TW201303814A - Content delivery system, content delivery subsystem and reproduc - Google Patents

Abstract

According to the present invention, a first encryption unit (221) in a first server device (101) generates a first encrypted block by performing a first encryption of a part of a plain text block, and generates an intermediate encrypted content constituted by the plain text block and the first encrypted block, while a first summarizing unit (222) generates a first summarized value from each block in the intermediate encrypted content. A second encryption means in a second server device (102) generates a second encrypted block by performing a second encryption of the plain text block in the intermediate encrypted content, and generates an encrypted content constituted by the first encrypted block and the second encrypted block. A selection unit (521) in a reproduction device (104) selects the second encrypted block, and a decryption unit (522) applies a decryption corresponding to the second encryption to the second encrypted block thereby generating the plain text block, and a second summarizing unit (523) generates a second summarized value from the plain text block, and a verification unit (524) verifies the encrypted content by using a plurality of the first summarized values and the second summarized values.

Description

Content delivery system, content delivery subsystem, and reproduction device Field of invention

The present invention relates to a technique for illegally replacing detected content.

Background of the invention

In recent years, opportunities for communication between household electrical products, mobile phones, and the like through the Internet have increased. Between such devices, for the protection of the work or the prevention of leakage of the communication content, after the machine authentication and the key sharing, the shared key is used for the secret communication. One of the authentication key sharing methods defines a standard called DTCP (Digital Transmission Content Protection) (Patent Document 2 and Non-Patent Document 2).

As a result of communication between such household electric products, mobile phones, and the like, digital contents such as movies or music are recorded on a memory card in which a flash memory is mounted, and the digital device recorded on the memory card is reproduced by the reproducing device.

In order to prevent illegal copying, digital content is recorded on a memory card in a state of being encrypted using an encryption algorithm. Here, an example of the encrypted algorithm is AES (Advanced Encryption Standard) which can utilize a 128-bit key.

The key used to decrypt the digital content is assigned to the information processing device for reproducing the digital content. In general, this is called a component key. In the simplest configuration, the digital content may be encrypted first using the component key, but the digitized content encrypted here may be limited to the specific information processing device that holds the component key. Therefore, use the title key (also known as For the content key, the digital content is first encrypted, and the title key is further encrypted using the component key, and the encrypted content is recorded on the memory card together with the encrypted title key.

However, in this configuration, if it is desired to reproduce, for example, 1 million information processing apparatuses, it is not practical to total 1 million encrypted title keys. . Therefore, for example, in the case of an SD memory card, CPRM (Content Protection for Recording Media) is used, and in the case of Blu-ray Disc, AACS (Advanced Access Content System) is used. In these methods, by arranging the component key groups in a matrix or a tree shape, the number of encrypted title keys that should be recorded first is greatly reduced. This configuration is called MKB (MediaKeyBlock).

If the information processing device is attacked and the title key is illegally exposed, the encrypted content (legal encrypted content) can be illegally decrypted when the exposed title key is used. As a result, the content of the illegal culture will be revealed.

[First technical literature]

[Patent Document 1] Japanese Patent Laid-Open No. 6-103694

[Patent Document 2] Japanese Patent Publication No. 2007-529162 [Non-Patent Literature]

[Non-Patent Document 1] DONALDE.KNUTH, "THEARTOFCOMPUTERPROGRAMMINGVol.2SEMINU MERICALALGORITHMS", AddisonWesleyLongman

[Non-Patent Document 2] "DigitalTransmissionContentProtectionSpecificationVolum E1 (InformationalVersion), Revision1.6, March 19, 2010

However, when the title key is illegally exposed, once the exposed title key is used, not only the legal encrypted content will be illegally decrypted, but also the content of the illegal plaintext will be encrypted using the exposed title key to generate illegal encryption. Content, and the replacement of legitimate encrypted content with illegally encrypted content is replaced by the possibility of attack.

In the case of such a attack, in a legitimate reproduction device, decryption and reproduction of illegally encrypted content may occur, and a legitimate reproduction device may become a hotbed of illegal content distribution.

It is an object of the present invention to provide a content transmission system, a content transmission subsystem, a reproduction device, a control method, a control program, a recording medium, and an integrated circuit that can detect illegally replaced content, thereby solving such a problem.

In order to achieve the above object, the present invention is a content transmission system, which is composed of a first server device, a second server device, and a reproduction device, wherein the first server device has a first encryption mechanism. And performing a first encryption on a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content to generate a first encrypted block, and generating the plaintext area without the first encryption Blocking the intermediate encrypted content formed by the first encrypted block that has been generated; and The first aggregation means aggregates each of the plurality of blocks constituting the intermediate encrypted content to generate a first summary value of the plurality, and the second server device has a second encryption mechanism, and the second encryption mechanism is And performing, in the foregoing block included in the intermediate encrypted content, performing second encryption on the plaintext block without the first encryption, generating a second encrypted block, and generating the first encrypted area by using the foregoing first encrypted area And the encryption device comprising the block and the second encrypted block, wherein the playback device includes: a selection means for selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; The decryption mechanism is configured to perform the decryption corresponding to the second encryption to generate a plaintext block in the selected second encrypted block, and the second summary mechanism aggregates the generated plaintext block to generate the first a summary value; the verification institution performs verification of the encrypted content using the first summary value of the plurality and the generated second summary value; and a regeneration mechanism, When the aforementioned verification fails, stops decryption of said encrypted content, and the authentication is successful, the encryption of the decrypted content after reproduction.

According to this configuration, in the encrypted content, when the selected second encrypted block is replaced by an attack of an illegally encrypted block generated by encrypting the illegal plaintext block, the foregoing may be generated by comparison. a second summary value, corresponding to the second encrypted area before being replaced by the illegally encrypted block The first summary value generated by the block achieves the excellent effect of the replacement of the detectable content.

Simple illustration

Fig. 1 is a view showing the overall configuration of a content transmission system 10 as a first embodiment of the present invention.

Fig. 2 is a view showing the overall configuration of a content transmission system 10a according to the second embodiment of the present invention.

Fig. 3 is a block diagram showing the configuration of the content signature creation server device 101a.

The fourth figure shows an example of the data structure of the original content 701 stored in the content storage unit 201.

Fig. 5 is a conceptual diagram showing an outline of generation of the divided content 721 by the display unit generating unit 204.

Fig. 6 shows an example of a data structure of the unit selection information 780 generated by the unit generation unit 204.

Figure 7 shows a portion of the encryption process performed by the encryption mechanism 206. It is also a conceptual diagram showing the generation summary of the encrypted split file 800.

FIG. 8 shows an example of a data structure of the encrypted content 820 generated by the encryption unit 206.

Fig. 9 is a conceptual diagram showing an outline of the generation of the header information 860 by the header information generating unit 207.

Fig. 10 is a conceptual diagram showing an outline of generation of the first hash table 861 by the header information generating unit 207.

Figure 11 shows the second generated by the header information generating unit 207. An example of the data structure of the hash table 865.

Fig. 12 is a conceptual diagram showing an outline of the generation of the signature information 890 by the signature generation unit 209.

Fig. 13 is a block diagram showing the configuration of the transmission server device 102a.

Fig. 14 is a conceptual diagram showing a selection outline of an encryption unit using the title key flag information by the encryption unit 306.

Fig. 15 is a conceptual diagram showing an outline of generation of the encrypted file 901 for transmission by the encryption unit 306.

Fig. 16 shows an example of a data structure of the encrypted content 900 for transmission generated by the encryption unit 306.

Fig. 17 is a diagram showing an example of a data structure of the public key certificate 921 of the transmission server device 102a.

Fig. 18 is a block diagram showing the configuration of the information processing device 103a for recording.

Fig. 19 is a block diagram showing the configuration of the information processing device for reproduction 104a.

Fig. 20 is a conceptual diagram showing an outline of the replacement of the second hash table 931 by the replacement combination generating means 506.

Fig. 21 is a conceptual diagram showing an outline of selection of file information from the unit selection information 780 by the replacement combination generating means 506.

Fig. 22 is a conceptual diagram showing an outline of the replacement of the first hash table 941 by the replacement combination generating means 506.

Fig. 23 is a conceptual diagram showing an outline of replacement of the second hash table 931 by the replacement combining unit generating means 506.

Fig. 24 is a conceptual diagram showing an outline of verification of the signature information 890 by the signature verification unit 507.

Fig. 25 is a block diagram showing the configuration of the information recording medium device 105a.

Fig. 26 is a view showing an example of a schematic data structure of the public key certificate 951 of the information recording medium device 105a.

Fig. 27 is a sequence diagram showing an action of generating a content signature in the content distribution system 10a.

Fig. 28 is a sequence diagram showing the action of content transmission in the content distribution system 10a.

Fig. 29 is a sequence diagram showing an operation of reproducing the content in the content distribution system 10a.

Fig. 30 is a view showing the overall configuration of a content transmission system 10b as a third embodiment of the present invention.

Fig. 31 is a block diagram showing the configuration of the transmission server device 102b.

Fig. 32 is a view showing an example of the structure of the outline of the title key transmission certificate 1000.

Fig. 33 is a block diagram showing the configuration of the information processing device for reproduction 104b.

Figure 34 is a block diagram showing the construction of the information recording medium device 105b.

Fig. 35 is a sequence diagram showing the action of content transmission in the content distribution system 10b.

Figure 36 shows the action of content reproduction in the content delivery system 10b. Sequence diagram.

Fig. 37 is a view showing the overall configuration of a content transmission system 10c as a third embodiment of the present invention.

Fig. 38 is a block diagram showing the configuration of the content signature creation server device 101c.

Fig. 39 shows an example of a data structure with WM divided content 1100.

Fig. 40 is a view showing an outline of the generation of the WM split file 1131 by the digital watermark embedding mechanism 210.

Fig. 41 is a view showing an outline in which the encryption unit 206c encrypts and generates the WM divided file 1161.

Fig. 42 is a view showing an example of a data structure in which the WM content 1201 is encrypted by the encryption unit 206c.

Fig. 43 is a view showing an outline of the generation of the WM header information 1251 by the header information generating unit 207c.

Fig. 44 shows a flow of generation of the WM first hash table 1271 by the header information generating unit 207c.

Fig. 45 shows an example of a data structure with the WM second hash table 1261 generated by the header information generating unit 207c.

Fig. 46 shows the generation processing of the signature information 1300 by the signature generation unit 209c.

Fig. 47 is a block diagram showing the configuration of the transmission server device 102c.

Fig. 48 shows the processing of selecting the title key flag information by the encryption unit 306c.

Fig. 49 shows the generation processing of the WM file 1371 with the encryption for transmission by the encryption unit 306c.

Fig. 50 shows an example of a data structure in which the WM content 1361 is encrypted for transmission by the encryption unit 306c.

Fig. 51 is a block diagram showing the configuration of the information processing device for reproduction 104c.

Fig. 52 is a view showing an outline of the process of generating the replacement WM second hash table 1391 by the replacement combination generating means 506c.

Fig. 53 is a flow chart showing the generation of the replacement of the WM first hash table 1381 by the replacement combining unit 506c when the title key flag information is "0".

Fig. 54 is a flow chart showing the generation of the WM first hash table 1381 by the replacement combining unit 506c when the title key flag information is "1".

Fig. 55 shows a flow of generation in which the replacement combining body generating means 506c is replaced with the WM second hash table 1391.

Fig. 56 shows the verification processing of the signature information 1300 by the signature verification unit 507c.

Fig. 57 is a sequence diagram showing the action of generating the content signature of the content distribution system 10c.

Fig. 58 is a sequence diagram showing the action of the content transmission by the content distribution system 10c.

Fig. 59 is a sequence diagram showing the operation of content reproduction by the content distribution system 10c.

Fig. 60 is a view showing the outline of the generation of the WM split file 1401 by the digital watermark embedding unit 210 in the modification (9).

Fig. 61 is a view showing the outline of the generation of the WM split file 1431 by the encryption by the encryption unit 206c in the modification (9).

Fig. 62 is a view showing the outline of the generation of the WM first hash table 1451 by the header information generating unit 207c in the modification (9).

Fig. 63 is a view showing the outline of the generation of the WM file 1501 by the encryption unit 306c in the modification (9).

Fig. 64 is a view showing an outline of the generation of the WM first hash table 1521 in place of the replacement combined body generating means 506c in the modification (9). In the figure, the title key flag information is "0".

Detailed description of the preferred embodiment

One aspect of the present invention is a content transmission system, which is composed of a first server device, a second server device, and a reproduction device, wherein the first server device has a first encryption mechanism. And performing a first encryption on a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content to generate a first encrypted block, and generating the plaintext block without the first encryption. And the first summary unit configured to generate the first summary value of the plurality of complex blocks constituting the intermediate encrypted content, and the first summary unit The second server device has a second encryption mechanism, and the second encryption mechanism performs a second block on the plaintext block that is not encrypted by the first encryption in the block included in the intermediate encrypted content. Encrypting, generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the reproducing device has a selection mechanism configured to constitute the encryption Selecting, in the foregoing encrypted block, a second encrypted block; the decrypting mechanism is configured to perform decryption corresponding to the second encryption to generate a plaintext area by using the selected second encrypted block a second summary unit that aggregates the generated plaintext blocks to generate a second summary value, and the verification unit performs the encrypted content by using the first summary value of the plurality and the generated second summary value. Verification; and the regenerative mechanism stops the decryption of the encrypted content when the verification fails, and decrypts the encrypted content after the verification is successful

Here, the first server device further includes a signature mechanism for signing a combination of at least a plurality of the first summary values that have been generated, to generate signature data, and the regeneration device further And a replacement combination generating mechanism, wherein the replacement combination generation mechanism replaces the first summary value corresponding to the second summary value in the combination body with the second summary value to generate a replacement combination body, The aforementioned verification mechanism uses the aforementioned replacement combination to verify the aforementioned signature data.

Here, the second server device outputs the encrypted content to the playback device via a recording medium device, and the first encryption device of the first server device is used in common with a plurality of recording media devices. Performing the first encryption on the plaintext block by using the common title key, and the second encryption mechanism of the second server device uses the individual title key inherent to the one recording medium device, Performing the second encryption on the encrypted plaintext block, the decryption mechanism of the playback device performing the decryption corresponding to the second encryption in the selected second encrypted block by using the individual title key .

Another aspect of the present invention is a content transmission subsystem, which is composed of a first server device and a second server device, wherein the first server device has: a first encryption mechanism, the first The encryption mechanism generates a first encrypted block by performing a first encryption on a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content, and generates the foregoing by the first encryption without the foregoing first encryption. The plaintext block and the intermediate encrypted content formed by the generated first encrypted block; and the first summary mechanism sums each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values The second server device has a second encryption mechanism, and the second encryption The densification mechanism generates a second encrypted block in the block included in the intermediate encrypted content, and performs the second encryption on the plaintext block without the first encryption, and generates the first encrypted block. Encrypted content formed by the encrypted block and the second encrypted block.

The first server device further includes a signature mechanism that performs signature on the combination obtained by combining at least the plurality of the first summary values generated to generate the signature data.

Here, the second server device transmits the encrypted content to the playback device via a recording medium device, and the first encryption device of the first server device uses a common title gold common to the plurality of recording media devices. And performing, by the key, the first encryption on the plaintext block, wherein the second encryption unit of the second server device uses the individual title key unique to the one recording medium device, and the foregoing The plaintext block performs the aforementioned second encryption.

Here, the first server device further includes a common title key generation unit for generating the common title key common to the plurality of recording medium devices, and the first encryption mechanism is used by the first encryption device. The aforementioned common title key is generated.

The second server device further includes an individual title key generation unit that generates the individual title key unique to the one recording medium device, and the second encryption mechanism uses the generated Individual title key.

Here, the second server device further includes a media identifier obtaining unit that includes a media identifier for identifying the one of the recording media devices, and the individual title key generating unit generates the media identifier including the acquired media identifier The aforementioned individual title key.

The individual title key generation means generates a random number, combines the media identifier with the random number to generate a combination, and encrypts the generated combination to generate the individual title key.

Here, the second server device further includes a certificate generating unit that performs a signature on the combination of the common title key, the individual title key, and the media identifier to generate a title. The key is sent to the certificate.

Here, the first server device further includes a digital watermark embedding mechanism that embeds one of the plaintext blocks that are the first encryption target in the first encryption mechanism or a plurality of digital watermarks, thereby regenerating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, The first encryption unit further performs the foregoing first encryption on a group of one or a plurality of embedded blocks that have been generated, and generates one or a plurality of first encrypted embedded blocks, and generates Further comprising the foregoing intermediate encrypted content of one or more of the foregoing first encrypted embedded blocks that have been generated, Configuring a location of the portion of the media identifier in the media identifier and the first encrypted block included in the intermediate encrypted content and One or more of the groups of the first encrypted embedding blocks correspond to positions in the intermediate encrypted content, and the second encryption mechanism selects a position corresponding to the position of the partial information in the media identifier. And the group of the first encrypted block and the one or more of the first encrypted embedded blocks in the intermediate encrypted content, using the content of the partial information, by the first encrypted block and one or plural The foregoing group of the first encrypted embedded blocks selects any of the blocks, and generates the encrypted content including the selected block as the first encrypted block.

Here, the digital watermark embedding mechanism embeds one type of digital watermark for each plaintext block, thereby regenerating one embedded block in which the digital watermark is embedded, and the first encryption mechanism is generated. Performing the first encryption on the first embedded block, and generating one first encrypted embedded block, and generating the intermediate encrypted content further including one of the first encrypted embedded blocks that has been generated, the foregoing The partial information is bit information constituting one bit of the media identifier, the bit position of the bit information in the media identifier and the first encrypted block and one of the foregoing included in the intermediate encrypted content. An encryption embedding block corresponds to a position in the intermediate encrypted content, and the second encryption mechanism selects the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier. The foregoing a first encryption block and a first encryption embedding block, and using the value of the bit information, selecting any block from the first encryption block and one of the first encryption embedding blocks .

Here, the digital watermark embedding mechanism of the first server device embeds one or more kinds of digital watermarks for each plaintext block of the first encryption unit that is not the target of the first encryption. Thereby regenerating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, the first encryption mechanism generating the middle of the group further comprising one or a plurality of the embedded blocks that have been generated. Encrypting the content, and constituting the portion of the media identifier in the media identifier and the group of the plaintext block and the one or more embedded blocks included in the intermediate encrypted content in the middle encrypted content Corresponding to the location, the second encryption mechanism selects the plaintext block and one or more of the embedded blocks in the intermediate encrypted content corresponding to the location of the partial information in the media identifier. Grouping, and using the content of the foregoing part of the information, selecting any block from the aforementioned plaintext block and one or a plurality of the aforementioned embedded block groups, and Optional block of the second encryption purposes of generating the encryption of the second block, and the generating comprises generating the encrypted content has the encryption of the second block.

Here, the digital watermark embedding mechanism embeds one type of digital watermark for each plaintext block that is not the target of the first encryption, thereby regenerating one embedded block in which the digital watermark is embedded. The first encryption unit generates the intermediate encrypted content further including one embedded block that has been generated, and the partial information is bit information constituting one bit of the media identifier, and the bit information is in the media identifier. The bit position in the middle corresponds to the position of the plaintext block and the one embedded block included in the intermediate encrypted content in the intermediate encrypted content, and the second encryption mechanism selects the bit and the bit The information in the media identifier corresponds to the plaintext block and the one embedded block in the intermediate encrypted content, and uses the value of the bit information to be used by the plaintext block and one of the foregoing embedded Block, select any block.

Another aspect of the present invention is a reproducing apparatus for performing a first encryption by using a first server device to generate a first encryption only for a portion of the plaintext block constituting a plurality of plaintext blocks of the plaintext content. And generating an intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated, and constituting the plurality of blocks of the intermediate encrypted content Generating each of the plurality of first summary values, and performing second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content by the second server device Generating a second encrypted block and generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the reproducing device has a selection mechanism for constructing the encrypted content Multiple encryption In the block, a second encrypted block is selected; the decryption mechanism is configured to perform the decryption corresponding to the second encryption to generate a plaintext block by using the selected second encrypted block; The mechanism collects the generated plaintext blocks to generate a second summary value; the verification institution performs verification of the encrypted content by using the first summary value of the plurality and the generated second summary value; and regeneration The mechanism stops the decryption of the encrypted content when the verification fails, and decrypts the encrypted content and reproduces when the verification is successful.

Here, the first server device further performs a signature on at least a combination of the plurality of the first summary values that have been generated to generate the signature data, and the regeneration device further includes a replacement combination generation mechanism. The replacement combination generating mechanism generates a replacement combination by replacing the first summary value corresponding to the second summary value in the combination with the second summary value, and the verification mechanism uses the replacement combination to verify The aforementioned signature information.

Here, the playback device receives the encrypted content through a recording medium device by the second server device, and uses a common title key common to a plurality of recording media devices by the first server device. Performing the aforementioned first encryption on the aforementioned plaintext block, And using the second server device to perform the second encryption on the plaintext block without the first encryption by using the individual title key unique to the one recording medium device, wherein the decryption mechanism uses the foregoing individual title And deleting, by the selected second encrypted block, the decryption corresponding to the foregoing second encryption.

Here, the second server device performs a signature on the combination of the common title key, the individual title key, and the media identifier for identifying the one recording medium device, and generates a title. a key transmission certificate, wherein the common title key, the individual title key, and the title key transmission certificate are written to the recording medium device, and the playback device further includes: an acquisition unit obtained by the recording medium device The media identifier, the common title key, the individual title key, and the title key transmission certificate; and the title key transmission certificate verification unit, combining the common title key, the individual title key, and the media The combination is generated to generate a combination, and the generated combination of the title key is used to verify the acquired certificate.

Here, the first server device further embeds one or more types of digital watermarks for each of the plaintext blocks to be the target of the first encryption, thereby regenerating the first digital watermark embedded therein. Or a plurality of groups of embedded blocks, and further performing the foregoing first encryption on a group of one or a plurality of embedded blocks that have been generated, generating one or a plurality of groups of first encrypted embedded blocks, and Build further contains generated The intermediate encrypted content of one or a plurality of the first encrypted embedding blocks, the position of the partial information of the media identifier in the media identifier and the first encryption included in the intermediate encrypted content The group of the first block or the plurality of the first encrypted embedded blocks corresponds to the position in the intermediate encrypted content, and the first server device selects the part of the information in the medium. Identifying, in the intermediate encrypted content, the first encrypted block and one or a plurality of the first encrypted embedded blocks in the intermediate encrypted content, and using the content of the partial information, by the first encryption And selecting one of the blocks and one or more of the first encrypted embedded blocks to generate the encrypted content including the selected block as the first encrypted block, and the foregoing reproducing device further includes selecting a mechanism, wherein the selection mechanism selects the first encrypted block at a specific location in the encrypted content, and the decryption mechanism further selects the foregoing The first encrypted block is decrypted to generate a plaintext block, and the foregoing reproducing device further comprises: a digital watermark determining mechanism for determining whether the aforementioned plaintext block has been embedded with one or more of the foregoing digital watermarks. And outputting the judgment result; and the media identifier generation mechanism is located at a position corresponding to the media identifier in the specific position, and the content of the judgment result is used as The partial information of the media identifier is generated and generated.

Here, the first server device further embeds one type of digital watermark for each plaintext block to be the target of the first encryption, thereby regenerating an embedded region in which the digital watermark is embedded. Blocking, performing the foregoing first encryption on one embedded block that has been generated, generating one first encrypted embedded block, and generating and further including the foregoing intermediate portion of the first encrypted embedded embedded block that has been generated Encrypting the content, the part of the information is bit information constituting one bit of the media identifier, the bit position of the bit information in the media identifier, and the first encrypted area included in the intermediate encrypted content The block and one of the first encrypted embedding blocks correspond to positions in the intermediate encrypted content, and the first server device 1 selects and corresponds to the bit position of the bit information in the media identifier. The first encrypted block and the first encrypted embedded block in the intermediate encrypted content, and using the value of the bit information, by the first encrypted block and 1 The foregoing first encrypted embedding block selects any block, and generates the encrypted content including the selected block as the first encrypted block, and the digital watermark judging mechanism judges the aforementioned plaintext block that has been generated. Whether one type of the aforementioned digital watermark is embedded, and the media identifier generation means generates a value according to the determination result as a bit constituting the media identifier in a bit position in the media identifier corresponding to the specific position News.

Here, by using the first server device, one or a plurality of digital watermarks are embedded in each plaintext block that is not the target of the first encryption, thereby regenerating the digital watermark embedded with the digital watermark. And a plurality of embedded blocks, and generating the intermediate encrypted content further comprising a group of one or a plurality of the embedded blocks that have been generated, and constituting a part of the information of the media identifier in the media identifier Corresponding to the location of the plaintext block and one or more of the embedded blocks included in the intermediate encrypted content in the intermediate encrypted content, and the foregoing second server device selects the foregoing Part of the information in the media identifier corresponding to the plaintext block and one or a plurality of the embedded blocks in the intermediate encrypted content, and using the content of the partial information, the plaintext block and the Or a plurality of the foregoing groups of embedded blocks select any block, and perform the foregoing second encryption on the selected block to generate the second encrypted block, and generate And including the encrypted content of the generated second encrypted block, the selecting mechanism further selecting the second encrypted block of the specific location in the encrypted content, and the decrypting mechanism further selects the foregoing Decrypting the encrypted block to generate a plaintext block, the digital watermark determining unit further determining whether the plaintext block generated by the decrypting of the second encrypted block is embedded with one or more kinds of the digital watermarks And outputting the judgment result, the media identifier generation mechanism further performing the second encryption In the position in the media identifier corresponding to the specific position of the block, the content of the determination result is generated as the partial information constituting the media identifier.

Here, the first server device embeds one type of digital watermark for each plaintext block that is not the target of the first encryption, thereby regenerating one embedded block in which the digital watermark is embedded. And generating the intermediate encrypted content, which further comprises one of the embedded blocks that have been generated, wherein the partial information is bit information constituting one bit of the media identifier, and the bit information is in a bit of the media identifier. a location corresponding to the location of the plaintext block and one of the embedded blocks included in the intermediate encrypted content in the intermediate encrypted content, and the second server device selects and stores the bit information The plaintext block and one of the embedded blocks in the intermediate encrypted content corresponding to the bit position in the media identifier, and using the value of the bit information, the plaintext block and one of the embedded blocks Selecting any block, and performing the foregoing second encryption on the selected block to generate the second encrypted block, and generating the generated second encrypted block In the encrypted content, the selection means selects the second encrypted block at a specific location in the encrypted content, and the decryption mechanism decrypts the selected second encrypted block to generate a plaintext block. The digital watermark determining unit determines whether the aforementioned plaintext block is decoded by the second encrypted block, and the first digital floating watermark is embedded, and outputs a determination result, and the media identifier generating unit is in the second encryption. The position in the media identifier corresponding to the specific position of the block is generated, and the content of the determination result is generated as the bit information constituting the media identifier.

Further, a control method according to another aspect of the present invention is used in a content transmission system including a first server device, a second server device, and a reproduction device, and includes the following steps: first encryption In the step of the first server device, only a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content is subjected to the first encryption to generate the first encrypted block, and the generated first block is generated. The intermediate encrypted content formed by the first encrypted first block and the first encrypted block that has been generated; the first summary step is to form the intermediate encryption by using the first server device. Each of the plurality of blocks of the content is aggregated to generate a plurality of first summary values; and the second encryption step is performed by the second server device in the block included in the intermediate encrypted content, The first encrypted block of the first encryption is subjected to second encryption to generate a second encrypted block, and is generated by the first encrypted block and the second encrypted block. The encrypted content; selecting step, based by the reproducing apparatus, in the configuration of the encryption Selecting, in the plurality of encrypted blocks, a second encrypted block; and the decrypting step, by using the foregoing reproducing device, performing the decryption corresponding to the second encryption by using the selected second encrypted block Generating a plaintext block; the second summarizing step is to collect the generated plaintext block by the foregoing reproducing device to generate a second summary value; and the verifying step is to use the foregoing first summary value by the foregoing reproducing device And generating the second summary value to perform verification of the encrypted content; and the reproducing step, by the reproducing device, stopping decryption of the encrypted content when the verification fails, and encrypting the encrypted content when the verification succeeds The content is decrypted and reproduced.

Furthermore, a control program according to another aspect of the present invention is used in a content transmission system including a first server device, a second server device, and a playback device, and is characterized in that: the first servo of the computer The device performs the following steps: the first encryption step, performing only the first encryption on the part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content to generate the first encrypted block, and generating the The intermediate encrypted content formed by the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated; and the first summary step, by the first server device, constitutes the intermediate encryption Each of the plural blocks of the content is aggregated to generate a complex number a summary value, and performing a second encryption step for the aforementioned second server device of the computer, the second encryption step being in the foregoing block included in the intermediate encrypted content, without the first encryption The second plaintext block is generated by the second plaintext block to generate a second encrypted block, and the encrypted content composed of the first encrypted block and the second encrypted block is generated; The reproducing apparatus performs the following steps: a selecting step of selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content by the reproducing device; and the decrypting step is performed by the reproducing device And generating, by the selected second encrypted block, the decryption corresponding to the second encryption, to generate a plaintext block; and the second summarizing step, by using the foregoing regeneration device, summarizing the generated plaintext block to generate the first a summary value; the verification step is performed by using the foregoing regenerative device, using the first summary value of the plurality and the second summary value generated to perform the verification of the encrypted content ; And a regeneration step, by the Department of the reproducing apparatus when the authentication fails, stops decryption of said encrypted content, and in the authentication is successful, the encryption of the decrypted content after reproduction.

Further, another aspect of the present invention is a computer readable recording medium in which a control program used in a content transmission system composed of a first server device, a second server device, and a reproduction device is recorded, and is characterized. Lie in: Performing the following steps for the first server device of the computer: the first encryption step is to perform the first encryption on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content to generate the first Encrypting the block, and generating intermediate encrypted content formed by the foregoing plaintext block without the first encryption and the first encrypted block that has been generated; the first summary step is by using the first servo The device device aggregates each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values, and performs a second encryption step for the second server device of the computer, the second encryption step And performing, by the second block, the second encrypted block in the foregoing block included in the intermediate encrypted content without the first encryption, generating a second encrypted block, and generating the first encrypted block and the foregoing Encrypting the content of the second encrypted block, and performing the following steps on the reproducing device for the computer: the selecting step is performed by the plurality of the above-mentioned encrypted content a second encrypted block is selected in the block, and the decrypting step is performed by performing the decryption corresponding to the second encryption by using the selected second encrypted block to generate a plaintext block; and the second summary step Generating the generated plaintext block to generate a second summary value; the verifying step is to perform verification of the encrypted content using the first summary value of the plurality and the generated second summary value; and a regeneration step When the aforementioned verification fails, the above encryption is stopped. The decryption is performed, and when the verification is successful, the encrypted content is decrypted and reproduced.

Moreover, another aspect of the present invention is an integrated circuit that constitutes a first server device and is characterized by: The first encryption unit performs the first encryption on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content to generate the first encrypted block, and generates the first encrypted layer without the foregoing first encryption. And the first summary unit is configured to aggregate the plurality of blocks constituting the intermediate encrypted content to generate a plurality of the encrypted blocks; A summary value.

Further, another aspect of the present invention is an integrated circuit that constitutes a second server device and is characterized in that it has a second encryption mechanism that borrows the first server device and constitutes only plaintext. The first plaintext block of a part of the plurality of plaintext blocks of the content is subjected to the first encryption, the first encrypted block is generated, and the foregoing plaintext block without the first encryption is generated and the foregoing generated An intermediate encrypted content formed by an encrypted block, and each of the plurality of blocks constituting the intermediate encrypted content is aggregated to generate a first summary value of the plurality, and the foregoing block included in the intermediate encrypted content Performing the second encryption in the foregoing plaintext block without the foregoing first encryption, generating a second encrypted block, and generating an encryption formed by the first encrypted block and the second encrypted block. content.

Further, another aspect of the present invention is a regeneration method, which is a regeneration device The user is characterized in that the foregoing regeneration method is performed by the first server device, and only the first plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content is subjected to the first encryption to generate the first encrypted block. And generating intermediate encrypted content composed of the foregoing plaintext block without the foregoing first encryption and the first encrypted block that has been generated, and performing each of the plurality of blocks constituting the intermediate encrypted content Generating a plurality of first summary values, and using the second server device, performing the second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content, and generating Encrypting the second encrypted block and generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the reproducing method includes: a selecting step of forming a plurality of the encrypted content In the encryption block, one of the foregoing second encryption blocks is selected; and the decrypting step is performed on the selected second encryption block to perform the second encryption. The second summary step is to generate the second summary value by combining the generated plaintext blocks; the verification step is to use the first summary value of the plurality and the second summary value generated, And performing the verification of the encrypted content; and the reproducing step stops the decryption of the encrypted content when the verification fails, and decrypts the encrypted content and then reproduces when the verification is successful.

Moreover, another aspect of the present invention is a reproduction program, which is a reproduction device. The user is characterized in that the regenerative program uses the first server device to perform the first encryption on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content to generate the first encrypted block. And generating intermediate encrypted content composed of the foregoing plaintext block without the first encryption and the first encrypted block that has been generated, and performing each of the plurality of blocks constituting the intermediate encrypted content Generating a first summary value of the plurality of complexes, and performing, by the second server device, performing second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content, to generate And secondly encrypting the block, and generating encrypted content formed by the first encrypted block and the second encrypted block, wherein the reproducing program is configured to perform the following steps on the foregoing reproducing device for the computer: a selecting step of selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; and the decrypting step is performed by selecting the second The densification block performs decryption corresponding to the foregoing second encryption to generate a plaintext block; and the second aggregation step is to aggregate the generated plaintext blocks to generate a second summary value; the verification step uses the foregoing The first summary value and the generated second summary value are used to perform verification of the encrypted content; and the regeneration step is to stop decryption of the encrypted content when the verification fails, and to perform the encryption when the verification is successful. The content is decrypted and reproduced.

According to still another aspect of the present invention, a computer-readable recording medium is a reproduction program used by a reproduction device, wherein the recording medium is a first server device and only constitutes plaintext content. Performing the first encryption on a part of the plaintext block in the plurality of plaintext blocks to generate a first encrypted block, and generating the foregoing plaintext block without the first encryption and the first encryption already generated Intermediate encrypted content formed by the block, and each of the plurality of blocks constituting the intermediate encrypted content is aggregated to generate a first summary value of the plurality, and the intermediate encrypted content is obtained by the second server device Forming, by the second block, the foregoing plaintext block without the foregoing first encryption in the foregoing block, generating a second encrypted block, and generating the first encrypted block and the second encrypted area The encrypted content formed by the block, wherein the reproducing program is configured to perform the following steps in the reproducing device for the computer: the selecting step is performed before the plural of the encrypted content In the encryption block, one of the foregoing second encrypted blocks is selected; and the decrypting step is performed by performing decryption corresponding to the second encryption by using the selected second encrypted block to generate a plaintext block; a step of summarizing the generated plaintext blocks to generate a second summary value; the verifying step is to verify the encrypted content by using the first summary value of the plurality and the generated second summary value; and The step is to stop the decryption of the encrypted content when the verification fails, and decrypt the encrypted content after the verification is successful. Health.

