JP2002539557A - Copy protection of storage media by randomizing location and key for write access - Google Patents

Abstract

  (57) [Summary] A method for providing copy protection on a storage medium, wherein the location where the data arranged in blocks is stored is preferably selected randomly by a (preferably built-in) controller. Using an encryption key that is highly dependent on the location of the data in the storage medium makes decryption of the copied data virtually impossible.

Description

DETAILED DESCRIPTION OF THE INVENTION

The present invention relates to a method for providing copy protection to a data storage medium, and more particularly to a solid-state memory module. With the technology evolving, the next generation of portable audio playback and recording devices will be based on solid state technology. The advantageous discussion is based on considerations of weight, power and shock resistance.

For example, software providers, such as music publishers, seek means to counter unauthorized copying of digitally stored information without causing any or no inconvenience to authorized users. I have. In addition, the method and system must support business models such as rental, pre-purchase listening, and controlled copying (eg, super-distribution). A particular problem is posed by devices that do not comply with protection standards that potentially allow access to all information on the storage medium.

[0003] Known anti-copy solutions use a unique identification code (ID) "engraved" on the storage medium. At some point, this is disadvantageous due to privacy considerations. Further, as described below, methods that rely primarily on such IDs do not provide adequate protection against copy mechanisms known as "playback attacks."

[0004] It is therefore an object of the present invention to provide a relatively inexpensive and only I which requires only moderate processing.
It is an object of the present invention to provide a method and system that does not require the use of D, in particular, provides protection against replay attacks.

[0005] The basic idea of this copy protection method and system is that the data is encrypted using a key that is critically dependent on where the data is stored, and where the data is actually stored on the media. Combined with methods that make it impossible to predict what will happen.
Thus, copying the data results in an unpredictable change in the storage location, thereby breaking the crucial relationship between the latter and the encryption key. Therefore, once the data is moved, it can never be recovered if the cryptography is strong enough, the random number generator is strong enough to decipher, and all secrets are well hidden.

Accordingly, among others, an object of the present invention is to provide an inexpensive method for storing data on a storage medium, wherein the copying operation disrupts the relationship between the encryption key and the storage location. It is to be.

The present invention provides for easy random access to any location in memory, especially based on bits, bytes or other entities such as sectors of uniform size related to the access width of the target memory. It is suitable for a solid-state memory module.

Therefore, according to one aspect of the invention, the data on the storage medium is encrypted with a key K that depends on the location (L ₁ , L ₂ , L ₃ ) of the data on the storage medium, and In each write operation, the data is written to a randomly selected location on the storage medium.

The present invention provides a system arranged to be executed by the method according to claim 1, a playback device for playing back a recording prepared by the method according to claim 1, and
It also relates to a record carrier prepared according to the method of claim 1. Further advantageous features of the invention are set out in the independent claims.

[0010] These and other objects of the invention will be apparent with reference to the following examples.

FIG. 1 is a diagram showing a conceptual two player arrangement with two players A and B and an exchangeable module C carried between the players. As shown, both playback devices have a suitable way of inserting the module. In the following description,
It is assumed that the replaceable module can be accessed by other means (eg, a PC-based reader). This poses the risk of unauthorized copying of the data on the module, even if the playback devices A and B do not allow unauthorized copying. Although the preferred embodiment is described in the context of a solid state audio (solid state) playback device, it may be used more widely in accordance with the present invention.

Within a few years, solid state audio (SSA) players are expected to become the new standard for portable audio players. This is mainly due to the advantages over current disks or tapes in terms of weight, size, power consumption and shock resistance. Currently available SSA playback devices include 32-64 MB flash memory and MPEG to achieve up to one hour (near) CD quality music playback time.
Combines audio compression technology such as one layer III (MP3) or AAC. However, due to the digital nature of these devices and the ease of copying associated with them, the music industry demands appropriate copyright protection features.

One tool for copy protection of digital content is encryption. Cryptography by itself does not prevent piracy, but renders such copies unusable because the original content can only be retrieved by decrypting it with the appropriate key. As a result, playback of the content is limited to devices that can access such keys. It is an object of a copy protection system to prevent illegal copying and at the same time manage keys without the inconvenience of using legitimate and intended content.

Most memories for solid state multimedia storage applications have large flash memory and an on-board controller. The controller may or may not be integrated, and multiple separate memories may be provided on the module. Examples of such multimedia memory modules are Memory Stick (Sony), SmartMedia (SSFDC Forum Association), CompactFlash (registered trademark) (PCMCIA Forum), Multimedia Card (MMC Association). In addition, these devices can be considered as block devices, similar to hard disk drives, where memory accesses occur by being addressed in sectors (typically 512 bytes) on the module. Certainly, some of the modules mentioned above use the ATA interface standard, which connects hard disks and other peripherals to a PC. This allows the content of such a memory module to be easily duplicated (bit by bit) using a PC. Other modules have dedicated interfaces and instruction sets, but are based on blocks. That is, individual sectors on a module can be addressed and changed.

In the following, the SSA playback device employs a removable memory module (see FIG. 1) and is accessible by other means (eg, a PC-based reader).

