CN1783139A - Identification modes of content file producer and its method - Google Patents

Abstract

Provided is a method and method for authenticating content file creators. In providing services for multimedia content files to mobile devices (such as mobile phones), the mobile device side provides specified services only for content files created using legitimate content creation tools. The content production side uses a certain hardware key 2 or secret information to perform encryption processing 3 on the content, such as the music source 1, to obtain the content file 4. The mobile device side downloads the content file 4 and temporarily stores it in the file storage unit 11 . The verification unit 12 verifies whether the downloaded content file is produced by an authentic production tool, and if the verification is passed, the content file 4 is registered in the registration unit 13 and provided to the user.

Description

Authentication method and method of content file creator

The present invention is a divisional application with the application number 200410000502.0, the application date being January 8, 2004, and the title of the invention being the authentication method and its program for content document creators.

technical field

The present invention relates to an authentication method and method for content file creators. In the authentication method, in the provision service of multimedia content files for mobile phones, the mobile phone side only provides content files produced by legitimate content creation tools. prescribed service.

Background technique

As such prior art, there is a digital signature technology for judging whether or not a transmitted content, such as a contract, has been falsified. In addition, as another prior art, there is a method for authenticating the other party between the receiver and the sender, that is, for verifying the sender's side. This is a query-response method for whether you have the correct secret key.

The outline of this inquiry response procedure is shown in FIG. 8 . As shown in FIG. 8, the receiving side generates a random number, and transmits the random number to the sending side (transmission of a challenge code). The receiving side and the sending side perform some kind of calculation (hash calculation) using the secret key based on the random value, and the sending side transmits the result of the hash calculation (transmission response code) to the receiving side. The receiving side compares the received value with the value calculated by its own hash, and if they match, it judges that the sending side is the one who holds the correct secret key.

In addition, as a document related to the above-mentioned prior art, there is, for example, Japanese Patent Laid-Open Publication No. 2002-334173 "Content distribution method おょびこれににいゐサババ and びterminalびびびびんンピユータピムラム" (the name is : content distribution method and the server and terminal used therefor and computer program).

However, in the prior art described above, communication between the sender and the receiver is necessary to authenticate the other party, and there is a problem that direct communication between the content creator and the receiver is not realistic in the content delivery service.

Contents of the invention

The object of the present invention is to provide a content file creator authentication method and method for providing a predetermined service only to content files created by legitimate content creation tools on the mobile side in a multimedia content file providing service for mobile devices (such as mobile phones). program.

In addition, another object of the present invention is to provide a content file creator that detects a content file created using an illegal content creation tool, such as a content file created by a pirated tool, and does not provide the content file with a predetermined service in a mobile device. Authentication methods and procedures.

Another object of the present invention is to provide a method and program for authenticating content file creators that do not require communication between senders and receivers in order to authenticate content files created using legitimate content creation tools.

In order to achieve the above object, the present invention is characterized in that the transmitting side includes means for encrypting content data with a content file creation tool to create a content file; and means for distributing (distributing) the content file. In addition, it is characterized in that the receiving side includes a file storage unit for storing the acquired content file; a verification unit that verifies whether the content file stored in the file storage unit is created by a legitimate content file creation tool; and a registration unit, It registers the content files judged to be legitimate by the verification.

In addition, the present invention is characterized in that the content file production side extracts partial data from the content file, adds a data signature to the partial data, and the mobile device extracts the same portion as the partial data from the received content file. data, perform verification of the data signature, and provide specified services for the content files judged to be legitimate by the verification.

According to these features, since the creator of the content file can be authenticated on the mobile device side, the mobile device can provide a predetermined service only to the content file created using the authorized content creation tool.

In addition, a second feature of the present invention is to provide a program for creating content files, the program comprising the steps of: partially extracting data at a predetermined position from the data portion of an unsigned content file; A hash function is used to obtain a hash value; the hash value is encrypted with a secret key and assigned to a header of the content file; and a public key and a public key certificate are assigned to the header.

According to this feature, it is possible to provide a content file having data that can authenticate the creator of the content file with a small amount of calculation.

In addition, another feature of the present invention is to provide a mobile phone content file creator authentication program, the program is composed of the following steps: determine whether there is a data signature in the received content file; if there is the data signature, Use the root certificate to authenticate the public key certificate; in the case of authentication, use the public key to decode the authentication data encrypted by the secret key to obtain the first hash value; from the received content Extract predetermined part of the data from the data part of the file; apply a hash function to the part of the data to calculate the second hash value; judge whether the first and second hash values are consistent; if they are consistent, provide the specified Services, in case of inconsistency, do not provide the specified services.

According to this feature, the mobile device side can verify whether the received content file is created by an authorized content file creation tool without communicating with the content file creation side, and this verification can be provided with a small amount of calculation.