An integrated circuit is a device for constructing a regenerative device, wherein the integrated circuit is configured by the first server device to perform the first encryption only on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content. And generating a first encrypted block, and generating intermediate encrypted content formed by the foregoing plaintext block without the first encryption and the first encrypted block that has been generated; and a first summary mechanism, And summing each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values, and by using the second server device, the first block included in the intermediate encrypted content is not in the foregoing first block Encrypting the plaintext block to perform second encryption, generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the integrated circuit has a selection mechanism for selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; and a decryption mechanism for selecting the second added a verification block, corresponding to the decryption of the second encryption, to generate a plaintext block; the second summary mechanism sums the generated plaintext block to generate a second summary value; the verification mechanism uses the foregoing The first summary value and the generated second summary value perform verification of the encrypted content; and the reproduction mechanism stops decryption of the encrypted content when the verification fails, and when the verification is successful, the encrypted content is After decryption Health.

1. Embodiment 1

Here, the content transmission system 10 according to the first embodiment of the present invention will be described with reference to the drawings.

(1) The content transmission system 10 is composed of the first server device 101, the second server device 102, and the reproduction device 104 as shown in Fig. 1 .

The first server device 101 has a first encryption unit 221 and a first summary unit 222.

The first encryption unit 221 performs the first encryption on only a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content, and generates the first encrypted block, and generates the first encrypted block. The intermediate encrypted content formed by the encrypted plaintext block and the generated first encrypted block.

The first summary unit 222 aggregates each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values.

The second server device 102 has a second encryption unit 321.

The second encryption unit 321 performs second encryption on the plaintext block that is not encrypted by the first encryption in the block included in the intermediate encrypted content to generate a second encrypted block, and generates and generates a second encrypted block. The encrypted content formed by the first encrypted block and the second encrypted block.

The playback device 104 includes a selection unit 521, a decryption unit 522, a second aggregation unit 523, a verification unit 524, and a reproduction unit 525.

The selection unit 521 selects one of the second encrypted blocks among the plurality of encrypted blocks constituting the encrypted content.

The decryption unit 522 generates a plaintext block by performing decryption corresponding to the second encryption in the selected second encrypted block.

The second summary unit 523 aggregates the generated plaintext blocks to generate a second summary value.

The verification unit 524 performs verification of the encrypted content using the plurality of first summary values and the generated second summary value.

The reproduction unit 525 stops the decryption of the encrypted content when the verification fails, and decrypts the encrypted content and reproduces it when the verification is successful.

According to the above configuration, when the second encrypted block selected in the encrypted content is replaced by the illegal encrypted block generated by encrypting the illegal plaintext block, the comparison is generated. The second summary value and the first summary value generated corresponding to the second encrypted block before being replaced by the illegally encrypted block, because the second summary value is inconsistent with the first summary value, Replace it.

Furthermore, the reproduction unit 525 may determine that the encrypted content is illegal when the verification fails, instead of stopping the decryption of the encrypted content.

Moreover, if the attack is performed by the illegally encrypted block generated by the encryption of the first encrypted block in the encrypted content, the illegal encrypted block is decrypted to obtain the plaintext. The block, and the summary value generated by the obtained plaintext block, may be detected because the summary value generated is inconsistent with the first summary value generated by the first encrypted block.

In addition, if the second content is not selected as described above in the encrypted content When the encrypted block is replaced by an attack of an illegal encrypted block generated by encrypting the illegal plaintext block, the illegal encrypted block is decrypted to obtain a plaintext block, and a summary value is generated from the obtained plaintext block. Since the generated summary value is inconsistent with the first summary value generated corresponding to the second encrypted block before being replaced by the illegally encrypted block, the substitution can be detected.

The apparatus 101 may further include at least a signature unit 223 that issues a signature to the combination obtained by combining the generated plurality of first summary values to generate signature data.

In this case, the regeneration device 104 further includes a replacement combination generation unit 526, and the replacement combination generation unit 526 is connected to the combination, and the first summary value corresponding to the second summary value is replaced with the second summary value. Generate a replacement combination. The verification unit 524 verifies the aforementioned signature data using the aforementioned replacement combination.

According to the above configuration, by verifying the signature data, the replacement of the content can be detected.

(3) The second server device 102 can also output the encrypted content to the playback device 104 via one of the recording media devices 105.

The first encryption unit 221 of the first server device 101 performs the first encryption on the plaintext block using a common title key common to the plurality of recording medium devices.

The second encryption unit 321 of the second server device 102 performs the second encryption on the plaintext block in which the first encryption has not been performed, using the individual title key unique to the one recording medium device 105.

The decryption unit 522 of the playback device 104 performs decryption corresponding to the second encryption in the selected second encrypted block using the individual title key.

According to the above configuration, in a piece of encrypted content, since the block encrypted by the individual title key and the block encrypted by the common title key are mixed, if the attacker has to obtain the individual title key and the common title. Both of the keys can decrypt the encrypted content, making it more difficult to illegally decrypt the content.

(4) An aspect of the present invention may be a content transmission subsystem composed of the first server device 101 and the second server device 102.

The first server device 101 may further include: a first encryption unit 221, configured to perform first encryption on a part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content to generate the first encryption. And generating an intermediate encrypted content composed of the foregoing plaintext block without the first encryption and the generated first encrypted block; and the first summary unit 222, which constitutes the intermediate encryption Each of the plurality of blocks of content is aggregated to generate a first summary value of the plurality.

The second server device 102 may further include a second encryption unit 321 that is in the block included in the intermediate encrypted content, and the plaintext block that is not encrypted by the first encryption. Performing second encryption, generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block.

According to this configuration, it is possible to generate an encrypted content that can detect the replacement attack.

(5) The first server device 101 may further include at least a signature department 223. The signature department 223 performs a signature on the combination obtained by combining the generated first summary values, and generates signature data.

(6) The second server device 102 can also output the encrypted content to the playback device 104 via a recording medium device 105.

The first encryption unit 221 of the first server device 101 performs the first encryption on the plaintext block using a common title key common to the plurality of recording medium devices.

The second encryption unit 321 of the second server device 102 performs the second encryption on the plaintext block that is not encrypted by the first encryption using the individual title key unique to the one recording medium device 105.

According to the above configuration, since an encrypted block is mixed with a block encrypted by using an individual title key and a block encrypted by using a common title key, the attacker cannot obtain the individual title key and If both of the common title keys are used, the encrypted content cannot be decrypted, making it illegal to decrypt the content illegally.

(7) The first server device 101 may further include a common title key generation unit 224 for generating the common title key common to the plurality of recording medium devices.

The first encryption unit 221 uses the generated common title key.

(8) The second server device 102 may further include an individual title key generation unit 322 for generating the individual title key unique to the recording medium device 105.

The second encryption unit 321 uses the generated individual title key.

(9) The second server device 102 may further include a media identifier The unit 323, the media identifier acquisition unit 323 can acquire a media identifier for identifying the one recording medium device 105.

The individual title key generation unit 322 is configured to generate the individual title key including the acquired media identifier.

According to this configuration, since the media identifier for identifying the recording medium device 105 is used, the individual title key unique to the recording medium device 105 can be generated.

(10) The individual title key generation unit 322 may generate a random number, combine the media identifier with the random number to generate a combination, and encrypt the generated combination to generate the individual title key.

According to this configuration, since the random number is used in the generation of the individual title key, it is difficult for the attacker to illegally analyze the individual title key.

(11) The second server device 102 may further include a certificate generating unit 324 that performs a signature on the combination of the common title key, the individual title key, and the media identifier. , generate a title key to send a certificate.

According to this configuration, it is possible to generate a certificate verifying the validity of the group of the common title key, the individual title key, and the media identifier.

(12) The first server device 101 may further include a digital watermark embedding unit 225, and the digital watermark embedding unit 225 is included in the first encryption unit 221 for each plaintext block that is the object of the first encryption. One or a plurality of digital watermarks are embedded, thereby regenerating a group of one or a plurality of embedded blocks in which the aforementioned digital watermark is embedded.

The first encryption unit 221 further pairs one or more of the generated ones Performing the foregoing first encryption on the group of embedded blocks to generate one or a plurality of first encrypted embedded blocks, and generating one or more of the generated first encrypted embedded regions. The aforementioned intermediate encrypted content of the group of blocks.

a group of the information identifying the media identifier in the media identifier, the first encrypted block included in the intermediate encrypted content, and one or a plurality of the first encrypted embedded blocks. The locations within the intermediate encrypted content correspond.

The second encryption unit 321 selects the first encrypted block and one or a plurality of the first encrypted embedded blocks at positions in the intermediate encrypted content corresponding to the position of the partial information in the media identifier. a group, using the content of the foregoing partial information, selecting one of the first encrypted block and one or a plurality of the first encrypted embedded block, and generating the inclusion as the first encrypted block The aforementioned encrypted content of the selected block.

According to this configuration, it is possible to generate encrypted content that can specify part of the information of the media identifier.

(13) The digital watermark embedding unit 225 may regenerate one embedding block in which the digital watermark is embedded by embedding one type of digital watermark for each plaintext block.

The first encryption unit 221 performs the first encryption on the generated one of the embedded blocks, generates one first encrypted embedded block, and generates one of the generated first encrypted embedded regions. The aforementioned intermediate encrypted content of the block.

The foregoing partial information is bit information constituting one bit of the aforementioned media identifier.

a position of the bit information in the media identifier, a position of the first encrypted block included in the intermediate encrypted content, and a position of the first encrypted embedded block in the intermediate encrypted content. Corresponding.

The second encryption unit 321 selects the first encrypted block and one of the first encrypted embedded blocks at positions in the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier. And using the value of the bit information to select any block from the first encrypted block and one of the first encrypted embedded blocks.

According to this configuration, it is possible to generate encrypted content that can specify the bit information of the media identifier.

(14) The digital watermark embedding unit 225 of the first server device 101 may embed one or more kinds of plaintext blocks that are not to be the first encryption target in the first encryption unit 221. The digital watermark is used to regenerate a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark.

The first encryption unit 221 may also generate the intermediate encrypted content including the generated one or a plurality of the embedded blocks.

a position of the partial information of the media identifier in the media identifier, a position of the plaintext block included in the intermediate encrypted content, and a group of the plurality of embedded blocks in the intermediate encrypted content Correspondence.

The second encryption unit 321 selects the plaintext block and one or a plurality of the embedded blocks at positions in the intermediate encrypted content corresponding to the position of the partial information in the media identifier, and uses the aforementioned portion. For the content of the information, selecting any block from the group of the plaintext block and one or more of the embedded blocks, and performing the second encryption on the selected block to generate the second encrypted block. And generating the aforementioned encrypted content including the generated second encrypted block.

According to this configuration, it is possible to generate encrypted content that can specify part of the information of the media identifier.

(15) The digital watermark embedding unit 225 may embed one type of digital watermark for each plaintext block that is not the target of the first encryption, thereby regenerating one embedded block in which the digital watermark is embedded. .

The first encryption unit 221 generates the intermediate encrypted content including the generated one of the embedded blocks.

The foregoing partial information is bit information constituting one bit of the aforementioned media identifier.

The bit position of the bit information in the media identifier corresponds to a position of the plaintext block included in the intermediate encrypted content and one of the embedded blocks in the intermediate encrypted content.

The second encryption unit 321 selects the plaintext block and one of the embedded blocks in the intermediate encrypted content of the bit position of the bit information in the media identifier, and uses the value of the bit information. Any block is selected from the aforementioned plaintext block and one of the aforementioned embedded blocks.

According to this configuration, it is possible to generate a bit element that can specifically constitute a media identifier. The encrypted content of the message.

(16) Other aspects of the invention may also be the regeneration device 104.

The first encrypting block is generated by the first server device 101 to generate a first encrypted block only for a part of the plaintext block in the plurality of plaintext blocks of the plaintext content, and the first encrypted block is generated without the foregoing first encryption. The intermediate encrypted content formed by the plaintext block and the generated first encrypted block is aggregated, and each of the plurality of blocks constituting the intermediate encrypted content is aggregated to generate a first summary value of the plurality.

The second server device 102 performs second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content to generate a second encrypted block, and generates Encrypted content composed of the first encrypted block and the second encrypted block.

The playback device 104 includes a selection unit 521, a decryption unit 522, a second aggregation unit 523, a verification unit 524, and a reproduction unit 525.

The selection unit 521 selects one of the second encrypted blocks among the plurality of encrypted blocks constituting the encrypted content.

The decryption unit 522 performs decryption corresponding to the second encryption on the selected second encrypted block to generate a plaintext block.

The second summary unit 523 aggregates the generated plaintext blocks to generate a second summary value.

The verification unit 524 performs verification of the encrypted content using the plurality of first summary values and the generated second summary value.

The reproducing unit 525 stops the decryption of the encrypted content when the verification fails, and decrypts the encrypted content after the verification is successful. Line regeneration.

According to this configuration, the illegal replacement of the encrypted content can be detected.

(17) The first server device 101 may further perform at least a signature on the combination of the generated plurality of first summary values to generate signature data.

The regeneration device 104 further includes a replacement combination generation unit 526.

The replacement combined body generating unit 526 replaces the first summary value corresponding to the second summary value with the second summary value in the combination, and generates a replacement combination.

The verification unit 524 verifies the aforementioned signature data using the aforementioned replacement combination.

According to this configuration, the verification of the signature data can be used to detect the illegal replacement of the encrypted content.

(18) The reproducing device 104 may also receive the encrypted content through the one recording medium device 105 by the second server device 102.

The first encryption is performed on the plaintext block by the first server device 101 using a common title key common to the plurality of recording medium devices.

The second encryption is performed by the second server device 102 on the plaintext block that is not encrypted by the first encryption using the individual title key unique to the one recording medium device 105.

The decryption unit 522 performs decryption corresponding to the second encryption on the selected second encrypted block using the individual title key.

(19) The second server device 102 may also issue a signature on the combination of the common title key, the individual title key, and the media identifier used to identify the one recording medium device 105 to generate a title. gold The key transmission certificate is written, and the common title key, the individual title key, and the title key transmission certificate are written to the recording medium device 105.

The playback device 104 may further include an acquisition unit 527 and a title key transmission certificate verification unit 528.

The acquisition unit 527 acquires the media identifier, the common title key, the individual title key, and the title key transmission certificate from the recording medium device 105.

The title key transmission certificate verification unit 528 combines the common title key, the individual title key, and the media identifier to generate a combination, and uses the generated combination to verify the acquired title key transmission certificate. .

According to this configuration, the certificate can be transmitted using the title key, and the group of the common title key, the individual title key, and the media identifier can be verified for justification.

(20) The first server device 101 may further embed one or more types of digital watermarks for each of the plaintext blocks to be the first encryption target, thereby regenerating the digital watermark embedded therein. 1 or a plurality of embedded blocks, and further performing the foregoing first encryption on the generated one or a plurality of embedded blocks to generate one or a plurality of first encrypted embedded blocks And generating the intermediate encrypted content further comprising a group of the generated one or a plurality of the first encrypted embedded blocks.

a position of the part of the information identifying the media identifier in the media identifier, and the first encrypted block included in the intermediate encrypted content And a group of one or more of the foregoing first encrypted embedded blocks corresponds to a position within the intermediate encrypted content.

Determining, by the first server device 101, the first encrypted block and one or more of the first encryptions at a position within the intermediate encrypted content of the location of the partial information in the media identifier a group of embedded blocks, using the content of the foregoing partial information, selecting any block from the first encrypted block and one or a plurality of the first encrypted embedded block groups, and generating the inclusion as the first Encrypted content of the selected block of the encrypted block.

The playback device 104 may further include a selection unit 521, a digital watermark determination unit 529, and a media identifier generation unit 530.

The selection unit 521 selects the first encrypted block at a specific location within the encrypted content.

The decryption unit 522 further decrypts the selected first encrypted block to generate a plaintext block.

The digital watermark determining unit 529 determines whether or not one of the plurality of types of digital watermarks is embedded in the generated plaintext block, and outputs the determination result.

The media identifier generation unit 530 generates a content based on the determination result as the partial information constituting the media identifier in a position in the media identifier corresponding to the specific position.

According to this configuration, part of the information constituting the media identifier can be specified.

(21) The first server device 101 may further embed one type of digital floating water for each plaintext block to be the target of the first encryption. Printing, thereby regenerating an embedded block embedded with the aforementioned digital watermark, further performing the first encryption on the generated embedded block, and generating a first encrypted embedded block, and The intermediate encrypted content further including the generated one of the first encrypted embedded blocks is generated.

The aforementioned partial information constitutes bit information of one bit of the aforementioned media identifier.

a position of the bit information in the media identifier, a position of the first encrypted block included in the intermediate encrypted content, and a position of the first encrypted embedded block in the intermediate encrypted content. Corresponding.

Determining, by the first server device 101, the first encrypted block and the first first encryption at a position within the intermediate encrypted content corresponding to a bit position of the bit information in the media identifier Embedding the block, using the value of the bit information, selecting any block from the first encrypted block and one of the first encrypted embedded blocks to generate a region including the selection as the first encrypted block The aforementioned encrypted content of the block.

The digital watermark determining unit 529 determines whether or not one type of the aforementioned digital watermark is embedded in the generated plaintext block.

The media identifier generation unit 530 generates a value based on the determination result as the partial information constituting the media identifier in a position in the media identifier corresponding to the specific position.

According to this configuration, the bit information constituting the media identifier can be specified.

(22) The first server device 101 may embed one or more types of floating water for each plaintext block that is not the target of the first encryption. Printing, thereby regenerating a group of one or a plurality of embedded blocks in which the aforementioned digital watermark is embedded, and generating the intermediate encrypted content further including a group of the generated one or a plurality of the embedded blocks.

a position of the partial information of the media identifier in the media identifier, a position of the plaintext block included in the intermediate encrypted content, and a group of the plurality of embedded blocks in the intermediate encrypted content Correspondence.

The second server device 102 may also select the plaintext block and one or more of the embedded blocks at the position in the intermediate encrypted content corresponding to the position of the partial information in the media identifier. And using the content of the foregoing part of the information, selecting any block from the group of the plaintext block and the one or more of the embedded blocks, and performing the second encryption on the selected block to generate the foregoing Second encrypting the block and generating the aforementioned encrypted content including the generated second encrypted block.

The selection unit 521 further selects the second encrypted block at the specific position in the encrypted content.

The decryption unit 522 further decrypts the selected second encrypted block to generate a plaintext block.

The digital watermark determining unit 529 further determines whether or not one of the plurality of types of digital watermarks is embedded in the plaintext block generated by the decryption of the second encrypted block, and outputs the determination result.

The media identifier generation unit 530 further generates a content according to the determination result in the position in the media identifier corresponding to the specific position of the second encrypted block as before the media identifier is constructed. Some of the information.

According to this configuration, part of the information constituting the media identifier can be specified.

(23) The first server device 101 may embed one type of digital watermark for each plaintext block that is not the target of the first encryption, thereby regenerating the digital watermark embedded with the digital watermark. Embedding blocks and generating the aforementioned intermediate encrypted content, which in turn includes the generated one of the aforementioned embedded blocks.

The aforementioned partial information constitutes bit information of one bit of the aforementioned media identifier.

a position of the bit information in the media identifier, a position of the first encrypted block included in the intermediate encrypted content, and a position of the first encrypted embedded block in the intermediate encrypted content. Corresponding.

The second server device 102 may also select the plaintext block and one of the embedded blocks at the position in the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier. The value of the bit information is selected by the plaintext block and one of the embedded blocks, and the second encryption is performed on the selected block to generate the second encrypted block, and the generated Generating the aforementioned encrypted content of the aforementioned second encrypted block.

The selection unit 521 selects the second encrypted block at the specific position among the encrypted contents.

The decryption unit 522 decrypts the selected second encrypted block to generate a plaintext block.

The digital watermark determining unit 529 determines whether or not one type of the digital watermark is embedded in the plaintext block generated by the decryption of the second encrypted block, and outputs the determination result.

The media identifier generation unit 530 generates the content based on the determination result as the bit information constituting the media identifier, corresponding to the position in the media identifier of the specific position of the second encrypted block.

According to this configuration, the bit information constituting the media identifier can be specified.

2. Embodiment 2

Here, the content transmission system 10a according to the second embodiment of the present invention will be described with reference to the drawings.

2.1 Composition of content transmission system 10a

As shown in FIG. 2, the content distribution system 10a is composed of a content signature generation server device 101a, a transmission server device 102a, a recording information processing device 103a, a reproduction information processing device 104a, and an information recording medium device 105a. Here, the content signature generation server device 101a and the transmission server device 102a constitute a content transmission subsystem 30a (not shown).

The content signature generation server device 101a and the transmission server device 102a can be directly connected by the communication cable 21. The transmitting server device 102a and the recording information processing device 103a are connectable via the network 20 represented by the Internet.

The recording information processing device 103a is installed in the information recording medium device 105a by the user, and is transmitted between the transmission server device 102a and the information recording medium device 105a via the recording information processing device 103a as will be described later. The secret communication path 22 is established, and the transmission server device 102a transmits the common title key 241, the individual title key 381, and the transmission content data set 351 to the information recording medium device 105a via the secret communication path 22. The common title key 241, the individual title key 381, and the transmission content data set 351 will be described later.

The information recording medium device 105a to which the common title key 241, the individual title key 381, and the transmission content data set 351 have been written is installed in the reproduction information processing device 104a by the user, and the information processing device for reproduction is provided. 104a verifies the transmission content data set 351 recorded in the information recording medium device 105a, and if the verification is successful, the transmission content data set 351 is reproduced, and when the verification fails, the reproduction of the transmission content data set 351 is stopped.

Furthermore, when the verification fails, it may be determined that the content data set 351 for transmission is illegal.

Further, the content signature generation server device 101a, the transmission server device 102a, and the reproduction information processing device 104a correspond to the first server device 101, the second server device 102, and the reproduction device 104 of the content transmission system 10, respectively.

2.2 Content signature generation server device 101a

As shown in FIG. 3, the content signature generation server device 101a includes a content storage unit 201, a storage unit 202, an inter-machine transfer unit 203, a unit generation unit 204, a common title key generation unit 205, and an encryption unit 206. The header information generating unit 207, the signature key storing unit 208, the signature generating unit 209, and the control unit 211 are configured.

Here, the content signature generation server device 101a may specifically be a PC (Personal Computer) including a CPU (Central Processing Unit), a memory, a secondary memory device, an Internet interface circuit, and the like. In this case, the content storage unit 201, the storage unit 202, and the signature key storage unit 208 are each constituted by a secondary storage device, the unit generation unit 204, the common title key generation unit 205, the encryption unit 206, and the header information. The generation unit 207, the signature generation unit 209, and the control unit 211 are constituted by a CPU and a program operating thereon, and the inter-machine transmission unit 203 is constituted by an internet interface circuit. Of course, this is not the limit. A part of the components of the content signature generation server device 101a may also be constituted by dedicated circuits. For example, the encryption mechanism 206 and the signature generation unit 209 may each be configured by a dedicated hardware circuit.

2.2.1 Content preservation organization 201

The content storage unit 201 is for storing the original content 701. The original content 701 is an image data and sound data that are encoded by the TS (TransportStream) method of MPEG2 (Moving Picture Expert Group 2) in an unencrypted state. Therefore, the original content 701 is plaintext content composed of plaintext materials. Furthermore, the format of the content is not limited to the MPEG2 method, and may be any format.

Further, the content storage unit 201 may receive the original content 701 from an external device or a recording medium, and store the received original content 701.

As an example of the original content 701 stored in the content storage unit 201, as shown in FIG. 4, c (c is an integer of 1 or more) of the original files 711 "CNT1", 712 "CNT2", 713 "CNT3", ‧ ‧, 714 "CNTc" is composed.

The image data and sound data contained in the original content 701 are divided into c, and the original files 711, 712, 713, ‧ ‧ and 714 are respectively in a state in which the divided image data and sound data are not encrypted The TS mode of MPEG2 is encoded.

2.2.2 Storage Mechanism 202

The storage unit 202 has a memory area for memorizing the common title key 241 and the intermediate content data set 242 which will be described later. The intermediate content data set 242 is composed of unit selection information 780, encrypted content 820, header information 860, and signature information 890, as will be described later.

2.2.3 Signature Key Depository Authority 208

The signature key storage unit 208 stores the private key 251 "KSG". The private key 251 is a content signature that generates a private key assigned to the server device 101a, and is used for the signature generation algorithm S of the digital signature based on the public key cryptographic method. The private key 251 is used by the signature generation unit 209.

Here, the signature generation algorithm S is a signature-based algorithm based on a public key cipher such as an RSA signature, a DSA (Digital Signature Algorithm), or an elliptic curve DSA. Furthermore, the signature generation algorithm S is not limited to this. Other algorithms may also be signatures based on a common key or hash function such as MAC (Message Authentication Code).

2.2.4 unit generation mechanism 204

The unit generation unit 204 generates the divided content 721 and the unit selected capital by the original content 701 held by the content storage unit 201 by the flow described below. News 780.

(a) Generation of split content 721

The unit generation unit 204 generates the divided content 721 from the original content 701 as shown in FIG. The fifth diagram will be used below, and the generation flow of the divided content 721 will be described.

The unit generation unit 204 sequentially reads the original files 711, 712, 713, ‧ ‧ and 714 constituting the original content 701 by the content storage unit 201.

Next, the unit generation unit 204 performs the following processing (1) to (7) on each of the original files that have been read. Here, only the processing of the original file 711 is described as a representative, and the unit generating unit 204 can perform the same processing on the other original files 712, 713, ‧ ‧ and 714

(1) The unit generation unit 204 generates a file identifier "FID1" corresponding to the read original file 711 "CNT1". Here, the file identifier "FID1" is generated by connecting the fixed information "FID" displayed as the file identifier and the number "1" indicating the order of reading the original file 711 in this order. Regarding the other original files 712, 713, ‧ ‧ and 714, the numbers indicating the order of reading are "2", "3", ‧ ‧ and "c", respectively, so the file identifiers "FID2" and "FID3" are generated. , ‧‧‧, "FIDc"

(2) Next, the unit generation unit 204 divides the original file 711 "CNT1" for each VOBU (VideoObject Unit), and generates m (m is a natural number) unit 773 "U1_1", unit 774 "U1_2", and unit 775 "U1_3". Unit 776 "U1_4", ‧‧‧, unit 777 "U1_m". Next, the number of cells N1 indicating the number of generated cells is generated. Here, N1=m.

(3) Next, the unit generation unit 204 generates the file information "FI1" composed of the file identifier "FID1" and the unit number N1, and memorizes the generated file information "FI1".

(4) Next, the unit generation unit 204 generates a unit identifier "UID1i" corresponding to the unit "U1_i_" (i is an integer from 1 to m) for each of the units 773, 774, ‧‧, and 777. The unit identification subsystem uniquely identifies the identification information of each unit. The unit identifier is generated by combining the fixed information "UID" displayed as the unit identifier, the number "1" indicating the order in which the original file 711 is read, the symbol "_", and the number "i" indicating the order of each unit in this order.

The number "i" indicating the order of each unit is, for example, the order in which "1", "2", "3", ‧‧", and "m" are started by the start unit. Here, the number of accumulated bits from the unit of the opening may be used.

(5) Next, the unit generation unit 204 determines the use of the common title key 241 for each of the units 773, 774, ‧‧, and 777, that is, for each unit "U1_i" (i is an integer from 1 to m). Encryption is performed or encrypted using an individual title key 381.

The determination is, for example, a ratio of the number of units to be encrypted by the individual title key 381 and the number of units to be encrypted by the common title key 241, and the individual units are randomly selected from the m units. The header key 381 performs the unit of the object to be encrypted, and makes it into the ratio, thereby performing it. Further, it is also possible to select a unit to be encrypted as the individual title key 381, and to make the ratio closer.

In this case, the encryption of the individual title key 381 is performed. The ratio of the number of units of the image to the number of units of the object to be encrypted by the common title key 241 is 1:9.

In other words, the unit generation unit 204 randomly selects ten percent of the units from the m units, and the selected unit is the object of encryption by the individual title key 381, and the remaining ninety percent of the units are common. The title key 241 is an object to be encrypted.

Here, the unit generation unit 204 determines, for example, that the unit 774 "U1_2" and the unit 776 "U1_4" are encrypted by the individual title key 381, and the other unit 773 "U1_1" and the unit 775 "U1_3" are shared by the title key 241. The unit "U1_5", the unit "U1_6", ‧‧‧, and the unit 777 "U1_m" are encrypted.

Further, the unit generation unit 204 generates a title key flag information "TKFI1_i" indicating that each unit "U1_i" (i is an integer from 1 to m) encrypted by the individual title key 381 or encrypted by the common title key 241. . The title key flag information may be any information that can be distinguished as the individual title key 381 and the common title key 241. However, when the individual title key 381 is used here, the title key flag information is set to " 0", when the common title key 241 is used, the title key flag information is set to "1".

Furthermore, the title key flag information can also be given by input from the outside.

Next, the unit generation unit 204 generates unit information composed of the unit by using the unit identifier, the corresponding title key flag information, and the corresponding unit as a group. For example, as shown in FIG. 5, the unit generation unit 204 is a group of the unit identifier 771, the title key flag information 772, and the unit 773. Unit information 761 composed of the group is generated. The other units are also the same. In other words, the unit generation mechanism 204 generates unit information for each unit.

Further, as shown in FIG. 5, the unit generation unit 204 generates the divided file 751 "splCNT1" composed of the group by using the generated unit information as a group in the units 773, 774, ‧ ‧ and 777. The other original files are the same. In other words, the unit generation unit 204 generates a split file for each original file.

The split file 751 "splCNT1" generated from the original file 711 "CNT1" is as shown in Fig. 5, and includes m unit information 761 "UI1_1", unit information 762 "UI1_2", unit information 763 "UI1_3", ‧‧ The unit information 764 "UI1_m" is composed. Unit information 761, 762, 763, ‧‧‧, 764, in other words, the unit information "UI1_i" (i is an integer from 1 to m) by the corresponding unit identifier "UID1_i", the title key flag information "TKFI1_i" and the unit " It is composed of U1_i".

(7) Next, the unit generation unit 204 generates the divided file information 731 "splFI1" including the file identifier 741 "FID1" and the divided file 751 "splCNT1" in the original file 711. [(7) End]

The unit generation unit 204 repeats the same processing for all the original files 711 "CNT1", 712 "CNT2", 713 "CNT3", ‧‧‧, 714 "CNTc", and generates c file information 781 "FI1", file information 782 "FI2", file information 783 "FI3", ‧‧‧, file information 785 "FIc", and generated c split file information 731 "splFI1", split file information 732 "splFI2", split file information 733 "splFI3" ‧ ‧ ‧ split file information 734 "splFIc"

Next, the unit generation unit 204 generates the divided content 721 including the generated c pieces of divided file information.

Furthermore, the number m of cells generated by each original file may be different.

Next, the unit generation unit 204 outputs the generated divided content 721 to the encryption unit 206.

In the above description, the unit generation unit 204 generates the file identifier, but the file identifier may be externally input together with the content.

Further, the division unit of the original file is VOBU, but is not limited thereto. It is also possible to make the original file, for example, every GOP (GroupofPicture), and every 64 The amount was divided into equivalent amounts of 1 second per regeneration time. In addition, the operator may input information indicating the division unit, and divide the original file according to the information input by the operator.

(b) Unit selection information 780 generation

When the output of the divided content 721 is completed, the unit generating means 204 generates unit selection information 780 composed of c pieces of archive information 781, 782, 783, ‧‧‧, 785.

An example of the data structure of the unit selection information 780 is shown in Fig. 6. The unit selection information 780 is composed of c file information 781 "FI1", file information 782 "FI2", file information 783 "FI3", ‧‧‧, file information 785 "FIc".

The unit generation unit 204 writes the generated unit selection information 780 as part of the intermediate content data set 242, writes it to the storage unit 202, and outputs the generated unit selection information 780 to the signature generation unit 209.

2.2.5 Common Title Key Generation Mechanism 205

The common title key generation unit 205 is for generating a common title key 241 "CTK". Specifically, one example of the common title key generation unit 205 generates a pseudo random number of 128 bits wide, and the generated pseudo random number is used as the common title key 241 "CTK". Next, the generated common title key 241 "CTK" is output to the encryption unit 206, and the generated common title key 241 "CTK" is written to the storage unit 202.

The common title key 241 "CTK" is common to the plural information recording medium device. In other words, the same common title key is used in the plural information recording media devices. The plurality of information recording media devices record the same content.

Here, the common title key 241 "CTK" is a key used to encrypt the original content 701. The encryption algorithm Enc used for encryption is, for example, an AES (Advanced Encryption Standard) code. However, this is not the limit. Other common key ciphers, such as DES (DataEncryptionStandard) cipher, Triple-DES, C2 (Cryptomeria Cipher) cipher, Camellia cipher, RC4 cipher, etc.

Further, it may be a public key cipher such as an RSA cipher or an elliptic curve cipher. Further, when the public key cipher is used, the common title key generation unit 205 generates the common title public key "CTPK" and the corresponding common title private key "CTSK" instead of the common title key 241 "CTK".

In the following example, the encryption algorithm Enc uses the AES cipher, and the common title key 241 "CTK" uses a 128-bit wide bit column.

Furthermore, the common title key generation unit 205 can also generate a true random number by using a signal noise or the like instead of the pseudo random number. The method of generating random numbers is non-patented Document 1 is detailed.

Further, the generation of the common title key 241 may be performed by other methods other than random number generation, or may be set by using the bit width of the common title key 241 in conjunction with the encryption algorithm used. For example, when using the Triple-DES key, a key of 168 bits (including 192 bits in the same place) is generated.

2.2.6 Encryption Mechanism 206

The encryption unit 206 receives the common title key 241 "CTK" from the common title key generation unit 205. Further, the encryption unit 206 receives the divided content 721 by the unit generation unit 204.

A part of the encryption processing performed by the encryption unit 206 is shown in Fig. 7, and the processing executed by the encryption unit 206 will be described below.

When the encryption unit 206 receives the divided content 721, the encrypted file 751 "splCNT1" included in the divided file information 731 "splFI1" constituting the received divided content 721 is selected. Next, the title key flag information 772 "TKFI1_1" is extracted from the start unit information 761 "UI1_1" of the selected split file 751 "splCNT1", and the extracted title key flag information 772 "TKFI1_1" is determined to be "0" and What is "1"?

If the determination is "0", it means that the individual title key 381 is used for encryption. Therefore, instead of encrypting, the encryption unit 206 directly generates the unit information 761 as the encrypted unit information. Therefore, the generated encryption unit information is the same as the original unit information 761. Second, move to the next unit of processing.

If the determination is "1", it means that the password is encrypted by the common title key 241. Therefore, the encryption unit 206 is provided by the unit information 761 "UI1_1". The unit 773 "U1_1" is taken, and the extracted unit 773 "U1_1" is subjected to the encryption algorithm Enc using the accepted common title key 241 "CTK" to generate the encryption unit 813 "EU1_1".

Here, EU1_1=Enc(CTK, U1_1). Further, Enc(K, D) displays the encrypted data generated by performing the encryption algorithm Enc on the data D using the key K. Further, when the public key cipher is used as the encryption algorithm, the key used for encryption is not the common title key 241 "CTK" but the common title public key "CTPK".

Furthermore, the encryption performed by the encryption algorithm Enc used by the encryption mechanism 206 is referred to as first encryption. Further, the encryption unit generated by the encryption unit 206 may be referred to as a first encryption unit.