Basically, two approaches exist for copy protection. The first is to tie the audio to a particular playback device by providing each individual playback device with a unique secret number which is used as a key for audio encryption.
Therefore, the audio stored in the memory by one playback device is played back only by that playback device. If one has a plurality of SSA playback devices, of course, it is very confusing. It is required that music stored on a memory module can be played regardless of the SSA device used to download the module. What must be avoided is that the user can copy the audio content to other modules and play it from both.

One known solution is to embed a unique identification code (ID) in the memory module that can be read from the application, but cannot be changed. This identification code is used to generate a module-specific encryption key.

Another known solution is to take advantage of defects in the memory module that occur naturally as a result of the manufacturing process used to manufacture inexpensive but high storage capacity memories. The location of these natural defects is probabilistically unique for each module and serves as a "fingerprint" for the device. Again, a unique module-specific key is generated.

[0019] These known solutions require a unique identification code and do not provide protection against replay attacks. A “replay attack” is a form of copy in which an unauthorized copy is made from one system (system 1) to another system (system 2), and is an unauthorized (but unplayable) copy on system 2. Can be used many times to recover a reproducible copy on the system, even after the original copy has expired. FIG. 2 illustrates this in detail. Each system has a unique identification code, represented by ID1 for system 1 and ID2 for system 2, and the content is stored as a separate block sequence. Include files. In this example, the data relating to the rights and use of the original copy is encrypted with a key obtained from ID1 and a secret S. In a 'pre-purchase' or rental business model, data access is also denied after a specific time period or number of uses. Copying data to the system with the unique identification code ID2 (second step in FIG. 2) does not result in a usable copy. This is because the identification code does not match ID1. However, this copy is completely (bit by bit) identical to the original. You can reverse copy from system 2 to system 1 at any time, and a copy of this copy is available. This allows a fraudulent customer to keep a copy on system 2 that can be re-copied many times on system 1 and used. Thus, after obtaining the content by "pre-purchase", the fraudulent customer copies the data from system 1 to system 2 and re-copys from system 2 to system 1 many times to maintain the "pre-listen" I do. "Pre-purchase audition" becomes "infinite audition". Similarly, the mechanism can be used to pay once for a rental and make a permanent copy.

In order to use the storage device effectively, it is necessary to use a file system. User data is organized and accessed through a file system. In order to treat the memory module as a block device, the creation and management of the file system is left to the application. In the PC environment, the operating system already has built-in file system support, which is a logical choice. By supporting the ATA standard, this support can be used for memory modules without modification. However, in a stand-alone device such as an SSA playback device, if the memory module adopts a block device approach, the application needs to perform file system details. Therefore, if the controller unit on the memory module handles the details of the file system, independent (portable) applications that require the storage of multimedia content are created more efficiently.

FIG. 3 shows a schematic diagram of Embodiment 20 of the memory module. For simplicity, the figure does not show the electromechanical interface to the playback device. The storage area 30
It has a substantially independent access time to the physical storage location. The controller 22 controls access to the memory itself. Various subsystems, such as a host interface 24, a memory interface 26, and a file system 28 are also shown. External writing and internal selection to the memory are also shown. The following functions should be provided in the application programming interface API. For the format of the memory, only a fixed or hardwire or random volume number generated each time the instruction is executed is output. This number changes only when the format instruction is executed,
Thereby all data on the device is lost. Copy protection itself does not require this number. To generate the file and later reference the file in question,
A reusable file ID is generated. When writing to a block, a sector number randomly selected from the free block list is generated. Depending on usage, the generated sector number is the actual sector number in which the data itself was stored during the write operation, or the sector number stored during the next write operation. Among other things, solid-state audio devices are possible without significant loss of time because flash memory is not hampered by seek times as is common in disk-based systems. Such a random choice also helps to average wear over the entire device. The application uses or discards the sector number returned by the requested block write command. When reading a block, the file ID controls the output of the data itself and the sector number of the current or next block to be read.

FIG. 4 shows an example of a file structure distributed into blocks having the size of a single sector of 512 bytes. The first block holds information about the file and the others have the file data itself. The above arrangement blocks the creation of bit-by-bit copies of the module, unless a means of change is provided for each individual sector. Copy to intermediate location and subsequent recopy of data on module (see above)
Constituting a replay attack) copies the data to a completely different location.
Provides some protection against copying. Copy protection is further achieved by encrypting the data block with a secret and a key that is also obtained from the location where the data in question is stored (eg, preferably a sector number). The position information is obtained from a block write function that returns the sector number of the next file sector. This information
Since it is not available for the first block, it can be used for less sensitive data. This limitation can be overcome by having the file generation function return the sector number of the first sector in the file where the data itself (eg, file information) is written. For reading, before reading the actual data, the current or next sector number is available, allowing the application to calculate the appropriate decryption key when it is just right. The encryption key thus binds to the location of the store, and makes it impossible for a method to do so to predict this location. The copy changes the storage location and thus breaks the relationship between the location and the decryption key. Note that the secret used in the derivation of the key is globally shared with the secret between all playback devices, or generated in other ways known to those skilled in the art.