In addition, another feature of the present invention is that the content file creator provides the content file with authentication data created from information known only to the content file creator, and the mobile device verifies whether or not the authentication data is assigned to the acquired content file, When the verification is established, a predetermined service is provided to the content file.

According to this feature, the mobile device side provides predetermined services only for valid content files. In addition, even if the mobile device does not communicate with the creator of the content file, it can be verified whether the received content file is created by an authorized content file creation tool.

Description of drawings

FIG. 1 is a block diagram showing a schematic system configuration of the present invention.

FIG. 2 is an explanatory diagram of an example of a data signature in the first embodiment of the present invention.

FIG. 3 is an explanatory diagram showing a structural example of a content file.

Fig. 4 is a flowchart showing a content file creating program.

Fig. 5 is a flowchart showing a content file creator authentication procedure of the mobile device.

FIG. 6 is an explanatory diagram of an example of authentication data provision according to the second embodiment of the present invention.

Fig. 7 is a flowchart showing a content file creator authentication procedure on the mobile device side.

Fig. 8 is a diagram showing a conventional inquiry response procedure.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a schematic system diagram of a service for providing multimedia content files for mobile phones using the present invention.

The sending side (creating side) of the content file applies a certain hardware key 2 (secret information held only by the producing side) to the content data, such as the music source 1, performs encryption processing 3, and obtains the content file 4. That is, the sending side (creating side) creates the content file 4 with its own content creation tool (including the hardware key 2 and the encryption process 3).

On the other hand, the receiving side (mobile device side) downloads the content file 4 and temporarily stores it in the file storage unit 11 . The verification unit 12 verifies whether the downloaded content file is created by an authorized authoring tool, and if it is verified that it was created by the authorized authoring tool, registers the content file 4 in the registration unit 13 and provides it to the user. For example, the playing function of the music source 1 is provided to the user. On the other hand, if the verification unit 12 has not verified that the downloaded content file was produced by an authentic production tool, it takes measures not to provide the content file 4 to the user.

Next, a first embodiment of the present invention will be described. In normal data signing, a hash value is calculated for the entire content data and encrypted with a secret key to obtain a signature value. This is to ensure that no tampering has been made anywhere in the content data.

On the contrary, in the first embodiment of the present invention, the purpose is to ensure that the creator of the content file has a legitimate secret key, or to verify that the creator of the content file has a legitimate secret key, and does not care about the integrity of the content data itself. , That is, whether the content data itself has been tampered with, in other words, do not care about the authenticity of the content data itself.

First, the method of encryption processing performed by the encryption processing 3 will be described. As content data to be supplied, in addition to the music source 1, video data, audio data, or video and audio data, etc. are included.

As shown in FIG. 2 , partial data A1 , A2 , A3 , . . . are extracted from content data A, a hash function is applied to them, and a hash value is calculated. Next, authentication data obtained by performing a data signature on the hash value using a secret key.

Next, the authentication data is filled in an appropriate storage location in the header portion shown in FIG. 3 , that is, an appropriate field (atom: atom). Here, FIG. 3 shows an example of the format of the content file 4, and the content file 4 is composed of a header part and a data part. In addition, the public key paired with the secret key is also filled in the atom. And, the public key certificate for authenticating the public key is also filled in the atom. This public key certificate is a certificate certified by a root certificate held inside the mobile phone.

Here, the positions of the data A1, A2, A3, . . . extracted from the data portion are predetermined by the production side and the mobile phone. For example, it is predetermined to extract 1 kbytes from the head of the data, or to extract 1 byte every 10 bytes for a total of 5 kbytes.

Fig. 4 is a flowchart illustrating the procedure or operation of the creation side (sending side). In step S1, an unsigned content file, such as the music source 1, is produced. In step S2, data (for example said data A1, A2, A3) are partially extracted from the data portion. In step S3, a hash function is applied to the extracted data to obtain a hash value. In step S4, the hash value is encrypted with a secret key to form authentication data with a data signature, and the data is filled in in the atom. In step S5, the public key paired with the secret key is also filled in the atom, and the public key certificate for authenticating the public key is also filled in the atom. In step S6, upload to the server.

Next, procedures or processing on the mobile phone side (mobile device side) will be described with reference to FIG. 5 . Verification of the data signature is performed on the mobile phone side. In step S11, it is judged whether there is a signature in the content file downloaded from the server. That is, it is verified whether the authentication data is included in the header. If there is a signature, it proceeds to step S12, where the public key certificate in the content file (see FIG. 3 ) is authenticated using the root certificate in the mobile phone. In addition, when there is no signature in the content file, the process proceeds to step S18, and the predetermined service is not provided.