The encryption unit 206 generates the encryption of the unit identifier 771 "UID1_1" included in the unit information 761 "UI1_1", the title key flag information 772 "TKFI1_1", and the encryption unit 813 "EU1_1" generated here. Unit information 801 "EUI1_1".

The encryption unit 206 repeats the same processing for the unit information 762 "UI1_2", the unit information 763 "UI1_3", ‧‧‧, and the unit information 764 "UI1_m", and generates the encryption unit information 802 "EUI1_2" and the encryption unit information 803. "EUI1_3", ‧‧‧, encryption unit information 804 "EUI1_m".

Next, the encryption unit 206 generates an encrypted divided file 800 "EsplCNT1" composed of a group of m pieces of encrypted unit information generated by one divided file 751. In this manner, the encryption unit 206 generates one encrypted divided file from one divided file. Furthermore, since the encrypted split file contains a unit that is not encrypted by the common title key 241, it is also called a middle plus Densify split files.

As shown in FIG. 7, the encrypted divided file 800 "EsplCNT1" generated by the above-described flow by the divided file 751 "splCNT1" is composed of m encrypted unit information 801 "EUI1_1" and encrypted unit information 802 "EUI1_2". The encryption unit information 803 "EUI1_3", ‧‧‧, and the encryption unit information 804 "EUI1_m" are formed. Each of the encryption unit information 801, 802, 803, ‧‧‧, 804, that is, each encryption unit information "EUI1_i" (i is an integer from 1 to m) is used to form the unit information of the divided file 751 "splCNT1" 761, 762, 763, ‧‧‧, 764 are generated based on each unit information "UI1_i", and include a unit identifier "UID1_i", a title key flag information "TKFI1_i", and an encryption unit "EU1_i".

Next, the encryption unit 206 extracts the encryption unit "EU1_i" from each of the encryption unit information "EUI1_i" (i is an integer of 1 to m) constituting the generated encrypted divided file 800 "EsplCNT1". That is, the encryption unit 206 extracts the encryption units 813, 814, 815, 816, ‧ ‧ and 817 shown in FIG. Next, an encrypted file 821 "ECNT1" composed of a group of the extracted m encryption units is generated.

In other words, the encryption unit 206 is configured to generate an encrypted file 821 "ECNT1" composed of m encryption units 813, 814, 815, 816, ‧ ‧ and 817.

Next, the encryption unit 206 replaces the divided file 751 "splCNT1" included in the divided file information 731 "splFI1" with the generated encrypted divided file 800 "EsplCNT1" to generate the encrypted divided file information 841. "EsplFI1". In other words, the encrypted divided file information 841 "EsplFI1" includes the file identifier "FID1" 851 and the encrypted divided file 852 "EsplCNT1". The file identifier "FID1" 851 is the same as the file identifier "FID1" 741, and the encrypted divided file 852 "EsplCNT1" is the same as the encrypted divided file 800 "EsplCNT1".

The encryption unit 206 also generates the encrypted divided file information 842 "EsplFI2" and the encrypted segmentation in the same manner for the divided file information 732 "splFI2", the divided file information 733 "splFI3", ‧ ‧ and the divided file information 734 "splFIc" File Information 843 "EsplFI3", ‧‧‧, Encrypted Split File Information 844 "EsplFIc".

Further, the encryption unit 206 also generates the encrypted file 822 "ECNT2" and the encrypted file in the same manner for the divided file information 732 "splFI2_", the divided file information 733 "splFI3", ‧ ‧ and the divided file information 734 "splFIc" 823 "ECNT3", ‧‧‧, encrypted file 824 "ECNTc".

Next, as shown in FIG. 9, the encryption unit 206 generates the encrypted divided content 840 composed of the generated c-encrypted divided file information 841, 842, 843, ‧ ‧ and 844.

Next, the encryption unit 206 outputs the generated encrypted divided content 840 to the header information generating unit 207.

Next, as shown in FIG. 8, the encryption unit 206 generates a group of c encrypted files 821, 822, 823, ‧‧, and 824 as the encrypted content 820, and generates the encrypted content 820. It is written to the storage unit 202 as part of the intermediate content data set 242. Furthermore, the encrypted content 820 also includes a unit that is not encrypted by the common title key 241, so Sometimes referred to as intermediate encrypted content. For the same reason, each encrypted file 821, 822, 823, ‧ ‧ and 824 may also be referred to as an intermediate encrypted file.

As shown in Fig. 8, the encrypted content 820 is composed of c encrypted files 821 "ECNT1", encrypted file 822 "ECNT2", encrypted file 823 "ECNT3", ‧‧‧, encrypted file 824 "ECNTc" Composition.

Each of the encrypted files 821, 822, 823, ‧‧‧, 824, that is, each encrypted file "ECNTj" (J is an integer from 1 to c) is an encrypted split file information included in the encrypted divided content 840 841, 842, 843, ‧‧‧, 844, which is generated based on each encrypted split file information "EsplFIj", includes a complex encryption unit.

As an example, as shown in FIG. 8, the encrypted file 821 "ECNT1" includes the encryption unit 813 "EU1_1", the encryption unit 814 "EU1_2", the encryption unit 815 "EU1_3", and the encryption unit 816 "EU1_4". ‧‧‧Encryption unit 817 "EU1_m".

As described above, the encryption mechanism 206 performs the use of the common title key 241 only for the plaintext unit of a part of the plurality of plaintext units (also referred to as plaintext blocks) of the original content 701 of the plaintext content. Encryption unit (also referred to as an encryption block) is generated by first encryption, and encrypted content 820 composed of the plaintext unit without the first encryption and the generated encryption unit is generated (also called Encrypt content for the middle).

2.2.7 Header Information Generation Mechanism 207

The header information generating unit 207 receives the encrypted divided content 840 by the encryption unit 206. When accepting the encrypted partitioned content 840, it is as shown in Figure 9. The header information 860 is generated using the accepted encrypted partitioned content 840.

Fig. 9 is a view showing an outline of a flow of generation of the header information 860 by the header information generating unit 207. The encrypted partitioned content 840 is received by c-encrypted split file information 841 "EsplFI1", encrypted split file information 842 "EsplFI2", encrypted split file information 843 "EsplFI3", ‧‧‧, encrypted split file information 844 "EsplFIc". Encrypted split file information 841, 842, 843, ‧‧‧, 844, that is, each encrypted split file information "EsplFIj" (J is an integer from 1 to c) including the file identifier "FIDj" and the encrypted split file "EsplCNTj" "."

The header information generating unit 207 generates first hash tables 861, 862, 863, ‧ ‧ and 864 based on the encrypted divided files included in the encrypted divided file information 841, 842, 843, ‧ ‧ and 844, respectively. For example, the first hash table 861 "HA1TBL1" is generated based on the encrypted divided file 852 "EsplCNT1" included in the encrypted divided file information 841. Next, the header information generating unit 207 generates a second hash table 865 "HA2TBL" from the generated c first hash tables 861, 862, 863, ‧ ‧ and 864.

The generation of the first hash table 861, 862, 63, ‧ ‧ , 864 and the second hash table 865 are described in detail below.

(1) Generation of the first hash table 861. The generation flow of the first hash table 861 will be described below. Furthermore, the generation flow of the first hash table 862, ‧‧‧, 864 is the same as the generation flow of the first hash table 861, and thus the description thereof is omitted.

The outline of the flow of generation of the first hash table 861 "HA1TBL1" by the header information generating means 207 is shown in FIG.

First, the header information generating unit 207 extracts the encryption unit 813 "EU1_1" from the encryption unit information 801 "EUI1_1" which constitutes the start of the encrypted divided file 800 "EsplCNT1", and extracts the extracted encryption unit 813 "EU1_1". Substituting the hash function SHA-1 (SecureHashAlgorithm-1), the unit hash value "UHA1_1" is generated.

Here, the unit encrypted by the encryption unit 206 using the individual title key 381 has the same encryption unit information as the unit information, and therefore there is no equivalent to the encryption unit. Therefore, for a unit encrypted with an individual title key 381, the unit is treated as an encryption unit and substituted into a hash function. For units that are encrypted using the individual title key 381, the cryptographic unit is also considered to be the same as the unit. Therefore, for the unit encrypted using the individual title key 381, the plaintext unit is substituted into the hash function, and the unit encrypted by the common title key 241 is substituted into the hash function.

Here, the hash function uses SHA-1, but is not limited to this. It is also possible to use SHA-2, SHA-3, or CBC-MAC (CipherBlock Chaining-Message Authentication Code) using a block number.

Here, the encryption unit 813 "EU1_1" of the encryption unit information 801 is replaced with the generated unit hash value "UHA1_1", and the unit hash information 871 "UHI1_1" is generated. That is, the unit hash information 871 "UHI1_1" is composed of the unit identifier 881 "UID1_1", the title key flag information 882 "TKFI1_1", and the unit hash value 883 "UHA1_1".

Here, the unit identifier 881 "UID1_1" is the same as the unit identifier 811 "UID1_1" included in the encryption unit information 801, so the title key flag information 882 "TKFI1_1" and the title key flag included in the encryption unit information 801. The standard information 812 "TKFI1_1" is the same.

The header information generating unit 207 also repeats the same processing for the encryption unit information 802 "EUI1_2", the encryption unit information 803 "EUI1_3", ‧‧‧, and the encryption unit information 804 "EUI1_m", and generates unit hash information 872 "UHI1_2", unit hash information 873 "UHI1_3", ‧‧‧, unit hash information 874 "UHI1_m". Next, as shown in FIG. 10, the header information generating unit 207 generates a first hash table 861 "HA1TBL1" composed of the generated m unit hash information 871, 872, 873, ‧ ‧ and 871.

Similarly, the header information generating unit 207 generates first hash tables 861, 862, 863, ‧‧‧, 864.

(2) Generation of the second hash table 865

The header information generating unit 207 repeats the above-described flow, and when the c first partial hash tables 861, 862, 863, ‧‧‧, 864 are generated by the encrypted divided content, the generated c first hash tables 861, 862 are used. , 863, ‧‧‧, 864, generate a second hash table 865 "HA2TBL". The second hash table 865 "HA2TBL" is as shown in Figure 11, which consists of c files hashing information 885 "FHI1", file hashing information 886 "FHI2", file hashing information 887 "FHI3", ‧ ‧ The file hash information 888 "FHIc" is composed. The file hash information 885, 886, 887, ‧‧‧, 888, that is, the file hash information "FHIj" (J is an integer from 1 to c) contains the file identifier "FIDj" and the file hash value "FHAj".

The generation flow of the second hash table 865 will be described below.

The header information generating unit 207 substitutes the combination of the unit hash information 871, 872, 873, ‧‧‧, 874 constituting all of the generated first hash table 861 "HA1TBL1" into the hash function SHA-1. , generate file hash value 892 "FHA1".

Here, the hash function uses SHA-1, but is not limited to this. As described above, a CBC-MAC (CipherBlock Chaining-Message Authentication Code) or the like using SHA-2, SHA-3, or a block cipher may be used.

Next, the header information generating unit 207 extracts the file identifier 851 "FID1" from the encrypted divided file information 841 "EsplFI1" corresponding to the first hash table 861 "HA1TBL1", and generates the extracted file identifier 851 "FID1". The file hash information 885 "FHI1" formed by the generated file hash value "FHA1".

As shown in Fig. 11, the file hash information 885 "FHI1" includes the file identifier 891 "FID1" and the file hash value 892 "FHA1".

Here, the file identifier 891 "FID1" is the same as the file identifier 851 "FID1" extracted by the encrypted divided file information 841 "EsplFI1", and the file hash value 892 "FHA1" and the file generated by the function SHA-1 are substituted. The hash value "FHA1" is the same.

The header information generating unit 207 repeats the same processing as the above for the first hash table 862 "HA1TBL2", the first hash table 863 "HA1TBL3", ‧‧‧, and the first hash table 864 "HA1TBLc", and Generate file hash information 886 "FHI2", file hash information 887 "FHI3", ‧‧‧, file hash information 888 "FHIc".

Each file hash information includes file identifiers and file hash values.

Next, the header information generating unit 207 generates a second hash table 865 "HA2TBL" composed of the generated c file hash information 885, 886, 887, ‧ ‧ and 888.

The flow of generation of (1) the first hash table 861, 862, 863, ‧‧, 864 and (2) the second hash table 865 has been described above.

The header information generating unit 207 generates header information 860 including the generated c first hash tables 861, 862, 863, ‧‧‧, 864 and one second hash table 865 "HA2TBL", and generates the header The information 860 is written to the storage mechanism 202 as part of the intermediate content data set 242.

Further, the header information generating unit 207 outputs the generated second hash table 865 "HA2TBL" to the signature generating unit 209.

2.2.8 signature generation mechanism 209

The signature generation unit 209 generates the signature information 890 for the second hash table 865 "HA2TBL" or the like using the private key 251 stored in the signature key storage unit 208 as will be described below.

Specifically, the signature generation unit 209 receives the unit selection information 780 by the unit generation unit 204, and the header information generation unit 207 receives the second hash table 865 "HA2TBL". Next, the signature generation unit 209 reads the private key 251 "KSG" by the signature key storage unit 208.

Further, the signature generation unit 209 combines the accepted second hash table 865 with the received unit selection information 780 as shown in FIG. 12 to generate The combination 261 combines the generated private key 251 "KSG" with the generated combination 261, executes the signature generation algorithm S, and generates the signature information 890. Furthermore, the signature generation algorithm S is as described above. Next, the signature generation unit 209 writes the generated signature information 890 as part of the intermediate content data set 242 to the storage unit 202.

2.2.9 Inter-machine transfer mechanism 203

The inter-machine transfer mechanism 203 reads the common title key 241 from the storage unit 202 under the control of the control unit 211, and transmits the read common title key 241 to the transmission server device 102a via the communication cable 21. .

Moreover, the inter-machine transfer mechanism 203 reads the intermediate content data set 242 composed of the cell selection information 780, the encrypted content 820, the header information 860, and the signature information 890 by the storage unit 202 under the control of the control unit 211. The read intermediate content data set 242 is transmitted to the transmission server device 102a via the communication cable 21.

2.2.10 Control Mechanism 211

The control unit 211 controls the inter-machine transfer unit 203, the unit generation unit 204, the common title key generation unit 205, the encryption unit 206, the header information generation unit 207, and the components of the content signature generation server device 101a. Signature generation mechanism 209.

2.3 The composition of the transmitting server device 102a

As shown in FIG. 13, the transmission server device 102a includes a storage unit 301, an inter-machine transfer unit 302, an inter-machine receiving unit 303, a media identifier acquisition unit 304, an individual title key generation unit 305, and an encryption unit. The configuration 306, the title key database storage unit 307, the application body public key storage unit 308, the private key storage unit 309, the public key certificate storage unit 310, the secret communication path establishing unit 311, and the control unit 313 are constituted.

Here, the transmission server device 102a may specifically be a PC including a CPU, a memory, a secondary memory device, an internet interface circuit, or the like. In this case, the storage unit 301, the title key database storage unit 307, the application body public key storage unit 308, the private key storage unit 309, and the public key certificate storage unit 310 are respectively constituted by secondary memory devices. The media identification sub-acquisition means 304, the individual title key generation means 305, the encryption means 306, and the secret communication path establishment means 311 are respectively constituted by a CPU and a program operating thereon, and the inter-machine transfer mechanism 302 and the inter-machine receiving mechanism 303 are provided. They are composed of Internet interface circuits. Needless to say, it is not subject to these restrictions. A part of the components of the transmitting server device 102a may also be constituted by dedicated circuits. For example, the encryption mechanism 306 can also be constructed of a dedicated hardware circuit.

2.3.1 Storage mechanism 301

The storage unit 301 has an area for storing the intermediate content material set 242, the common title key 241, the individual title key 381, and the transmission content data set 351.

The intermediate content material set 242 and the common title key 241 are received by the content signature generation server device 101a. The intermediate content data set 242 is composed of the unit selection information 780, the encrypted content 820, the header information 860, and the signature information 890 as described above.

The individual title key 381 and the transmission content data set 351 are transmitted to the information recording medium device 105a via the recording information processing device 103a as will be described later. The transmission content data set 351 is composed of unit selection information 780, header information 860, signature information 890, and transmission encrypted content 900, which will be described later, as shown in FIG.

2.3.2 Using the subject public key deposit mechanism 308

The application subject public key storage unit 308 holds a public key 361 of a certification authority device (not shown) included in the application body of the content transmission system 10a.

The public key 361 is used by the secret communication path establishing unit 311 when the secret communication path 22 is established between the transmission server device 102a and the information recording medium device 105a.

Here, the public key 361 is configured to be embedded in the transmission server device 102a in advance, but is not limited thereto. For example, the public key 361 may be transmitted by the authentication authority of the application body of the content distribution system 10a, the transmission server device 102a receives the public key 361, and the public key storage unit 308 of the application body public key storage unit 308 memorizes the received public key 361.

2.3.3 Private Key Depository Agency 309

The private key storage mechanism 309 holds the private key 362 of the transmitting server device 102a. The private key 362 is used by the secret communication path establishing means 311 when the secret communication path 22 is established between the transmission server device 102a and the information recording medium device 105a, and is used by the public key or public key signature used. The private key 362 is a transmission server device issued by the certification authority device of the application body of the content transmission system 10a and the public key certificate. 102a's private key.

2.3.4 Public Key Certificate Holding Organization 310

The public key certificate storage unit 310 stores the public key certificate 921 of the transmission server device 102a. The public key certificate 921 includes a public key 922, other information, and a signature 923 of the transmission server device 102a as shown in FIG. In addition, other information includes the expiration date of the certificate, etc., but the description is omitted here for the sake of brevity. The public key 922 of the transmission server device 102a is a public key issued by the authentication authority device of the application body of the content transmission system 10a to the transmission server device 102a. The signature 923 is a certification authority device of the application body of the content transmission system 10a, and performs a signature generation calculation on the public key 922 and other information of the transmission server device 102a using the private key stored by the certification authority device. The digital signature data generated by the method S.

Here, one example of the signature generation algorithm S is an EC-DSA (EllipticCurve Digital Signature Algorithm) having a 160-bit key length. However, without this limitation, it can also be a digital signature or a different key width. Further, it is also possible to prevent tampering by using other cipher functions such as MAC (Message Authentication Code). By assigning the signature, the public key 922 of the transmission server device 102a can be verified to be issued by the certification authority device of the application body of the content transmission system 10a.

2.3.5 Title Key Database Storage Organization 307

The title key database storage unit 307 has an area in which the media identifier 371, which will be described later, is paired with an individual title key 281, which will be described later.

The media identifier 371 is received by the media identifier obtaining unit 304 and is uniquely identifying the identification information of the information recording medium device 105a. The individual title key 381 is accepted by the individual title key generation unit 305.

The title key database storage unit 307 is memorized by pairing the media identifier 371 with the individual title key 381, whereby the individual title key 381 is leaked by the information recording medium device 105a even on the WEB server or the Internet. The road display panel exposes the individual title key 381 and can also track the information recording media device of the leak source.

In this case, specifically, the media identifier 371 corresponding to the individual title key 381 exposed on the WEB server or the Internet display panel is read by the title key database storage unit 307. Thus, the read media identifier 371 identifies the information recording medium device of the leak source. If the information recording medium device of the leak source is identified, the media identifier transmitted by the information recording medium device can be confirmed, and the transmission of the content of the information recording medium device to the leak source after the transmission of the server device 102a is stopped.

2.3.6 Inter-machine receiving mechanism 303

The inter-machine receiving unit 303 receives the common title key 241 and the intermediate content data set 242 by the content signature generation server device 101a. When the common title key 241 and the intermediate content data set 242 are received, the received common title key 241 and intermediate content data set 242 are written to the storage unit 301.

Further, the inter-machine receiving unit 303 receives the transmission request information 321 indicating the transmission request of the transmission content data set 351 or the like through the recording information processing device 103a by the information recording medium device 105a. When receiving the transmission request information 321, the receiving transmission request information 321 is transmitted to the secret communication path. The mechanism 311 outputs.

Further, after the secret communication path 22 is established between the server device 102a and the information recording medium device 105a, the inter-machine receiving unit 303 receives the media identifier 371 via the secret communication path 22 by the information recording medium device 105a. When the media identifier 371 is received, the received media identifier 371 is output to the media identifier obtaining unit 304.

2.3.7 Media Identification Sub-Acquisition Agency 304

The media identification sub-acquisition mechanism 304 receives the media identifier 371 from the inter-machine receiving mechanism 303, and writes the accepted media identifier 371 to the title key database storage unit 307.

Here, the media identifier 371 is 128 bits wide, but is not limited thereto, and may be 64 bits wide, 256 bits wide, or the like.

2.3.8 cryptographic communication path establishment mechanism 311

The secret communication path establishing unit 311 uses the public key 361 stored by the application body public key storage unit 308, the private key 362 held by the private key storage unit 309, and the transmission server device 102a held by the public key certificate storage unit 310. The public key certificate 921 establishes the secret communication path 22 with the information recording medium device 105a via the recording information processing device 103a.

Specifically, the cipher communication path establishing unit 311 is for verifying whether or not the recording information processing device 103a of the communication target is a proper device. When it is judged to be illegal, the establishment of the secret communication path 22 is suspended. When the secret communication path establishing unit 311 determines that the communication information processing device 103a of the communication party is a legitimate device, it shares a secret with the recording information processing device 103a. Dialogue key. Secret secret communication is performed between the information processing device 103a for recording using the shared dialog key.

The method of establishing the cipher communication path 22 may be any one of the methods defined by, for example, SSL (Secure Socket Layer), TLS (Transport Layer Security), or DTCP (Digital Transmission Content Protection) described in Patent Document 2 and Non-Patent Document 2. In the second embodiment, the method defined by DTCP is used.

2.3.9 Individual Title Key Generation Mechanism 305

The individual title key generation unit 305 generates an individual title key 381 "ITK". Specifically, the individual title key generation unit 305 is identical to the generation of the common title key 241 by the common title key generation unit 205. For example, a pseudo-random number of 128-bit width is generated, and the pseudo-random number to be generated is generated. As the individual title key 381 "ITK".

Thus, the individual title key 381 "ITK" is inherent in an information recording media device.

Next, the individual title key generation unit 305 outputs the generated individual title key 381 to the encryption unit 306. Further, the generated individual title key 381 is written into the storage unit 301 and the title key database storage unit 307, respectively.

Further, when the individual title key generation unit 305 writes the individual title key 381 to the title key database storage unit 307, the media identifier 371 and the individual title that have been memorized in the title key database storage unit 307 are stored. The key 381 is paired.

The individual title key 381 "ITK" is used as will be described later. The unit 820 that is encrypted without using the common title key 241 is encrypted. The encryption algorithm Enc used at this time is the same as the encryption algorithm Enc used in the encryption using the common title key 241.

Furthermore, the encryption algorithm when the individual title key 381 is used may be different from the encryption algorithm when the common title key 241 is used. Further, the method of generating the individual title key 381 may be different from the method of generating the common title key 241. Further, the bit width of the individual title key 381 and the common title key 241 may be different.

2.3.10 Encryption Mechanism 306

The encryption unit 306 receives the individual title key 381 "ITK" by the individual title key generation unit 305. Further, the encryption unit 306 reads the encrypted content 820 and the header information 860 included in the intermediate content data set 242 stored in the storage unit 301.

The encryption processing executed by the encryption unit 306 will be described using Figs. 14 and 15.

The encryption unit 306 extracts the first hash table 861 "HA1TBL1", the first hash table 862 "HA1TBL2", the first hash table 863 "HA1TBL3", the ‧‧‧, the first hash table 864 from the read header information 860 HA1TBLc". Further, the encryption unit 306 extracts the encrypted file 821 "ECNT1", the encrypted file 822 "ECNT2", the encrypted file 823 "ECNT3", the ‧‧‧, and the encrypted file 824 "ECNTc" from the read encrypted content 820 . As described in detail below, each of the extracted first hash tables is used, and the encryption unit included in the encrypted file corresponding to the first hash table is encrypted using the individual title key 381 "ITK". Encryption Since the processing in the file is the same, only the encryption processing of the first hash table 861 "HA1TBL1" and the encrypted file 821 "ECNT1" corresponding thereto will be described as a representative.

Furthermore, the encryption performed by the encryption algorithm used by the encryption mechanism 306 is referred to as second encryption. Further, the encryption unit generated by the encryption unit 306 is also referred to as a second encryption unit (or a second encryption block).

The encryption unit 306 confirms the title key flag information 875, 876 included in the unit hash information 871, 872, 873, ‧ ‧ and 874 included in the first hash table 861 as shown in FIG. Values of 877, 878, ‧ ‧ and 879 Next, in the title key flag information, the header key flag information is extracted as "0".

For example, as shown in FIG. 14, the title key flag information 876 and the title key flag information 878 are respectively "0", and the other title key flag information 875, 877, ‧ ‧ and 879 are "1" "."

At this time, the encryption unit 306 extracts the encryption unit corresponding to the title key flag information of “0” from the encrypted file 821, and encrypts the extracted encryption unit using the individual title key 381 to generate and transmit. Use the encryption unit. On the other hand, the encryption unit corresponding to the title key flag information of "1" does not use the encryption of the individual title key 381, but the respective encryption units are directly used as the transmission encryption unit. That is to say, in this case, the encryption unit is the same as the transmission encryption unit.

In the case of the example shown in Figs. 14 and 15, the title key flag information 876 and the title key flag information 878 are respectively "0", so the encryption is performed. The encryption unit 306 extracts the encryption unit 814 and the encryption unit 816 from the encrypted file 821, and encrypts the extraction encryption unit 814 and the encryption unit 816 using the individual title key 381 to generate transmission encryption units 914 and 916. Since the other title key flag information 875, 877, ‧‧ ‧, 879 is "1", the encryption units 813, 815, ‧ ‧ and 817 corresponding to the title key flag information are not used The encryption of the individual title key 381 is used as the transmission encryption units 913, 915, ‧ ‧ and 917, respectively.

In this way, the encryption unit 306 generates the transmission encryption unit 913 "DU1_1_", the transmission encryption unit 914 "DU1_2", the transmission encryption unit 915 "DU1_3", and the transmission encryption unit 916 "DU1_4", ‧‧‧ The transmission encryption unit 917 "DU1_m".

Next, the encryption unit 306 generates the transmission encryption unit 913 "DU1_1", the transmission encryption unit 914 "DU1_2", the transmission encryption unit 915 "DU1_3", the transmission encryption unit 916 "DU1_4", and ‧ ‧ The transmission encrypted file 901 "DCNT1" constituted by the encryption unit 917 "DU1_m" is transmitted.

The encryption mechanism 306 also pairs the first hash table 862, 863, ‧‧‧, 864 and the encrypted files 822, 823, ‧‧‧, 824, that is, the first hash table "HA1TBLj" and the encrypted file "ECNTj" ( j is an integer from 2 to c. The same processing as described above is executed, and the encrypted file "DCNTj" for transmission is generated.

Next, as shown in FIG. 16, the encryption unit 306 generates the generated encrypted file 901 "DCNT1" and the encrypted file for transmission. 902 "DCNT2", the transmission encrypted file 903 "DCNT3", the ‧‧‧, the transmission encrypted file 904 "DCNTc", the transmission encrypted content 900, and the generated transmission encrypted content 900 is written Storage mechanism 301.

At this time, the encryption unit 306 generates the transmission content data set 351 including the unit selection information 780, the header information 860, and the signature information 890 included in the intermediate content data set 242 and the generated transmission encrypted content 900. The content data set 351 is stored in the storage mechanism 301.

As described above, the encryption unit 306 uses the above-described plaintext unit that has not been encrypted first in the unit (also referred to as a block) included in the encrypted content 820 (also referred to as intermediate encrypted content). Encryption unit (also referred to as an encryption block) generated by the second encryption of the individual title key 381, and the encryption unit generated by the first encryption and the second encryption station The encrypted content 900 for transmission formed by the encryption unit generated.

2.3.11 inter-machine transfer mechanism 302

The inter-machine transfer unit 302 reads the individual title key 381, the common title key 241, and the transmission content data set 351 by the storage unit 301 under the control of the control unit 313. Next, the individual title key 381 and the common title key 241 are transmitted to the information recording medium device 105a via the secret communication path 22. Further, the transmission content data set 351 is transmitted to the information recording medium device 105a through the recording information processing device 103a, that is, without passing through the secret communication path 22.

2.3.12 Control mechanism 313

The control unit 313 is configured to control the inter-machine transfer mechanism 302, the inter-machine receiving mechanism 303, the media identification sub-acquisition mechanism 304, the individual title key generation unit 305, the encryption mechanism 306, and the secret communication for transmitting the components of the server device 102a. Road establishment mechanism 311.

2.4 Composition of the information processing device 103a for recording

As shown in FIG. 18, the recording information processing device 103a includes an inter-machine transfer unit 401, an inter-machine receiving unit 402, an inter-media transfer unit 403, and an inter-media receiving unit 404.

Furthermore, an example of the information processing device 103a for recording may be a home appliance composed of a CPU, a memory, a built-in flash memory, a media read/write device (SD card slot or CD player), an internet interface circuit, and the like. machine. In this case, the inter-machine transfer mechanism 401 and the inter-machine receiving mechanism 402 are constituted by an internet interface circuit, and the inter-media transfer mechanism 403 and the inter-media receiving mechanism 404 are constituted by a media read/write device. Of course, this is not the limit.

2.4.1 Inter-machine transfer mechanism 401

The inter-machine transfer mechanism 401 transmits the transmission request information 321 generated by the user's operation to the transmission server device 102a. Here, the transmission request information 321 is a request for transmission from the transmission server device 102a to the transmission content data set 351 of the information recording medium device 105a.

Further, when the inter-machine transfer unit 401 establishes the secret communication path 22 between the transmission server device 102a and the information recording medium device 105a, the information recording medium device 105a receives the establishment of the secret communication path 22 via the medium-to-media receiving unit 404. The necessary information is transmitted to the transmitting server device 102a.

Further, the inter-machine transfer unit 401 is responsible for transmitting the protected data to the transmitting server device 102a side of the secret communication path 22 after the secret communication path 22 is established between the transmitting server device 102a and the information recording medium device 105a. . Here, the information recording medium device 105a transmits the encrypted medium communication path 22 to the transmission server device 102a while the received media identifier 371 is protected.

2.4.2 Inter-machine receiving mechanism 402

When establishing the secret communication path 22 between the transmission server device 102a and the information recording medium device 105a, the inter-machine receiving unit 402 receives the data necessary for the establishment of the secret communication path 22 transmitted by the transmission server device 102a, and transmits the data through the medium. The inter-transfer mechanism 403 transmits the received data to the information recording medium device 105a.

Further, the inter-machine receiving unit 402 is between the transmitting server device 102a and the information recording medium device 105a, and is responsible for receiving the protected side of the transmitting server device 102a from the cryptographic communication path 22 after the cryptographic communication path 22 is established. data. Here, the transmission server device 102a transmits the individual title key 381 and the common title key 241 in the protected state through the secret communication path 22, and transmits it to the information recording medium device 105a.

Further, the inter-machine receiving unit 402 receives the transmission content data set 351 from the transmission server device 102a, and transmits it to the information recording medium device 105a via the inter-media communication unit 403, that is, without passing through the secret communication path 22.

2.4.3 Media Transfer Agency 403

The inter-media transfer unit 403 is configured to transmit when the secret communication path 22 between the transmission server device 102a and the information recording medium device 105a is established. The server device 102a receives the data necessary for the establishment of the secret communication path 22 through the inter-machine receiving unit 402, and transmits the received data to the information recording medium device 105a.

Further, the inter-media transfer means 403 is located between the transmission server device 102a and the information recording medium device 105a, and is responsible for transmitting the protected data on the side of the information recording medium device 105a in the secret communication path 22 after the secret communication path 22 is established. . Here, the transmission server device 102a transmits the encrypted individual communication key 22 to the information recording medium device 105a while the received individual title key 381 and the common title key 241 are protected.

Further, the inter-media transfer unit 403 passes the inter-machine receiving unit 402 via the inter-machine receiving unit 402, that is, does not transmit the secret content data set 351, and receives the received content data set 351 for transmission. The recording medium device 105a transmits.

2.4.4 Media Intermediary Organization 404

When the media-to-media receiving unit 404 establishes the secret communication path 22 between the transmitting server device 102a and the information recording medium device 105a, the information recording medium device 105a receives the data necessary for the establishment of the secret communication path 22, and receives the received data. The transmission is made to the transmission server device 102a via the inter-machine transmission mechanism 401.

Further, the medium-to-media receiving unit 404, after establishing the secret communication path 22 between the transmission server device 102a and the information recording medium device 105a, is responsible for receiving the protected material from the side of the information recording medium device 105a in the cipher communication path 22. Here, the information recording medium device 105a passes through the secret communication path 22, and receives the media identifier 371 in a protected state, and It is transmitted to the transmitting server device 102a side.

2.5 Composition of the information processing device 104a for reproduction

As shown in FIG. 19, the reproduction information processing device 104a includes an inter-media transfer unit 501, an inter-media receiving unit 502, a title key obtaining unit 503, a decryption unit 504, a signature verification key storage unit 505, and a replacement combination. The body generation unit 506, the signature verification unit 507, the reproduction possibility determination unit 508, the reproduction unit 509, and the control unit 513 are configured.

Further, an example of the information processing device for reproduction 104a may be a home electric appliance including a CPU, a memory, a built-in flash memory, a media read/write device (SD card slot or a CD player). In this case, the inter-media transfer unit 501 and the inter-media receiving unit 502 are each constituted by a media read/write device, and the title key acquisition unit 503, the decryption unit 504, the replacement combination generation unit 506, the signature verification unit 507, and the reproduction. The determination unit 508 is composed of a program that operates on the CPU and the memory, and the signature verification key storage unit 505 is installed by the built-in flash memory. However, of course, it is not limited by these.

2.5.1 Signature Verification Key Depository 505

The signature verification key storage unit 505 stores the public key 531 "KPV". The public key 531 is the public key of the content signature generation server device 101a, and corresponds to the private key 251 "KSG" held by the signature key storage unit 208 of the content signature generation server device 101a. The public key 531 is used for the signature verification mechanism 507.

2.5.2 Media Transfer Organization 501

The inter-media transfer mechanism 501 is controlled by the control mechanism 513. The information recording medium device 105a transmits the individual title key 381, the common title key 241, and the transmission instruction 551 of the transmission content data set 351.

2.5.3 Intermediary Receiving Organization 502

The medium-to-media receiving unit 502 receives the individual title key 381, the common title key 241, and the transmission content data set 351 from the information recording medium device 105a. The transmission content data set 351 is composed of the unit selection information 780, the transmission encrypted content 900, the header information 860, and the signature information 890 as described above.

When the individual title key 381, the common title key 241, and the transmission content data set 351 are received, the media-to-media receiving unit 502 sets the individual title key 381, the unit selection information 780, the transmission encrypted content 900, the header information 860, and The signature information 890 is output to the regeneration possibility determination unit 508. Further, the inter-media receiving unit 502 outputs the individual title key 381, the common title key 241, the transmission encrypted content 900, and the header information 860 to the reproduction unit 509.

