 is a response packet indicating that a packet having a packet length of 1500 bytes transmitted from the power device A 201 has been successfully received. If it is, it is determined that the device B211 belongs to the same local network as the device A201. In this case, the device A201 After the authentication process is completed, the copy-controlled content is sent to the device B 211.

On the other hand, when the device B211 is not a device belonging to the same local network as the device A201, as described above, the device A201 and the device B211 are generally connected by ADSL or the like using PPPoE. ing. Therefore, the path MTU of the network 221 provided between the device A 201 and the device B 211 is less than 1500 bytes. In this case, a packet with a packet length of 1500 bytes including the IP header and the IP payload sent from the device A201 can not reach the device B211 unless it is IP fragmented in the network! / ヽ

However, the packet transmitted from the device A 201 can not be IP fragmented because the D flag is “1”. In this case, the network 221 (for example, a router provided in the network 221, etc.) abandons the packet transmitted from the device A 201, and sends an ICMP packet as a response packet notifying that the packet length is longer than a predetermined packet length. Send to device A 201.

When the device control unit 202 of the device A 201 indicates that the analysis result input from the received packet analysis unit 205 is an ICMP packet notifying that the packet length is longer than a predetermined packet length, It determines that B211 belongs to the same local network as device A201 and is! /,! / ヽ device, and terminates the authentication process. In this case, device A201 does not send the copied content to device B211!

In addition, device A 201 transmits a packet having a packet length of 1500 bytes and a D flag value of “1”, and the force is also from the ICMP packet or device B 211 until the certain time elapses. It is also conceivable that neither of the predetermined response packets sent is received. In such a case, the device A 201 sends a packet having a packet length of 1500 bytes and the value of the D flag set to “1” to the device B 211 again.

In addition, in a router or the like provided in the network 221, the value of the D flag may be illegally rewritten from “1” to “0”. In this case, an ICMP packet should be transmitted to the device A 201 from a router or the like originally provided in the network 221. However, because the value of the D flag has been illegally rewritten, the pass sent from the device A 201 is The packet is IP fragmented by a router or the like provided in the network 221 and reaches the device B 211. Therefore, the received packet analysis unit 205 of the device B 211 checks whether the value of the D flag is incorrectly rewritten, and whether the received packet is IP fragmented or not. deep. In this case, the device B 211 transmits a packet of authentication failure to the device A 201 to terminate the authentication process.

FIG. 4 is a diagram showing an example of an authentication process performed between the device A 201 and the device B 211. In FIG. 4, device A (source device) 201 is a transmitter for transmitting copy-controlled content, and device B (sink device) 211 is a receiver for receiving copy-controlled content, as described above. explain. Also, in the description of FIG. 4, the device B211 is described as being a device that does not belong to the same local network as the device A201.

A router F411 is provided in the network between the device A201 and the device B211.

In the router F411, the device B211 does not belong to the same local network as the device A201.

V, one of the routers that may be present in the network between the device A 201 and the device B 211 when the device is a device.

First, in S401, the device B 211 transmits an authentication request packet to the device A 201 that holds the copy-controlled content. The authentication request packet contains data of the random value B and the device certificate B as described above. In step S402, the device A 201 transmits, to the device B 211, an ACK packet indicating that the authentication request packet has been received.

In S403, the device A 201 transmits to the device B 211 a reply packet in which the packet length is 1500 bytes and the value of the D flag is “1”. This return packet contains the data of random number A and device certificate A as described above. This reply packet is an extension of the packet length of the reply packet shown in S 1303 of FIG. 13 to 1500 bytes.

As described above, the device B211 does not belong to the same local network as the device A201.

V. When the device, the path MTU between the device A 201 and the device B 211 is less than 1500 bytes. In FIG. 4, for example, the path MTU ahead of router F411 is less than 1500 bytes. I assume. Therefore, if the packet length is 1500 bytes and the reply packet with the D flag value set to “1” is received, the router F411 may send the reply packet to the device B211 if it does not fragment the reply packet. Can not ,.

However, since the D flag of the reply packet received by the router F 411 is “1”, the router F 411 can not IP fragment the reply packet. In this case, in step S404, the router F411 abandons the reply packet received from the device A201, and the packet length of the packet received from the device A201 is longer than the predetermined packet length, and therefore, the V error is displayed. The ICMP packet shown is sent to the device A 201 as a response packet. The device A 201 that has received the ICMP packet determines that the device B 211 belongs to the same local network as the device A 201 and is a device.

In step S405, the device A 201 transmits a packet notifying an authentication failure to the device B 211, and terminates the authentication process. When the device B 211 receives the packet notifying the authentication failure, the device B 211 aborts the authentication process, and transmits an ACK packet indicating that the device A 201 has received the packet notifying the authentication failure in S 406. In this case, the device A201 does not transmit the copy-controlled content to the device B211.

When the reply packet transmitted from the device A 201 is received by the device B 211, the device B 211 confirms that the packet length of the reply packet is 1500 bytes and the D flag is “1”. Keep it. Then, when the packet length of the received reply packet is 1 500 bytes, or when the D flag is “0”, the device B 211 transmits a packet of authentication failure to the device A 201 so as to abort the authentication process. Keep it.

In the above-described first embodiment, device A 201 changes the packet length and D flag of the reply packet used in the conventional authentication process, and device B 211 belongs to the same small network as device A 201. A method that uses only a packet to check whether the device B211 is a device that belongs to the same local network as the device A201. It may be

Also, in order to check whether the device B 211 belongs to the same local network as the device A 201, the reply packet transmitted from the device A 201 is the transmission / reception of the authentication request packet, the transmission / reception of the key exchange message Until finished (more preferably, key exchange message It is preferable that the communication be performed between the start of transmission and reception of

Further, in the above-described first embodiment, the confirmation packet for confirming whether the device B 211 belongs to the same local network as the device A 201 is transmitted from the device A 201 to the device B 211. An example is shown! / I'm sorry, but it is possible to send a confirmation packet from device B211 to device A201.

FIG. 5 is a flow chart showing the flow of processing executed by the device control unit 202 of the device A 201. First, in S501, it is determined whether the authentication request packet transmitted from the device B 211 has been received. If it is determined that the authentication request packet has not been received, the process of this flowchart ends because it is not the authentication stage. On the other hand, when it is determined that the authentication request bucket has been received, the process proceeds to the process of S502 to perform the authentication process. In S502, processing is performed to instruct the transmission packet generation unit 203 to generate a reply packet in which the packet length is 1500 bytes and the value of the D flag is "1".