FIGS. 5A and 5B show a method according to the invention. Each time a data block is written, the controller 22 writes data to a randomly selected location.
5A and 5B, the locations are indicated by L ₁ , L _2, etc. The data is encrypted with a key that depends on the combination of the secret S and the location _Li or the location _Li (eg, the location of the block to be written or the previous block or the location of the written and previous block).

Creating a copy of the data in the memory module (see FIG. 5B) changes the location of the data in a way that cannot be reproduced. In fact, this happens twice. Thus, a recopy of a copy has data whose location (L ₁ ″, L ₂ ″, etc.) does not correspond to the arguments required for proper decryption of the data. Thereafter, the copy of the copy is not decrypted and cannot be used. "Replay attacks" are prevented.

FIGS. 6A and 6B show an embodiment of the invention, in which all data is encrypted with a key K (consisting of a single key or block of keys) and itself as position arguments L ₁ , The data is encrypted with a key K ′, which is an output of a hash function having a secret S, such as L ₂ and L _3, and is stored. Thus, K ′ is the position of the data block, in this case
Depends on the entire sequence in which the data block is written. Since the position L ₁ , L ₂ , L ₃ is changed in an unpredictable manner for each write access, the result of the hash function H and, thereby, the key K ′ is changed. If the content is copied and re-copied, the playback device fails to recover the key (as in the method shown in FIGS. 5A and 5B) because the key K 'is changed in an unpredictable way. I do. Therefore, any replay attack will fail. In this way, copying is prevented in a relatively inexpensive manner that requires only moderate processing and does not require the use of a unique ID. Note that the invention offers the possibility of copy protection without having to use a unique ID. This does not exclude the use of such codes for other reasons or for further protection. It is also possible to arrange the data in groups of blocks and to write the groups of blocks at random locations. The same mechanism as described above can be used for groups of blocks instead of a single block. "Random position" within the concept of the present invention, in a broad sense, means a position that cannot be predicted in advance for all legitimate purposes. "For all legitimate purposes" is because some algorithm is used to obtain the use of a random number or location. Substantially truly random, ie substantially evenly distributed throughout the memory module, is also preferred with regard to wear on the device. Although it is preferred that the method be applied to all or substantially all data, the invention also encompasses embodiments where the method is applied to only some of the data in the memory module. This is advantageous, for example, in terms of operating speed. The invention is not limited to the use of one and only one encryption method. If the data is divided into groups, different encryption methods and different methods where the encryption method is position dependent can be used for different groups. This reduces the risk of unauthorized decryption. Although a controller is provided in the system separate from the memory module, the controller unit from which random positions are selected is preferably integrated with the memory module. This makes it difficult to avoid the method or affect the choice of data location.

A method for providing copy protection on a storage medium, wherein the location where the data arranged in the block is stored is preferably chosen randomly by a (preferably built-in) controller. Using an encryption key that is highly dependent on the location of the data in the storage medium makes decryption of the copied data virtually impossible.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a conceptual arrangement of two playback devices.

FIG. 2 is a diagram showing a mechanism of a conventional 'playback attack'.

FIG. 3 is a diagram showing schematic blocks of an embodiment of a storage medium.

FIG. 4 is a diagram showing an example of a file structure.

FIG. 5A shows an example of a method according to the invention and how this method prevents “playback attacks”.

FIG. 5B shows an example of a method according to the invention and how this method prevents “playback attacks”.

FIG. 6A shows a further example of a method according to the invention.

FIG. 6B shows a further example of a method according to the invention.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) G10L 11/00 G11B 20/10 H G11B 20/10 20/12 20/12 G10L 9/00 EF term ( Reference) 5B017 AA03 AA06 BA07 BA09 BB00 CA09 CA16 5B065 BA09 PA04 PA16 5D044 AB05 DE12 GK17

Claims (10)

[Claims] 1. A method for providing a copy protection service on a storage medium, comprising:
The data on the storage medium is encrypted with a key depending on the position of the data in the memory module, and in each write operation, the data is written to a randomly selected position on the storage medium. how to. 2. The method according to claim 1, wherein the data is arranged in blocks having sector numbers, and during each block write, a sector number of a current or next block is randomly selected from a free block list. The described method. 3. Data according to claim 1, wherein the data on the storage medium is arranged in blocks, and the blocks are encrypted with a key depending on the position of one or more blocks. the method of. 4. The method of claim 3, wherein the block is encrypted with a key that depends on the location of the block. 5. The method of claim 3, wherein the block is encrypted with a key that depends on the location of the previously written block. 6. The method according to claim 3, wherein the blocks are encrypted with a key that depends on the position of all blocks. 7. The method of claim 1, wherein the storage medium is a replaceable solid state memory module. 8. A system arranged to carry out the method according to claim 1, further comprising a controller for selecting a position at random. 9. A reproducing apparatus for reproducing data from a storage medium having data prepared according to the method of claim 1. 10. A data storage medium prepared according to the method of claim 1, further comprising a controller for selecting a position at random.