2.5.4 Title Key Acquisition Agency 503

The title key obtaining unit 503 is configured by the decryption unit 504 to accept the unit key identifier information and the header key flag information included in the unit hash information corresponding to the unit identifier. Next, the title key obtaining means 503 is for judging whether the value of the received title key flag information is "0" or "1". When it is judged that the received title key flag information is "0", the media-to-media receiving unit 502 accepts the individual title key 381, and when it is judged as "1", the media-to-media receiving means 502 accepts the common title key 241. Next, when the title key obtaining means 503 judges that the accepted title key flag information is "0", it will accept the one. The header key 381 is output to the decryption unit 504. When it is judged that the received title key flag information is "1", the received common title key 241 is output to the decryption means 504.

2.5.5 regeneration possibility determination mechanism 508

The reproduction possibility determination unit 508 receives the individual title key 381, the unit selection information 780, the transmission encrypted content 900, the header information 860, and the signature information 890 by the medium-to-media receiving unit 502, and accepts the individual title key 381, The unit selection information 780, the transmission encrypted content 900, the header information 860, and the signature information 890 are output to the replacement combination generation unit 506.

Further, the reproduction possibility determination unit 508 receives the verification result 541 using the signature information 890 by the signature verification unit 507. The verification result 541 indicates that when the verification is successful, the instruction starts to the reproduction unit 509 to reproduce the content. When the verification result 541 indicates that the verification has failed, the reproduction means 509 is instructed to stop the reproduction processing of the content.

Further, in order to cause the user to recognize that the reproduction processing of the content is stopped, a screen for notifying the error is displayed on the display connected to the information processing device for reproduction 104a, and the indicator light of the information processing device for reproduction 104a is turned on. , notify the user that the content cannot be reproduced.

2.5.6 Decryption Mechanism 504

The decryption unit 504 starts the reproduction of the encrypted content 900 for transmission or stops the reproduction processing in response to an instruction from the reproduction possibility determination unit 508.

The decryption mechanism 504 is based on the finger from the regeneration possibility determination mechanism 508. When the encrypted content 900 for transmission is received and reproduced, the decryption process is performed as follows.

The decryption unit 504 receives the individual title key 381, the common title key 241, the header information 860, and the encrypted content 900 for transmission by the playback unit 509.

Next, the decryption unit 504 receives the individual title key 381 and the common title key 241 from the media receiving unit 502 by the title key obtaining unit 503, and accepts the received individual title key 381 and the common title key 241. The transmission is decrypted with the encrypted content 900.

Hereinafter, the process of decryption will be specifically described.

First, the decryption unit 504 extracts the transmission encrypted file 901 "DCNT1", the transmission encrypted file 902 "DCNT2", and the transmission encrypted file 903 "DCNT3", ‧ from the received encrypted content 900 ‧‧, the encrypted file 904 "DCNTc" is transmitted. Next, the received transmission encrypted files 901, 902, 903, ‧‧‧, 904 are decrypted using the individual title key 381 and the common title key 241 accepted by the title key obtaining means 503.

Since the decryption processing of each of the transmission encrypted files 901, 902, 903, ‧‧, and 904 is the same, the decryption processing of the transmission encrypted file 901 "DCNT1" will be described below.

The decryption unit 504 extracts the transmission encryption unit 913 "DU1_1", the transmission encryption unit 914 "DU1_2", the transmission encryption unit 915 "DU1_3", ‧‧‧, and the transmission encryption by the transmission encrypted file 901 Unit 917 "DU1_m".

Next, the decryption unit 504 performs the following processing for each of the transmission encryption units 913, 914, 915, ‧‧, and 917. Hereinafter, the transmission encryption unit 913 will be described as a representative.

The decryption unit 504 extracts the first hash table 861 corresponding to the transmission encryption unit 913 from the received header information 860, and hashes the information according to the unit in each first hash table 861, and extracts the hash information from the unit. The unit identifier and the title key flag information corresponding to the unit identifier. Next, the extracted unit identifier and the title key flag information are output to the title key obtaining unit 503 in accordance with the unit hash information in each of the first hash table 861.

Next, the decryption unit 504 receives the individual title key 381 by the title key obtaining unit 503 when the title key flag information is "0" based on the value of the title key flag information. If the title key flag information is "1", the title key acquisition means 503 accepts the common title key 241. The decryption unit 504 decrypts the transmission encryption unit 913 using the received title key, and outputs the obtained decryption unit to the reproduction unit 509. The same processing is performed on the transmission encryption units 914, 915, 916, ‧ ‧ and 917, and decryption is performed, and the decryption unit is output to the reproduction unit 509.

In addition to the above-described decryption processing, the decryption unit 504 performs decryption based on an instruction from the replacement combination generation unit 506 as will be described below.

The decryption unit 504 receives the header information 860 and the transmission encryption unit by the replacement combination generation unit 506, and performs decryption of the received transmission encryption unit.

The decryption processing of the transmission encryption unit is the same as the above processing. Specifically, the decryption mechanism 504 will correspond to the single encryption unit for transmission. The meta-recognition is output to the title key obtaining unit 503, and the title key is accepted by the title key obtaining unit 503, and the transmission encryption unit is decrypted using the accepted title key. The decryption unit 504 outputs the decryption unit obtained by decrypting the transmission encryption unit to the replacement combination generation unit 506.

2.5.7 Replacement Combination Generation Mechanism 506

The replacement combination generation unit 506 receives the individual title key 381, the unit selection information 780, the transmission encrypted content 900, the header information 860, and the signature information 890 by the reproduction possibility determination unit 508.

Next, the replacement combiner generation mechanism 506 generates a replacement first hash table and a replacement second hash table as explained below.

Fig. 20 is a view showing an outline of a generation operation of replacing the first hash table 941 and replacing the first hash table 943 and replacing the second hash table 931 by the replacement combination generating means 506.

The replacement combination generating means 506 is as shown in Fig. 21, and the unit selection information 780 selects k (k is a natural number below c) file information, and extracts the file identifier from each of the selected file information. Here, one of the examples selects the file information 781, 783, ‧ ‧ and extracts the file identifier 786 "FID1", the file identifier 787 "FID3", ‧ ‧ from the selected file information 781, 783, ‧ ‧ .

Next, the replacement combination generation unit 506 generates a replacement first dispersion based on the first hash table 861 "HA1TBL1" and the transmission encrypted file 901 "DCNT1" corresponding to the extracted file identifier 786 "FID1". Listing 941 "RHA1TBL1". Other file knowledge extracted The other child 787 "FID3" and ‧‧‧ also generated the replacement of the first hash table 943 "RHA1TBL3", ‧‧‧ Next, the replacement combination generating means 506 is based on the generation of the replacement first hash table 941 "RHA1TBL1", the replacement first hash table 941 "RHA1TBL3", the ‧‧‧ and the second hash table 865 "HA2TBL", as explained below The replacement second hash table 931 "RHA2TBL" is generated.

Next, the generation flow of the first hash table 941, 943, ‧ ‧ and the generation flow of the replacement second hash table 931 are replaced, and the detailed description will be made using the drawings.

(1) Replace the generation of the first hash table

The generation flow for replacing the first hash table 941 will be described using FIG. 21 and FIG.

The replacement combined body generating means 506 selects c pieces of file information ‧781, 782, 783, ‧‧‧, 785 included in the information 780 by the receiving unit as shown in Fig. 21, and selects k (k is c or less) Natural number) file information.

The method of selecting file information is to generate k (r1, r2, ‧ ‧, rk), for example, the number of random numbers below 1 and below c, and select the r1, r2, ‧ ‧ and rk file information The file identifier is extracted from the selected file information.

The method of selecting the file information to extract the file identifier is not limited to this, as long as it is difficult to predict which file identifier to select, and which method is acceptable.

For example, the aforementioned random number may also use noise such as temperature, humidity, and electrical signals.

In the present embodiment, a case where seven file information "FI1", "FI3", and ‧‧" are selected is assumed to be k=7.

Next, the replacement combination generating mechanism 506 is as shown in Fig. 21, In the example, one of the transmission encryption units is selected from the transmission encrypted file 901 "DCNT1" corresponding to the file identifier 786 "FID1" extracted from the selected file information 781 "FI1".

Specifically, the replacement combining unit generating means 506 reads out the number of cells N1 included in the selected file information, and generates a pseudo-number t of the number of readings N1 or less. Here, it is generated that the number of random numbers t=3. Next, as shown in an example of Fig. 22, the third transmission encryption unit 915 that receives the encrypted encrypted file 901 "DCNT1" by the medium-to-media receiving unit 502 corresponds to the generated pseudo-disorder number t (= 3). "DU1_3".

Next, the replacement combining unit 506 receives the title key flag information "TKFI1_3" corresponding to the received transmission encrypting unit 915 "DU1_3" by the medium-to-media receiving unit 502. Next, the replacement combining unit 506 determines that the title key flag information "TKFI1_3" is any of "0" and "1".

When the title key flag information "TKFI1_3" is "0", the transmission encryption unit 915 outputs the result to the decryption unit 504, and the decryption unit 504 receives the decryption unit decrypted by the transmission encryption unit. The replacement combination generation unit 506 uses the received decryption unit as the hash target unit "HU1_3".

When the title key flag information "TKFI1_3" is "1", the replacement combination generating means 506 sets the transmission encryption unit itself as the hash target unit "HU1_3".

Further, the replacement combining unit generating means 506 substitutes the hash target unit "HU1_3" into the hash function to generate a replacement unit hash value "RUH3". Here, the replacement combination generation unit 506 uses the same hash function as the hash function used by the header information generation unit 207 of the content signature generation server device 101a.

Next, the replacement combining unit 506 receives the first hash table 861 "HA1TBL1" included in the header information 860 by the medium-to-media receiving unit 502.

The m unit hash information 871, 872, 873, ‧‧‧, 874 composed of the received first hash table 861 "HA1TBL1" will correspond to the unit of the unit identifier "UID1_3" which coincides with the number of random numbers t=3 The hash value "UHA1_3" is replaced with the calculated replacement unit hash value 942 "RUH3", and the hash table after the replacement unit hash value 942 "RUH3" is replaced is replaced with the first hash table 941 "RHA1TBL1".

The replacement combination generating means 506 repeats the same processing for the other selected file information "FI3" and ‧ ‧ to generate the replacement first hash table 943 "RHA1TBL3" and ‧ ‧

(2) Replacing the generation of the second hash table 931

Hereinafter, the generation flow of the second hash table 931 will be replaced, and the description will be made using FIG.

According to the selected seven file information, when the generation of the seven replacement first hash tables 941, 943, and ‧ ‧ is completed, the replacement combination generating unit 506 substitutes the generated replacement first hash table 941 "RHA1TBL1" into the hash function. And generate a replacement file hash value 892a "RFH1". Similarly, the replacement file hash value 894a "RFH3" and ‧‧‧ are generated based on the replacement of the first hash table 943 "RHA1TBL3" and ‧‧‧

Second, the replacement combiner generation mechanism 506 will be an inter-media receiver The structure 502 accepts the second hash table 865 "HA2TBL" included in the header information 860. The c file hash information 885, 886, 887, ‧‧‧, 888 included in the second hash table 865 "HA2TBL" to be accepted includes the file identifier "FID1" and "including" in the selected seven file information. The file hash value of the file hash information of FID3" and ‧‧" is replaced by the generated replacement file hash value 892a "RFH1", the replacement file hash value 883a "RFH3", and ‧‧. The second hash table after the replacement is replaced with the second hash table 931 "RHA2TBL".

Next, the replacement combining unit 506 outputs the unit selection information 780, the replacement second hash table 931 "RHA2TBL", and the signature information 890 to the signature verification unit 507.

2.5.8 Signature Verification Agency 507

The signature verification unit 507 receives the unit selection information 780, the replacement second hash table 931 "RHA2TBL", and the signature information 890 by the replacement combination generation unit 506.

When the unit selection information 780 is received, the second hash table 931 "RHA2TBL" and the signature information 890 are replaced, the signature verification unit 507 reads the public key 531 "KPV" by the signature verification key storage unit 505. Next, as shown in Fig. 24, the accepted replacement second hash table 931 "RHA2TBL" is combined with the unit selection information 780 to generate a combined body 552. Next, using the read public key 531, the signature verification algorithm V is used on the generated combination 552 to verify the accepted signature information 890.

Here, the signature verification algorithm V is an algorithm of the signature method described in 1.2.8, and is generated corresponding to the signature used in the signature generation mechanism 209. Algorithm S.

Next, the signature verification unit 507 outputs the verification result 541 to the reproduction possibility determination unit 508.

2.5.9 Regeneration Mechanism 509

The reproduction unit 509 receives the individual title key 381, the common title key 241, the transmission encrypted content 900, and the header information 860 by the medium-to-media receiving unit 502, and accepts the individual title key 381 and the common title key 241, The transmission encrypted content 900 and the header information 860 are output to the decryption unit 504.

Further, the playback unit 509 receives the decrypted content obtained by decrypting the encrypted content for transmission by the decryption unit 504, and reproduces the received decrypted content.

2.6 Composition of information recording media device 105a

As shown in Fig. 25, the information recording medium device 105a includes an inter-machine transfer unit 601, an inter-machine receiving unit 602, a media identifier storage unit 603, an operation subject public key storage unit 604, a private key storage unit 605, and a public fund. The key certificate storage unit 606, the secret communication path establishing unit 607, the title key storage unit 608, the content storage unit 609, and the control unit 610 are configured.

Further, the information recording medium device 105a may specifically be a memory such as a CPU, a RAM, or a ROM, a flash memory, or an access to the information processing device 103a for recording or the information processing device 104a for reproduction and data. A memory card composed of an interface unit or the like.

In this case, the inter-machine transfer mechanism 601 and the inter-machine receiving mechanism 602 are constituted by interface units, the media identifier storage unit 603, and the application master. The body public key storage unit 604, the private key storage unit 605, and the public key certificate storage unit 606 are each composed of a ROM, and the title key storage unit 608 and the content storage unit 609 are respectively composed of flash memory. The communication path establishing unit 607 and the control unit 610 are each constituted by a program that operates on the CPU and the memory. Furthermore, the CPU, memory or interface unit also has a hardware structure called a controller. Of course, it is not limited to these.

Furthermore, the media identifier storage unit 603, the application body public key storage unit 604, the private key storage unit 605, and the public key certificate storage unit 606 are each constituted by a ROM, but may be, for example, an EEPROM or a mixed flash memory. The body is composed of a memory that can be temporarily written during manufacture.

2.6.1 Using the subject public key depository mechanism 604

The application body public key storage means 604 holds the public key 361 of the certification authority device of the application body of the content distribution system 10a.

The public key 361 is the same as the public key 361 held by the application body public key storage unit 308 of the transmission server device 102a.

The public key 361 is used when the cipher communication path establishing unit 607 establishes the cipher communication path 22.

The public key 361 is created in advance to be embedded in the information recording medium device 105a, but is not limited thereto. Alternatively, the public key 361 may be transmitted by the authentication authority device of the application body of the content distribution system 10a, the information recording medium device 105a receives the public key 361, and the entity public key storage unit 604 stores the received public key 361. .

2.6.2 Private Key Depository 605

The private key holding mechanism 605 holds a private key 631 (also referred to as a media private key) of the information recording medium device 105a. The private key 631 is a user of the public key or public key signature used by the secret communication path establishing unit 607 when establishing the secret communication path 22, and is authenticated by the authentication authority of the application body of the content transmission system, and The public key issued jointly by the public key certificate 951.

2.6.3 Public Key Certificate Depository 606

The public key certificate storage unit 606 holds the public key certificate 951 of the information recording medium device 105a. The public key certificate 951 is composed of a media disclosure key 952 and other information and a signature 953 as shown in FIG. The media public key 952 is a public key issued by the authentication authority device of the application body of the content transmission system 10a to the information recording medium device 105a. With respect to the media disclosure key 952 and other information, the signature 953 is the authentication authority device of the application body of the content distribution system 10a, and uses the signature generation algorithm S, and generates it using the private key stored by the certification authority itself. Digital signature information.

The signature generation algorithm S is an EC-DSA (EllipticCurve Digital Signature Algorithm) having a 160-bit key length in this embodiment. However, this is not the limit. It can also be a digital signing method or a key with a different bit width. Further, it is also possible to prevent tampering by using other cipher functions such as MAC (Message Authentication Code). By attaching the signature, the media disclosure key 952 can surely verify that the certification authority device of the application body of the content delivery system 10a is issued. The situation.

2.6.4 Media Identification Sub-Save Organization 603

The media identifier storage unit 603 stores a media identifier 371 that uniquely identifies the information recording medium device 105a.

2.6.5 Title Key Storage Authority 608

The title key storage unit 608 has an area for storing the individual title key 381 and the common title key 241. The title key storage unit 608 is a memory area in which information can be written only by the server server 102a that is determined to be legitimate.

Here, the individual title key 381 and the common title key 241 are the recipients of the secret communication path 22 established by the secret communication path establishing unit 607.

2.6.6 Content Storage Organization 609

The content storage unit 609 has an area for recording the content set 351 for transmission.

The transmission content data set 351 is received by the inter-machine receiving unit 602.

2.6.7 Inter-machine transfer mechanism 601

The inter-machine transfer unit 601 transfers the individual title key 381 and the common title key 241 recorded in the title key storage unit 608 to the playback information processing device 104a under the control of the control unit 610, and stores it in the content storage unit 609. The content data set 351 for transmission.

Further, the inter-machine transfer unit 601 transmits the media identifier 371 stored in the media identifier storage unit 603 to the recording information processing device 103a via the secret communication path 22 established by the secret communication path establishing unit 607.

2.6.8 Inter-machine receiving mechanism 602

The inter-machine receiving unit 602 receives the individual title key 381, the common title key 241, and the transmission content data set 351 by the recording information processing device 103a. Here, the individual title key 381 and the common title key 241 are received by the secret communication path 22 established by the secret communication path establishing unit 607.

2.6.9 cryptographic communication path establishment mechanism 607

The secret communication path establishing unit 607 uses the public key 361 held by the application body public key storage means 604, the private key 631 of the information recording medium device 105a held by the private key holding means 605, and the public key certificate holding means 606. The public key certificate 951 of the stored information recording medium device 105a establishes the secret communication path 22 with the transmission server device 102a via the recording information processing device 103a.

Specifically, the secret communication path establishing unit 607 is for verifying whether or not the transmission server device 102a of the communication target is a legitimate device. When it is judged to be illegal, the establishment of the secret communication path 22 is suspended. When the secret communication path establishing unit 607 determines that the transmission server device 102a is a legitimate device, a secret session key is shared with the transmission server device 102a. Secret secret communication is performed with the transmitting server device 102a using the shared dialog key.

When the secret communication path 22 is established, the secret communication path establishing unit 607 permits the title key storage means 608 of the title server key (the individual title key 381 and the common title key 241) to be determined by the transmission server device 102a. Write. For devices that are not judged to be legitimate, they are not allowed to go to the title gold The writing of the data of the key storage mechanism 608.

The method of establishing the secret communication path 22 is the same as the method of the secret communication path establishing unit 311 of the transmitting server device 102a. Therefore, in the present embodiment, the method defined by DTCP is used.

2.7 Action of Content Delivery System 10a

In the following, in the operation of the content distribution system 10a, the content signature generation server device 101a generates the intermediate content data set 242 and the like, and transmits the intermediate content data set 242 and the like to the "content signature generation" of the transmission server device 102a. The operation and transmission server device 102a generates the content data set 351 for transmission, and the operation and reproduction of the "content transmission" stored in the information recording medium device 105a via the recording information processing device 103a. The operation of the "content reproduction" reproduced by the information recording medium device 105a and the reproduction of the content data set 351 for transmission by the information processing device 104a will be described.

(1) Action of content signature generation

The operation of generating the content signature is described using the sequence diagram shown in Fig. 27.

The unit generation unit 204 of the content signature generation server device 101a generates the divided content 721 and the unit selection information 780, and outputs the divided content 721 to the encryption unit 206, and outputs the unit selection information 780 to the signature generation unit 209 to output the unit. The selection information 780 is written to the storage unit 202 (step S1001). The common title key generation unit 205 generates the common title key 241, outputs the common title key 241 to the encryption unit 206, and writes the common title key 241 to the storage unit 202 (step S1002). Encryption machine The configuration 206 generates the encrypted divided content 840 and the encrypted content 820, outputs the encrypted divided content 840 to the header information generating unit 207, and writes the encrypted content 820 to the storage unit 202 (step S1003). The header information generating unit 207 generates the header information 860, writes the header information 860 to the storage unit 202, and outputs the second hash table 865 included in the header information 860 to the signature generating unit 209 (step S1004). Next, the signature generation unit 209 generates the signature information 890, and writes the signature information 890 to the storage unit 202 (step S1005). The inter-machine transfer unit 203 reads the common title key 241 and the intermediate content data set 242 from the storage unit 202, and transmits the common title key 241 and the intermediate content data set 242 to the transmission server device 102a. The inter-machine receiving unit 303 of the transmitting server device 102a receives the common title key 241 and the intermediate content data set 242 (step S1006), and writes the common title key 241 and the intermediate content data set 242 to the storage unit 301 (step S1007). ).

(2) Action of content transmission

The operation of transmitting the content is explained using the sequence diagram shown in Fig. 28.

The recording information processing device 103a transmits the transmission request information 321 to the transmission server device 102a, and the device-to-machine receiving mechanism 303 of the transmission server device 102a receives the transmission request information 321 (step S1101). Next, the cipher communication path establishing unit 311 of the transmission server device 102a and the cipher communication path establishing unit 607 of the information recording medium device 105a establish the cipher communication path 22 between the transmission server device 102a and the information recording medium device 105a (step S1102). ). When the cipher communication path 22 is established, the inter-machine transfer mechanism 601 of the information recording medium device 105a passes through the cipher communication path 22 The hire information processing device 103a transmits the media identifier 371 to the transmission server device 102a (step S1103).

The inter-machine receiving unit 303 of the transmission server device 102a receives the media identifier 371 via the secret communication path 22 (step S1103). The individual title key generation unit 305 generates an individual title key 381 (step S1104). The encryption unit 306 generates the encrypted content 900 for transmission (step S1105). The inter-machine transmission unit 302 transmits the transmission content data set 351 to the information recording medium device 105a via the recording information processing device 103a (step S1106).

The inter-machine receiving unit 602 of the information recording medium device 105a receives the transmission content data set 351 (step S1106), and writes the transmission content data set 351 to the content storage unit 609 (step S1107).

The inter-machine transfer unit 302 of the transmission server device 102a transmits the individual title key 381 and the common title key 241 to the information recording medium device 105a via the recording information processing device 103a using the secret communication path 22 (step S1108).

The inter-machine receiving unit 602 of the information recording medium device 105a receives the individual title key 381 and the common title key 241 using the secret number communication path 22 (step S1108), and transfers the individual title key 381 and the common title key 241 to the title key. The storage unit 608 writes (step S1109).

(3) The action of content regeneration

The operation of content reproduction is described using a sequence diagram of Fig. 29.

The inter-media transfer mechanism 501 of the reproduction information processing device 104a transmits a transfer instruction 551 to the information recording medium device 105a, and the inter-machine receiving mechanism 602 of the information recording medium device 105a receives the transfer instruction 551 (step S1201).

Then, the inter-machine transfer unit 601 of the information recording medium device 105a transmits the individual title key 381, the common title key 241, and the transmission content data set 351 to the playback information processing device 104a (step S1202).

Next, the inter-media receiving unit 502 of the reproduction information processing device 104a receives the individual title key 381, the common title key 241, and the transmission content data set 351 (step S1202). The replacement combination generation mechanism 506 generates a replacement second hash table 931, and replaces the second hash table 931 with the unit selection information 780 to generate a replacement combination 552 (step S1203). The signature verification unit 507 performs signature verification using the generated replacement combination 552 and the signature information 890, and in response to the verification result 541, the reproduction possibility determination unit 508 determines whether or not the reproduction is possible (step S1204). When the verification result 541 indicates that the verification has failed ("verification failure" in step S1204), the content reproduction processing is stopped. When the verification result 541 indicates that the verification is successful ("verification succeeded" in step S1204), the title key obtaining means 503 acquires the title key (the individual title key 381 and the common title key 241), and the decryption means 504 uses the obtained title. The key decrypts the transmission encrypted content 900 (step S1205). The reproduction unit 509 reproduces the decrypted content obtained by the decryption (step S1206).

2.8 Effect of Content Delivery System 10a

(1) The content transmission system 10a stores the title key (the individual title key 381 and the common title key 241) in the title key storage unit 608 of the information recording medium device 105a. The title key storage unit 608 of the information recording medium device 105a is a memory area in which the information can be written by the server device 102a only by the determination.

Specifically, in the content distribution system 10a, the secret communication path 22 established by using the verification public key certificate is used, and the title key transmitted only by the transmission server device 102a whose verification is determined to be correct is written in the information recording medium device 105a. Title key storage mechanism 608. As a result, writing of the title key from the illegal server device whose authentication is determined to be illegal can be prevented.

(2) In the content distribution system 10a, the signature information 890 for the content is stored in the information recording medium device 105a, and by using the verification of the signature information 890, the illegal replacement of the encrypted content can be detected, and the encryption can be prevented. Illegal substitution of content.

(3) Further, in the content distribution system 10a, the individual title key generation means 305 of the transmission server device 102a generates an individual title key 381 for each information recording medium device, and the title key database storage means 307 makes individual titles. The key 381 is stored and managed in pairs with a media identifier that uniquely identifies the information recording medium device. Thereby, when the individual title key 381 is illegally exposed on the WEB server or the Internet webpage, the media identifier of the information recording medium device for the individual title key 381 can be obtained by the sending server device 102a, and the information record of the specific leak source is obtained. The media device, and the content after the suppression is sent to the specific information recording media device.

(3) The content transmission system 10a adds, to the unit to be used as the common title key 241, the second generation generated based on the encrypted divided file including the encryption unit obtained by encrypting the unit. Signature information such as lists. Therefore, if the illegal server device writes the illegal common title key to the information recording medium device, even if the encrypted content generated by the illegal common title key is written into the information recording medium device, The signature verification performed by the information processing device for reproduction can detect illegality and stop the reproduction of the illegally encrypted content.

(4) Further, in the content distribution system 10a, a second hash table generated based on the encrypted divided file including the unencrypted unit and the plaintext unit is added to the unit to be used as the individual title key 381. Wait for the signature information. In this way, the signature information for the content is not generated in the transmission server device 102a, but the content signature generation server device 101a generates the signature information in advance.

Therefore, only the transmission server device 102a is connected to the network, and if the content signature generation server device 101a is not connected to the network, the content signature generation server device 101a can be prevented from being attacked through the network, and the signature information is Will not be changed to be true.

(5) In addition, as for the unit to be used as the individual title key 381, as described above, even if the illegal common title key and the encryption unit generated in conjunction therewith are illegally written to the information recording medium device, the information for reproduction is used. The signature verification performed by the processing device 104a cannot detect such illegality, and the reproduction cannot be stopped.

However, in one content, the unit encrypted by using the individual title key 381 is mixed with the unit encrypted by the common title key 241, so even if only the part using the individual title key 381 is used instead, Regeneration does not stop, and it is difficult to reproduce content.

Specifically, a method of symbolizing a compressed animation such as MPEG2 includes a B image or a P image which is a difference between an I image which is a basis of an image and a difference from an I image. For example, the I picture is encrypted with the common title key 241, When the B picture or the P picture is encrypted by the individual title key 381, the only basic image cannot be represented by the replacement of the B picture or the P picture, and thus it is impossible to form a view as desired by the attacker.

Thus, the encryption of the individual title key 381 and the encryption using the common title key 241 are mixed by the units of the content, that is, if the individual title key 381 and the common title key 241 are used, Encryption of content, even if the attacker illegally replaces the title key with a part of the unit, it is impossible to reproduce the content as the attacker wishes.

(6) Further, the second hash table generated by the unit hash value of the unit encrypted according to the use of the common title key 241 and the unit hash value of the unit used as the individual title key 381, The signature information is generated, thus preventing tampering of the hash values of the units.

As described above, in the content distribution system 10a, by using the individual title key 381 and the common title key 241, the common title key 241 is encrypted, and the individual title key 381 is in plaintext. The unit generates a unit hash value, has the effect of preventing the attacker from attacking, and can generate the signature information of the content in advance.

Furthermore, as described above, since both the individual title key 381 and the common title key 241 are used, the common title key 241 is encrypted in the unit, and the individual title key 381 is in the plaintext unit. Since the cell hash value is generated, even if the title key is tampered with, the reproduction information processing apparatus can prevent the attack of reproducing the illegal content using the falsified title key. In the content distribution system 10a, only the configuration in which the server device can write the title key is transmitted, but in order to exhibit the above effects, only the servo is transmitted. The configuration in which the device device can write the title key is not essential to the present invention.

3. Embodiment 3

Here, a modification of the content distribution system 10a will be described with reference to the drawings as the content transmission system 10b according to the third embodiment of the present invention.

3.1 The whole composition of the content transmission system 10b

As shown in FIG. 30, the content distribution system 10b is composed of a content signature generation server device 101a, a transmission server device 102b, a recording information processing device 103a, a reproduction information processing device 104b, and an information recording medium device 105b. Here, the content signature generation server device 101a and the transmission server device 102b constitute a content transmission subsystem 30b (not shown).

The content signature generation server device 101a and the recording information processing device 103a have the same configuration as the content signature generation server device 101a and the recording information processing device 103a of the content transmission system 100a.

Further, the transmission server device 102b, the reproduction information processing device 104b, and the information recording medium device 105b have configurations similar to those of the transmission server device 102a, the reproduction information processing device 104a, and the information recording medium device 105a of the content transmission system 100a.

Here, a description will be given focusing on the difference from the content distribution system 10a.

3.2 The composition of the transmitting server device 102b

As shown in FIG. 31, the transmission server device 102b includes a storage unit 301, an inter-machine transfer unit 302, an inter-machine receiving unit 303, a media identifier acquisition unit 304, an individual title key generation unit 305, and an encryption unit. 306, title key database storage unit 307, application body public key storage unit 308, private key storage unit 309, public key certificate storage unit 310, secret communication path establishment unit 311, title key transmission certificate The generating mechanism 312 and the control unit 313 are configured.

Here, the storage unit 301, the inter-machine transfer unit 302, the inter-machine receiving unit 303, the media identifier acquisition unit 304, the individual title key generation unit 305, the encryption unit 306, the title key database storage unit 307, and the application body are disclosed. The key storage unit 308, the private key storage unit 309, the public key certificate storage unit 310, the secret communication path establishing unit 311, and the control unit 313 have a configuration corresponding to the transmission server device 102a of the content transmission system 10a. The same composition of elements. On the other hand, the title key transmission certificate generation unit 312 does not exist in the transmission server device 102a of the content transmission system 10a.

Furthermore, the transmission server device 102b may be a PC including a CPU, a memory, a secondary memory device, an internet interface circuit, etc., in the same manner as the transmission server device 102b. In this case, the title key transmission certificate is generated. The mechanism 312 is composed of a CPU and a program that operates thereon. However, needless to say, it is of course not limited thereto.

Hereinafter, description will be given focusing on the difference from the transmission server device 102a of the content transmission system 10a.

3.2.1 Title Key Transmission Certificate Generation Authority 312

The title key transmission certificate generation unit 312 generates a title key transmission certificate 1000 as described below.

The title key transmission certificate generation unit 312 is stored by the storage mechanism 301. The individual title key 381 and the common title key 241 are read, and the media identifier 371 is received by the media identifier obtaining unit 304. Further, the private key 362 is read by the private key holding means 309.

Next, the title key transmission certificate generation unit 312 combines the individual title key 381, the common title key 241, and the media identifier 371 in this order to generate a combination 271, and uses the read private key 362 to generate the pair. The combination 271 performs a signature generation algorithm S to generate signature information 1001. Here, the signature generation algorithm S is as described above.

Next, the title key transmission certificate generation unit 312 reads out the public key certificate 921 from the public key certificate storage unit 310, and as shown in Fig. 32, the signature information 1001 and the public key certificate 921 are generated. The title key transmission certificate 1000 writes the generated title key transmission certificate 1000 to the storage unit 301.

3.2.2 Other components

The media identification sub-acquisition unit 304 outputs the received media identifier 371 to the title key transmission certificate generating unit 312.

The inter-machine transfer mechanism 302 reads the title key transmission certificate 1000 from the storage unit 301 under the control of the control unit 313, and transmits the read title key transmission certificate 1000 to the information record through the information processing device 103a for recording. Media device 105b.

3.3 Composition of the information processing device 104b for regeneration

As shown in FIG. 33, the reproduction information processing device 104b includes an inter-media transfer unit 501, an inter-media receiving unit 502, a title key obtaining unit 503, a decryption unit 504, a signature verification key storage unit 505, and a replacement. The combination generation unit 506, the signature verification unit 507, the reproduction possibility determination unit 508, the reproduction unit 509, the media identification sub-acquisition unit 510, the operation main body public key storage unit 511, the title key transmission certificate verification unit 512, and the control unit 513 Composition.

The inter-media transfer unit 501, the media-to-media reception unit 502, the title key acquisition unit 503, the decryption unit 504, the signature verification key storage unit 505, the replacement combination generation unit 506, the signature verification unit 507, and the reproduction possibility determination mechanism 508. The reproduction unit 509 and the control unit 513 have the same configuration as the components corresponding to the reproduction information processing device 104a of the content transmission system 10a. On the other hand, the media identification sub-acquisition unit 510, the operation main body public key storage unit 511, and the title key transmission certificate verification unit 512 are not present in the reproduction information processing device 104a.

Further, the reproduction information processing device 104b may be a home appliance including a CPU, a built-in flash memory, a memory, a media read/write device, and an internet interface circuit, similarly to the playback information processing device 104a. In this case, the application subject public key storage means 511 is constituted by built-in flash memory, and the media identification sub-acquisition means 510 and the title key transmission certificate verification means 512 are programs which are operated by the CPU and the memory. Composition. However, of course, this is not the limit.

Hereinafter, description will be given focusing on the difference from the reproduction information processing device 104a of the content distribution system 10a.

3.3.1 Media Identification Sub-Acquisition Mechanism 510

The media identification sub-acquisition mechanism 510 acquires the media identifier 371 that can specifically identify the information recording media device 105b by the inter-media receiving mechanism 502. The obtained media identifier 371 is output to the title key transmission certificate verification unit 512.

3.3.2 Using the subject public key deposit institution 511

The use main body public key storage means 511 holds a public key 561 of a certification authority device (not shown) which the operation body of the content distribution system 10b has. The public key 561 is the same as the public key 361 held by the application body public key storage unit 308 of the content distribution system 10a.

The public key 561 is used when the title key transmission certificate verification unit 512 verifies the title key transmission certificate.

The public key 561 of the main body is embedded in the information processing device 104b for reproduction in advance, but is not limited thereto. For example, the public key 561 may be transmitted by the authentication authority device of the application body of the content transmission system 10b, the reproduction information processing device 104b receives the public key 561, and the entity public key storage unit 511 is used to memorize the received public key 561. .

3.3.3 Title Key Sending Certificate Verification Authority 512

The title key transmission certificate verification unit 512 receives the title key transmission certificate 1000 from the media-to-media receiving unit 502.

Next, as shown below, the title key transmission certificate verification unit 512 verifies the obtained title key transmission certificate 1000.

The title key transmission certificate verification unit 512 reads out the public key 561 of the operation body from the operation subject public key storage unit 511.