At S 503, it is determined whether a response packet to the return packet has been received. As described above, this response packet is provided in the network between the device A 201 and the device B 211, and the router F 411 is transmitted. The ICMP packet transmitted and the reply packet transmitted from the device A 201 are the device B 211. And a predetermined response packet transmitted from the device B 211 when received normally.

When the packet transmitting / receiving unit 204 of the device A 201 receives the response packet, the received response packet is analyzed by the received packet analysis unit 205 of the device A 201, and the analysis result is output to the device control unit 202 of the device A 201. Ru. Thus, the device control unit 202 of the device A 201 can determine whether a response packet has been received. If it is determined that the response packet has been received, the process proceeds to step S505. On the other hand, if it is determined that the response packet has not been received, the process proceeds to step S504.

[0150] In S504, it is determined whether or not a certain period of time has elapsed since the transmission packet generation unit 203 of the device A 201 is instructed to generate a reply packet. If it is determined that the predetermined time has not elapsed, the process returns to the process of S503, and the processes of S503 and S504 are repeated until the predetermined time elapses. On the other hand, when it is determined that the predetermined time has elapsed, the process returns to the processing of S502, and the processing power S of S502, S503, and S504 is performed again. In S505, it is determined whether the analysis result obtained by analyzing the response packet in the received packet analysis unit 205 of the device A 201 indicates that it is an ICMP packet. The analysis result indicates that the packet is an ICMP packet! /, The process proceeds to the process of S508, and the analysis result indicates that the packet is not an ICMP packet, and the process proceeds to the process of S506.

In S506, it is determined that the device B211 is a device belonging to the same local network as the device A201, and generation of a key exchange packet, which is a continuation of authentication processing in the transmission packet generation unit 203 of the device A201. Processing is performed.

Thereafter, in S507, a process of instructing the transmission packet generation unit 203 of the device A 201 to generate a packet of the copy-controlled content is performed. Thus, the content subjected to copy control is transmitted from the device A 201 to the device B 211.

In S508, it is determined that the device B211 is not a device belonging to the same local network as the device A201, and instructs the transmission packet generation unit 203 of the device A201 to generate a packet notifying an authentication failure. Processing is performed.

Since it is determined in S508 that the device B211 is not a device belonging to the same local network as the device A201, in S509, a process of aborting the authentication process is performed. In this case, the process of instructing the transmission packet generation unit 203 of the device A 201 to generate a packet of the content subjected to copy control is performed. The content subjected to copy control from the device A 201 to the device B 211 is not transmitted.

The device A 201 or the device B 211 having the functions described above is installed in a personal computer, digital camera, digital video camera, DVD recorder or the like that can handle digitized contents.

In this way, the device control unit 202 of the device A 201 is a packet that is transmitted to the device B 211 connected via the network 211 and has a length of 1500 bytes and the value of the D flag. The device B 211 belongs to the same local network as the device A 201 by judging whether the response packet to the packet of “1” is an ICMP packet or an ACK packet indicating that the packet has been successfully received. It can be determined whether the device is a force or not.

In addition, the device control unit 202 of the device A 201 returns in the authentication step whether the device B 211 is a device belonging to the same local network as the device A 201 or not. In order to instruct the transmission packet generation unit 203 of the device A 201 to generate a transmission packet, when it is determined that the device B 211 is not a device belonging to the same local network as the device A 201, copy-controlled content is transmitted. The communication with the device B 211 can be terminated prior to the As a result, it is possible to prevent the flow of copy-controlled content from the device A 201 to the device B 211 belonging to a local network different from the device A 201.

In addition, even if the value of the D flag of the packet transmitted by the device A201 is illegally rewritten by a router or the like provided between the device A201 and the device B201, the authentication process is cut off. Therefore, it is possible to prevent the flow of copy-controlled content from the device A 201 to the device B 211.

Also, when no response packet is received during a fixed time period after instructing the transmission packet generation unit 203 of the device A 201 to generate a reply packet, the transmission packet generation unit of the device A 201 does not receive any response packet. In order to instruct 203 to generate a reply packet again, it is possible to determine as much as possible whether the device B2 11 is a device belonging to the same local network as the device A 201 or not.

In the above-described first embodiment, when it is determined in S504 of FIG. 5 that the predetermined time has elapsed, the present invention is not limited to this. For example, if it is determined in S504 that the predetermined time has elapsed, the process may proceed to the process of S509 and the authentication process may be aborted. In this way, when it is unknown whether the device B211 belongs to the same local network as the device A201, it is possible to prevent the flow of copy-controlled content from the device A201 to the device B211. be able to.

Second Embodiment

A second embodiment will now be described. In the second embodiment, points different from the first embodiment will be mainly described. In the first embodiment, whether device A211 is a device belonging to the same local network as device A201 or not is determined by the type of the response packet to the reply packet transmitted with device A 201 with the value of D flag set to “1”. It was judged. Embodiment

In step 2, the reply packet in which the value of the D flag transmitted from the device A 201 is set to “0” is received. The device B 211 determines whether or not the device B 211 is a device belonging to the same local network as the device A 201 based on the status of the received reply packet.

FIG. 6 is a diagram showing an example of an authentication process performed between the device A 201 and the device B 211. In the first embodiment, the D flag of the reply packet transmitted from the device A 211 to the device B is the power S “1”, and thus the power can be applied to both IPv4 and IPv6. In the second embodiment, the device A 201 to Since the D flag of the reply packet sent to the device B 211 is “0”, it can be applied only to IPv4.

In FIG. 6, device A (source device) 201 is a transmitter for transmitting copy-controlled content, and device B (sink device) 211 is for reception of copy-controlled content, as described above. It explains as a container. Further, in the description of FIG. 6, it is assumed that the device B211 is a device not belonging to the same local network as the device A201.

First, in step S601, the device B 211 transmits an authentication request packet to the device A 201 that holds the copy-controlled content. The authentication request packet contains data of random number B and device certificate B. In step S602, the device A 201 transmits, to the device B 211, an ACK packet indicating that the authentication request packet has been received.

In step S603, the device A 201 transmits, to the device B 211, a reply packet in which the packet length is 1500 bytes and the value of the D flag is “0”. This return packet contains data of random number A and device certificate A. Further, this reply packet is obtained by extending the packet length of the reply packet shown in S1303 of FIG. 13 to 1500 bytes.

