ES2352052T3 - CONTENT PROTECTION SYSTEM, TERMINAL DEVICE, TERMINAL APPLIANCE METHOD AND REGISTRATION SUPPORT. - Google Patents

Abstract

A content protection system including a key data generation apparatus (100) that uses a tree structure to manage a plurality of device keys maintained by a terminal apparatus (200), and the terminal apparatus (200), the key data generation apparatus (100) for generating header information based on positional information of selected device keys in the tree structure, a selection unit (102), operable to select one or more device keys corresponding to revocation information, a conversion unit (103) operable to convert first key data used to encrypt content, performing a predetermined conversion with the use of conversion information generated for a selected device key used for encryption of the first data of key, thereby generating second key data; an encryption unit (105) operable to encrypt the second key data using the device key, thereby generating encrypted key data; an output unit (110) operable to send the encrypted key data, which has the attached header information and the terminal apparatus (200) includes: a conservation unit (202) operable to maintain a plurality of device keys and for maintain positional information of the device keys of the terminal apparatus in the tree structure; a procurement unit (207) operable to obtain the encrypted key data and the header information that is attached to the encrypted key data; a selection unit (201) operable to select one of the device keys corresponding to revocation information, a decryption unit (203) operable to decrypt the encrypted key data using the selected device key maintained by the conservation unit ( 202), thereby generating the second key data; a conversion unit (204) operable to generate conversion information from the header information and positional information, and convert the second key data, performing a predetermined conversion with the use of the generated conversion information; thereby generating the first key data; and a content use unit (205, 206, 208) operable to send the decrypted content using the first key data.

Description

TECHNICAL FIELD

The present invention relates to a system for recording digitized data of content that is a work, such as a movie, on a large capacity recording medium, such as an optical disc, and reproducing the content.

BACKGROUND OF THE INVENTION

In order to protect the copyright of content that is a work, such as a movie or music, the playback devices receive a plurality of device keys, and the content is recorded in an encrypted state on a recording medium, along with key data that is used to decrypt the content and that can only be obtained by a playback device that can reproduce the content. One way to manage keys to generate this type of key data is to use a tree structure.

Document 1 describes a technique related to a key management system that uses a tree structure, and in which the amount of key information is relatively small and individual keys can be revoked. In addition, document 2 describes a technique that is based on the technique of document 1 and which refers to a method of managing digital content protection keys that prevents increases in the number of device keys previously maintained by the devices of playback, while reducing the amount of key information recorded on the recording medium.

The key management method described in document 1 is outlined below.

A key management organization manages device keys such that the leaves in a tree structure are in one-to-one correspondence with the reproduction apparatus. Each playback device maintains device keys that correspond to nodes placed in the path from the root to the sheet corresponding to the playback device. The key management organization encrypts a content and an MK media key used to decrypt the content, using a device key K which is the device key among all managed device keys that is shared by the largest number of devices. reproduction. Then, the key management organization writes the encrypted media key E (K, MK) on a recording medium. Note that E (X, Y) denotes an encrypted text obtained by encrypting Y data with X key data.

Here, if a reproduction apparatus is analyzed internally and all the device keys maintained by the reproduction apparatus are exposed, the key management organization revokes the exposed keys, and selects, from among the remaining device keys, the device that are shared by the largest number of playback devices, and uses the selected device keys to encrypt the MK media key.

As shown in Figure 11, in the case of revocation of a reproduction apparatus 0, device keys Kf, Kb and K1 are used to encrypt the media key MK, thereby generating encrypted texts E (Kf, MK), E (Kb, MK), and E (K1, MK), which are written to the recording medium.

Consequently, the revoked playback device 0 is unable to obtain the media key MK since it does not have any of the device keys Kf, Kb, and K1, and only the playback devices that have any of the device keys Kf, Kb and

K1 are able to obtain the medium key MK.

Here, if the uniqueness of the device keys is lost, for example if the respective values of the device key Kf and the device key k1 are identical, the values of the encrypted texts E (Kf, MK) and E (K1 , MK) recorded on the recording medium will be the same. This means that it will be publicly known that device keys Kf and K1 have identical values.

If the reproduction apparatus 7 is subsequently revoked, as shown in Figure 12, the key management organization encrypts the media key MK with the use of the device keys Kb, Kc, K1 and K6, and four are recorded Encrypted texts E (Kb, MK), E (Kc, MK), E (K1, MK), and E (K6, MK) in the recording medium.