Next, the title key transmission certificate verification unit 512 extracts the public key certificate 921 of the transmission server device 102b from the title key transmission certificate 1000, and verifies using the public key 561 of the read operation subject. The public key certificate 921 that has been extracted.

When the verification of the public key certificate 921 fails, the title key transmission certificate verification unit 512 determines that the title key transmission certificate 1000 is illegal. At this time, the determination result 581 of the title key transmission certificate 1000 is illegal, and the reproduction possibility determination means 508 outputs and ends.

When the verification of the public key certificate 921 is successful, the title key transmission certificate verification unit 512 extracts the signature information 1001 from the title key transmission certificate 1000, and extracts the disclosure of the transmission server device 102b from the public key certificate 921. The key is obtained by the media receiving unit 502, and the media title identifier 371 is acquired by the media identifier obtaining unit 510, and the individual title key 381 and the common title key 241 are combined in this order. And the media identifier 371, the combination 571 is generated, and the generated combination 571 and the extracted signature information 1001 are signature-verified using the public key of the extracted transmission server device 102b.

When the verification fails, the title key transmission certificate verification unit 512 determines that the title key transmission certificate 1000 is illegal. When the verification is successful, it is determined that the title key transmission certificate 1000 is correct. The title key transmission certificate verification unit 512 outputs the determination result 581 that the title key transmission certificate 1000 is illegal or correct to the reproduction possibility determination unit 508.

3.3. Other components

The medium-to-media receiving unit 502 receives the media identifier 371 that can specifically identify the information recording medium device 105b by the information recording medium device 105b. Further, the information recording medium device 105b receives the title key transmission certificate 1000.

When the title key transmission certificate verification unit 512 receives the determination result 581 and the determination result 581 is displayed as the title key transmission certificate 1000 is illegal, the reproduction possibility determination unit 508 further instructs the reproduction unit 509 to execute the reproduction processing of the stop content.

3.4 Composition of information recording media device 105b

As shown in FIG. 34, the information recording medium device 105b includes an inter-machine transfer unit 601, an inter-machine receiving unit 602, a media identifier storage unit 603, an operation subject public key storage unit 604, a private key storage unit 605, and a public fund. The key certificate storage unit 606, the secret communication path establishing unit 607, the title key storage unit 608, the content storage unit 609, the control unit 610, and the title key transmission certificate storage unit 611 are configured.

The inter-machine transfer unit 601, the inter-machine receiving unit 602, the media identifier storage unit 603, the operation main body public key storage unit 604, the private key storage unit 605, the public key certificate storage unit 606, the secret communication path establishing unit 607, The title key storage unit 608, the content storage unit 609, and the control unit 610 have the same configuration as the components corresponding to the information recording medium device 105a of the content distribution system 10a. On the other hand, the title key transmission certificate storage means 611 does not exist in the information recording medium device 105a.

Further, the information recording medium device 105b may be a memory such as a CPU, a RAM, or a ROM, a flash memory, a recording information processing device 103a, or an information processing device for reproduction, similarly to the information recording medium device 105a. A memory card composed of a interface circuit for accessing data of 104b. In this case, the title key transmission certificate storage mechanism 611 is fast Flash memory. Of course, this is not the limit.

Here, the description will be centered on the difference from the information recording medium device 105a.

3.4.1 Title Key Sending Certificate Storage Organization 611

The title key transmission certificate storage unit 611 has an area for holding the title key transmission certificate 1000. The title key transmission certificate 1000 is received by the transmission server device 102b.

3.4.2 Inter-machine receiving mechanism 602

The inter-machine receiving unit 602 receives the title key transmission certificate 1000 from the transmission server device 102b at the time of content transmission, and writes the received title key transmission certificate 1000 to the title key transmission certificate storage unit 611. .

3.4.3 Machine-to-machine transfer mechanism 601

The inter-machine transfer mechanism 601 is controlled by the control unit 610, and when the content is reproduced, the title key transmission certificate storage unit 611 reads out the title key transmission certificate 1000, and transmits the read title key. The book 1000 is transferred to the reproduction information processing device 104b.

3.5 action of content delivery system 10b

Here, the content signature generation server device 101a generates the intermediate content data set 242, transmits the "content signature generation" to the transmission server device 102b, and the transmission server device 102b generates the transmission content data set 351 via The operation of the "content transmission" stored in the information recording medium device 105b by the recording information processing device 103a and the transmission information processing device 104b receive the transmission content data set 351 from the information recording medium device 105b. In the operation of the "content registration" of the reproduction, the operation of the "content signature generation" is the same as the operation of the content distribution system 10a. Therefore, the description will be omitted. Hereinafter, the respective operations of "content transmission" and "content reproduction" are performed. Description.

(1) Action of content transmission

Here, the operation of transmitting the content will be described using the sequence diagram shown in FIG.

The recording information processing device 103a transmits the transmission request information 321 to the transmission server device 102b, and the device-to-machine receiving mechanism 303 of the transmission server device 102b receives the transmission request information 321 (step S2001). The cipher communication path establishing unit 311 of the transmission server device 102b and the cipher communication path establishing unit 607 of the information recording medium device 105b establish the cipher communication path 22 (step S2002).

When the cipher communication path 22 is established, the inter-machine transmission unit 601 of the information recording medium device 105b transmits the media identification 371 to the transmission server device 102b via the recording information processing device 103a using the cipher communication path, and transmits the device of the server device 102b. The inter-receiving unit 303 receives the media identifier 371 (step S2003).

Next, the individual title key generation unit 305 of the transmission server device 102b generates an individual title key 381 (step S2004). The encryption unit 306 generates the encrypted content 900 for transmission (step S2005). The title key transmission certificate generation unit 312 generates a title key transmission certificate 1000 (step S2006).

Next, the inter-machine transfer mechanism 302 of the transmit server device 102b will The transmission content data set 351 and the title key transmission certificate 1000 are transmitted to the information recording medium device 105b via the recording information processing device 103a (step S2007), and the machine-to-machine receiving mechanism 602 of the information recording medium device 105b receives the transmission content data. The set 351 and the title key transmission certificate 1000 (step S2007), and the transmission content data set 351 and the title key transmission certificate 1000 are written in the content storage means 609 of the information recording medium device 105b (step S2008).

The inter-machine transfer unit 302 of the transmission server device 102b transmits the individual title key 381 and the common title key 241 to the information recording medium device 105b via the recording information processing device 103a using the secret communication path 22 (step S2009), information. The inter-machine receiving unit 602 of the recording medium device 105b receives the individual title key 381 and the common title key 241 using the secret communication path 22 (step S2009), and writes the individual title key 381 and the common title key 241 to the information recording medium. The title key storage unit 608 of the device 105b (step S2010).

(2) The action of content regeneration

Here, the operation of content reproduction will be described using a sequence diagram shown in FIG.

The inter-media transfer unit 501 of the reproduction information processing device 104b transmits a transfer instruction 551 to the information recording medium device 105b, and the inter-machine receiving unit 602 of the information recording medium device 105b receives the transfer instruction 551 (step S2101).

Next, the inter-machine transfer unit 601 of the information recording medium device 105b transmits the individual title key 381 to the reproduction information processing device 104b, and shares the common The title key 241, the transmission content data set 351, the title key transmission certificate 1000, and the media identifier 371, and the media-to-media receiving unit 502 of the reproduction information processing device 104b receives the individual title key 381, the common title key 241, The transmission content data set 351, the title key transmission certificate 1000, and the media identifier 371 (step S2102).

Next, the media identifier acquisition unit 510 of the reproduction information processing device 104b acquires the media identifier 371 (step S2103). The title key transmission certificate verification unit 512 of the reproduction information processing device 104b verifies the title key transmission certificate 1000 (step S2104). If it is determined that the title key transmission certificate is illegal (in step S2104, "the certificate is illegal"), the reproduction unit 509 stops the content reproduction processing. When it is determined that the title key transmission certificate is correct ("the certificate is correct" in step S2104), the replacement combination generating means 506 of the reproduction information processing device 104b generates the replacement combination (step S2105). The signature verification unit 507 of the reproduction information processing device 104b performs signature verification using the generated replacement combination and the signature information, and the reproduction possibility determination unit 508 determines whether or not the reproduction is possible in response to the signature verification result (step S2106). If the result of the signature verification is unsuccessful (in the case of "verification failure" in step S2106), the reproduction means 509 stops the reproduction processing of the content. When the verification is successful ("verification succeeded" in step S2106), the title key acquisition means 503 of the reproduction information processing apparatus 104b acquires the title key, and the decryption means 504 encrypts the transmission using the acquired title key. The content is decrypted (step S2107). The reproduction unit 509 of the reproduction information processing device 104b reproduces the decrypted content that has been generated (step S2108).

3.6 effect of content delivery system 10b

Similarly to the content distribution system 10a, the content transmission system 10b uses both the individual title key 381 and the common title key 241, and when the common title key 241 is used, the unit that is encrypted using the common title key 241 is used. When the cell hash value is generated and the individual title key 381 is used, the cell is generated by hashing the value to the plaintext unit, thereby preventing the attacker from attacking and having the effect of pre-generating the signature information of the content.

Further, in the content distribution system 10b, the title key transmission certificate is stored in the information recording medium device. By verifying the title key transmission certificate by the reproduction information processing apparatus, it is possible to verify that the media identifier of the information recording medium device storing the title key is correct. Thereby, it can be reproduced only when it is stored in the information recording medium device whose content is correct. Therefore, in the event that the attacker can directly write the title key or the content data set for transmission to another information recording medium device, the title information transmission certificate can be verified by the information processing device for reproduction, and the recording can be stopped. The content of the illegal information recording media device is reproduced.

4. Embodiment 4

Here, a modification of the content distribution system 10a and the content transmission system 10b will be described as a content transmission system 10c according to the fourth embodiment of the present invention with reference to the drawings.

4.1 The whole composition of the content transmission system 10c

The content transmission system 10c is composed of a content signature generation server device 101c, a transmission server device 102c, a recording information processing device 103a, an information recording medium device 105b, and a reproduction information processing device as shown in Fig. 37. 104c constitutes. Here, the content signature generation server device 101c and the transmission server device 102c constitute a content transmission subsystem 30c (not shown).

The recording information processing device 103a has the same configuration as the recording information processing device 103a of the content transmission system 10a, and the information recording medium device 105b has the same configuration as the information recording medium device 105b of the content transmission system 10b.

Further, the content signature generation server device 101c has a configuration similar to that of the content signature generation server device 101a of the content distribution system 10a, and the transmission server device 102c has a configuration similar to that of the transmission server device 102b of the content transmission system 10b. The reproduction information processing device 104c has a configuration similar to that of the reproduction information processing device 104b of the content transmission system 10b.

Here, each device will be described focusing on the difference point.

4.2 Content signature generation server device 101c

As shown in FIG. 38, the content signature generation server device 101c includes a content storage unit 201, a storage unit 202, an inter-machine transfer unit 203, a unit generation unit 204c, a common title key generation unit 205, and an encryption unit 206c. The header information generating unit 207c, the signature key storing unit 208, the signature generating unit 209c, the digital watermark embedding unit 210, and the control unit 211 are configured.

Here, the content storage unit 201, the storage unit 202, the inter-machine transfer unit 203, the common title key generation unit 205, the signature key storage unit 208, and the control unit 211 respectively have contents associated with the content signature generation server device 101a. The storage mechanism 201, the storage mechanism 202, the inter-machine transfer mechanism 203, the common title key generation unit 205, and the signature key storage mechanism 208 The same configuration as the control unit 211.

Further, the unit generation unit 204c, the encryption unit 206c, the header information generation unit 207c, and the signature generation unit 209c respectively have a unit generation unit 204a, an encryption unit 206a, and a header information generation with the content signature generation server device 101a. The mechanism 207a and the signature generating unit 209a are similarly constructed.

Further, the digital watermark embedding mechanism 210 does not exist as a constituent element in the content signature creation server device 101a.

Here, each component is described with respect to each component as a center.

Here, the content signature generation server device 101c may be a PC composed of a CPU, a memory, a secondary memory device, an internet interface circuit, or the like, similarly to the content signature generation server device 101a. In this case, the digital watermark embedding mechanism 210 is composed of a CPU and a program that operates thereon. Of course, this embodiment is not limited to these.

The content signature generation server device 101c transmits the intermediate content data set 242c to the transmission server device 102c as explained below. The intermediate content data set 242c is different from the intermediate content data set 242 of the content distribution system 10a, and includes unit selection information 780, encrypted WM content 1201, WM header information 1251, and signature information 1300, as will be described later. .

4.2.1 unit generation mechanism 204c

The unit generation unit 204c generates the divided content 721 and the unit selection information 780 in the same manner as the unit generation unit 204 of the content signature generation server device 101a.

The unit generating unit 204c floats the generated divided content 721 to the digital position The watermark embedding mechanism 210 outputs. Further, the unit generation unit 204c outputs the generated unit selection information 780 to the signature generation unit 209c, and writes the generated unit selection information 780 as a part of the intermediate content data set 242c to the storage unit 202.

4.2.2 Digital Watermark Embedding Mechanism 210

The digital watermark embedding unit 210 receives the divided content 721 by the unit generating unit 204c, and uses the received divided content 721 to generate the WM divided content 1100 displayed as an example in FIG. The following is a description of the generation flow of the WM split content 1100.

One of the digital watermark embedding mechanisms 210 extracts the divided file 751 "splCNT1", the divided file "splCNT2", the ‧ ‧ and the divided file "splCNTc" from the divided content 721 shown in FIG. 5, and is extracted by the extracted File 751 "splCNT1", split file "splCNT2", ‧‧‧, split file "splCNTc", respectively, are generated with WM split file 1131 "WsplCNT1", WM split file "WsplCNT2", ‧‧‧, with WM Split the file "WsplCNTc". The generation flow of each WM split file is described later.

The digital watermark embedding unit 210 further extracts the file identifier 741 "FID1", the file identifier "FID2", the ‧ ‧ and the file identifier "FIDc" from the divided file information in the divided content 721. Next, the WM split file information 1111 "WsplFI1" including the extracted file identifier 741 "FID1" (shown as file identifier 1121 in Fig. 39) and the generated WM split file 1131 "WsplCNT1" is generated. Similarly, the file identifier "FID2", ‧‧‧, file identifier "FIDc" Each of the generations includes a file identifier and a WM split file information with a WM split file attached.

In this manner, the digital watermark embedding mechanism 210 generates c attached file information 1111, 1112, 1113, 1114, ‧ ‧ , 1115, and generates the c-generated ones as shown in FIG. 39 The WM split file information 1111, 1112, 1113, 1114, ‧ ‧ , 1115 is accompanied by WM split content 1100. Next, the digital watermark embedding unit 210 outputs the generated WM divided content 1100 to the encryption unit 206c.

As shown in the example in Figure 39, the WM split file information 1111 "WsplFI1" includes the file identifier 1121 "FID1" and the WM split file 1131 "WsplCNT1", and the WM split file information 1112 "WsplFI2" contains the file. The identifier "FID2" and the WM split file "WsplCNT2" are attached, and the WM split file information 1113 "WsplFI3" includes the file identifier "FID3" and the WM split file "WsplCNT3" with WM split file information 1114 "WsplFI4" Includes file identifier "FID4" and WM split file "WsplCNT4" with WM split file information 1115 "WsplFIc" including file identifier "FIDc" and WM split file "WsplCNTc".

(with the generation of WM split files)

Next, the generation process of the WM split file with the digital watermark embedding mechanism 210 is shown below. In addition, since the WM split file 1131 "WsplCNT1", the WM split file "WsplCNT2", ‧‧‧, and the WM split file "WsplCNTc" are generated, the flow is the same. Therefore, the following is a description of the generation flow of the WM split file 1131 "WsplCNT1".

Fig. 40 is a view showing an outline of a flow of generation of the WM split file 1131 "WsplCNT1" by the digital watermark embedding unit 210.

The digital watermark embedding mechanism 210 extracts unit information 761, 762, 763, 764, ‧‧‧, 765 from the divided file 751, and generates each of the extracted unit information 761, 762, 763, 764, ‧ ‧, 765 WM unit information 1141, 1142, 1143, 1144, ‧ ‧ and 1145 are attached. Next, a WM split file 1131 including the WM unit information 1141, 1142, 1143, 1144, ‧‧, 1145 is generated.

(with the generation of WM unit information)

Next, a flow of generating information accompanying the WM unit from each unit information will be described.

The digital watermark embedding mechanism 210 extracts a unit information from the divided file 751, and extracts the title key flag information from the extracted unit information. Next, it is determined which of the extracted title key flag information is "0" and "1".

When it is determined that the title key flag information is "1", the digital watermark embedding mechanism 210 is configured by the unit information extracting unit, and embeds a digital watermark WM in the extracted unit to generate a WM embedded with the digital watermark WM. unit. Furthermore, the method of embedding the digital watermark WM is well known, and thus the description is omitted. The digital watermark WM embedded in the above may be any one as long as it is detectable. Secondly, the unit information extracting unit recognizes the child, and generates the extracted unit identifier, and the extracted title key flag. The information, the extracted unit and the generated WM unit with attached WM unit information.

If it is determined that the title key flag information is "0", the digital watermark embedding mechanism 210 generates the extracted unit identifier, the extracted title key flag information, and the extracted information by the unit information extracting unit and the unit identifier. The unit is accompanied by WM unit information.

The generation of the WM unit information by the digital watermark embedding mechanism 210 will be specifically described using the example shown in FIG.

As shown in FIG. 40, the title key flag information 772 included in the unit information 761 is "1", so the digital watermark embedding mechanism 210 embeds the digital watermark WM into the unit 773 included in the unit information 761, and generates the attached unit 761. The WM unit 1151 generates the unit identifier 771 included in the unit information 761, the title key flag information 772, the unit 773, and the generated WM unit information 1141 attached to the WM unit 1151.

Moreover, the title key flag information 782 included in the unit information 762 is "0", so the digital watermark embedding mechanism 210 generates the unit identifier 781, the title key flag information 782, and the unit 774 included in the unit information 762. WM unit information 1142 is attached.

4.2.3 Encryption Mechanism 206c

The encryption unit 206 receives the common title key 241 "CTK" from the common title key generation unit 205. Further, the encryption unit 206c receives the WM divided content 1100 by the digital watermark embedding unit 210.

When the encryption unit 206c receives the WM divided content 1100 by the digital watermark embedding mechanism 210, it is extracted by the WM-divided content 1100. There are WM split files 1131, 1132, 1133, ‧ ‧ and 1135, and each of the extracted WM split files 1131, 1132, 1133, ‧ ‧ and 1135 is used, and the encryption is generated as shown below There are WM split files 1161, 1162, 1163, ‧ ‧ and 1164

(Encryption with WM split file generation)

The encryption of the encryption unit 206c is accompanied by a summary of the generation of the WM split file, which will be described using FIG. Here, the flow of generating the encrypted WM-divided file 1161 by using the WM-divided file 1131 will be described as a representative. Since the generation process of the encrypted WM divided files 1162, 1163, ‧‧, and 1164 is the same, the description is omitted.

The encryption unit 206c extracts the WM unit information 1141, 1142, 1143, 1144, ‧‧‧, 1145 from the attached WM split file 1131, and uses the extracted WM unit information 1141, 1142, 1143, 1144, ‧ Each of ‧ and 1145, as shown below, generates encryption with WM unit information 1171, 1172, 1173, 1174, ‧‧‧, 1175 Next, an encrypted WM-separated file 1161 containing the generated encryption-encoded WM unit information 1171, 1172, 1173, 1174, ‧‧, 1175 is generated.

(Encryption is accompanied by the generation of WM unit information)

The encryption unit 206c extracts the title key flag information from the WM unit information, and determines that the extracted title key flag information is "0" or "1".

When it is determined that the extracted title key flag information is "0", this means that the encryption of the individual title key 381 is used, so that encryption is not performed here, and the encryption mechanism 206c is extracted by the WM unit information. Unit identification sub-unit and unit, the extracted unit is directly used as an encryption unit to generate a package The encryption of the unit identifier, the title key flag information, and the encryption unit is accompanied by WM unit information. Therefore, at this time, the WM unit information is attached to the WM unit information generated by the WM unit information and has the same content.

When it is determined that the extracted title key flag information is "1", at this time, since the encryption of the common title key 241 is used, the encryption means 206c is provided with the WM unit information extraction unit identifier, unit and attached. There are WM units. Next, using the common title key 241 "CTK", the encrypted algorithm Enc is performed on the extracted unit, and an encryption unit is generated, and the extracted WM unit is encrypted using the common title key 241 "CTK". Enc, generated encryption with WM unit.

Here, EU1_1=Enc(CTK, U1_1), EWU_1=Enc(CTK, WU1_1).

Furthermore, when the encryption algorithm Enc uses the public key cipher, the common title public key "CTPK" is used instead of the common title key 241 "CTK" at the time of encryption.

Next, the encryption unit 206c generates the encryption-attached WM unit information including the unit identifier, the title key flag information, the encryption unit, and the encryption-attached WM unit.

As shown in Fig. 41, the WM split file 1161 "EWsplCNT1" which is encrypted by the above-described flow with the WM split file 1131 "WsplCNT1" includes m encryptions with WM unit information 1171 "EWUI1_1", Encrypted with WM unit information 1172 "EWUI1_2", encrypted with WM unit information 1173 "EWUI1_3", ‧‧‧ Encrypted with WM unit information 1175 "EWUI1_m".

Each of the encryption-encoded WM unit information "EWUI1_i" (i is an integer of 1 to m) is generated based on the WM unit information "WUI1_i" attached to each of the WM-division files 1131 "splCNT1". When the title key flag information "TKFI1_i" is "0", the encryption-attached WM unit information "EWUI1_i" includes the unit identifier "UID1_i", the title key flag information "TKFI1_i", and the encryption unit "EU1_i". When the title key flag information "TKFI1_i" is "1", the encryption-attached WM unit information "EWUI1_i" includes the unit identifier "UID1_i", the title key flag information "TKFI1_i", the encryption unit "EU1_i", and Encryption is accompanied by the WM unit "EWU1_i".

(Encryption is accompanied by the generation of WM content 1201)

The encryption unit 206c is provided with each of the WM divided files 1161, 1162, 1163, ‧‧‧, 1164, which are encrypted, and are generated as shown below, with the WM files 1211, 1212, 1213, ‧ ‧ And 1214, and as shown in FIG. 42, generating the encrypted WM content 1201 including the generated encrypted WM files 1211, 1212, 1213, ‧‧, 1214. Next, the encryption mechanism 206c writes the generated encrypted WM content 1201 as part of the intermediate content data set 242c to the storage mechanism 202.

Encrypted with WM content 1201, as shown in Fig. 42, includes c encryption with WM file 1211 "EWCNT1", encryption with WM file 1212 "EWCNT2", and encryption with WM file 1213 "EWCNT3" ‧ ‧ ‧ Encrypted with WM file 1214 "EWCNTc"

(Encryption with the generation of WM files)

The encryption unit 206c is provided with the WM unit information "EWUI1_i" (i is an integer from 1 to m) constituting each of the encrypted encryption-attached WM-divided files 1161 "EWsplCNT1", if the title key flag information " When TKFI1_i" is "0", the encryption unit "EU1_i" is extracted, and if the title key flag information "TKFI1_i" is "1", the encryption unit "EU1_i" is extracted and the WM unit "EWU1_i" is encrypted. . In this way, an encrypted encrypted unit including the extracted WM unit and an encrypted encrypted WM file 1211 "EWCNT1" are generated.

Here, the encrypted WM file 1211 "EWCNT1" is shown in FIG. 41, and includes an encryption unit 1181, an encryption-attached WM unit 1182, an encryption unit 1183, an encryption unit 1184, and an encryption with WM. Unit 1185, encryption unit 1186, ‧‧‧, encryption unit 1187, and encryption are attached with WM unit 1188.

Similarly, the encryption mechanism 206c generates encryption with WM files 1212, 1213, ‧‧‧, 1214.

Here, each encryption is accompanied by a WM file "EWCNTj" (j is an integer from 1 to c) including a plurality of encryption units, and further includes a plurality of encryptions attached to the WM unit.

(Encryption is accompanied by generation of WM split content 1231)

The encryption unit 206c extracts the file identifier 1121 "FID1", the file identifier 1122 "FID2", the file identifier 1123 "FID3", ‧‧‧, the file identifier 1125 "FIDc", and the extracted file is extracted from the WM divided content 1100. File identifiers 1121, 1122, 1123, ‧‧‧, 1125 Each of the generated and encrypted encryptions is accompanied by WM split files 1161, 1162, 1163, ‧‧‧, 1164, as shown in Fig. 43, the file identifier 1121 and the encrypted WM split file 1161 are grouped The generated encryption is accompanied by WM split file information 1156. Similarly, for each of the file identifiers 1122, 1123, ‧ ‧ and 1125, the file identifier and the encrypted WM split file are grouped to generate an encrypted WM split file information.

In this manner, the encryption unit 206c generates the encrypted WM split file information 1256, 1257, 1258, ‧‧‧, 1259, and as shown in FIG. 43, generates the encrypted data with the generated WM split file information 1256, The encryption of 1257, 1258, ‧‧, and 1259 is accompanied by WM division content 1231, and the generated encryption-encoded WM division content 1231 is output to the header information generation unit 207c.

As shown in Fig. 43, the encrypted WM-divided content 1231 includes c-encrypted WM-divided file information 1256, 1257, 1258, ‧‧‧, 1259. Further, the encrypted WM split file information 1256 includes the file identifier 1121 "FID1" and the encrypted WM split file 1161 "EWsplCNT1", and the encrypted WM split file information 1257 includes the file identifier 1122 "FID2" and encryption. WM split file 1162 "EWsplCNT2" is attached, and WM split file information 1258 is encrypted. The file identifier 1123 "FID3" and the encrypted WM split file 1163 "EWsplCNT3" are attached, and the encrypted WM split file information 1259 includes the file. The identifier 1125 "FIDc" and the encryption are attached with the WM split file 1164 "EWsplCNTc".

4.2.4 Header Information Generation Mechanism 207c

The header information generating unit 207c is encrypted by the encryption unit 206c and is provided with WM divided content 1231. When the WM divided content 1231 is attached to the encryption, the WM header information 1251 is generated by using the accepted encryption with the WM divided content 1231 as described below.

Encryption with WM split content 1231 is as shown in Fig. 43, with c-encrypted WM split file information 1256 "EWsplFI1", encrypted WM split file information 1257 "EWsplFI2", and encryption with WM Split file information 1258 "EWsplFI3", ‧‧‧, encrypted with WM split file information 1259 "EWsplFIc". Each encryption is accompanied by WM split file information "EWsplFIj" (j is an integer from 1 to c) including the file identifier "FIDj" and the encrypted WM split file "EWsplCNTj".

As shown in FIG. 43, the header information generating unit 207c extracts and encrypts the WM divided file information 1256, 1257, 1258, ‧‧‧, 1259 by encryption in the WM divided content 1231. Split files 1161, 1162, 1163, ‧‧‧, 1164 Next, the extracted encryption is accompanied by each of the WM split files 1161, 1162, 1163, ‧‧‧, 1164, and the WM first hash table 1271 "WHA1TBL1" is attached, and the WM first hash table 1272 "WHA1TBL2" is attached. The WM first hash table 1273 "WHA1TBL3", ‧‧‧, and the WM first hash table 1274 "WHA1TBLc" are attached. Further, a WM second hash table 1261 "WHA2TBL" is generated from the c generated first W1 first hash tables 1271, 1272, 1273, ‧‧‧, 1274. Attached to the WM first hash table 1271, 1272, 1273, ‧‧‧, 1274, the details of the generation and WM Details of the generation of the second hash table 1261 will be described later.

Next, the header information generating unit 207c generates the attached WM header information 1251 including c first hash tables 1271, 1272, 1273, ‧‧1, 1274, and WM second hash table 1261 attached thereto.

Next, the header information generating unit 207c writes the generated WM header information 1251 as a part of the intermediate content data set 242c to the storage unit 202. Further, the generated WM second hash table 1261 "WHA2TBL" is output to the signature generating unit 209c.

(1) The generation of WM first hash tables 1271, 1272, 1273, ‧‧‧, 1274

Here, the generation of the WM first hash table 1271 is attached in detail. Furthermore, since the generation of the WM first hash tables 1272, 1273, ‧‧, and 1274 is the same as the generation of the WM first hash table 1271, the description thereof is omitted.

Fig. 44 is a view showing an outline of a flow of generation of the WM first hash table 1271 "WHA1TBL1" by the header information generating means 207c.

The header information generating unit 207c extracts and encrypts the WM unit information 1171, 1172, 1173, 1174, ‧‧, 1175 by encrypting the WM divided file 1161. Next, as shown in FIG. 44, the extracted encryption is accompanied by each of the WM unit information 1171, 1172, 1173, 1174, ‧‧‧, 1175, and the WM unit hash information 1281, 1282, 1283 is generated. 1284, ‧‧‧, 1285 Further, a WM first hash table 1271 "WHAT1TBL1" including the generated WM unit hash information 1281, 1282, 1283, 1284, ‧‧1, 1285 is generated.

(with the generation of WM unit hash information)

Next, a method of generating WM unit hash information by adding WM unit information to each encryption will be described.

The header information generating unit 207c is provided with a WM unit information extracting unit identifier, a title key flag information, and an encryption unit by encryption. Here, when the title key flag information is "1", the WM unit is further extracted and encrypted by the encryption with the WM unit information.

Next, the header information generating unit 207c substitutes the extracted encryption unit into the hash function to generate a unit hash value. When the title key flag information is "1", further, the extracted encryption is accompanied by the WM unit substituted into the hash function to generate a WM unit hash value.

Further, the hash function uses the CBC-MAC using SHA-1, SHA-2, SHA-3, or a block secret number, similarly to the content transmitting systems 10a and 10b.

Here, when the title key flag information is "0", the encryption unit extracted by encrypting the WM unit information is as described above, and is an unencrypted plaintext state.

Next, the header information generating unit 207c generates WM unit hash information including the extracted unit identifier, the title key flag information, and the generated unit hash value. When the title key flag information is "1", the WM unit including the extracted unit identifier, the title key flag information, the generated unit hash value, and the generated hash value with the WM unit hash value is generated. Hash information. [With the end of the generation of WM unit hash information]

An example of WM first hash table 1271 is attached as shown in Figure 44. Contains WM unit hash information 1281, 1282, 1283, 1284, ‧‧‧, 1285.

The attached WM unit hash information 1281 includes a unit identifier 771, a title key flag information 772, a unit hash value 1291, and a WM unit hash value 1292. Here, the cell hash value 1291 and the WM cell hash value 1292 are respectively generated by hashing the encryption unit 1181 included in the WM unit information 1171 and the encryption-attached WM unit 1182. Further, the WM unit hash information 1282 includes a unit identifier 781, a title key flag information 782, and a unit hash value 1293. Here, the cell hash value 1293 is generated by hashing the encryption unit 1183 included in the WM unit information 1172 with encryption.

(2) With the generation of WM second hash table 1261

Here, the generation of the WM second hash table 1261 is attached in detail.

The header information generating unit 207c is provided with the WM first hash tables 1271, 1272, 1273, ‧ ‧ and 1274, which are generated in the following, and are generated in the 45th figure as an example. Second hash table 1261.

The header information generating unit 207c combines all of the WM unit hash information included in the WM first hash table 1271 to generate a combined body. In this case, the WM unit hash information is attached. When the title key flag information included in the WM unit hash information is "1", as described above, the WM unit hash value is included. Next, the header information generating unit 207c substitutes the generated combination into the hash function to generate a WM file hash value 1296 "WFHA1".

Next, the header information generating unit 207c is segmented by encryption with WM. The content 1231 acquires the file identifier 1121 "FID1" corresponding to the WM first hash table 1271.

Next, the WM file hash information 1266 "WFHI1" including the acquired file identifier 1121 "FID1" and the generated WM file hash value 1296 "WFHA1" is generated.

The header information generating unit 207c is attached with each of the WM first hash tables 1272, 1273, ‧‧‧, and 1274, and generates a WM file hash value 1297 "WFHA2" and a WM file hash as described above. The value 1298 "WFHA3", ‧‧‧, with the WM file hash value of 1299 "WFHAc", obtained the file identifiers 1122, 1123, ‧ ‧ and 1125 Secondly, each of the WM first hash tables 1272, 1273, ‧‧‧, 1274 is attached, and the WM file hash information 1267, 1268, ‧‧, including the file identifier and the hash value of the WM file is generated. 1269.

Next, the header information generating unit 207c generates a WM second hash table 1261 including the WM file hash information 1266, 1267, 1268, ‧‧, and 1269.

Here, the WM second hash table 1261 "WHA2TBL" is shown in the example of FIG. 45, and includes c files with WM file hash information 1266 "WFHI1" and WM file hash information 1267 "WFHI2". WM file hash information 1268 "WFHI3", ‧‧‧, WM file hash information 1269 "WFHIc", and WM file hash information "WFHIj" (j is an integer from 1 to c) Contains the file identifier "FIDj" and the WM file hash value "WFHAj".

4.2.5 Signature Generation Mechanism 209c

The signature generation unit 209c receives the WM second hash table 1261 "WHA2TBL" from the header information generation unit 207c, and the unit generation unit 204c receives the unit selection information 780.

When the WM second hash table 1261 and the unit selection information 780 are attached, the signature generation unit 209c reads the private key 251 "KSG" by the signature key storage unit 208.

Next, the signature generation unit 209c combines the WM second hash table 1261 and the unit selection information 780 in this order to generate a combination 261c, and uses the read private key 251 to sign the generated combination 261c. The chapter generates an algorithm S to generate signature information 1300.

Here, the signature generation algorithm S is an algorithm of the same signature method as the content transmission system 10a.

Next, the signature generation unit 209c writes the generated signature information 1300 as part of the intermediate content data set 242c to the storage unit 202.

4.3 The composition of the transmission server device 102c

As shown in Fig. 47, the transmission server device 102c includes a storage unit 301, an inter-machine transfer unit 302, an inter-machine receiving unit 303, a media identifier acquisition unit 304c, an individual title key generation unit 305, an encryption unit 306c, and a title. The key database storage unit 307, the use main body public key storage unit 308, the private key storage unit 309, the public key certificate storage unit 310, the secret communication path establishing unit 311, and the control unit 313 are configured.

Storage mechanism 301, inter-machine transfer mechanism 302, inter-machine receiving mechanism 303, individual title key generation mechanism 305, title key database storage device The main body public key storage unit 308, the private key storage unit 309, the public key certificate storage unit 310, the secret communication path establishing unit 311, and the control unit 313 respectively have a configuration corresponding to the transmission server device 102a. The same composition of elements.

Further, the media identification sub-acquisition means 304c and the encryption means 306c each have a configuration similar to that of the transmission server device 102a.

Here, the description will be centered on the difference point.

Further, the transmission server device 102c may be a PC composed of a CPU, a memory, a secondary memory device, an internet interface circuit, or the like, similarly to the transmission server device 102a. In this case, the encryption unit 306c is composed of a CPU and a program that operates thereon. Of course, this embodiment is not limited to this.

Further, the transmission server device 102c transmits the transmission content data set 351c to the information recording medium device 105b via the recording information processing device 103a. The transmission content data set 351c is different from the transmission content data set 351 of the content transmission systems 10a and 10b, and includes unit selection information 780, WM header information 1251, signature information 1300, and transmission encryption, as will be described later. WM content 1361 is attached.