As described above, when the device B 211 is not belonging to the same local network as the device A 201 V, and is a device, the path MTU between the device A 201 and the device B 211 is less than 1500 bytes. In FIG. 6, it is assumed that the path MTU ahead of the router F411 is less than 1500 bytes as described above. Therefore, router F411 that receives a reply packet with a packet length of 1500 bytes and a D flag value of “0” can not send the reply packet to device B211 unless it fragments the reply packet. ! /.

In Embodiment 2, since the value of the D flag of the return packet is “0”, the router F 411 can IP fragment the return packet. In this case, the router F 411 splits the reply packet into a plurality of packets (in the second embodiment, two packets 604 and 605). IP fragment is shown in the example below, and two IP-fragmented return packets are sent to device B 211.

[0168] Upon receiving both of the two IP-fragmented return packets 604 and 605, the device B 211 reconstructs the two IP-fragmented return packets 604 and 605 into one original return packet. In step S606, the device B 211 transmits, to the device A 201, an ACK packet indicating that the return packet has been received. When receiving the IP fragmented return packet, the device B 211 determines that the device B 211 is not a device belonging to the same local network as the device A 201.

In step S 607, the device B 211 transmits a packet notifying an authentication failure to the device A 201, and terminates the authentication process. When the device A 201 receives the packet notifying the authentication failure, the device A 201 aborts the authentication process, and transmits an ACK packet indicating that the device B 211 has received the packet notifying the authentication failure in S 608. In this case, the device A 201 does not transmit the copy-controlled content to the device B 211.

It is also conceivable that the reply packet transmitted from the device A 201 reaches the device B 211 without being fragmented by IP. In this case, the device B 211 confirms that the packet length of the return packet transmitted from the device A 201 is 1500 bytes. Then, when the packet length of the received return packet is not 1500 bytes, the device B 211 transmits a packet of authentication failure to the device A 201 so as to abort the authentication process.

[0171] By doing this, when it is unclear whether the device B211 is a device belonging to the same local network as the device A201 or not, the content copied for control from the device A201 to the device B211 leaks out Can be blocked.

In the above-described second embodiment, device A 201 changes the packet length of the reply packet used in the conventional authentication process, and device B 211 is a device belonging to the same local network as device A 201. This is a method that uses a packet that is used only to check whether the device B211 that is also used as a packet to check whether there is a device is a device belonging to the same local network as the device A201. Well,

In addition, in order to confirm whether the device B211 belongs to the same local network as the device A201, the reply packet transmitted from the device A201 is sent as an authentication request packet. It is preferable that exchange is performed during the period until transmission / reception of the key exchange message is completed (more preferably, transmission / reception of the key exchange message is started).

FIG. 7 is a flowchart showing the flow of processing executed by the device control unit 202 of the device B 211. First, in S701, it is determined whether a process of instructing the transmission packet generation unit 203 of the device B 211 to generate an authentication request packet has been performed. Processing for instructing the generation of a certification request bucket is performed, and this is not the certification phase, so the processing of this flow chart ends. On the other hand, when the process of instructing generation of the authentication request packet is performed, the process proceeds to the process of S702 in order to perform the authentication process.

At S702, it is determined whether a return packet has been received. The reply packet is a packet transmitted when the device A 201 receives the authentication request packet transmitted from the device B 211 as described above. When the response bucket is received by the packet transmission / reception unit 204 of the device B211, the received packet received is analyzed by the received packet analysis unit 205 of the device B211, and the analysis result is output to the device control unit 202 of the device B211. Then, the device control unit 202 can determine whether or not the reply packet has been received. If it is determined that the reply packet has been received, the process proceeds to step S704. If it is determined that the reply packet has not been received, the process proceeds to step S703.

[0176] In S703, generation of an authentication request packet is instructed to the transmission packet generation unit 203 of the device B 211, and it is determined whether or not the force has reached a certain time. If it is determined that the predetermined time has not elapsed, the process returns to S702, and the processes of S702 and S703 are repeated until the predetermined time elapses. On the other hand, when it is determined that the predetermined time has elapsed, the process proceeds to the process of S708 described later, and a process of aborting the authentication process is performed.

In S704, the received packet analysis unit 205 of the device B 211 determines whether or not the analysis result obtained by deciphering the reply packet indicates that the reply packet is an IP fragmented reply packet. If it is indicated that the analysis result is an IP fragmented return packet, the process proceeds to the process of S707, and if not, the process proceeds to the process of S705.

In S705, it is determined that the device B211 is a device belonging to the same local network as the device A201, and generation of a packet for notifying the transmission packet generation unit 203 of the device B211 of authentication success is performed. A process of instructing is performed. Notify of authentication success Packets may be packets only for notification purpose, or packets following the authentication phase

(Key exchange packet etc.) may be used. After that, in S706, the process of receiving the copy control content packet transmitted from the device A 201 is performed.

At S 707, it is determined that the device B 211 is not a device belonging to the same local network as the device A 201, and at the same time, it instructs the transmission packet generation unit 203 of the device B 211 to generate a packet notifying an authentication failure. Processing is performed.

Since it is determined in S 707 that the device B 211 is not a device belonging to the same local network as the device A 201, in S 708, a process of aborting the authentication process is performed. In this case, the copy-controlled content is not transmitted from the device A 201 to the device B 211.

The device A 201 or the device B 211 having the functions described above is installed in a personal computer, digital camera, digital video camera, DVD recorder, or the like that can handle digitized contents.

In this way, the device control unit 202 of the device B 211 determines whether or not the return packet transmitted from the device A 201 connected via the network is IP fragmented, thereby the device B 211. It can be determined whether or not the device belongs to the same local network as the device A201.

[0183] The device control unit 202 of the device B211 performs IP fragmentation on the return packet for checking whether the device B211 is a device belonging to the same local network as the device A201 at the authentication stage. If it is determined that the device B211 is not a device belonging to the same low power nore network as the device A201, the device A211 and the device A201 are transmitted prior to the step of transmitting the copy-controlled content. Communication can be terminated. As a result, the device A 201 can belong to a local network different from the device A and can prevent the copy controlled content from being leaked to the device B 211.

In the above-described second embodiment, when it is determined in S703 of FIG. 7 that the predetermined time has elapsed, the process proceeds to the process of S708 and shows an example in which the process of aborting the authentication process is performed. It is not limited. For example, if it is determined in S703 that a predetermined time has elapsed However, the processing may return to the processing of S701, and the processing power S of S701, S702, and S703 may be performed again.