If the authentication in step S12 is correct, the process proceeds to step S13, where the public key is used to decode the authentication data encrypted with the secret key to obtain a hash value. That is, the hash value calculated by the creation side (transmission side) is taken out. If the authentication in step S12 is not correct, the process is aborted. In step S14, predetermined partial data at the same location as the production side is extracted from the data part of the content file, that is, partial data shared with the production side (such as the data A1, A2, A3). Afterwards, in step S15, a hash function is applied to the extracted partial data to calculate a hash value.

In step S16, it is judged whether or not the hash values calculated in steps S13 and S15 match. In case of agreement, verify the data signature. If the determination in step S16 is affirmative, the process proceeds to step S17 to perform a prescribed service, such as audio playback. On the other hand, in the case of inconsistency, the data signature cannot be verified, and the process goes to step S18, and the prescribed service is not performed.

According to the above-mentioned first embodiment, since the data signature is performed on the partial data of the content file, the data signature can be performed with a small amount of computation. In addition, data signature verification is performed on the partial data of the received content file on the mobile device side, so it can be verified whether the content file was created by a valid content file creation tool without communicating with the content file creation side.

In addition, the mobile device side may provide predetermined services only to content files created using authorized content creation tools. On the contrary, it is possible to prevent the provision of prescribed services for content files produced by unauthorized content production tools, for example, content files produced by pirated tools. In addition, even if the mobile device does not communicate with the creator of the received content file, it can verify whether the content file is created by an authorized content file creation tool.

Next, a second embodiment of the present invention will be described with reference to FIGS. 6 and 7 . In this embodiment, the mobile device side can also verify whether the received content file is created by an authorized content file creation tool without using a data signature, and only provide specified services for content files created by an authorized content creation tool.

Referring to FIG. 6, the processing on the transmission side (creation side) of the content file will be described. First, the sending side has secret information 21 and arithmetic formula 22 which are information known only to the content file creator, and stores the secret information 21 and arithmetic formula 22 in a storage unit on the receiving side (mobile device side). For example, the secret information 21 and the calculation formula 22 are previously stored in a memory of a mobile device such as a mobile phone by a manufacturer of the mobile device before the mobile device is shipped.

As shown in FIG. 6 , the sending side uses the secret information 21 to perform predetermined operations (for example, scramble operations) on content data B such as music sources through the operation formula 22 to obtain authentication data. Next, the authentication data is stored in the header of the content file 23, and the content file 23 is distributed to mobile devices such as mobile phones.

Next, the operation of a mobile device such as a mobile phone will be described with reference to the flowchart in FIG. 7 . The mobile device first receives the content file. Next, in step S21, it is judged whether there is authentication data in the header of the content file. If the judgment is negative, the process proceeds to step S26, where a predetermined service is not provided.

On the other hand, if the determination in step S21 is affirmative, proceed to step S22 to extract authentication data from the header of the content file. Afterwards, proceed to step S23, and use the secret information to perform predetermined calculations on the data in the content file to generate authentication data. In step S24, it is judged whether the authentication data extracted in step S22 is consistent with the authentication data generated in step S23, and if the judgment is affirmative, that is, in the case of matching, it proceeds to step S25, and a predetermined service is provided. On the other hand, when this determination is negative, it progresses to step S26.

According to the second embodiment, it is possible to verify whether or not a content file is created using a valid content creation tool without using a data signature, and the mobile device side provides a predetermined service only for a valid content file. Also, even if the mobile device does not communicate with the creator of the content file, it can verify whether the received content file was created by an authorized content file creation tool.

In each of the above-mentioned embodiments, the procedures or actions according to the present invention have been described with reference to the flowcharts of FIGS. ) to execute. In addition, it is obvious that various changes can be made to such processing procedures without departing from the scope of the spirit of the present invention.

Claims (2)

1. An authentication method for a content file creator, characterized in that, The content file creator side has: A means for obtaining authentication data by performing calculations on the data portion of the content file using secret information and calculation formulas known only to the content file creator; and filling the authentication data into the element of the header of the content file; and Publishing the unit of the content file in which the authentication data is filled in the header; The mobile machine side that obtains the published content file has: means for generating authentication data by performing calculations on the acquired content file data portion using the secret information and calculation formulas acquired in advance; and Comparing the generated authentication data with the authentication data filled in the header, and when the two authentication data match, it is a means to perform a predetermined service as an authentic content file created using an authentic content file. 2. A content file producer authentication method for a mobile device, which consists of the following steps: A step of judging whether authentication data is given in the received content file; When the authentication data is assigned, a step of generating authentication data by performing a predetermined calculation on the content file using secret information known only to the content file creator; A step of judging whether the authentication data assigned to the received content file is consistent with the generated authentication data; If they match, the specified service is provided, and if they do not match, the specified service is not provided.

Images