4.3.1 Media Identification Sub-Acquisition Mechanism 304c

The media identification sub-acquisition unit 304c acquires the media identifier 371 of the special identification information recording medium device 105b from the inter-machine receiving unit 303, and outputs the acquired media identifier 371 to the encryption unit 306c, and the obtained media identifier 371 to the title gold. Key database storage mechanism 307 write In.

4.3.2 Encryption Mechanism 306c

The encryption unit 306c receives the individual title key 381 "ITK" by the individual title key generation unit 305. Further, the encryption unit 306c reads out the encrypted WM content 1201 and the WM header information 1251 from the intermediate content data set 242c stored in the storage unit 301.

When the WM header information 1251 is read, the encryption mechanism 306c extracts the WM first hash table 1271 "WHA1TBL1", 1272 "WHA1TBL2", and 1273 "WHA1TBL3" from the read WM header information 1251. , ‧‧‧, 1274 "WHA1TBLc".

Further, when the read-encrypted WM content 1201 is attached, the encryption means 306c attaches the WM content by the read encryption, and extracts the encrypted WM file 1211 "EWCNT1", 1212 "EWCNT2", 1213 "EWCNT3". , ‧‧‧, 1214 "EWCNTc".

Next, the encryption unit 306c encrypts the encrypted unit included in the encrypted WM file corresponding to each of the extracted WM first hash tables, using the individual title key 381 "ITK". Here, the processing corresponding to the encryption of the WM first hash table 1271 "WHA1TBL1" with the WM file 1211 "EWCNT1" is representative, and will be described below. Furthermore, since the WM file is attached to the other encryption, the description is omitted.

The encryption unit 306c is provided with the WM unit hash information 1281 "WUHI1_1", 1282 "WUHI1_2", 1283 "WUHI1_3", ‧‧‧, 1285 "WUHI1_m" included in the WM first hash table 1271. The title key flag information "TKFI1_1", "TKFI1_2", "TKFI1_3", ‧‧‧, "TKFI1_m" are extracted, and the extracted title key flag information "TKFI1_1", "TKFI1_2", "TKFI1_3", ‧‧‧ The value of "TKFI1_m" is "0" or "1". Next, the title key flag information is extracted to "0" in the title key flag information.

For example, as shown in Fig. 48, the title key flag information 1311 "TKFI1_2" and 1312 "TKFI1_4" are "0", and other title key flag information "TKFI1_1", "TKFI1_3", "TKFI1_5", ‧ ‧ "TKFI1_m" is "1".

At this time, the extracted title key flag information is "TKFI1_2" and "TKFI1_4". The encryption unit 306c encrypts the encryption units 1183 "EU1_2" and 1186 "EU1_4" corresponding to the title key flag information using the individual title key 381 "ITK", and generates encryption for transmission. WM unit 1342 "DWU1_2" and 1344 "DWU1_4" are attached.

The WM unit hash information "WUHI1_1", "WUHI1_3", "WUHI1_5", ‧‧‧, "WUHI1_m" are included in the header key flag information "1", and the encryption mechanism 306c is adapted to the media identifier 371. The encryption unit and the encryption are attached to any of the WM units, and the selected one directly attaches the WM unit as the transmission encryption.

Here, the method of selection may be any method in which the WM unit specific media identifier 371 is attached to the selected transmission encryption.

For example, the encryption unit 306c has the WM unit hash information "WUHI1_1" attached thereto, and if the first bit of the media identifier 371 is "0", Then, the encryption unit "EU1_1" is selected, and if the lower first bit is "1", the encryption unit is selected to have the WM unit "EWU1_1". In this way, the selected person is attached with the WM unit "DWU1_1" as the transmission encryption.

Similarly, the encryption unit 306c selects either one of the encryption unit "EU1_3" and the encryption-attached WM unit "EWU1_3" in response to the value of the second bit below the media identifier 371. The third bit below the media identifier 371 is also the same.

In this way, the encryption unit 306c associates the hash information with the WM unit including the title key flag information "1", and sequentially corresponds to the lower bits of the media identifier, and selects the encryption unit and encrypts the WM unit. Either.

With such a selection, even if the plaintext unit obtained by decrypting the WM unit after encryption is exposed on the Internet or the like, the digital watermark embedded in the exposed unit can be extracted and extracted to determine whether the unit is The cryptographic unit and the encryption are attached to any of the WM units, and as a result, the specific one bit of the media identifier 371 is determined. The other units also determine the bits of the media identifier 371 by performing the same analysis. In this way, the information recording media device can be specified as the source of the illegally exposed content.

As shown in FIG. 49, the encryption unit 306c generates the transmission-encrypted WM unit 1341 "DWU1_1", 1342 "DWU1_2", 1343 "DWU1_3", 1344 "DWU1_4", ‧‧‧, 1345 The transmission of "DWU1_m" is encrypted with the WM file 1371 "DWCNT1".

As shown in Figure 49, the transmission encryption is accompanied by a WIM file 1371 package. The WM units 1341, 1342, 1343, 1344, ‧‧‧, 1345 are attached with encryption for transmission.

Here, the transmission encryption-attached WM unit 1341 is selected by the encryption unit 1181 and the encryption-attached WM unit 1182 in response to the value of the first bit of the media identifier 371. Further, the transmission encryption-attached WM unit 1343 is selected by the encryption unit 1184 and the encryption-attached WM unit 1185 in response to the value of the second bit of the media identifier 371. Further, the transmission encryption-attached WM unit 1345 is selected by the encryption unit 1187 and the encryption-attached WM unit 1188 in response to the value of the n-th bit of the media identifier 371. Here, n is the number of encryption units generated by encrypting the WM file and using the common title key.

Further, the transmission encryption unit W1 unit 1342 encrypts the encryption unit 1183 using the individual title key 381. Further, the transmission encryption unit W4 unit 1344 encrypts and encrypts the encryption unit 1186 using the individual title key 381.

The encryption unit 306c performs the same processing as described above with the WM first hash table "WHA1TBLj" and the encrypted WM file "EWCNTj" (j is an integer from 2 to c), and generates a transmission encryption. WM file "DWCNTj".

Next, the encryption unit 306c generates a transmission encryption including the WM file 1371 "DWCNT1", 1372 "DWCNT2", 1373 "DWCNT3", ‧‧‧, 1374 "DWCNTc", which is encrypted by the transmission for transmission. WM content 1361, and the generated transmission encryption with WM content 1361 as part of the content data set 351c for writing, write The storage mechanism 301 is entered.

At this time, the encryption unit 306c reads the unit selection information 780, the WM header information 1251, and the signature information 1300 from the intermediate content data set 242c, and selects the read unit to select the information 780, and attaches the WM header information 1251. The signature information 1300 is written to the storage unit 301 as part of the content data set 351c for transmission.

4.4 Composition of the information processing device 104c for reproduction

As shown in FIG. 51, the reproduction information processing device 104c includes an inter-media transfer unit 501, an inter-media receiving unit 502, a title key obtaining unit 503, a decryption unit 504, a signature verification key storage unit 505, and a replacement combination. The volume generation unit 506c, the signature verification unit 507c, the reproduction availability determination unit 508, the reproduction unit 509, the media identification sub-acquisition unit 510c, the operation main body public key storage unit 511, the title key transmission certificate verification unit 512, and the control unit 513 Composition.

The inter-media transfer unit 501, the media-to-media reception unit 502, the title key acquisition unit 503, the decryption unit 504, the signature verification key storage unit 505, the reproduction availability determination unit 508, the reproduction unit 509, and the control unit 513 respectively have regeneration In the same configuration as the components corresponding to the information processing device 104a, the application main body public key storage unit 511 and the title key transmission certificate verification unit 512 have the same configuration as the components corresponding to the reproduction information processing device 104b.

Further, the replacement combined body generating means 506c, the signature verifying means 507c, and the medium identifying section obtaining means 510c each have a configuration in which the components corresponding to the reproducing information processing means 104b are similar.

Here, the description will be centered on the different points.

Similarly to the playback information processing device 104b, the reproduction information processing device 104c may be a home electric appliance including a CPU, a built-in flash memory, a memory, a media read/write device, and an internet interface circuit. In this case, the replacement combination generating means 506c and the media identification sub-acquisition means 510c may be configured by a CPU and a program operating on the memory. Of course, this embodiment is not limited to this.

4.4.1 Media Identification Sub-Acquisition Mechanism 510c

The media identification sub-acquisition unit 510c acquires the media identifier 371 of the information recording medium device 105b by the media-to-media receiving unit 502. The media identification sub-acquisition unit 510c outputs the acquired media identifier 371 to the title key transmission certificate verification unit 512 and the replacement combination generation unit 506c.

4.4.2 Replacement Combination Generation Mechanism 506c

The replacement combination generation unit 506c receives the individual title key 381, the unit selection information 780, the transmission encryption-attached WM content 1361, the WM header information 1251, and the signature information 1300 by the reproduction possibility determination unit 508.

Next, the replacement combination generating means 506c is as follows. One of the examples is to generate a replacement with the WM first hash tables 1381 and 1382, and to generate a replacement with the WM second hash table 1391. Next, the replacement combining unit 506c outputs the unit selection information 780, the replacement WM second hash table 1391, and the signature information 1300 to the signature verification unit 507c.

Figure 52 shows the replacement by the replacement combination generating mechanism 506c. An outline of the WM first hash table 1381 and 1382 and the generation action of the WM second hash table 1391 are attached.

The replacement combining unit 506c selects k pieces of information (k is a natural number below) from the unit selection information 780, and extracts the file identifier from the selected file information. Here, the file identifier 951 "FID1" and the file identifier 953 "FID3" shown in Fig. 52 are extracted.

The replacement combination generating unit 506c is extracted from the attached WM first hash table 1271, 1272, ‧‧1, and 1274 included in the WM header information 1251, and is extracted corresponding to the extracted file identifiers 951 and 953, respectively. WM first hash tables 1271 and 1273.

Further, the replacement combined body generating means 506c extracts the WM files 1371, 1372, 1373, ‧‧‧, 1374 included in the transmission encryption included in the WM content 1361 for transmission, and extracts the file identifiers corresponding to the extracted files respectively. The transmissions of 951 and 953 are encrypted with WM files 1371 and 1373.

Next, the replacement combination generating means 506c extracts the file identifier 951, and uses the WM first hash table 1271 and the transmission encryption to attach the WM file 1371, and generates and replaces the WM first hash table 1381 "RWHA1TBL1". Further, the extracted file identifier 952 is attached with the WM first hash table 1273 and the transmission encryption with the WM file 1373, and the WM first hash table 1382 "RWHA1TBL3" is generated and replaced.

(1) Replacement with the generation of WM first hash tables 1381 and 1383

Next, the following description replaces the details of the generation of the WM first hash table 1381 "RWHA1TBL1". Furthermore, the replacement is accompanied by WM Since the details of the generation of the hash table 1383 "RWHA1TBL3" are the same, the description is omitted.

As shown in FIG. 52 and FIG. 53, the replacement combined body generating means 506c is provided with the encryption for transmission included in the WM file 1371 "DWCNT1" corresponding to the transmission encryption corresponding to the extracted file identifier 951 "FID1". In the WM units 1341, 1342, 1343, ‧‧, and 1345, any one of the transmission encryption units is selected.

Specifically, the replacement combining unit 506c reads out the number of cells "N1" included in the selected file information, and generates a pseudo-number t (here, t=3) of "N1" or less. Next, in response to the generated pseudo random number t (=3), the third transmission encryption with the WM file "DWCNT1" encrypted for transmission is selected and WM unit 1343 "DWU1_3" is attached.

Next, the replacement combining unit 506c extracts the title key flag corresponding to the selected transmission encryption-attached WM unit 1343 "DWU1_3" from the attached WM first hash table 1271 corresponding to the extracted file identifier 951. Information "TKFI1_3". Next, the replacement combination generation unit 506c determines that the extracted title key flag information "TKFI1_3" is any one of "0" and "1".

When the title key flag information "TKFI1_3" is "0", as shown in Fig. 53, the transmission encryption-attached WM unit 1343 is output to the decryption mechanism 504, and the decryption mechanism 504 receives the transmission encryption. The decrypted result obtained by decryption by the WM unit 1343 is attached. Next, the replacement combining unit 506c uses the accepted decrypted result as the hash target unit "HU1_3".

When the title key flag information "TKFI1_3" is "1", it is the 54th. As shown in the figure, the replacement combined body generating means 506c attaches the WM unit 1343 itself to the transmission encryption unit as the hash target unit "HU1_3".

Next, the replacement combining unit 506c substitutes the hash target unit "HU1_3" into the hash function to generate a replacement unit hash value "RUH3". Here, the replacement combined body generating means 506c uses the same hash function as the hash function used by the header information generating means 207 of the content signature generating server means 101c.

When the title key flag information "TKFI1_3" is "0", the replacement combination generating means 506c is provided with m pieces of WM unit hash information 1281, 1282, 1283 included in the WM first hash table 1271 "WHA1TBL1". , ‧ ‧ and 1285, replacing the unit hash value "UHA1_3" corresponding to the unit identifier "UID1_3" corresponding to t=3 with the calculated replacement unit hash value "RUH3", and attaching it as an alternative WM first hash table 1381 "RWHA1TBL1".

When the title key flag information "TKFI1_3" is "1", the replacement combination generating means 506c selects the unit hash value "UHA1_3" and the attached WM unit by the media identification sub-acquisition unit 510c. Any of the column values "WUHA1_3". This selection method is the same as the selection method of the media identifier 371 in the encryption mechanism 306c using the transmission server device 102c.

In the present embodiment, any one of the cell hash value and the WM cell hash value is selected in accordance with the value of the bit corresponding to the position in the media identifier to which the WM cell hash information "WUHI1_3" is attached.

In Figure 54, since the value of this bit is "1", the selection is attached. The WM unit hashes the value "WUHA1_3" and replaces it with the calculated replacement unit hash value "RUH3". In this way, the WM first hash table 1381 "RWHA1TBL1" is attached as a replacement.

The replacement combined body generating means 506c repeats the same processing as described above for the other selected file information "FI3", and generates and replaces the WM first hash table 1382 "RWHA1TBL3".

(2) Replacement with the generation of WM second hash table 1391

Here, the generation flow for replacing the WM second hash table 1391 is described using FIG. 55.

The replacement combining unit 506c substitutes the generated replacement WM first hash table 1381 "RWHA1TBL1" into the hash function, and generates a replacement file hash value 1296a "RFH1". Further, the WM first hash table 1382 "RHA1TBL3" is substituted for the hash function, and the replacement file hash value 1297a "RFH3" is generated.

Next, the replacement combined body generating means 506c is attached with the WM header information 1251, and the WM second hash table 1261 "WHA2TBL" is extracted.

Secondly, in the extracted WM file hash information 1266, 1267, 1268, ‧‧‧, 1269 included in the WM second hash table 1261 "WHA2TBL", the selected file information is extracted The file identifiers "FID1" and "FID3" are included with the WM file hash information, and the extracted WM file hash information is extracted, and the WM file hash value is taken out and attached. The WM file hash values are replaced with the generated replacement file hash values "RFH1" and "RFH3", respectively.

The replacement combined body generating mechanism 506c will be replaced with the WM second hash Table 1261 is accompanied by a WM second hash table 1391 "RWHA2TBL".

4.4.3 Signature Verification Organization 507c

The signature verification unit 507c accepts the unit selection information 780 by the replacement combination generation unit 506c, and replaces the WM second hash table 1391 and the signature information 1300.

Upon receiving the unit selection information 780, replacing the WM second hash table 1391 and the signature information 1300, the signature verification unit 507c reads the public key 531 "KPV" by the signature verification key storage unit 505, and will accept The replacement WM second hash table 1391 and the unit selection information 780 are combined in this order to generate a combination 552c, and by using the signature verification algorithm V, the read public key 531 is used, and the generated one is used. The combination 552c and the signature information 1300 perform verification of the signature information 1300.

Here, the signature verification algorithm V is as described above, and corresponds to the signature creation algorithm S used by the signature generation unit 209c.

Next, the signature verification unit 507c outputs the verification result 541 to the reproduction possibility determination unit 508.

4.5 Action of Content Delivery System 10c

In the following, in the operation of the content distribution system 10c, the content signature generation server device 101c generates the intermediate content data set 242c and the like, and transmits the intermediate content data set 242c and the like to the "content signature generation" of the transmission server device 102c. The operation and the transmission server device 102c generate the transmission content data set 351c and the like, and the transmission content data set 351c and the like are stored in the "content transmission" of the information recording medium device 105c via the recording information processing device 103a. And regeneration information processing device 104c The operation of "content reproduction" in which the content data set 351c for transmission is received by the information recording medium device 105c and reproduced will be described.

(1) Action of content signature generation

The operation of generating the content signature is described using the sequence diagram shown in Fig. 57.

The unit generation unit 204c of the content signature generation server device 101c generates the divided content 721 and the unit selection information 780, outputs the divided content 721 to the digital watermark embedding unit 210, and outputs the unit selection information 780 to the signature generation unit 209c. The unit selection information 780 is written to the storage unit 202 (step S3001).

The digital watermark embedding unit 210 generates the WM divided content 1100, and outputs the WM divided content 1100 to the encryption unit 206c (step S3002).

The common title key generation unit 205 generates the common title key 241, outputs the common title key 241 to the encryption unit 206c, and writes the common title key 241 to the storage unit 202 (step S3003).

The encryption unit 206c generates the encrypted WM divided content 1231 and the encrypted WM content 1201, and the encrypted WM divided content 1231 is output to the header information generating unit 207c, and the encrypted WM content 1201 is attached thereto. The storage unit 202 writes (step S3004).

The header information generating unit 207c generates the WM header information 1251, and writes the WM header information 1251 to the storage unit 202, and attaches the WM header information 1251 to the WM second hash table. 1261 is output to the signature generation unit 209c (step S3005).

The signature generation unit 209c generates the signature information 1300, and writes the signature information 1300 to the storage unit 202 (step S3006).

The inter-machine transfer unit 203 reads the common title key 241 and the intermediate content data set 242c from the storage unit 202, and transmits the read common title key 241 and intermediate content data set 242c to the transmission server device 102c (step S3007). ).

The inter-machine receiving unit 303 of the transmitting server device 102c receives the common title key 241 and the intermediate content data set 242c by the content signature generating server device 101c (step S3007), and the storage unit 301 memorizes the common title key 241 and the intermediate content data. Set 242c (step S3008).

(2) Action of content transmission

The operation of transmitting the content will be described using the sequence diagram shown in Fig. 58.

The recording information processing device 103a transmits the transmission request information 321 to the transmission server device 102c, and the inter-machine reception mechanism 303 of the transmission server device 102c receives the transmission request information 321 (step S3101).

Next, the secret communication path establishing unit 311 of the transmission server device 102c and the secret communication path establishing unit 607 of the information recording medium device 105c establish the secret communication path 22 (step S3102).

The inter-machine transfer unit 601 of the information recording medium device 105b uses the secret communication path 22 to transmit the media identifier 371 to the transmission server device 102c via the recording information processing device 103a, and the device-to-machine receiving mechanism 303 of the transmission server device 102c receives the media identifier. 371 (step S3103).

The individual title key generation mechanism 305 of the sending server device 102c is The individual title key 381 is entered (step S3104).

The encryption unit 306c uses the individual title key 381, the encrypted WM content 1201, the attached WM header information 1251, and the media identifier 371 to generate the transmission encryption with the WM content 1361 (step S3105).

The title key transmission certificate generation unit 312 generates a title key transmission certificate 1000 (step S3106).

The inter-machine transmission unit 302 transmits the transmission content data set 351c and the title key transmission certificate 1000 to the information recording medium device 105b via the recording information processing device 103a, and the inter-machine reception mechanism 602 of the information recording medium device 105b receives ( In step S3107), the content storage means 609 of the information recording medium device 105b memorizes the transmission content data set 351c and the title key transmission certificate 1000 (step S3108).

The inter-machine transfer unit 302 of the transmission server device 102c transmits the individual title key 381 and the common title key 241 to the information recording medium device 105b via the recording information processing device 103a using the secret communication path 22, and the information recording medium device 105b The inter-machine receiving unit 602 receives (step S3109), and the title key storage unit 608 of the information recording medium device 105b stores the individual title key 381 and the common title key 241 (step S3110).

(3) The action of content regeneration

The operation of content reproduction will be described using the sequence diagram shown in Fig. 59.

The inter-media transfer unit 501 of the reproduction information processing device 104c transmits a transfer instruction 551 to the information recording medium device 105b, and the information recording medium is loaded. The inter-machine receiving mechanism 602 of the setting 105b receives the transfer instruction 551 (step S3201).

The inter-machine transfer unit 601 of the information recording medium device 105b transmits the individual title key 381, the common title key 241, the transmission content data set 351c, the title key transmission certificate 1000, and the media identifier 371 to the playback information processing device 104c. The medium-to-media receiving unit 502 of the reproduction information processing device 104c receives the individual title key 381, the common title key 241, the transmission content data set 351c, the title key transmission certificate 1000, and the media identifier 371 (step S3202).

The media identifier acquisition unit 510c of the reproduction information processing device 104c acquires the media identifier 371 (step S3203).

The title key transmission certificate verification unit 512 verifies the title key transmission certificate 1000 (step S3204). As a result of the verification, if it is determined that the title key transmission certificate is illegal (step S3204 is "Illegal certificate"), the reproduction processing is stopped.

If it is determined that the title key transmission certificate is correct ("the certificate is correct" in step S3204), the replacement combination generating means 506c generates a replacement attached WM second hash table 1391 (step S3205), and the signature verification means 507c uses The generated replacement is accompanied by the WM second hash table 1391, the unit selection information 980, and the signature information 1300 for signature verification, and in response to the verification result, the reproduction possibility determination unit 508 determines whether or not the reproduction is possible (step S3206). As a result of the signature verification, if it is determined that the verification has failed ("verification failure" in step S3206), the regeneration processing is stopped. If it is determined that the verification is successful ("verification succeeded" in step S3206), the title key obtaining means 503 obtains the title. The key decryption unit 504 decrypts the transmission encrypted content with the WM content using the acquired title key (step S3207). The reproduction unit 509 of the reproduction information processing device 104c reproduces the decrypted content obtained by the decryption (step S3208).

4.6 Other variants

The reproduction information processing device 104c may include a selection mechanism, a digital watermark determination unit, and a media identification generation unit.

The selection mechanism is within the encrypted content and selects the first encryption unit at a particular location.

The decryption unit 504 decrypts the selected first encryption unit to generate a plaintext unit.

The digital watermark judging unit judges whether or not the aforementioned plaintext unit has been embedded with one type of digital watermark, and outputs the judgment result. The result of the judgment is whether the digital watermark is embedded or not, so it can be "0" or "1".

The media identifier generating unit, in the bit position in the media identifier corresponding to the specific location, uses the content of the determination result, that is, "0" or "1" as the bit information constituting the media identifier. generate.

In this way, the bit information in the media identifier can be generated, and the media identifier can be restricted. Thus, when the content has been exposed, the bit information can be made a clue to the information recording media device of the particular leak source.

When the bit information constituting all of the media identifiers is configured as described above, the entire media identifier can be restored.

4.7 Effect of Content Delivery System 10c

(1) The content transmission system 10c uses both the individual title key 381 and the common title key 241 in the same manner as the content distribution systems 10a and 10b. It is a unit that uses the encrypted object of the common title key 241, and generates a unit hash value for the encryption unit. On the other hand, it becomes a unit that uses the encryption of the individual title key 381, and hashes the value to the plaintext unit generation unit. Thus, in one content, a unit encrypted with the individual title key 381 and a unit encrypted by using the common title key 241 are mixed, whereby even if only the portion using the individual title key 381 is replaced, As described above, although the reproduction is not stopped, it is difficult to reproduce the content.

(2) Further, the content distribution system 10c can directly process the title key or the content data set for transmission into another information recording medium in the same manner as the content transmission system 10b. The device verifies the title key transmission certificate and has the effect of resuming the content recorded on the illegal information recording medium.

(3) Further, in the content distribution system 10c, a unit that encrypts using the common title key 241 is embedded in the digital watermark depending on the media identifier. Thereby, when the plaintext content is exposed by the attacker, the media identifier of the information recording media device that identifies the source of the leak can be obtained from the exposed content. In this way, by using the obtained media identifier, the transmission server device can confirm the media identifier of the information recording medium device, thereby stopping the transmission of the content to the information recording medium of the following leakage source, thereby preventing the disaster from being further enlarged.

5. Other variants

Furthermore, the present invention has been described based on the above embodiments, but the present invention is of course not limited to the above embodiments. The following forms are also included in the present invention.

(1) In the content transmission systems 10a, 10b, and 10c, each of the transmission server devices transmits the content data for transmission to the information recording medium device via the recording information processing device without using the secret communication channel 22 (step S1106, Step S2007, step S3107). However, it is not subject to this limitation.

Each of the transmission server devices of each content transmission system can also transmit the content data for transmission to each information recording medium device using the secret communication path 22.

In this case, each of the information processing apparatuses for recording is transmitted to each information recording medium device in a state where the content data set for transmission is not decrypted and encrypted, and each information recording medium device receives the data using the secret communication path 22.

Further, in step S2007 and step S3107, the title key transmission certificate can also be transmitted using the secret communication path 22.

(2) In the content distribution systems 10a, 10b, and 10c, when the content is reproduced, the information recording medium device transmits the transmission content data set, the individual title key 381, and the common information to each of the reproduction information processing apparatuses without using the secret communication path. Title key 241 and other information. However, it is not subject to this limitation.

The information recording medium device and each of the reproduction information processing devices may establish a secret communication path, and after establishing the secret communication path, use the established secret communication path to transmit the transmission content data set and the individual title key 381. And the information of the common title key 241 and the like.

At this time, it is also possible to transmit, for example, an individual title key 381 using a secret communication path. And a common title key 241. Further, all the data (the individual title key 381, the common title key 241, and the content data set for transmission) can be transmitted using the secret communication path.

At this time, the information processing apparatus for reproduction also has a main body public key storage means, a public key certificate storage means, and a secret communication path establishing means. Further, the public key certificate storage unit of the information processing device for reproduction stores a public key certificate for the information processing device for reproduction issued by the certification authority device of the operating body of the system.

(3) In the content distribution systems 10a, 10b, and 10c, each content signature generation server device generates signature information of the content, but is not limited thereto.

Each sending server device can also generate signature information. At this time, each transmission server device may also generate signature information in advance before the content is transmitted.

In the content transmission systems 10b and 10c, when each of the transmission server devices generates the signature information, not only the second hash table (the WM second hash table is attached to the content transmission system 10c) but also the unit selects the information, and the second is scattered. The list (the WM second hash table is attached to the content transmission system 10c), the unit selection information, the individual title key 381, the common title key 241, and the media identifier are combined to generate a combination, and the combined combination is executed. The chapter generates an algorithm S to generate signature information. In this case, the title key transmission certificate is not required, and if the signature information is verified, it is possible to verify that the individual title key 381 and the common title key 241 are indeed directed to the information recording medium device corresponding to the media identifier included in the combination. send.

(4) In the content delivery systems 10a, 10b, and 10c, the individual title key 381 is randomly generated, and the media identification sub-371 and the individual title key 381 are made. Paired, stored in the header key database storage mechanism of each sending server device. Thereby, when the one-title key 381 is leaked, the media identifier 371 corresponding to the leaked individual title key 381 is read by the title key database storage means, and the media identifier 371 that has been read can be specified. The identified information recording media device. In this way, it becomes the source of the individual title key leaked by the specific information recording media device. But not limited to this.

The media identifier 371 can also be embedded in the individual title key, and the memory of the media identifier 371 and the individual title key 381 of the title key database storage mechanism can be replaced later. Thereby, in each of the transmission server devices, the title key database storage means is not required.

Here, it is explained that the media identifier is embedded in the individual title key.

Each of the transmission server devices of the content transmission systems 10a, 10b, and 10c generates a key TGK (referred to as a title key generation key) for generating an individual title key, and stores the title key generation key TGK.

Here, the media identifier (371) CID is 64 bits wide, and the random number R is 64 bits wide.

The individual title key generation means of each transmission server device generates a random number R, and combines the media identifier (371) CID and the random number R in this order to generate a combination.

Combination = CID||R

Here, A||B indicates a combination in which the data A and the data B are bit-connected in this order.

Second, the individual title key generation mechanism of each transmitting server device uses the title key to generate the key TKG, and performs an encryption algorithm on the combined body. Enc, so that the generated encryption combination is an individual title key.

Individual title key = Enc (TKG, CID||R)

Here, the encryption algorithm Enc is an encryption algorithm of the secret key secret mode. One of them is the encryption algorithm Enc for AES.

In case, if the generated individual title key is exposed, the title key generation key TKG can be used to decrypt the individual title key, thereby generating CID||R, and obtaining an information recording medium device capable of specifically identifying the source of the leak. Media identification sub CID.

Furthermore, if the media identifier 371 is longer than the 64-bit width, the combination of one of the media identifiers 371 and the random number R may be encrypted using the title key generation key TKG to generate an individual title key. .

In this case, only one part of the media identifier can be identified, but based on the information of one of the identified media identifiers, the information recording media device of the source of the leak can be restricted.

Further, in the above, the media identifier 371 is 64-bit wide, the random number is 64-bit wide, and the combined body is 128-bit wide. But not limited to this. Alternatively, the bit width of the media identifier 371 and the bit width of the random number may be 128, and the bit width of the media identifier 371 and the bit width of the random number may be set.

Further, when the key length of the encryption algorithm Enc used is 128 bits or more, the bit width of the media identifier and the bit width of the random number may be set to be equal to or less than the length of the key.

Also, individual title keys = CID||R.

Also, it can be an individual title key = Hash (CID||R). Here, Hash (A) is a hash value obtained by hashing the data A.

(5) In the content transmitting systems 10a, 10b, and 10c, a replacement combination (replacement of the second hash table and replacement of the WM second hash table) is generated, and the signature combination information is verified using the generated replacement combination. However, this is not the limit.

The signature verification unit of each of the reproduction information processing apparatuses may generate a second hash table "HA2TBL" that is not replaced (the WM second hash table "WHA2TBL" in the content transmission system 10c) is combined with the unit selection information. Combine the body and use the generated combination as the object data to verify the signature information.

As a result of the signature verification, if the verification of the signature information fails, the regeneration possibility determination means can stop the regeneration process, and instruct the regeneration mechanism that the regeneration mechanism stops the regeneration process.

If the verification of the signature information is successful, the k-transmission encryption unit is selected (the WM unit is attached to the transmission encryption system 10c for transmission), and the replacement unit hash value and the unit hash value are transmitted (content transmission) The system 10c is a unit hash value or a WM unit hash value for comparison. As a result of the comparison, if the replacement unit hash value and the cell hash value of the k transmission encryption units do not match, the reproduction possibility determination means can stop the reproduction processing, instruct the reproduction mechanism, and the reproduction mechanism stops the reproduction. deal with. When the replacement unit hash value and the cell hash value of all the k transmission encryption units match, the reproduction possibility determination means can perform the reproduction processing, and instruct the reproduction means to perform the reproduction processing.

(6) In the content transmission systems 10a, 10b, and 10c, when the secret communication path 22 is established, only one transmission server device can write the title key to the information recording medium device, and the information recording medium device performs the transmission server device. recognize certificate. However, this is not the limit.

Alternatively, the certificate authority device of the system may assign the public key certificate to the writable complex transmission server device in advance, so that the plurality of transmission server devices can write the title key to the information recording medium device. The public key certificate can also be used to authenticate the transmitting server device.

Further, in the information recording medium device, the memory device area dedicated to each of the transmission server devices may be set in advance by the plurality of transmission server devices, and the certification authority device of the system application body may allocate the public key certificate, and may The memory area is written to the corresponding transmit server device. In this case, the memory area identifier that uniquely identifies the written memory area is attached to the public key certificate, and the memory area identifier is also included in the object data of the signature in the public key certificate. The information recording medium device also includes a memory area identifier that specifically identifies the memory area, and verifies the public key certificate, thereby determining whether or not writing to the memory area of the write target is permitted.

(7) The content transmission systems 10a, 10b, and 10c determine the respective content signature generation server devices without depending on the title key flag information of each unit information in each of the information recording medium devices to be transmitted. But not limited to this.

Alternatively, when transmitting content to each information recording medium device, each of the transmission server devices determines the title key flag information corresponding to the media identifier that specifically identifies each information recording medium device.

At this time, each content signature signature generation server device is a unit in which a digital watermark is embedded in the unit, and a cell hash value is generated by the unit in which the digital watermark is embedded. Also, content signature generation The server device does not generate the title key flag information. Therefore, the content signature generation server device causes the title key flag information not to be included in the object data of the signature. The sending server device generates a signature.

(8) In the content transmission system 10c, a unit that encrypts the common title key 241 is used, and a unit that encrypts is selected using a media identifier (the unit is embedded with a digital watermark), and the encryption is performed. Attached to any of the WM units. Thereby, when the plaintext content is exposed, the digital recording watermark embedded in each unit is used to extract the media identifier, and the information recording medium device of the leak source can be specified. But not limited to this.

It is also possible to prepare a plurality of units to be embedded as digital watermark data (WM). For example, prepare 15 kinds of WM first. If 15 WMs are embedded in each unit, 16 units can be generated in conjunction with units that are not embedded in WM. In this way, 16 units can be made to correspond to part of the 4 bits of the media identifier.

The digital watermark embedding mechanism 210 of the content signature generation server device 101c generates 16 units in one unit as described above. Of the 16 units, one unit is a unit in which WM is not embedded. The remaining 15 units are WM units with 15 WMs embedded in them.

Thus, the digital watermark embedding mechanism 210 generates WM unit information including one unit and 15 WM units. Further, a WM split file including a plurality of WM unit information is generated, and a WM split content including a plurality of WM split files is generated.

The encryption unit 206c encrypts 16 units included in the WM unit information to generate 16 encryption units. The 16 encryption sheets The element is called a group unit. Further, the encryption unit 206c generates an encryption-attached WM file including a plurality of group units, and generates an encrypted-enclosed WM content including a plurality of encrypted WM files.

In other words, the encryption unit 206c generates the encrypted WM content as explained below. Encryption with WM content containing multiple encryptions with WM files. Each encryption is accompanied by a WM file containing a plurality of group elements. Each group of cells contains 16 encryption units. Here, among the 16 encryption units, one encryption unit is a unit that is not embedded with a WM. The remaining 15 encryption units are respectively encrypted with the WM unit embedded with 15 WMs.

The encryption unit 306c of the transmission server device 102c selects one encryption unit from the 16 encryption units included in the group unit in response to the value indicated by the 4-bit partial information in the acquired media identifier. Specifically, when the value indicated by the partial information of the 4-bit is "1", the 16 encryption units are selected and placed in the first encryption unit. If the value is "2", the second encryption unit is selected. If the value is "3", the encryption unit that is placed in the third is selected.

The encryption unit 306c includes the encryption unit thus selected in the encryption for transmission with the WM file.

In this way, by means of a part of the information corresponding to the 4-bit media identifier, 16 units of WM (including 15 WMs and unembedded WMs) are selected, thereby clearing the plaintext of the content when the plaintext is exposed. The unit extracts the WM, and determines which of the 16 types of WM has been extracted, and obtains information of 4 bits by the result of the determination. So, by the 4 bits obtained The information is specific to the information recording media device that limits the source of the leak.