[0185] In this way, transmission of the device B211 is not performed when a reply packet is not received within a predetermined period of time after the transmission packet generation unit 203 of the device B211 is instructed to generate an authentication request packet. In order to instruct the packet unit 203 to generate an authentication request packet again, it is determined as much as possible whether or not the device B 211 is a device belonging to the same low power nore network as the device A 201. be able to.

Third Embodiment

A third embodiment will now be described. In this third embodiment, points different from the first embodiment and the second embodiment will be mainly described. In the third embodiment, when the packet length to be transmitted to a certain device power or another device is changed, the change of the transmission time with respect to the change of the packet length is measured, whereby the same local device as the other device is. This embodiment is different from Embodiments 1 and 2 in that it is determined whether or not it belongs to a network. The method will be described in detail below.

When ADSL is used in communication between devices not belonging to the same local network, communication may be performed using PPPoA (PPP over AAL5, RFC2364). PPPoA is a specification for establishing PPP connections over ATM networks. When communication is performed using PPPoA, a packet with a packet length of 1 500 bytes may also be able to reach another device without being fragmented IP on the way. In this case, the method described in the first embodiment and the second embodiment can not prevent the leakage to devices other than the local network to which the copy-controlled content device belongs.

[0187] When transmitting a packet on ADSL using PPPoA, the packet is finally mapped to an ATM packet (ATM cellification) and transmitted. FIG. 8 is a diagram showing how IP packets are mapped to ATM packets in the case of AD SL using PPPoA. Figure 8 (a) shows the packet format before being mapped to an ATM cell when transmitting an IP packet on ADSL using PPPoA. Figure 8 (b) shows the packet format when transmitting packets on an ATM network. As shown in FIG. 8 (a), the bucket format when transmitting a packet on ADSL using PPPoA is LLC / SNAP 801, PPP field 802, IP header 803, IP payload 804, It comprises a PAD field 805 and a trailer 806. LLCZSNA P field 801, PPP field 802, IP header 803 and IP payload 804 are the same as those described in the Ethernet (registered trademark), wireless LAN and PPPoE frame formats described above. The Trailer field 806 contains length information up to LLCZ SNAP field 80 1 power IP payload 804, a CRC for error detection, and the like. A PAD field 805 is padding, which is used when ATM cellization is performed.

As shown in FIG. 8 (b), the packet format when transmitting a packet on an ATM network is composed of an ATM header and an ATM payload. The ATM packet is a fixed 53-byte packet consisting of an 5-byte long ATM header and a 48-byte long ATM payload.

[0190] When converting the packet shown in Fig. 8 (a) into an ATM cell shown in Fig. 8 (b), the ATM payload of the final ATM packet may be less than 842 bytes by 8 bytes. At this time, the padding of the PAD field 805 in FIG. 8A described above is added to make it 48 bytes.

[0191] FIG. 9A, FIG. 9B and FIG. 9C are diagrams showing the relationship between packet length and transmission time on various media. FIG. 9A is a diagram showing the relationship between packet length and transmission time on an ATM network. FIG. 9B is a diagram showing the relationship between packet length and transmission time on Ethernet (registered trademark) or wireless LAN (IEEE802.1 ib). FIG. 9C is a diagram showing the relationship between packet length and transmission time on a wireless LAN (IEEE802.11a, IEEE802.11g).

[0192] When carrying out an ATM cell, since padding is performed as described above, even if the packet length desired to be transmitted changes, it takes to transmit an ATM packet as long as the number of ATM packets after ATM cellization does not change. Time does not change. Therefore, on an ATM network, as shown in FIG. 9A, the change in transmission time when the packet length changes becomes stepwise.

On the other hand, when transmitting a packet on Ethernet (registered trademark) or wireless LAN (IEEE 802.1 lb), the transmission time changes in units of 1 byte according to the change in packet length as shown in FIG. 9B. Do. Also, wireless LANs (IEEE802.11a and IEEE802.l lg) can be used as OFDM (Ortho As shown in Fig. 9C, since the gonal Frequency Division Multiplexing modulation scheme is used, the transmission time change power in OFDM symbol units is different from that of ATM bytes by up to 27 bytes.

Therefore, by examining the relationship between packet length and transmission time, it is determined whether the network between one device and another device includes an ATM network, that is, the same local device as another device. You can check if the device belongs to the network or not. The transmission time can be obtained by measuring the RTT described above.

[0195] When measuring RTT, a response packet of a predetermined length and having a predetermined length may be sent to another device that has received an RTT measurement packet transmitted by a certain device. Although it is conceivable, it is preferable to send a response packet of the same packet length as the RTT measurement packet. In this way, the influence of the change in transmission time on the change in packet length can be doubled, and the steps in the graph shown in FIG. 9A can be clarified. Examples of such RTT measurement packets and response packets are Echo Message (Type 8) and Echo Reply Message (Type O) of ICMP packets used as a ping command. In addition, since RTT tends to increase as the network gets busy, it is preferable to use the minimum value among multiple measurements.

FIG. 10 is a block diagram showing a schematic configuration of a system in the third embodiment. The system is composed of a device E 1001, a device B 211 and a network 221. Here, device E1001 will be described as a device (sender) that transmits copy-controlled content, and device B211 will be described as a device (receiver) that receives copy-controlled content. In the third embodiment, the device B211, which is a receiver, has the same configuration as the first embodiment and the second embodiment, but may have the same configuration as the device E1001.

As in Embodiment 1 and Embodiment 2, the network 221 is Ethernet (registered trademark) or a wireless LAN depending on whether the device B 211 belongs to the same local network as the device E 1001. It is built on the Internet, etc., or it can be a private network.

[0198] When the device E1001 tries to transmit the copy-controlled content to the device B211, the copy-controlled content corresponds to the local network to which the device E1001 belongs. The device E1001 is copy-controlled to determine whether the device B211 is a device belonging to the same local network as the device E1001 in order to prevent the leakage to the device other than the device. Before transmitting to the device B 211 (authentication step).

The device E 1001 includes a device control unit 1002, a transmission packet generation unit 203, a packet transmission / reception unit 204, a received packet analysis unit 1003, and an RTT measurement unit 1004. When the device E1001 tries to transmit the copy-controlled content to the device B211, in order to check whether the device B211 belongs to the same local network as the device E1001, generation of RTT measurement packet is performed. It instructs the transmission packet generation unit 203 of the device E1001. The device control unit 1002 outputs, to the RTT measurement unit 1004, information on the time (timing) at which the transmission packet generation unit 203 of the device E1001 is instructed to generate the RTT measurement packet.

[0200] The transmission packet generation unit 203 of the device E1001 generates an RTT measurement packet according to an instruction from the device control unit 1002, and outputs the generated RTT measurement packet to the packet transmission / reception unit 204 of the device E1001. The packet transmission / reception unit 204 of the device E1001 is connected to the RTT measurement packet input from the transmission packet generation unit 203 of the device E1001 via the network 221 and transmits it to the device B211.

Also, the packet transmission / reception unit 204 of the device E 1001 outputs a response packet to the RTT measurement packet received from the device B 211 to the received packet analysis unit 1003. The reception bucket analysis unit 1003 outputs the analysis result to the device control unit 1002, and outputs information on the time (timing) at which the response packet is input from the packet transmission / reception unit 204 to the RTT measurement unit 1004.

In the RTT measurement unit 1004, the device control unit 1002 instructs the transmission packet generation unit 203 to generate an RTT measurement packet, and the received packet analysis unit 1003 also receives a response packet for the RTT measurement packet. The time up to is calculated as RTT, and the obtained RTT is output to the device control unit 1002.

In the third embodiment described above, the device control unit 1002 instructs the transmission packet generation unit 203 to generate an RTT measurement packet, and the received packet analysis unit 1003 also receives a response packet for the RTT measurement packet. Although an example is shown in which the time until the input of It is not restricted to this. For example, the time from when the packet for RTT measurement is input to the packet transmission / reception unit 204 of the device E1001 until the packet transmission / reception unit 204 of the device E1001 outputs a response packet for the RTT measurement packet to the received packet analysis unit 1 003 You may ask for In this case, a time stamp is added when the RTT measurement packet is input to the packet transmission / reception unit 204, and a time stamp is added when the packet transmission / reception unit 204 of the device E1001 outputs a response packet. In addition, the RTT measurement unit 1004 will calculate the RTT based on the timestamp.

[0204] FIG. 11 is a diagram showing an example of authentication processing performed between the device E1001 and the device B211. In FIG. 11, the device E (source device) 1001 is a transmitter for transmitting the copy-controlled content, and the device B (sink device) 211 is a copy-controlled content, as described above. It is described as a receiver. Further, in FIG. 11, it is assumed that the device B211 is a device not belonging to the same local network as the device E1001.

[0205] First, in S1101, the device B211 transmits an authentication request packet to the device E1001 possessing the copy-controlled content. This authentication request packet contains data of random number B and device certificate B. In S1102, the device E1001 transmits, to the device B211, an ACK packet indicating that the authentication request packet has been received.

In S1103, the device E1001 transmits a reply packet to the device B211. This reply socket contains data of random number A and device certificate A. In S1104, the device B211 transmits an ACK packet indicating that the reply packet has been received to the device E1001.

In the process from S1105 to S1110, the device E1001 repeatedly transmits the RTT measurement packet to the device B211, and the device B211 receives the RTT measurement packet transmitted from the device E1001. , Repeat the process of sending a response packet indicating that the RTT measurement packet has been received. At this time, the device E 1001 transmits, to the device B 211, an RTT measurement packet which is changed by a predetermined length from the packet length of the RTT measurement packet transmitted last time. In the processing from S 1105 to S 1110, whether the device control unit 1002 instructs the transmission packet generation unit 203 to generate a RTT measurement packet? The reception packet analysis unit 1003 repeatedly measures the time (RTT) until the response packet for the RTT measurement packet is input. A detailed description of this process will be described later.

[0208] The device E1001 has a step-like relationship as shown in FIG. 9A between the packet length of the RTT measurement packet that has been sent and the measured RTT, and the packet length per step is 48 bytes. If it is, it is determined that the device B211 is not a device belonging to the same local network as the device E1001, but otherwise the device B211 is a device belonging to the same local network as the device E1001. It is determined that

When it is determined that the device B211 belongs to the same local network as the device E 1001, the device E1001 transmits a packet notifying an authentication failure to the device B211 as shown in S1111. And abort the authentication process. When the device B 211 receives the packet notifying the authentication failure, the device B 211 aborts the authentication process, and transmits an ACK packet indicating that the device E 1001 receives the packet notifying the authentication failure to the device E 1001. In this case, the device E1001 does not transmit the copy-controlled content to the device B211.

Although the example of transmitting the bucket for RTT measurement from the device E1001 to the device B211 has been described in the third embodiment described above, the present invention is not limited to this, and an RTT measurement packet is transmitted from the device B211 to the device E1001. Let me see.

Here, the process of measuring the RTT from S1105 to S1110 in FIG. 11 will be described in detail. When measuring RTT, first transmit the packet length of the RTT measurement packet sent from the device E 1001 to the device B 211 (START_LENGTH), end the measurement packet length of the RTT measurement packet (END-LENGTH), RTT measurement packet The length of time to change the packet length (STEP), the number of times to measure RTT in the RTT measurement packet of the same packet length (COUNT-MAX), and the parameter value of timeout time (TH-TIMEOUT) are predetermined. Need to be

[0212] As a limitation of the parameter value, the difference between START-LENGTH and END-LENGTH needs to be larger than 96 bytes. Because, when the relationship between the packet length of the RTT measurement packet and the measured RTT becomes the step-like relationship shown in FIG. 9A, in order to determine whether the packet length per step is 48 bytes or not. At least three stages are required for the force AT Since RTT may not change while the packet length changes by 48 bytes due to MCell, only stage S 2 stages will appear if the difference between START-LENGTH and END-LENGTH is 96 bytes or less. It is a force with sex.

[0213] Further, preferably, STEP is a divisor of 48. Because, when the relationship between the packet length of the RTT measurement packet and the measured RTT becomes the step relationship shown in FIG. 9A, it is determined whether the packet length per step is 48 bytes or not. For example, if the packet length per step changes by 42 bytes or 49 bytes, the RTT changes by one step if the number (eg “7”) is set to STEP. Therefore, it is impossible to accurately judge whether the packet length per step is 48 bytes. Note that STEP is not limited to a positive number and may be a negative number. Hereinafter, the measurement method of RTT will be specifically described with reference to FIGS. 12 and 13, but in FIGS. 12 and 13, STEP will be described as a positive number.

FIGS. 12 and 13 are flowcharts showing the flow of processing executed by the device control unit 1002 of the device E 1001. First, in S1201, it is determined whether or not the authentication request packet transmitted from the device B 211 has been received. When it is determined that the authentication request packet has been received, it is not in the authentication stage, so the processing of the flowcharts of FIG. 12 and FIG. 13 ends. On the other hand, if it is determined that the authentication request packet has been received, the process proceeds to the process of S1202.