In the above, 16 kinds of WMs are corresponding to part of the 4-bit information of the media identifier, but 64 types of WMs may be corresponding to part of the 6-bit information of the media identifier.

Further, any method may be used as long as it is a method of allocating media identifiers corresponding to the type of digital watermark.

Further, in the above description, 16 types of WMs are prepared by including units in which digital watermarks are not embedded, but 16 types of WMs may be prepared, and WMs may be embedded in all of the units.

Further, in the above example, as for 16 or 64, WM of the type of power of 2 is prepared, but the number of types of WM may be other than the power of 2.

In the above case, the server device may be generated by the content signature, and one or a plurality of digital watermarks are embedded in each plaintext unit of the first encrypted object, thereby regenerating the digital watermark embedded in the digital watermark. a group of one or a plurality of embedded units, and further performing the first encryption on the generated one or a plurality of embedded units, generating one or a plurality of first encrypted embedded units, and further generating Intermediate encrypted content including a set of one or more of the aforementioned first encrypted embedded units.

The intermediate encryption of the location in the media identifier that constitutes part of the information of the media identifier, the first encryption unit included in the intermediate encrypted content, and one or a plurality of the first encryption embedding units The location within the content corresponds.

The server device is generated by the content signature, and the selection corresponds to the aforementioned part. a group of the first encryption unit and one or a plurality of the first encryption embedding units at positions in the intermediate encrypted content at the location in the media identifier, and using the content of the partial information, An encryption unit and one or a plurality of the first encryption embedding unit groups are selected to select any one of the units, and the encrypted content including the selected unit as the first encryption unit is generated.

The information processing device for reproduction includes a selection mechanism of the first encryption unit that selects a specific position among the encrypted contents.

The decryption mechanism of the information processing device for reproduction further decrypts the selected first encryption unit to generate a plaintext unit.

The information processing device for reproduction further includes a digital watermark determining unit and a media identifier generating unit, and the digital watermark determining unit determines whether one of the plurality of types of digital watermarks is embedded in the generated plaintext unit. And the judgment result outputter, the media identifier generation means generates the position in the media identifier corresponding to the specific position, and the content of the determination result is generated as the partial information constituting the media identifier.

Here, if a digital watermark of 16 types is embedded in a case where the digital watermark is not embedded, the above-described determination result is 16 as described above. When the performance is 2 digits, the judgment result is any of "0000", "0001", "0010", "0011", ‧‧", and "1111".

Therefore, the media identification sub-generating means generates part of the information constituting the 4-bit of the media identifier.

In this way, part of the information constituting the media identifier can be generated and can be limited Media identifier. Thereby, when the content is exposed, part of the information can be used as a clue of the information recording media device of the specific leak source.

(9) In the content transmission system 10c, the unit to be embedded as the digital watermark is set such that the title key flag information corresponding to the unit is "1", that is, the common title key 241 is used. The case of an encrypted object, but not limited to this.

The WM unit may be additionally added to the unit corresponding to the title key flag information "0", and the unit and the attached WM unit may be encrypted using the individual title key 381.

In the unit to which the encryption target of the individual title key 381 is used, a processing summary in which a digital watermark is embedded with a WM unit may be added, and a portion different from the content transmission system 10c is used as a center. 60 to 64 are illustrated.

(a) The digital signature embedding mechanism 210 of the content signature generation server device 101c may also be embedded with a digital watermark for all units, as shown in FIG. 60, without depending on the title key flag information. WM unit is attached.

As shown in Fig. 60, the divided file 751 contains unit information 761, 762, 763, ‧‧‧, 764. Further, the unit information 761, 762, 763, ‧ ‧ and 764 respectively include units 773, 774, 775, ‧ ‧ and 777

The digital watermark embedding mechanism 210 can embed a digital watermark for the unit included in all the unit information regardless of whether the title key flag information included in the unit information is "1" or "0", and generate a WM with a WM. unit.

Specifically, the digital watermark embedding mechanism 210 pairs the unit information 761 The WM unit information 1411 including the attached WM unit 1421 is generated. Further, the unit information 762 is also generated with WM unit information 1412 including the WM unit 1422. Here, the WM unit information 1413, 1414, ‧‧‧, 1415 is generated in the same manner, and the WM split file 1401 including the WM unit information 1411, 1412, 1413, 1414, ‧ ‧ and 1415 is generated.

(b) Next, the encryption mechanism 206c of the content signature generation server device 101c uses the common title gold for the unit corresponding to the title key flag information "1" and the attached WM unit as shown in Fig. 61. The key 241 is configured to perform an encryption algorithm Enc on the unit and the attached WM unit to generate an encryption unit and to encrypt the WM unit.

On the other hand, the unit corresponding to the title key flag information "0" and the attached WM unit are not encrypted, but the unit is directly used and the WM unit is attached. At this time, the unit and the attached WM unit are directly attached to the WM unit as an encryption unit and encrypted.

As described above, the encryption unit 206c generates the encrypted WM divided file 1431 as shown in FIG. Encryption with WM split file 1431 includes encryption with WM unit information 1441, 1442, 1443, 1444, ‧‧‧, 1445. Further, each encryption is accompanied by a WM unit information including a unit identifier, a title key flag information, an encryption unit, and an encryption with a WM unit.

Next, as shown in FIG. 61, the encryption unit 206c generates an encryption unit including all of the encryption units included in the WM-divided file 1431 and the encryption-attached WM unit. "EWCNT1".

(c) Next, the header information generating unit 207c of the content signature generating server device 101c, as shown in Fig. 62, encrypts all the encryptions in the WM divided file 1431 with WM unit information, The encryption is accompanied by an encryption unit included in the WM unit information and each calculated hash value of the encrypted WM unit, and a unit hash value is generated and a WM unit hash value is attached.

As shown in Fig. 62, the header information generating unit 207c generates a WM first hash table 1451. Here, the WM first hash table 1451 is attached with WM unit hash information 1461, 1462, 1463, 1464, ‧‧, 1465. Each of the WM unit hash information includes a unit identifier, a title key flag information, a unit hash value, and a WM unit hash value.

(d) Next, the encryption unit 306c of the transmission server device 102c, as shown in Fig. 63, selects the encryption unit and the encryption for the unit corresponding to the title key flag information "1" in response to the media identifier. There is any one of the WM units, and the selected one is generated as a transmission encryption with a WM unit. For the unit corresponding to the title key flag information “0”, any one of the WM units is selected in accordance with the media identifier selection encryption unit and the encryption, and the selected item is encrypted using the individual title key 381 to generate The transmission is encrypted with a WM unit.

Here, the selection method in response to the media identifier is as described in the content distribution system 10c.

In this way, the encryption unit 306c generates the transmission encryption and the WM file 1501 based on the encrypted WM file 1471.

Encrypted with an example of a WM file 1471, as shown in Fig. 63, includes cell groups 1481, 1482, 1483, 1484, ‧‧‧, 1485. Each unit group includes an encryption unit and an encryption attached WM unit. The encryption unit and the encryption-attached WM unit included in the unit group 1481 each use a common title key 241, and the unit and the WM unit are encrypted and generated. On the other hand, the encryption unit and the encryption-attached WM unit included in the unit group 1482 are not encrypted, but the unit and the WM unit itself are attached.

An example of the WM file 1501 attached to the transmission encryption is as shown in Fig. 63, and the WM units 1511, 1512, 1513, 1514, ‧ ‧ and 1515 are included in the encryption for transmission.

The transmission encryption unit is provided with an encryption unit included in the WM unit 1511 system unit group 1481 and an encryption-attached WM unit, and any one of them is selected in accordance with the media identifier. The same applies to the WM units 1513 and 1515 to which the transmission encryption is attached.

Further, the transmission encryption-attached WM unit 1512 is included in the encryption unit included in the unit group 1482 and the encryption-attached WM unit, and any one of them is selected in accordance with the media identifier, and the individual title key 381 is used to select the player. Generated by encryption. The same applies to the transmission encryption with the WM unit 1514 attached.

(e) The replacement combining unit 506c of the reproduction information processing device 104c is the same as the content transmission system 10c for the unit corresponding to the title key flag information "1", and as shown in Fig. 54, the transmission encryption is performed. The WM unit is directly used as a hash target unit, and a hash value in which the WM unit is attached to the transmission encryption is calculated, and a hash value that is replaced by the media identifier is determined and replaced.

For the unit corresponding to the title key flag information "0", as shown in Fig. 64, the transmission encryption unit is decrypted and the WM unit is decrypted to generate a hash target unit, and the generated hash target unit is calculated. The hash value is determined to be replaced by the hash value of the media identifier replacement.

Further, in the above, a digital watermark is embedded in both the unit that encrypts using the individual title key 381 and the unit that is encrypted using the common title key 241. But not limited to this. It is also possible to embed a digital watermark only for a unit encrypted with an individual title key 381.

(f) can also be constructed as shown below.

The server device may be generated by the content signature, and one or a plurality of digital watermarks may be embedded in each plaintext unit that is not the object of the first encryption, thereby regenerating the embedded digital watermark. Or a plurality of embedded units, and generating intermediate encrypted content further comprising a set of one or more of the aforementioned embedded units.

a position in the media identifier that constitutes part of the information of the media identifier, corresponding to a position in the intermediate encrypted content of the group of the plaintext unit and one or more of the embedded units included in the intermediate encrypted content .

And transmitting, by the sending server device, the plaintext unit and one or more of the embedded units in the position in the intermediate encrypted content corresponding to the location in the media identifier of the partial information, and using the foregoing partial information And selecting, by the group of the plaintext unit and the plurality of the plurality of embedded units, performing the second encryption on the selected unit, generating the second encryption unit, and generating the inclusion The encrypted content of the aforementioned second encryption unit has been generated.

The information processing device for reproduction may include a selection mechanism, a digital watermark determination mechanism, and a media recognition sub-generation mechanism.

The selection mechanism selects the aforementioned second encryption unit at a specific location among the encrypted contents.

The decryption unit of the information processing device for reproduction decrypts the selected second encryption unit to generate a plaintext unit.

The digital watermark judging means further judges whether or not one of the plurality of types of the digital watermarks is embedded in the plaintext unit generated by the decryption by the second encryption unit, and outputs the judgment result.

The media identification sub-generating means further generates, based on the content of the determination result, the content in the media identifier corresponding to the specific position of the second encryption unit as the partial information constituting the media identifier.

Here, if the digital watermark is not embedded, 16 types of digital watermarks are embedded in total, and the above-described determination result is 16 sets. When the performance is expressed by 2 digits, the judgment result will be any of "0000", "0001", "0010", "0011", ‧‧", and "1111".

Therefore, the media identifier generation unit generates part of the information constituting the 4-bit of the media identifier.

Further, it may be configured as shown below.

The server device may be generated by borrowing a signature, and one type of digital watermark is embedded in each plaintext unit that is not to be encrypted, thereby regenerating an embedded unit in which the digital watermark is embedded, and generating and including Has The intermediate encrypted content of the aforementioned embedded unit is generated.

Part of the information constituting the media identifier constitutes one bit of the information of the media identifier.

The bit position in the media identifier of the bit information corresponds to a position in the intermediate encrypted content of the plaintext unit and one of the embedded units included in the intermediate encrypted content.

Transmitting, by the sending server device, the media identifier of the bit information, the plaintext unit and the one of the embedded units corresponding to the position in the intermediate encrypted content of the bit position, and using the value of the bit information Selecting any one of the plaintext unit and the one of the embedded units, performing the second encryption on the selected unit, generating the second encryption unit, and generating the aforementioned second encryption unit including the generated second encryption unit Encrypted content.

The information processing device for reproduction may include a selection mechanism, a digital watermark determination mechanism, and a media recognition sub-generation mechanism.

The selection mechanism is configured to select the aforementioned second encryption unit at a specific location within the encrypted content.

The decryption unit of the information processing device for reproduction decrypts the selected second encryption unit to generate a plaintext unit.

The digital watermark judging unit judges whether or not the aforementioned plaintext unit generated by the decryption of the second encryption unit is embedded with one of the digital watermarks, and outputs the determination result.

The position of the media identification sub-generating means in the aforementioned media identifier corresponding to the specific position of the second encryption unit will be determined according to the foregoing The content of the broken result is generated as the bit information constituting the media identifier.

The above judgment result is 2. It is expressed in 2 digits, and the judgment result is either "0" or "1".

Therefore, the media identifier generation unit generates bit information that constitutes one bit of the media identifier.

As described above, part of the information or bit information constituting the media identifier can be generated, and the media identifier can be restricted. In this way, if the content is exposed, some information or bit information can be used as a clue for the information recording media device of the specific leak source.

(10) In the content distribution systems 10a, 10b, and 10c, the header information generating units 207 and 207c respectively generate a plurality of first hash tables, and generate one second hash table, and the signature generating units 209 and 209c are paired with the second The combination of the hash table and the unit selection information implements the signature generation algorithm S to generate the signature information. But not limited to this.

In the content delivery systems 10a, 10b, and 10c, the header information generating units 207 and 207c respectively generate a plurality of first hash tables, and the signature generating units 209 and 209c combine the first hash table and the unit selection information. The body implements the signature generation algorithm S to generate the signature information.

(11) In the content delivery systems 10a, 10b, and 10c, the original content includes a plurality of original files, and each original file includes a plurality of plaintext units. But not limited to this.

The original content may also contain a plurality of plaintext units. Here, as described above, one of the units is a unit of the VOBU. Also, the unit may be referred to as a block.

(12) It can also be constructed as shown below.

One aspect of the present invention is a content transmission system composed of a first server device, a second server device, and a reproduction device.

The first server device has: a first encryption circuit, which performs a first encryption on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content to generate a first encrypted block, and Generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated; and a first summary circuit that constitutes a complex region of the intermediate encrypted content Each of the blocks is aggregated to generate a first summary value of the plural.

The second server device has a second encryption circuit, and the second encryption circuit performs second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content. And generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block.

The playback device has a selection circuit for selecting one of the plurality of encrypted blocks in the plurality of encrypted blocks constituting the encrypted content, and a decryption circuit for performing the selected second encrypted block. Corresponding to the decryption of the second encryption, generating a plaintext block; the second summary circuit sums the generated plaintext blocks to generate a second summary value; and the verification circuit uses the first summary value of the plurality and The generated second summary value performs verification of the encrypted content; and the reproduction circuit stops decryption of the encrypted content when the verification fails, and decrypts and encrypts the encrypted content when the verification is successful.

Furthermore, another aspect of the present invention is a content transmission system including a first server device, a second server device, and a playback device.

The first server device has a memory unit, which is a computer program in which a plurality of computer command combinations are stored, and a processor that reads and interprets computer commands one by one by the computer program stored in the memory unit. And in response to the interpretation of the results of the action. The computer program is executed by the first server device of the computer: the first encryption step is performed by performing only the first encryption on a part of the plaintext block of the plurality of plaintext blocks constituting the plaintext content. First encrypting the block, and generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated; and the first summary step, which will constitute Each of the plurality of blocks of the intermediate encrypted content is aggregated to generate a plurality of first summary values.

The second server device has a memory unit, which is a computer program in which a plurality of computer command combinations are stored, and a processor that reads and interprets computer commands one by one by the computer program stored in the memory unit. And in response to the interpretation of the results of the action. The computer program performs a second encryption step for the second server device of the computer, and performs second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content. And generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block.

The reproducing device has a memory portion, a computer program in which a plurality of computer command combinations are stored, and a processor, which is memorized in the foregoing The computer program of the body part reads and interprets the computer instructions one by one, and acts according to the interpretation result. The computer program is configured to perform the following steps for the foregoing reproducing device of the computer: selecting a second encrypted block in the plurality of encrypted blocks constituting the encrypted content; and the decrypting step is selected The second ciphering block performs decryption corresponding to the second ciphering to generate a plaintext block; and the second merging step is to summarize the generated plaintext block to generate a second summary value; the verification step is Performing verification of the encrypted content using the first summary value of the plurality and the generated second summary value; and the reproducing step, when the verification fails, stopping decryption of the encrypted content, and when the verification is successful, The encrypted content is decrypted and reproduced.

(13) It can also be configured as follows.

An information processing device according to an aspect of the present invention is an information recording medium that reads and decrypts encrypted data of the digital work, and the information recording medium records: encrypted data of a digital work; a summary record of the plurality of records generated by the plurality of data blocks constituting the digital work; and the first combination of the plurality of record summary values is used to execute the signature creation algorithm using the first signature key The first record signature data is generated, and the information processing device includes: a first verification key storage unit that stores a first verification key corresponding to the first signature key; and a utilization mechanism is recorded in the foregoing The encrypted data of the aforementioned digital works of the information recording medium is decrypted and reproduced; the data block selection mechanism randomly selects a predetermined number of selected data blocks from the foregoing data block; the key determining mechanism is determined to be used Encrypted data solution of the selected data block The decrypted key of the densification is which one of the key corresponding to the information recording medium and the key shared with all the information recording media; and the data conversion mechanism determines that the decrypted key is the key decryption mechanism In order to correspond to the information recording medium, the encrypted data is decrypted, and the decrypted result is used as a transformed data block, and if the key determining unit determines that the decrypted key is common to all information recording media. In the case of the key, the encrypted data itself is generated as a transformed data block; the calculating unit calculates the calculated summary value from the transformed data block corresponding to each selected data block; the reading mechanism is recorded in And storing, by the record summary value group of the information recording medium, a residual summary value corresponding to at least another data block except the selected data block; and generating means, generating the foregoing by using the calculated summary value and the remaining summary value The second combination of the replacement data corresponding to the record summary value of the selected data block is replaced by the replacement data of the calculation summary value The first signature verification unit performs the signature verification algorithm using the first verification key by using the second combination and the first record signature data that have been generated, and performs signature verification; The control unit stops the reproduction of the digital work when the signature verification by the first signature verification unit fails.

Thereby, even if the decryption key recorded on the information recording medium is tampered with, it is possible to prevent the use of the falsified decryption key in the information processing apparatus, and to reproduce the content (digital work).

Here, in the information processing device, the information recording medium further records the second record signature data, and the second record signature data is a combination of the decrypted key and the identifier of the information recording medium. A generator is generated by the signature generation algorithm of the second signature key, and the information processing apparatus further includes: a media identification sub-acquisition unit that acquires an identifier of the information recording medium; and a second verification key storage unit that saves a second verification key corresponding to the second signature key; the second signature verification unit is a combination of the decryption key and the identifier obtained by the media identifier acquisition unit, and the second record The signature information is executed by the signature verification algorithm using the second verification key, and the signature verification is performed. The use control mechanism may also perform the signature verification by the first signature verification institution or the second signature. When the verification of the signature by the verification agency fails, the reproduction of the aforementioned digital works is stopped.

Thereby, it is possible to verify that the media identifier of the information recording medium on which the decrypted key is recorded is correct, and can be reproduced only when recorded on the information recording medium whose content is correct.

The content signature generation server device of the other aspect of the present invention generates a digital work: the encrypted data of the digital work, and the summary value of the plurality of records generated by the plurality of data blocks constituting the digital work, The common key of the key common to all the information recording media, the key flag information showing the information of the key used for the aforementioned data block, and the use of the first combination composed of the plurality of record summary values. The first signature signature data generated by the first signature key signature generation algorithm, and the content signature generation server device includes: a first signature key storage mechanism for storing the foregoing 1 signature key; the data block generation mechanism is used to divide the digital work into a plurality of data blocks; the common key generation mechanism is used to generate the aforementioned common key; the golden key flag The information generating mechanism selects which one of the above-mentioned common key to use the key corresponding to the information recording medium and the aforementioned common key, and generates the aforementioned key flag information for displaying the selection result; the encryption mechanism is displayed When the aforementioned key flag information corresponding to each of the foregoing data blocks is used as a key for encrypting the common key, the data block is encrypted by the common key to generate an encrypted data area. Block, and when displaying the aforementioned key flag information as a key for encrypting the individual key, the data block itself is generated as an encrypted data block; the encrypted data generating mechanism is The plurality of encrypted data blocks are combined to generate the encrypted data; and the record summary value calculating means calculates the record summary value from the encrypted data block for each of the data blocks; the first combined body generating mechanism Combining the plurality of record summary values to generate the first combination; and the first signature generation mechanism is performed by the first combination The first record signature data is generated by using the signature generation algorithm of the first signature key.

Thereby, even if the decryption key recorded on the information recording medium is tampered with, it is possible to prevent the information processing apparatus that reads the information recording medium and reproduces the content using the falsified decryption key to reproduce the content. Further, by using the content signature signature generation server device described in the third item of the request item, the content signature signature generation server device can generate the signature information of the content in advance, and transmit the generated data without generating it later. Signature of the content.

Here, the content signature generation server device may further include a digital watermark embedding mechanism, and each of the data blocks is displayed. When the aforementioned key flag information of the foregoing data block is used as a key for encrypting the common key, a WM data block embedded with a digital watermark is generated for the data block, and the foregoing encryption mechanism Further encrypting the foregoing WM data block with the foregoing common key to generate an encrypted WM data block, and the encrypted data generating unit combines the plurality of encrypted data blocks with the encrypted WM data block. To generate the encrypted data, the record summary value calculation means further calculates the record summary value from the encrypted WM data block.

Thereby, the content is transmitted in response to the information recording medium by using the digital watermark embedded with the transmitting server device, and when the plaintext content is exposed by the attacker, the identifier of the information recording medium of the leak source can be extracted from the exposed content. By using the extracted identifier, the transmitting server device confirms the identifier of the information recording medium, and can stop the subsequent content from being transmitted to the information recording medium of the leak source, thereby preventing the subsequent damage from expanding.

Here, the content signature generation server device may further include: the content signature generation server device further includes a digital watermark embedding mechanism, and the digital watermark embedding mechanism is configured to correspond to the foregoing data for each of the data blocks. When the aforementioned key flag information of the block is used as a key for encrypting the individual key, the WM data block in which the digital watermark is embedded is generated for the data block, and the encryption mechanism further includes the aforementioned WM. The data block itself is generated as an encrypted WM data block, and the encrypted data generating unit combines the plurality of encrypted data blocks with the encrypted WM data block to generate the encrypted data, and the foregoing record summary The value calculation mechanism is further encrypted by the aforementioned WM data area The block calculates the aforementioned summary value of the record.

Here, the content signature generation server device may further include a digital watermark embedding mechanism, and the digital watermark embedding mechanism displays the aforementioned golden key flag information corresponding to the data block for each of the data blocks. When the key used to encrypt the foregoing individual key is used, a WM data block in which a digital watermark is embedded is generated for the data block, and the aforementioned key flag information corresponding to the data block is displayed as When the key of the previous individual key encryption is used, a WM data block embedded with a digital watermark is generated for the foregoing data block, and the encryption mechanism displays the corresponding data block for each of the data blocks. When the aforementioned key flag information is used as a key for encrypting the common key, the WM data block is encrypted by the common key to generate an encrypted WM data block, and when the display corresponds to the foregoing When the aforementioned key flag information of the data block is used as the key for encrypting the previous individual key, the aforementioned WM data block itself is used as the encrypted WM data area. And generating, and the encrypted data generating unit combines the plurality of encrypted data blocks with the encrypted attached WM data block to generate the encrypted data, and the recording summary value calculating unit is further encrypted by the aforementioned WM The data block calculates the aforementioned summary value of the record.

The server of the other aspect of the present invention is a server device for receiving: encrypted data of a digital work; a summary value of a plurality of records generated by a plurality of data blocks constituting the digital work; and all information Recording the common key of the common key of the media; displaying the key flag information of the information of the used key for the foregoing data block; summarizing the value of the record by the plural In the first combination, the first record signature data generated by using the signature creation algorithm of the first signature key is generated, and the encrypted data to be transmitted for the digital work is generated. The individual key of the key of the information recording medium, the server includes: an individual key generation mechanism that generates the foregoing individual key; and an encryption mechanism that displays a plurality of encrypted data blocks corresponding to the encrypted data. When each of the aforementioned key flag information is used as a key for encrypting the common key, the encrypted data block itself is generated as a transmission encrypted data block, and the aforementioned key flag information is displayed. When the key used to encrypt the individual key is used, the encrypted data block is encrypted by the individual key to generate a transmission encrypted data block; and the encrypted data generation unit for transmission is combined with a plural number. The transmission encrypted data block is generated to generate the encrypted data for transmission.

Thereby, even if the attacker exposes the individual key, the information recording medium to be transmitted can be tracked by the exposed individual key.

Here, the transmission server device may further include: a media identification sub-acquisition means for acquiring an identifier of the information recording medium; and a second signature key storage means for storing the second signature key; and the second signature The generating means generates a second record signature data by performing a signature generation algorithm using the second signature key by a combination of the individual key, the common key, and the identifier.

Thereby, it is possible to verify that the media identifier of the information recording medium on which the decrypted key is recorded is correct, and can be reproduced only when recorded on the information recording medium having the correct content.

Here, the transmission server device may further include a media identification sub-acquisition mechanism for acquiring an identifier of the information recording medium, and the encrypted data system embeds the plurality of encrypted data blocks and embeds the data block. The digital watermark encryption is combined with the WM data block, and the encrypted data generating mechanism corresponds to the identifier, and the encrypted data is selected to include the encrypted data block and the encrypted WM data block. Which one of them generates the encrypted data.

Thereby, when the content of the plaintext is exposed by the attacker, the identifier of the information recording medium of the leak source can be extracted from the exposed content. By using the extraction identifier, the transmission server device confirms the identifier of the information recording medium, thereby preventing the subsequent content from being transmitted to the information recording medium of the leak source, and preventing the subsequent damage from expanding.

Here, the transmitting server device may also display the aforementioned key flag information system corresponding to the encrypted attached WM data block as a key for encrypting the common key.

Here, the foregoing sending server device displays the aforementioned key flag information corresponding to the encrypted attached WM data block as a key for encrypting the individual key.

The information processing method according to another aspect of the present invention is characterized in that the information recording medium reads and decrypts the encrypted data of the digital work, and the information recording medium records: the encrypted data of the digital work, and the composition The first record of the complex record data generated by the complex data block of the digital work, and the first combination of the plurality of record summary values, the first signature generated using the signature signature generation algorithm of the first signature key Record sign The information processing method includes the steps of: obtaining, by the first verification key, a first verification key acquisition step corresponding to the first signature key; and using the step, recording the information on the information recording medium The encrypted data of the digital work is decrypted and reproduced; the data block selecting step randomly selects a predetermined number of selected data blocks from the data block; the key determining step is determined to use the selected data. The decryption key of the encrypted data of the block is the key corresponding to the key of the information recording medium and the key common to all the information recording media; the data conversion step is determined by the aforementioned key When the step determines that the decrypted key is a key corresponding to the information recording medium, decrypting the encrypted data, and using the decrypted result as a transformed data block, and determining the decryption in the key determining step. When the key is a key common to all the information recording media, the encrypted data itself is generated as a transformed data block; the calculation step Calculating a summary value of the calculation by the converted data block corresponding to each selected data block; the reading step is performed by recording the summary value group recorded on the information recording medium, and reading at least corresponding to the selected data block a summary value of the remaining data blocks; and a generating step of generating, by the calculated summary value and the remaining summary value, the record summary value corresponding to the selected data block in the first combination to be replaced by the calculated summary value The second combination of the data; the first signature verification step is performed by using the generated second combination and the first record signature data, and performing a signature verification algorithm using the first verification key, The signature verification is performed; and the control step is used to stop the digital work when the signature verification by the first signature verification institution fails. regeneration.

In the tracking technology of the leak source terminal in the past, it is difficult to specify the source of the leak when the multiple attackers combined the part and the part of the content of each culture. When such a leaked content is once again stored in a legitimate recording medium, and the legitimate reproduction of the device can be reproduced, it will become a situation in which the general user uses the illegal content, and the loss is large.

The information recording medium of the present invention has an area in which only the server device can write, and the key encrypted by the content is stored in the area, thereby preventing leakage and tampering of the key. For the content replacement attack, generate a hash value for each content block, and attach a relative signature as a countermeasure. In case the key is leaked, the key common to the individual key can be imported according to the card of the content to be sent. Further, in order to reduce the load on the server device, a signature is attached to the content in advance, so that a hash value is generated for the plaintext data for the content block using the individual key of the card, and the content area of the key common to the card is used. Block, which generates a hash value for the plain text data.

(14) Each of the above devices is specifically a computer system composed of a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. The aforementioned RAM or hard disk unit has a computer program. The microprocessor operates in accordance with the aforementioned computer program, whereby each device achieves the function. Here, the computer program is configured by combining a plurality of instruction code codes of the computer to achieve a predetermined function.

(15) Part or all of the components constituting each of the above-described devices may be constituted by one system LSI (Large Scale Integration). System LSI is a combination of a plurality of components on one wafer. The ultra-multi-function LSI produced is specifically a computer system including a microprocessor, a ROM, a RAM, and the like. The aforementioned RAM memory has a computer program. The aforementioned microprocessor operates in accordance with the aforementioned computer program, whereby the system LSI achieves this function.

Further, each of the components constituting each of the above-described devices may be individually formed into one wafer, or may be formed into a part or all of the wafer.

Further, the method of integrating the circuit is not limited to the LSI, and may be implemented by a dedicated circuit or a general-purpose processor. After the LSI is manufactured, it is also possible to use a reconfigurable processor that can reconfigure an FPGA (Field Programmable Gate Array) or a battery connection or setting of a circuit battery inside the LSI.

Furthermore, if the technology of semiconductor technology is replaced by the advancement of semiconductor technology or the replacement of other technologies into LSI, it is naturally also possible to use this technique for the accumulation of functional blocks.

(16) Some or all of the constituent elements constituting each of the above-described devices may be constituted by an IC card or a single module that can be attached to and detached from each device. The IC card or the aforementioned module is a computer system composed of a microprocessor, a ROM, a RAM, and the like. The IC card or the aforementioned module may also include the above-described super multi-function LSI. The microprocessor can be operated with a computer program, whereby the aforementioned IC card or the aforementioned module achieves the function. The IC card or the module may also be resistant to tampering.

(17) The present invention can also be used as a control method for each of the above devices. It can also be a computer program that implements such methods by means of a computer, or a digital signal composed of the aforementioned computer program.

Moreover, the present invention can also be used for a computer to read the aforementioned computer program or the foregoing The recording medium of the digital signal can be recorded on, for example, a floppy disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray Disc), a semiconductor memory or the like. Moreover, it can also be used as the digital signal recorded on the recording medium.

Furthermore, the present invention may be configured to transmit the computer program or the digital signal via a telecommunication network, a wireless or wired communication circuit, and a network represented by the Internet via data transmission.

Moreover, the present invention is a computer system having a microprocessor and a memory, wherein the memory system memorizes the computer program, and the microprocessor can also operate in accordance with the computer program.

Further, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, thereby being implemented by another independent computer system.

(18) Each of the embodiments and the modifications may be combined.

10, 10a, 10b, 10c‧‧‧ content delivery system

21‧‧‧Communication cable

22‧‧‧Communication Road

30a‧‧‧Content Delivery Subsystem

101‧‧‧First server device

101a, 101c‧‧‧ content signature generation server device

102‧‧‧Second server device

102a, 102b, 102c‧‧‧ transmit server device

103a‧‧‧Information processing device for recording

104‧‧‧Regeneration device

104a, 104b, 104c‧‧‧Renewable information processing device

105‧‧‧Recording media installation

105a, 105b‧‧‧Information recording media installation

201‧‧‧Content preservation agency

202‧‧‧Storage agency

203‧‧‧Inter-machine transfer mechanism

204, 204c‧‧‧unit generation agency

205‧‧‧Common Title Key Generation Agency

206, 206c‧‧‧Encryption institutions

207, 207c‧‧‧ Header Information Generation Agency

208‧‧‧Signature Key Depository

209, 209c‧‧ ‧ signature generation agency

210‧‧‧Digital Watermark Embedding Mechanism

211‧‧‧Control agency

221‧‧‧First Encryption Department

222‧‧‧First Summary Department

223‧‧‧Signature Department

224‧‧‧Common Title Key Generation Department

225‧‧‧Digital Watermark Embedding Department

241‧‧‧Common title key

242,242c‧‧‧ intermediate content data set

251‧‧‧Private Key

301‧‧‧Storage agency

302‧‧‧Inter-machine transfer mechanism

303‧‧‧Inter-machine receiving mechanism

304, 304c‧‧‧Media Identification Subsidiary

305‧‧‧Individual title key generation agency

306, 306c‧‧‧Encryption institutions

307‧‧‧ Title Key Database Storage Organization

308‧‧‧Using the subject public key depository

309‧‧‧Private Key Depository

310‧‧‧ Public Key Certificate Depository

311‧‧‧Communication Road Establishment Agency

312‧‧‧ Title Key Sending Certificate Generation Agency

313‧‧‧Control agency

321‧‧‧Second Encryption Department

322‧‧‧Single Title Key Generation Department

323‧‧‧Media Identification Submission Department

324‧‧‧Certificate Generation Department

351, 351c‧‧‧Send content data set

361‧‧ ‧ public key

362‧‧‧Private Key

371‧‧‧Media identifier

381‧‧‧ individual title keys

401‧‧‧Inter-machine transfer mechanism

402‧‧‧Inter-machine receiving mechanism

403‧‧Intermediate media transfer agency

404‧‧ ‧ media reception agency

501‧‧Intermediate media transfer agency

502‧‧ ‧ media reception agencies

503‧‧‧ Title Key Acquisition Agency

504‧‧‧Decryption Agency

505‧‧‧Signature Verification Key Depository

506, 506c‧‧‧Replacement combined generation mechanism

507, 507c‧‧‧Signature Verification Agency

508‧‧‧Renewable judgment agency

509‧‧‧Recycling agency

510, 510c‧‧‧Media Identification Subsidiary

511‧‧‧Using the subject public key depository

512‧‧‧ Title Key Sending Certificate Verification Agency

513‧‧‧Control agency

521‧‧‧Selection Department

522‧‧‧Decryption Department

523‧‧‧Second Summary Department

524‧‧‧Verification Department

525‧‧‧Reproductive Department

526‧‧‧Replacement of the combination

527‧‧‧Acquisition Department

528‧‧‧ Title Key Sending Certificate Verification Department

529‧‧‧Digital Watermark Judgment Department

530‧‧‧Media Identification Sub-Generation Department

531‧‧ ‧ public key

541‧‧‧Verification results

551‧‧‧Transfer instructions

552‧‧‧Replacement combination

601‧‧‧Inter-machine transfer mechanism

602‧‧‧Inter-machine receiving mechanism

603‧‧‧Media Identification Subsector

604‧‧‧Using the subject public key depository

605‧‧‧Private Key Depository

606‧‧‧ Public Key Certificate Depository

607‧‧‧Communication Road Establishment Agency

608‧‧‧ Title Key Storage Organization

609‧‧‧Content storage agency

610‧‧‧Control agency

611‧‧‧ Title Key Sending Certificate Storage Organization

701‧‧‧ original content

711~714‧‧‧ original file

721‧‧‧Divided content

731~734‧‧‧ Split file information

741‧‧‧ file identifier

751‧‧‧ split file

761~765‧‧‧Unit information

771‧‧‧ unit identifier

772‧‧‧ Title Key Flag Information

Unit 773~777‧‧‧

780‧‧‧ Unit selection information

781~785‧‧‧Archive Information

786~787‧‧‧ file identifier

800‧‧‧Encrypted split file

801~804‧‧‧Encryption unit information

811‧‧‧unit identifier

812‧‧‧ Title Key Flag Information

813~817‧‧‧Encryption unit

820‧‧‧Encrypted content

821~824‧‧‧Encrypted files

840‧‧‧Encrypted split content

841~844‧‧‧Encrypted split file information

851‧‧‧ file identifier

852‧‧‧Encrypted split file

860‧‧‧Header Information

861~864‧‧‧First hash list

865‧‧‧Separate hash table

871~874‧‧‧Unit hash information

875~879‧‧‧ Title Key Flag Information

881‧‧‧unit identifier

882‧‧‧ Title Key Flag Information

883‧‧‧ unit hash value

885~888‧‧‧File Hash Information

890‧‧‧Signature Information

891‧‧‧ file identifier

892‧‧‧File hash value

892a‧‧‧Replace file hash value

894a‧‧‧Replace file hash value

900‧‧‧Encrypted content

901~904‧‧‧Send encrypted file

913~917‧‧‧Send encryption unit

921‧‧‧ Public Key Certificate

922‧‧‧public key

923‧‧‧ signature

931‧‧‧Replace the second hash table

941‧‧‧Replace the first hash table

943‧‧‧Replace the first hash table

951‧‧ ‧ public key certificate

952‧‧‧Media public key

953‧‧‧Signature

1000‧‧‧ Title Key Sending Certificate

1001‧‧‧Signature Information

1111~1115‧‧‧WM split file information

1121~1125‧‧‧ file identifier

1131~1135‧‧‧WM split file

1141~1145‧‧‧ with WM unit information

1156‧‧‧Encryption with WM split file information

1161~1164‧‧‧Encryption with WM split file

1171~1175‧‧‧Encryption with WM unit information

1181‧‧‧Encryption unit

1182‧‧‧Encryption with WM unit

1183‧‧‧Encryption unit

1184‧‧‧Encryption unit

1185‧‧‧Encryption with WM unit

1186‧‧‧Encryption unit

1187‧‧‧Encryption unit

1188‧‧‧Encryption with WM unit

1201‧‧‧Encryption with WM content

1211~1214‧‧‧Encrypted with WM file

1231‧‧‧Encryption with WM split content

1251‧‧‧ with WM header information

1256~1259‧‧‧Encryption with WM split file information

1261‧‧‧ with WM second hash table

1266‧‧‧ with WM file hash information

1267~1269‧‧‧ with WM file hash information

1271~1274‧‧‧ with WM first hash table

1281~1285‧‧‧ with WM unit hash information

1291‧‧‧unit hash value

1292‧‧‧ with WM unit hash value

1293‧‧‧unit hash value

1296‧‧‧ with WM file hash value

1297~1299‧‧‧ with WM file hash value

1297a‧‧‧Replace file hash value

1300‧‧‧Signature Information

1341~1345‧‧‧Send encryption with WM unit

1361‧‧‧Send encryption with WM content

1371~1374‧‧‧Send encryption with WM file

1381, 1382‧‧‧Replacement with WM first hash table

1391‧‧‧Replacement with WM second hash table

1401‧‧‧ with WM split file

1411‧‧‧With WM unit information

1413~1415‧‧‧ with WM unit information

1421‧‧‧ with WM unit

1431‧‧‧Encryption with WM split file

1451‧‧‧ with WM first hash table

1461~1465‧‧‧ with WM unit hash information

1471‧‧‧Encryption with WM files

1511~1515‧‧‧Send encryption with WM unit

S‧‧‧ signature generation algorithm

V‧‧‧ Signature Verification Algorithm

WM‧‧‧ digital watermark

Fig. 1 is a view showing the overall configuration of a content transmission system 10 as a first embodiment of the present invention.