[0215] In S1202, the sending process of the reply socket is performed. This consists of an instruction for generation of a reply packet and waiting for reception of an ACK for the reply packet, corresponding to S1103 and S1104 in FIG. When transmission of the reply packet is completed, the device control unit 1002 instructs the transmission packet generation unit 203 to generate the RTT measurement packet, and the force is also received by the reception packet analysis unit 1003 until the response packet for the RTT measurement packet is input. In order to perform processing to measure time (RTT), the processing proceeds to processing after S1203.

In S1203, initialization processing is performed. In the initialization process, the RTT recording tape is not measured yet, START-LENGTH is set as the packet length of the RTT measurement packet, and the COUNT value is set to "1". The RTT recording table is a tape that records the RTT measured for each packet length (LENGTH) of the RTT measurement packet. For example, it is realized by a storage medium such as a RAM or a hard disk mounted in the device E1001.

[0217] In S1204, processing is performed to instruct the transmission packet generation unit 203 of the device E1001 to generate an RTT measurement packet whose packet length is ST ART-LENGTH. At S 1205, it is determined whether the response packet to the RTT measurement packet has been received. When the packet transmitting / receiving unit 204 of the device E 1001 receives the response packet, the received packet is analyzed by the received packet analysis unit 1003, and the analysis result is output to the device control unit 1002. Thus, the device control unit 1002 can determine whether the response packet has been received or not. If it is determined that the response packet has been received, the process proceeds to step S1207. If it is determined that the response packet has not been received, the process proceeds to step S1206.

In S1206, the transmission packet generation unit 203 of the device E1001 is instructed to generate an RTT measurement packet, and it is determined whether or not the force has reached a certain time. If it is determined that the predetermined time has not elapsed, the process returns to the process of S1205, and the processes of S1205 and SI 206 are repeated until the predetermined time elapses. On the other hand, when it is determined that the predetermined time has elapsed, the process returns to the process of S1204 and the processing power S of S1204, S1205, and S1206 is performed again.

[0219] In S1207, it is determined whether or not the force at which RTT is the minimum value. As described above, for RTT measurement packets of the same packet length, RTT measurement is repeated as many times as defined by COUNT-MAX. In S 1207, the value of the RTT measured this time is compared with the value of the RTT recording table in which the minimum value of the RTTs measured up to the previous time is recorded, and recorded in the RTT recording table. It is judged whether it is smaller than the value. If it is determined that the value of RTT measured this time is smaller than the value of RTT recorded in the RTT recording table, the processing proceeds to S1208, and the value of RTT measured this time is recorded in the RTT recording table. If it is determined that the value is larger than the value of RTT, the process proceeds to step S1209. In the first RTT measurement, the value of RTT to be compared with the RTT recording table is recorded and it is a shame, so proceed to S1208.

S1208 is performed only when the determination of “Yes” is made in S1207, and the measurement is performed. Processing is performed to record the value of RTT in the RTT recording table. In S1209, it is determined whether the value of C OUNT is COUNT-MAX. If the value of COUNT is not COUNT—MAX, “1” is added to the value of COUNT at S1210, and S 1209 until the value of COUNT is determined to be COUNT—MAX at S1209. The processing up to S 1 209 is repeated.

[0221] If it is determined in S1209 that the value of COUNT is COUNT-MAX, then in S121 1! /, LENGTH is determined in advance, and it is determined whether or not END-LENGTH or more. It is judged. When it is determined that LENGTH is less than the predetermined LENGTH / END- LENGTH, the length defined in STEP is added to the packet length of the current RTT measurement packet in S1212. At the same time, the processing of S 1204 to S 1210 is repeated until the value of COUNT is set to “1” and it is determined that LE NGTH is equal to or greater than END—LENGTH.

On the other hand, when it is determined in S1211 that LENGTH is equal to or greater than END-LENGTH, it is determined in S1301 whether or not re-measurement of RTT is necessary. As LENGTH gets longer, the measured RTT value will not decrease or decrease. Therefore, in the RTT recording table, the RTT value RTT (n) for a given LENGTH is compared with the RTT value RTT (n + 1) for a given LENGTH + STEP, RTT (n)> RTT (n + 1) Determine if there is a place where there is a force. If there is a portion where RTT (n)> RTT (n + 1), it is necessary to re-measure RTT, so the processing proceeds to SI 302 processing, and if not, it proceeds to the processing of S1303.

In S1302, as described in S1301, re-measurement of the value of RTT for a LENGTH for which RTT (n)> RTT (n + 1) is performed is performed. At this time, the value of RTT may be measured only once, or it may be measured repeatedly until the value of COUNT mentioned above becomes COUNT-MAX, and the value of RTT recording table is repeatedly measured until the value is updated. I'm sorry. When re-measurement of the value of RTT is completed, the process returns to the process of S1301.

At S 1303, a packet length determination process is performed. In the packet length judgment process, the RTT recording table! /, The smaller the LENGTH! /, The RTT values are checked in order from the one !, and the same RTT value (the RTT within a certain error range Range of LENGTH continues Be This is done until END-LENGTH.

[0225] In SI 304, it is determined whether or not the range power of 8 bytes of LENGTH continues, with the same value of RTT examined in SI 303. If the range of the LENGTH which continues the same value of RTT is 48 bytes, the process proceeds to the processing of S1307, and if not, it proceeds to the processing of S1305.

In S1305, it is determined that the device B211 is a device belonging to the same local network as the device E1001, and instructs the transmission packet generation unit 203 of the device E1001 to generate a packet notifying a successful authentication. Processing is performed. The packet for notification of successful authentication may be a packet only for notification purpose or may be a packet following the authentication phase (key exchange packet etc.). Thereafter, in S1306, a process of instructing the transmission packet generation unit 203 of the device E1001 to generate a packet of copy-controlled content is performed. Thus, the content subjected to copy control is transmitted from the device E1001 to the device B211.

In S1307, it is determined that the device B211 is not a device belonging to the same local network as the device E1001, and the device E1001 generates a packet for notifying the transmission packet generation unit 203 of an authentication failure. A process of instructing is performed. Since it is determined in S1307 that the device B211 is not a device belonging to the same local network as the device E1001, in S1308, processing for aborting the authentication process is performed. In this case, the process of instructing the transmission packet unit 203 of the device E1001 to generate a packet of copy-controlled content is not performed. The content copy-controlled from the device E1001 to the device B211 is not transmitted. !

[0228] The device E1001 or the device B211 having the functions described above is installed in a personal computer, a digital camera, a digital video camera, a DVD recorder, or the like that can handle digitalized contents.

In this way, the device control unit 1002 of the device E1001 changes the packet length by the predetermined length transmitted to the device B211 connected via the network. The response time for receiving the response packet to the received packet is measured, and from the relationship between the transmitted packet length and the measured response time, the device B211 is a device belonging to the same local network as the device A201. It can be determined whether or not. In addition, the device control unit 1002 of the device ElOOl generates an RTT measurement packet for determining whether the device B 211 belongs to the same local network as the device E 1001 in the authentication stage. In order to instruct the transmission packet generation unit 203 of the device E1001, when it is determined that the device B211 is not a device belonging to the same local network as the device E1001, the device B2 is transmitted before the step of transmitting the copy-controlled content. Communication with 11 can be terminated. As a result, it is possible to prevent the flow of copy-controlled content from the device E1001 to the device B211 belonging to the local network different from the device E1001.

In addition, when the response packet to the RTT measurement packet is not received during a predetermined time after the transmission packet transmission unit 203 of the device E1001 is instructed to generate the RTT measurement packet, the device E1001 In order to instruct the transmission packet generation unit 203 to generate the RTT measurement bucket again, it is possible to measure the RTT as much as possible, and whether the device B211 belongs to the same local network as the device E1001. It is possible to make the judgment as to whether or not it is possible as much as possible.

In the above-described third embodiment, when it is determined in S1206 of FIG. 12 that the predetermined time has elapsed, the present invention is not limited to this. For example, if it is determined in S1 206 that a predetermined time has elapsed, the process may proceed to S1308 in FIG. 13 to abort the authentication process. In this way, when it is not possible to measure RTT and it is unclear whether the device B211 is a device belonging to the same local network as the device E1001 or not, the device E1001 to the device B211 It can prevent the flow of copy-controlled content.

[0233] The above-described first embodiment, second embodiment and third embodiment can also be used in combination without being exclusive.

[0234] DTCP-IP may exchange copy-controlled content with a large remote device! /, Authentication phase to check whether it is a device certified by DTLA, and content that is actually copy-controlled Can be divided into the content transmission phase in which the In Embodiment 1 to Embodiment 3 described above, the device B 211 is a device belonging to the same local network as the device A 201 or the device B 211 is a device E. Although it can be determined in either the authentication phase or the transmission phase whether or not the network belongs to the same local network as 1001, as described in the first to third embodiments described above, one of the authentication phases is performed. It is preferable to make a decision on the part. Because, if it is determined in the authentication stage that the device B211 is not a device belonging to the same local network as the device A201 or the device E1001, then it is not possible to exchange the copy-controlled content as if the authentication failed. It is also a force that should end the certification process. In the first and second embodiments described above, overhead is generated when a packet having a packet length of less than 1500 bytes is padded to 1500 bytes, but the authentication stage is more general than the transmission stage. This is because the data transmission rate is low and the request for packet timing is small, so the overhead is not easily affected.

It should be understood that the embodiment disclosed herein is illustrative in all respects and not restrictive. The scope of the present invention is indicated not by the above description but by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

Claims

The scope of the claims

[1] A packet generation unit (203) that generates a transmission packet in which a fragment is inhibited according to an instruction;

A packet transmitting / receiving unit (204) for transmitting the transmission packet generated by the packet generation unit to another device connected via a network and receiving a response packet to the transmission packet;

A packet analysis unit (205) for analyzing whether or not the packet length of the response packet received by the packet transmission / reception unit is a packet indicating that the packet length is longer than a predetermined packet length; And a device control unit (202) for determining whether or not the other device is a device belonging to the same local network as the own device as well as instructing generation of the transmission packet.

The device control unit is configured such that when the packet analysis unit analyzes that the response packet is a packet indicating that the packet length of the transmission packet is longer than a predetermined packet length, the other device is identical to the own device. A transmitter characterized by determining that the device does not belong to the local network.

[2] The apparatus control unit instructs the packet generation unit to generate the transmission packet whose fragment is prohibited in the authentication step of packet transmission.

The transmitter according to item 1.

[3] After determining that the other device is not a device belonging to the same local network as the own device, the device control unit instructs the packet generation unit to generate the transmission packet. The transmitter according to claim 1, wherein the transmitter is turned off.

[4] The transmitter according to claim 1, wherein the packet length of the transmission packet in which a fragment is prohibited is 1500 bytes.

[5] The packet analysis unit further belongs to the same local network as the own device that transmits the response packet received by the packet transmission / reception unit when the other device normally receives the transmission packet. Analyze whether it is a packet indicating that the device is not

In the device control unit, in the packet analysis unit, the response packet is transmitted by the other device. The other device is identical to the own device when it is analyzed that the packet indicates that the device does not belong to the same local network as the own device to be sent when the transmission packet is normally received. The transmitter according to claim 1, characterized in that it is determined that the device does not belong to the local network.

[6] The apparatus control unit instructs the packet generation unit to generate the transmission packet whose fragment is inhibited in the authentication step of packet transmission.

The transmitter according to item 5.

[7] The device control unit may instruct the packet generation unit to generate the transmission packet after determining that the other device is not a device belonging to the same local network as the own device. The transmitter according to claim 5, wherein the transmitter is turned off.

[8] The transmitter as set forth in [5], wherein the packet length of the transmission packet in which a fragment is inhibited is 1500 bytes.

[9] A packet generation unit (203) for generating a transmission packet in which the packet length is changed by a predetermined length in accordance with an instruction.

A response time measurement unit (10 for measuring a response time until the transmission packet is transmitted to the other device and the response packet to the transmission packet is received).

04) and

The packet generation unit repeatedly instructs generation of the transmission packet in which the packet length is changed by a predetermined length, and the other device belongs to the same local network as the own device. And a device control unit (1002) that determines whether or not there is a certain force.

When the response time measured by the response time measurement unit changes stepwise for each specific packet length, the device control unit belongs to the same low power network as the other device when the response time changes in a step-like manner for each specific packet length A transmitter characterized in that it is an apparatus.

[10] The device control unit instructs the packet generation unit in advance in an authentication step of packet transmission. 10. The transmitter according to claim 9, wherein generation of the transmission packet is instructed by changing the packet length by a predetermined length.

[11] The device control unit may instruct the packet generation unit to generate the transmission packet after determining that the other device is not a device belonging to the same local network as the own device. The transmitter according to claim 9, wherein the transmitter is turned off.