Fig. 2 is a view showing the overall configuration of a content transmission system 10a according to the second embodiment of the present invention.

Fig. 3 is a block diagram showing the configuration of the content signature creation server device 101a.

The fourth figure shows an example of the data structure of the original content 701 stored in the content storage unit 201.

Fig. 5 is a divided content 721 performed by the display unit generating unit 204 A conceptual diagram of the generated summary.

Fig. 6 shows an example of a data structure of the unit selection information 780 generated by the unit generation unit 204.

Figure 7 shows a portion of the encryption process performed by the encryption mechanism 206. It is also a conceptual diagram showing the generation summary of the encrypted split file 800.

FIG. 8 shows an example of a data structure of the encrypted content 820 generated by the encryption unit 206.

Fig. 9 is a conceptual diagram showing an outline of the generation of the header information 860 by the header information generating unit 207.

Fig. 10 is a conceptual diagram showing an outline of generation of the first hash table 861 by the header information generating unit 207.

Fig. 11 is a view showing an example of the data structure of the second hash table 865 generated by the header information generating unit 207.

Fig. 12 is a conceptual diagram showing an outline of the generation of the signature information 890 by the signature generation unit 209.

Fig. 13 is a block diagram showing the configuration of the transmission server device 102a.

Fig. 14 is a conceptual diagram showing a selection outline of an encryption unit using the title key flag information by the encryption unit 306.

Fig. 15 is a conceptual diagram showing an outline of generation of the encrypted file 901 for transmission by the encryption unit 306.

Fig. 16 shows an example of a data structure of the encrypted content 900 for transmission generated by the encryption unit 306.

Fig. 17 is a diagram showing an example of a data structure of the public key certificate 921 of the transmission server device 102a.

Fig. 18 is a block diagram showing the configuration of the information processing device 103a for recording.

Fig. 19 is a block diagram showing the configuration of the information processing device for reproduction 104a.

Fig. 20 is a conceptual diagram showing an outline of the replacement of the second hash table 931 by the replacement combination generating means 506.

Fig. 21 is a conceptual diagram showing an outline of selection of file information from the unit selection information 780 by the replacement combination generating means 506.

Fig. 22 is a conceptual diagram showing an outline of the replacement of the first hash table 941 by the replacement combination generating means 506.

Fig. 23 is a conceptual diagram showing an outline of replacement of the second hash table 931 by the replacement combining unit generating means 506.

Fig. 24 is a conceptual diagram showing an outline of verification of the signature information 890 by the signature verification unit 507.

Fig. 25 is a block diagram showing the configuration of the information recording medium device 105a.

Fig. 26 is a view showing an example of a schematic data structure of the public key certificate 951 of the information recording medium device 105a.

Fig. 27 is a sequence diagram showing an action of generating a content signature in the content distribution system 10a.

Fig. 28 is a sequence diagram showing the action of content transmission in the content distribution system 10a.

Fig. 29 is a sequence diagram showing an operation of reproducing the content in the content distribution system 10a.

Fig. 30 is a view showing the overall configuration of a content transmission system 10b as a third embodiment of the present invention.

Fig. 31 is a block diagram showing the configuration of the transmission server device 102b.

Fig. 32 is a view showing an example of the structure of the outline of the title key transmission certificate 1000.

Fig. 33 is a block diagram showing the configuration of the information processing device for reproduction 104b.

Figure 34 is a block diagram showing the construction of the information recording medium device 105b.

Fig. 35 is a sequence diagram showing the action of content transmission in the content distribution system 10b.

Fig. 36 is a sequence diagram showing the operation of content reproduction in the content distribution system 10b.

Fig. 37 is a view showing the overall configuration of a content transmission system 10c as a third embodiment of the present invention.

Fig. 38 is a block diagram showing the configuration of the content signature creation server device 101c.

Fig. 39 shows an example of a data structure with WM divided content 1100.

Fig. 40 is a view showing an outline of the generation of the WM split file 1131 by the digital watermark embedding mechanism 210.

Fig. 41 is a view showing an outline in which the encryption unit 206c encrypts and generates the WM divided file 1161.

Figure 42 shows the encryption attached by the encryption mechanism 206c. There is an example of a data structure of WM content 1201.

Fig. 43 is a view showing an outline of the generation of the WM header information 1251 by the header information generating unit 207c.

Fig. 44 shows a flow of generation of the WM first hash table 1271 by the header information generating unit 207c.

Fig. 45 shows an example of a data structure with the WM second hash table 1261 generated by the header information generating unit 207c.

Fig. 46 shows the generation processing of the signature information 1300 by the signature generation unit 209c.

Fig. 47 is a block diagram showing the configuration of the transmission server device 102c.

Fig. 48 shows the processing of selecting the title key flag information by the encryption unit 306c.

Fig. 49 shows the generation processing of the WM file 1371 with the encryption for transmission by the encryption unit 306c.

Fig. 50 shows an example of a data structure in which the WM content 1361 is encrypted for transmission by the encryption unit 306c.

Fig. 51 is a block diagram showing the configuration of the information processing device for reproduction 104c.

Fig. 52 is a view showing an outline of the process of generating the replacement WM second hash table 1391 by the replacement combination generating means 506c.

Fig. 53 is a flow chart showing the generation of the replacement of the WM first hash table 1381 by the replacement combining unit 506c when the title key flag information is "0".

Figure 54 shows the replacement knot when the title key flag information is "1". The merge generation mechanism 506c replaces the generation flow of the WM first hash table 1381.

Fig. 55 shows a flow of generation in which the replacement combining body generating means 506c is replaced with the WM second hash table 1391.

Fig. 56 shows the verification processing of the signature information 1300 by the signature verification unit 507c.

Fig. 57 is a sequence diagram showing the action of generating the content signature of the content distribution system 10c.

Fig. 58 is a sequence diagram showing the action of the content transmission by the content distribution system 10c.

Fig. 59 is a sequence diagram showing the operation of content reproduction by the content distribution system 10c.

Fig. 60 is a view showing the outline of the generation of the WM split file 1401 by the digital watermark embedding unit 210 in the modification (9).

Fig. 61 is a view showing the outline of the generation of the WM split file 1431 by the encryption by the encryption unit 206c in the modification (9).

Fig. 62 is a view showing the outline of the generation of the WM first hash table 1451 by the header information generating unit 207c in the modification (9).

Fig. 63 is a view showing the outline of the generation of the WM file 1501 by the encryption unit 306c in the modification (9).

Fig. 64 is a view showing an outline of the generation of the WM first hash table 1521 in place of the replacement combined body generating means 506c in the modification (9). In the figure, the title key flag information is "0".

10‧‧‧Content delivery system

101‧‧‧First server device

102‧‧‧Second server device

104‧‧‧Regeneration device

221‧‧‧1st encryption department

222‧‧‧1st summary department

321‧‧‧ Second Secret Department

521‧‧‧Selection Department

522‧‧‧Decryption Department

523‧‧‧Second Summary Department

524‧‧‧Verification Department

525‧‧‧Reproductive Department

Claims (32)

A content transmission system is composed of a first server device, a second server device, and a reproduction device, wherein the first server device has a first encryption mechanism, which is only for the plaintext content. In the plurality of plaintext blocks, a part of the plaintext block performs the first encryption to generate the first encrypted block, and generates the foregoing plaintext block without the first encryption and the first generated And the first aggregation unit aggregates the plurality of blocks constituting the intermediate encrypted content to generate a first summary value of the plurality, wherein the second server device has a second encryption unit, wherein the second encryption unit performs second encryption on the plaintext block that is not encrypted by the first encryption in the block included in the intermediate encrypted content to generate a second encryption And generating an encrypted content composed of the first encrypted block and the second encrypted block, wherein the reproducing device has a selection mechanism and is configured Deciphering the encrypted content, selecting one of the foregoing second encrypted blocks; and the decrypting mechanism is performing the decryption corresponding to the second encryption according to the selected second encrypted block. Generating a plaintext block; the second summary mechanism is to generate the aforementioned plaintext block Generating a second summary value; the verification means performs verification of the encrypted content by using the first summary value of the plurality and the generated second summary value; and the regeneration mechanism stops the encryption when the verification fails The content is decrypted, and when the verification is successful, the encrypted content is decrypted and reproduced. The content transmission system of claim 1, wherein the first server device further comprises a signature mechanism, and the signature mechanism performs a signature on at least a combination of the plurality of the first summary values that have been generated. And generating signature data, wherein the regeneration device further includes a replacement combination generation mechanism, wherein the replacement combination generation mechanism replaces the first summary value corresponding to the second summary value in the combination with the second summary value, The replacement binding body is generated, and the aforementioned verification mechanism uses the aforementioned replacement combination to verify the aforementioned signature data. The content transmission system of claim 1, wherein the second server device outputs the encrypted content to the reproducing device via a recording medium device, and the first encryption device of the first server device Performing the first encryption on the plaintext block using a common title key common to a plurality of recording medium devices, and the second encryption mechanism of the second server device And performing the second encryption on the plaintext block that is not encrypted by the first encryption by using an individual title key unique to the recording medium device, and the decryption mechanism of the playback device uses the individual title key in the The aforementioned second encrypted block is selected to perform decryption corresponding to the aforementioned second encryption. A content transmission subsystem is composed of a first server device and a second server device, wherein the first server device has a first encryption mechanism, and the first encryption mechanism is only configured. In the plurality of plaintext blocks of the plaintext content, a part of the plaintext block performs the first encryption to generate the first encrypted block, and generates the aforementioned plaintext block without the first encryption and generates the foregoing The intermediate encryption unit formed by the first encryption block; and the first aggregation unit aggregates each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values, and the second server device The second encryption unit is configured to perform second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content to generate a second encryption. The block is generated, and the encrypted content composed of the first encrypted block and the second encrypted block is generated. The content delivery subsystem of claim 4, wherein the first server device further includes a signature mechanism, and the signature mechanism is The combination is signed in combination with the plurality of generated first summary values generated to generate the signature data. The content transmission subsystem of claim 4, wherein the second server device transmits the encrypted content to the reproducing device through a recording medium device, and the first encryption of the first server device The mechanism performs the first encryption on the plaintext block using a common title key common to the plurality of recording media devices, and the second encryption mechanism of the second server device uses an individual title key inherent to the one recording medium device And performing the foregoing second encryption on the foregoing plaintext block without the foregoing first encryption. The content delivery subsystem of claim 6, wherein the first server device further comprises a common title key generation mechanism, and the common title key generation mechanism is configured to generate the aforementioned common title gold common to the plurality of recording medium devices. The key, and the aforementioned first encryption mechanism uses the aforementioned common title key generated. The content transmission subsystem of claim 6, wherein the second server device further includes an individual title key generation unit that generates the foregoing individual title key inherent to the one recording medium device. And the second encryption mechanism uses the generated individual title key. The content delivery subsystem of claim 8, wherein the second server device further comprises a media identifier acquisition mechanism, the media The identifier obtaining means is configured to obtain a media identifier for identifying the one recording medium device, and the individual title key generating means generates the individual title key including the acquired media identifier. The content delivery subsystem of claim 9, wherein the individual title key generation means generates a random number, combines the media identifier with the random number to generate a combination, and encrypts the generated combination to generate The aforementioned individual title key. The content transmission subsystem of claim 9, wherein the second server device further includes a certificate generating unit that combines the common title key, the individual title key, and the media identifier. And the combination of the implementation of the signature, generate a title key to send a certificate. The content transmission subsystem of claim 9, wherein the first server device further comprises a digital watermark embedding mechanism, wherein the digital watermark embedding mechanism is the first encryption in the first encryption mechanism. Each of the plaintext blocks of the object is embedded with one or more kinds of digital watermarks, thereby regenerating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, and the first encryption mechanism further Generating one or a plurality of embedded blocks, performing the foregoing first encryption, and generating one or a plurality of first encrypted embedded blocks, and generating further one or plural generated. The aforementioned intermediate encrypted content of the group of the first encrypted embedded embedding blocks, a group of the information identifying the media identifier in the media identifier, the first encrypted block included in the intermediate encrypted content, and one or a plurality of the first encrypted embedded blocks. Corresponding to the location in the intermediate encrypted content, the second encryption means selects the first encrypted block and one of the locations in the intermediate encrypted content corresponding to the location of the partial information in the media identifier. Or a plurality of the foregoing groups of the first encrypted embedding blocks, using the content of the foregoing partial information, selecting any block from the first encrypted block and one or a plurality of the first encrypted embedding block groups, And generating the encrypted content including the selected block as the first encrypted block. For example, the content transmitting subsystem of claim 12, wherein the digital watermark embedding mechanism embeds a digital watermark for each plaintext block, thereby regenerating an embedded block embedded with the digital watermark. The first encryption unit performs the first encryption on one of the embedded blocks that have been generated, and generates one first encrypted embedded block, and the generating further includes one of the foregoing first encryptions that have been generated. Embedding the intermediate encrypted content of the block, the partial information is bit information constituting one bit of the media identifier, the bit position of the bit information in the media identifier, and the intermediate encrypted content The first encrypted block and one of the first encrypted embedded blocks are in the intermediate encrypted content. Corresponding to the location, the second encryption unit selects the first encrypted block and the first part of the location in the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier. An encryption embedding block, using the value of the bit information, selects any block from the first encrypted block and one of the first encrypted embedding blocks. The content transmission subsystem of claim 12, wherein the digital watermark embedding mechanism of the first server device is a plaintext block that is not the target of the first encryption in the first encryption mechanism. Inserting one or more kinds of digital watermarks, thereby regenerating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, the first encryption mechanism generating further including one that has been generated or The intermediate encrypted content of the plurality of the embedded blocks, and the location of the partial information of the media identifier in the media identifier, and the plaintext block and one or more of the intermediate encrypted content The group of the embedded blocks corresponds to a position within the intermediate encrypted content, and the second encryption unit selects the position in the intermediate encrypted content corresponding to the position of the partial information in the media identifier. a plaintext block and a group of one or more of the aforementioned embedded blocks, and using the contents of the aforementioned partial information, from the aforementioned plaintext block and 1 Or a plurality of the embedded blocks of the group to select any block, and block the selection of the implementation of the second encryption, an encryption region for generating the second Blocking, and generating the aforementioned encrypted content including the aforementioned second encrypted block that has been generated. The content transmission subsystem of claim 14, wherein the digital watermark embedding mechanism embeds one type of digital watermark for each plaintext block that is not the object of the first encryption, thereby re-generating the embedded An embedded block of the digital watermark, wherein the first encryption unit generates the intermediate encrypted content further comprising one embedded block that has been generated, and the partial information is a bit of a 1-bit constituting the media identifier. Information that the bit position of the bit information in the media identifier corresponds to a position of the plaintext block included in the intermediate encrypted content and one of the embedded blocks in the intermediate encrypted content, and the foregoing The second encryption unit selects the plaintext block and the one embedded block at a position within the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier, and uses the bit information. The value is selected by the plaintext block and one of the aforementioned embedded blocks. A reproducing apparatus is configured to generate a first encrypted block by using a first server device to generate a first encrypted block only for a portion of the plaintext block of a plurality of plaintext blocks constituting the plaintext content, and generate a first encrypted block The intermediate encrypted content composed of the first plaintext block and the first encrypted block that has been generated without the first encryption, and the plurality of complex blocks constituting the intermediate encrypted content are aggregated to generate a complex number the first And summarizing the value, and performing, by the second server device, performing second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content to generate a second encrypted block And generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the playback device includes: a selection unit in the plurality of encrypted blocks constituting the encrypted content, Selecting a second encrypted block; the decryption mechanism is configured to perform the decryption corresponding to the second encryption to generate a plaintext block, and the second summary mechanism is generated by the selected second encrypted block. The plaintext block is aggregated to generate a second summary value; the verification means performs verification of the encrypted content by using the first summary value of the plurality and the generated second summary value; and the regeneration mechanism is as described above When the verification fails, the decryption of the encrypted content is stopped, and when the verification is successful, the encrypted content is decrypted and reproduced. For example, in the regenerative device of claim 16, the first server device further performs a signature on at least a combination of the plurality of the first summary values that have been generated to generate the signature data, and the regeneration is performed. The device further includes a replacement combination generating mechanism, the The replacement combination generating mechanism generates the replacement combination by replacing the first summary value corresponding to the second summary value in the combination with the second summary value, and the verification mechanism uses the replacement combination to verify the foregoing Signature information. The reproduction device of claim 16, wherein the reproduction device receives the encrypted content through a recording medium device by the second server device, and uses the plurality of records by the first server device. a common title key shared by the media device, performing the first encryption on the plaintext block, and using the second server device to use the individual title key inherent to the one recording medium device, without the first encryption The foregoing plaintext block performs the second encryption, and the decryption mechanism performs decryption corresponding to the second encryption on the selected second encrypted block by using the individual title key. The reproducing apparatus of claim 18, wherein the second server device combines the common title key, the individual title key, and a media identifier for identifying the one recording medium device. The binding body executes the signature to generate a title key transmission certificate, and the common title key, the individual title key, and the title key transmission certificate are written to the recording medium device, and the reproduction device further includes: The acquisition unit acquires the media identifier, the common title key, the individual title key, and the title key transmission certificate by the recording medium device; and the title key transmission certificate verification unit, which combines the common title The key, the individual title key, and the media identifier are used to generate a combination, and the generated combination of the title key is verified using the generated combination. The regenerative device of claim 18, wherein the first server device further embeds one or more digital watermarks in each of the plaintext blocks to be the first encryption target, thereby Generating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, and further performing the foregoing first encryption on the group of one or a plurality of embedded blocks that have been generated, to generate one or a plurality of first Encrypting the group of embedded blocks, and generating the intermediate encrypted content further comprising a group of one or a plurality of the first encrypted embedded blocks that have been generated, and forming part of the information of the media identifier in the media identifier a location, corresponding to a location of the first encrypted block and one or a plurality of the first encrypted embedded blocks included in the intermediate encrypted content in the intermediate encrypted content, by The first server device selects the first encryption of the location in the intermediate encrypted content corresponding to the location of the partial information in the media identifier And a block or a plurality of embedding said encrypted first block of the group, and using the content of the information section, Selecting any block from the first encrypted block and one or a plurality of the first encrypted embedded blocks, and generating the encrypted content including the selected block as the first encrypted block, the foregoing The playback device further includes a selection mechanism that selects the first encrypted block at a specific location within the encrypted content, and the decryption mechanism further decrypts the selected first encrypted block to generate a plaintext region The foregoing playback device further includes: a digital watermark judging means for judging whether the plaintext block that has been generated is embedded with one or more of the plurality of digital watermarks, and outputting the judgment result; and the media identifier The generating means generates the content based on the determination result as the partial information constituting the media identifier in a position corresponding to the media identifier in the specific position. The reproducing apparatus of claim 20, wherein the first server device further embeds one type of digital watermark in each of the plaintext blocks to be the object of the first encryption, thereby regenerating the embedded The first embedded block of the digital watermark is performed, and the first encryption is performed on one embedded block that has been generated, and a first encrypted embedded block is generated, and the generated one of the foregoing Encrypting the intermediate encrypted content of the embedded block, wherein the part of the information is one bit constituting the media identifier Bit information, the bit position of the bit information in the media identifier, and the first encrypted block and one of the first encrypted embedded blocks included in the intermediate encrypted content are encrypted in the middle Corresponding to the location in the content, the first encrypted device block selects the first encrypted block at a position within the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier by the first server device. And one of the foregoing first encrypted embedding blocks, and using the value of the bit information, selecting any block from the first encrypted block and one of the first encrypted embedding blocks to generate a selected area And the block is used as the encrypted content of the first encrypted block, and the digital watermark determining mechanism determines whether the aforementioned plaintext block is embedded with one type of the digital watermark, and the media identifier generating mechanism corresponds to the foregoing In the bit position in the media identifier of the specific location, a value according to the foregoing determination result is generated as the bit information constituting the media identifier. The regenerative device of claim 20, wherein the first server device embeds one or more digital watermarks for each plaintext block that is not the target of the first encryption, thereby re-establishing Generating a group of one or a plurality of embedded blocks embedded with the aforementioned digital watermark, and generating the intermediate encrypted content further comprising a group of one or a plurality of the embedded blocks that have been generated, And constituting a position of the partial information of the media identifier in the media identifier, a position of the plaintext block and one or a plurality of the embedded blocks included in the intermediate encrypted content in the intermediate encrypted content Corresponding to, by the second server device, selecting the plaintext block and one or more of the embedded blocks at positions in the intermediate encrypted content corresponding to the position of the partial information in the media identifier Grouping, and using the content of the foregoing partial information, selecting any block from the aforementioned plaintext block and one or a plurality of the foregoing embedded block groups, and performing the second encryption on the selected block to generate the second Encrypting the block and generating the encrypted content including the generated second encrypted block, the selecting mechanism further selecting the second encrypted block at a specific location in the encrypted content, and the decrypting mechanism further Deciphering the selected second encrypted block to generate a plaintext block, and the digital watermark determining mechanism further determines the foregoing Whether the aforementioned plaintext block generated by the decryption of the two encrypted blocks is embedded with one or more of the foregoing digital watermarks, and outputs a determination result, and the media identifier generation mechanism further performs the second encrypted block In the position in the media identifier corresponding to the specific position, the content of the determination result is generated as the partial information constituting the media identifier. The reproducing apparatus of claim 22, wherein the first server device embeds one type of digital watermark for each plaintext block that is not the target of the first encryption, thereby re-generating the embedded One embedded block of the digital watermark, and generating the intermediate encrypted content including one of the embedded blocks that have been generated, wherein the partial information is bit information constituting one bit of the media identifier, the bit The position of the bit in the media identifier corresponding to the position of the plaintext block and the one embedded block included in the intermediate encrypted content in the intermediate encrypted content, by the second server And selecting, by the device, the plaintext block and the one embedded block at a position in the intermediate encrypted content corresponding to the bit position of the bit information in the media identifier, and using the value of the bit information, Selecting any block in the foregoing plaintext block and one of the embedded blocks, and performing the second encryption on the selected block to generate the second encrypted block, and Forming the encrypted content including the generated second encrypted block, wherein the selecting means selects the second encrypted block of the specific location in the encrypted content, and the decrypting mechanism selects the second encrypted selected The block is decrypted to generate a plaintext block, and the digital watermark determining unit determines whether the aforementioned plaintext block is embedded in the plaintext block, and the first digital floating watermark is embedded, and the judgment result is output. The media identifier generation unit generates a content based on the determination result as the bit information constituting the media identifier at a position in the media identifier corresponding to the specific position of the second encrypted block. A control method is used in a content transmission system including a first server device, a second server device, and a playback device, and is characterized in that the method includes the following steps: the first encryption step is performed by the first servo And the device performs a first encryption on the part of the plaintext block in the plurality of plaintext blocks constituting the plaintext content to generate the first encrypted block, and generates the foregoing by the first encryption. The plaintext block and the intermediate encrypted content formed by the first encrypted block that has been generated; the first summary step is performed by using the first server device to perform each of the plurality of blocks constituting the intermediate encrypted content Generating a plurality of first summary values by summing; the second encryption step is, by using the second server device, the aforementioned plaintext area without the first encryption in the block included in the intermediate encrypted content The block performs second encryption to generate a second encrypted block, and generates encrypted content composed of the first encrypted block and the second encrypted block; Step, by the Department of the reproducing apparatus in the plurality of blocks constituting the encryption of said encrypted content, select an encryption of the second block; decryption step, the reproduction system by means already in the selection of The second ciphering block performs decryption corresponding to the second ciphering to generate a plaintext block; and the second merging step is to collect the generated plaintext block by the regenerating device to generate a second summary value; a step of performing verification of the encrypted content by using the plurality of first summary values and the generated second summary value by using the plurality of reproduction devices; and the reproducing step, by using the regeneration device, stopping when the verification fails The decrypted content is decrypted, and when the verification is successful, the encrypted content is decrypted and reproduced. A control program is used in a content transmission system including a first server device, a second server device, and a playback device, wherein the first server device for the computer performs the following steps: An encryption step of performing a first encryption on the plaintext block of a portion of the plurality of plaintext blocks constituting the plaintext content to generate a first encrypted block, and generating the first encrypted layer without the foregoing first encryption The plaintext block and the intermediate encrypted content formed by the first encrypted block that has been generated; and the first summarizing step, by the first server device, each of the plurality of blocks constituting the intermediate encrypted content Generating a plurality of first summary values, and performing a second encryption step on the second server device of the computer, the second encryption step being performed in the intermediate encrypted content In the foregoing block, the second encrypted block is generated by performing the second encryption on the plaintext block without the first encryption, and the first encrypted block and the second encrypted layer are generated. Encrypted content formed by the block; performing the following steps for the foregoing reproducing device of the computer: the selecting step is: selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; The decrypting step is to perform decryption corresponding to the second encryption by using the selected second encryption block to generate a plaintext block; and the second aggregation step is to summarize the generated plaintext block to generate a second a summary value; a verification step of performing verification of the encrypted content using the first summary value of the plurality and the generated second summary value; and a regeneration step of stopping decryption of the encrypted content when the verification fails And when the verification is successful, the encrypted content is decrypted and then reproduced. A computer readable recording medium recorded with a control program used in a content transmission system composed of a first server device, a second server device, and a reproduction device, wherein the recorded control program is executable The following steps are performed for the first server device of the computer: the first encryption step is only for the plural of the plaintext content. The first plaintext block of a part of the plaintext block performs the first encryption, generates the first encrypted block, and generates the aforementioned plaintext block without the first encryption and the first encryption generated. The intermediate merging content formed by the block; and the first merging step, by the first server device, summing each of the plurality of blocks constituting the intermediate encrypted content to generate a plurality of first summary values, and The second server device of the computer performs a second encryption step, and the second encryption step performs a second execution on the plaintext block without the first encryption in the block included in the intermediate encrypted content. Encrypting, generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, and performing the following steps on the foregoing reproducing device for the computer: selecting a step of selecting a second encrypted block in the plurality of encrypted blocks constituting the encrypted content; and the decrypting step is performed on the selected second encrypted region Performing a decryption corresponding to the foregoing second encryption to generate a plaintext block; a second summary step of summarizing the generated plaintext blocks to generate a second summary value; and the verifying step is to use the first summary value of the plurality And generating the foregoing second summary value to perform verification of the encrypted content; and In the reproduction step, when the verification fails, the decryption of the encrypted content is stopped, and when the verification is successful, the encrypted content is decrypted and reproduced. An integrated circuit, which is a first server device, is characterized in that: a first encryption mechanism is configured to perform first encryption on only a part of the plaintext block in a plurality of plaintext blocks constituting the plaintext content. Generating a first encrypted block, and generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated; and a first summary mechanism The plurality of complex blocks constituting the intermediate encrypted content are aggregated to generate a plurality of first summary values. An integrated circuit, which is a second server device, is characterized in that it has a second encryption mechanism, and the second encryption device borrows from the first server device, only one of the plurality of plaintext blocks constituting the plaintext content. And the part of the plaintext block performs the first encryption to generate the first encrypted block, and generates the plaintext block without the first encryption and the first encrypted block that has been generated. Intermediately encrypting the content, and summing each of the plurality of blocks constituting the intermediate encrypted content to generate a first summary value of the plurality, and not having the first encryption in the block included in the intermediate encrypted content The foregoing plaintext block performs second encryption to generate a second encrypted block, and generates encrypted content composed of the first encrypted block and the second encrypted block. A method for reproducing a user of a reproducing device, wherein the reproducing method is performed by the first server device, and performing only the first encryption on the plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content. Generating a first encrypted block, and generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated, and constituting the intermediate encryption Each of the plurality of blocks of content is aggregated to generate a plurality of first summary values, and by the second server device, the aforementioned plaintext block without the first encryption is included in the block included in the intermediate encrypted content And performing second encryption to generate a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, where the foregoing regeneration method includes: a selecting step, Selecting one of the foregoing second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; and the decrypting step is performed on the selected second encrypted block The row corresponds to the decryption of the second encryption, and generates a plaintext block; the second summary step is to summarize the generated plaintext block to generate a second summary value; and the verification step uses the first summary value of the plurality And generating the second summary value to perform verification of the encrypted content; and the regeneration step, stopping the adding when the verification fails The decrypted content is decrypted, and when the verification is successful, the encrypted content is decrypted and reproduced. A reproduction program is a user of a reproduction device, wherein the reproduction program is configured to perform first encryption on the plaintext block of a part of a plurality of plaintext blocks constituting the plaintext content by the first server device. Generating a first encrypted block, and generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated, and constituting the intermediate encryption Each of the plurality of blocks of content is aggregated to generate a first summary value of the plurality, and the second server device is used to add the aforementioned plaintext area without the first encryption to the block included in the intermediate encrypted content. Performing a second encryption on the block to generate a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, where the regenerative program is used for a computer The foregoing reproducing apparatus performs the following steps: a selecting step of selecting one of the second encrypted blocks in the plurality of encrypted blocks constituting the encrypted content; decrypting And generating, by the selected second encrypted block, the decryption corresponding to the second encryption, to generate a plaintext block; and the second summarizing step, the generated plaintext block is aggregated to generate a second summary. value; The verifying step is to perform verification of the encrypted content by using the first summary value of the plurality and the generated second summary value; and the regenerating step, stopping the decryption of the encrypted content when the verification fails, and When the verification is successful, the encrypted content is decrypted and then reproduced. A computer readable recording medium recorded by a reproducing program used by a reproducing device, characterized in that: by the first server device, only a part of the plaintext area of a plurality of plaintext blocks constituting the plaintext content is used. Performing a first encryption on the block, generating a first encrypted block, and generating intermediate encrypted content formed by the plaintext block not having the first encryption and the first encrypted block that has been generated, and And summing each of the plurality of blocks constituting the intermediate encrypted content to generate a first summary value of the plurality, and using the second server device, the first block included in the intermediate encrypted content is not in the foregoing first block Encrypting the plaintext block to perform second encryption, generating a second encrypted block, and generating encrypted content composed of the first encrypted block and the second encrypted block, and the reproduced program is The following steps are performed in the foregoing reproducing device for the computer: the selecting step is to select one of the foregoing second plus among the plurality of encrypted blocks constituting the encrypted content. Of the block; decryption step, based on the implementation of the selected second block corresponding to the encryption of the decryption of the second encryption, to generate a plaintext area a second summary step of summarizing the generated plaintext blocks to generate a second summary value; the verifying step is to perform the encrypted content by using the first summary value of the plurality of complexes and the generated second summary value The verification and the regeneration step stop the decryption of the encrypted content when the verification fails, and decrypt the encrypted content and reproduce the verification when the verification is successful. An integrated circuit is a device for constructing a regenerative device, characterized in that: by the first server device, only the aforementioned plaintext block of a part of the plurality of plaintext blocks constituting the plaintext content is first encrypted and generated first. Encrypting the block, and generating intermediate encrypted content composed of the aforementioned plaintext block without the first encryption and the first encrypted block that has been generated, and forming a plurality of blocks of the intermediate encrypted content And each of the plurality of first summary values is generated, and the second server device performs second encryption on the plaintext block without the first encryption in the block included in the intermediate encrypted content. Generating a second encrypted block and generating encrypted content composed of the first encrypted block and the second encrypted block, wherein the integrated circuit has a selection mechanism configured to constitute the encrypted content Selecting one of the foregoing second encrypted blocks from the plurality of encrypted blocks; The decryption mechanism is configured to perform the decryption corresponding to the second encryption to generate a plaintext block in the selected second encrypted block, and the second summary mechanism aggregates the generated plaintext block to generate a second a summary value; the verification means performs verification of the encrypted content using the first summary value of the plurality and the generated second summary value; and the regeneration mechanism stops the decryption of the encrypted content when the verification fails And when the verification is successful, the encrypted content is decrypted and then reproduced.