[12] The transmitter according to claim 9, wherein the specific packet length is 48 bytes.

[13] A packet receiving unit (204) for receiving received packets transmitted from other devices connected via the network;

A packet analysis unit (205) that analyzes whether the received packet received at a predetermined stage of packet transmission is a fragmented packet in the packet reception unit; A device control unit that determines whether or not the other device is a device belonging to the same local network as the own device while controlling

202) and,

The device control unit, when the packet analysis unit analyzes that the received packet is a fragmented packet, the other device belongs to the same local network as the own device. A receiver characterized by determining that there is.

14. The receiver according to claim 13, wherein the predetermined phase of packet transmission is an authentication phase of packet transmission.

[15] After determining that the other device is not a device belonging to the same local network as the device itself, the device control unit controls to stop transmission and reception of packets with the other device. The receiver according to claim 13, characterized in that.

[16] A packet generation unit (203) that generates a transmission packet according to an instruction;

A packet transmission / reception unit (204) for transmitting the transmission packet generated by the packet generation unit to another device connected via a network, and receiving a reception packet transmitted from another device. ,

A packet analysis unit (205) for analyzing whether or not the received packet is a fragmented packet received at a predetermined stage of packet transmission by the packet transmission / reception unit; And a device control unit that controls transmission and reception of packets with the other device and determines whether the other device is a device belonging to the same local network as the own device.

When the device control unit analyzes that the received packet is a fragmented packet by the packet analysis unit, the other device belongs to the same local network as the own device and is an unintended device. A receiver characterized in that it determines.

[17] The receiver according to claim 16, wherein the predetermined stage of packet transmission is an authentication stage of packet transmission.

[18] After the device control unit determines that the other device is not a device belonging to the same local network as the own device, the other device is the same as the own device with respect to the packet generation unit. The receiver according to claim 16, wherein generation of a packet notifying that the device is not a device belonging to the local network of is instructed.

[19] A packet generation instructing step (S502) for instructing a packet generation unit for generating a transmission packet whose fragment is inhibited according to an instruction to generate the transmission packet.

A reception determination step (S503) of determining whether a response packet to the transmission packet transmitted to another device connected via a network is received; and the reception determination step. A packet length determining step of determining whether the response packet is a packet indicating that the packet length of the transmission packet is longer than a predetermined packet length, when it is determined that a response packet is received; (S505) In the packet length determination step, when it is determined that the response packet is a packet indicating that the bucket length of the transmission packet is longer than a predetermined packet length, the other device is identical to the own device. And a device determination step (S508) for determining that the device does not belong to the local network.

[20] The transmission method according to claim 19, wherein the packet generation instructing step instructs the packet generation unit to generate the transmission packet in which a fragment is inhibited in an authentication step of packet transmission. .

[21] The packet generation instructing step is performed in the device determination step! After it is determined that the other device does not belong to the same local network as the own device, 20. The transmission method according to claim 19, further comprising the step of instructing the packet generation unit to generate the transmission packet.

22. The transmission method according to claim 19, wherein the packet length of the transmission packet in which a fragment is prohibited is 1500 bytes.

[23] When it is determined that the response packet is received in the reception determination step, the response packet is transmitted when the other device normally receives the transmission packet. The apparatus further includes a packet determination step (S505) of determining whether the packet is a device indicating that the device does not belong to the same local network as the device, and the device determination step includes the packet determination step. When it is determined that the response packet is a packet indicating that the other device belongs to the same local network as the own device that transmits the packet when the other device normally receives the transmission packet. The apparatus according to claim 19, characterized in that it determines that the other device is not a device belonging to the same local network as the device itself. Transmission method.

[24] The transmission method according to claim 23, wherein the packet generation instructing step instructs the packet generation unit to generate the transmission packet in which a fragment is inhibited in an authentication step of packet transmission. .

[25] In the packet generation instructing step, after it is determined in the device determination step that the other device is not a device belonging to the same local network as the own device, the packet generation unit The transmission method according to claim 23, characterized by stopping giving an instruction to generate the transmission packet.

[26] The transmission method according to claim 23, characterized in that the packet length of the transmission packet in which the fragment is prohibited is 1500 bytes.

[27] A packet generation instructing step (S 1204) repeatedly instructing generation of the transmission packet to a packet generation unit which generates a transmission packet in which the packet length is changed by a predetermined length according to an instruction.

A reception determination step (S1205) of determining whether a response packet to the transmission packet transmitted to another device connected via a network is received; and the reception determination step. When it is determined that you receive a response packet A response time measurement step (S1105 to S1110) for measuring a response time until the transmission packet is transmitted to the other device and the response packet to the transmission packet is received;

Assuming that the other device belongs to the same local network as the own device when the response time measured in the response time measurement step changes stepwise for each specific packet length. And a device determination step (S1307) for determining.

[28] The packet generation instructing step instructs the packet generation unit to generate the transmission packet in which the packet length is changed by a predetermined length in the authentication step of packet transmission. The transmission method according to claim 27.

[29] The packet generation instructing step is performed in the device determination step! After it is determined that the other device is not a device belonging to the same local network as the own device, the generation of the transmission packet is not instructed to the packet generation unit. The transmission method according to claim 27, wherein

[30] The transmission method according to Claim 27, wherein the specific packet length is 48 bytes.

[31] A reception judgment step (S702) of judging whether the other device connected via the network also receives the received packet that has been sent!

A fragment determination step (S704) of determining whether the received packet is a fragmented packet when it is determined that the received packet is received at a predetermined stage of packet transmission in the reception determination step;

In the fragment determination step, when the received packet is fragmented and it is determined that the received packet is a packet, the other device belongs to the same local network as the own device and is an /! And a device determination step (S707).

32. The transmission method according to claim 31, wherein the predetermined phase of packet transmission is an authentication phase of packet transmission.

[33] The generation of the transmission packet is performed by the packet generation unit which generates the transmission packet according to the instruction Instructed packet generation instruction step (S701)

Receiving determination step (S702) of determining whether the other device connected via the network also receives the received packet transmitted,

[34] The transmission method according to claim 33, wherein the predetermined stage of the packet transmission is an authentication stage of the packet transmission.

[35] The packet generation instructing step is performed in the device determination step! If it is determined that the other device does not belong to the same local network as the own device, it is indicated that the other device is a device not belonging to the same local network as the own device. 34. A transmission method according to claim 33, which instructs generation of a packet to be notified.