Here, since the device key Kf held by the playback apparatus 7 has already been exposed and because of the fact that it is publicly known that Kf and K1 are identical, there is a danger that an illegal party will use the exposed Kf to decrypt the encrypted text E (K1, MK) and therefore illegally obtain the MK media key. If, in order to avoid such illegal actions, the encrypted text E (K1, MK) is not recorded on the recording medium, the problem arises that the valid playback apparatus 1 is unable to obtain the media key MK and It is unfairly revoked.

An example of a way to prevent the media key from being obtained illegally and that a playback device that should not be revoked is unfairly revoked is to ensure (guarantee) the uniqueness of each device key. Specifically, since device keys are generally generated using a random number generator that generates a series of random numbers, one method is to check, each time a device key is generated, whether the device key corresponds or not to previously generated device keys. Here, the series of random numbers is destroyed if there is a matching device key, and is used if there is no matching device key.

However, in a large-scale system in which the number of playback devices is billions, it is enormously expensive in terms of time to check whether or not each generated device key corresponds to previously generated device keys. Even when the key management method of document 2 is used, the same problem arises from the time it takes to check the device keys.

Document 1

Nakano, Ohmori and Tatebayashi "Digital Content Hogoyou Kagi Kanri Houshiki (Key Management System for Digital Content Protection)", The 2001 Symposium on Cryptography and Information Security, SCIS2001, 5A-5, January 2001.

Document 2

Nakano, Ohmori and Tatebayashi "Digital Content Hogoyou Kanri Houshiki-Ki-kouzou Pattern Bunkatsu Houshiki (Key Management System for Digital Content Protection-Tree Pattern Division Method)", The 2002 Symposium on Cryptography and Information Security, SCIS2002, 10C-1, January 2002

WO 02/060116 A describes a technique for forming a tree, which is used to divide receivers without memory of states in an encrypted system of content diffused into subsets. The subset keys associated with the subsets are then used to encrypt a session key which, in turn, is used to encrypt the broadcast content.

EP 1 176 754 A specifies a technique for securely distributing an updated node key by performing encryption processing using node keys for a full path from the root to a leaf in a tree structure.

GHANEM SM et al: “A simple XOR-based technique for distributing group key in secure multicasting” PROCEEDINGS ISCC 2000. FIFTH IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS, PROCEEDINGS OF 5TH IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS, ANTIBES-JUAN LES PINS, FRANCE 3-6 JULY 2000, July 3, 2000 (2000-07-03), pages 166-171, XP010505342 describes a technique for using an XOR function for message construction by a key distribution center for multicasting a session key to a group in order to maintain the security of the multicast group.

DESCRIPTION OF THE INVENTION

In view of the indicated problems, the object of the present invention is to provide a content protection system that prevents the illegal acquisition of a media key and the unfair revocation of a reproduction device that should not be revoked, without verifying the uniqueness of device keys.

According to the present invention, the foregoing objectives are achieved as defined in the independent claims. Preferred embodiments are defined in the dependent claims.

Depending on the structure indicated, even if the device keys have identical values, the encrypted key data will not necessarily have identical values. In addition, it is not possible to determine whether or not the device keys have identical values using the encrypted key data. Therefore, the illegal acquisition of the first key data can be avoided. Consequently, the revocation of reproduction devices that should not be revoked is avoided.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a block diagram showing the structure of a key data generation apparatus 100 and a recording medium 300.

Figure 2 represents a tree structure expressing the correlation between device keys in the key data generation apparatus 100.

Figure 3 represents the correlation between device keys in a case where there are device keys to be revoked.

Figure 4 represents the content of encryption processing and conversion of media keys.

Figure 5 represents the structure of recording areas of a DVD 300.

Figure 6 is a block diagram depicting the structure of DVD 300 and a playback apparatus.

200.

Figure 7 represents the content of decryption processing and conversion of encrypted media keys.

Figure 8 is a flow chart showing the processing of key data generation in the key data generation apparatus 100.

Figure 9 is a flow chart representing operations performed by the reproduction apparatus

200.

Fig. 10 is a flow chart representing the operations of recording position designation and conversion information generation in the reproduction apparatus 200.

Figure 11 represents an example of a key management method using a tree structure.

And Figure 12 represents an example of a key management method that uses a tree structure.

BEST WAY TO CARRY OUT THE INVENTION

Embodiments of the pre are described below.

Invention with reference to the drawings.

First realization

1. Structure of the copyright protection system

The copyright protection system, as depicted in Figures 1 and 6, is composed of a key data generation apparatus 100, a plurality of playback devices 200a, 200b, etc., and a DVD

300. Note that the common structure of the reproduction apparatus 200a, 200b, etc., is represented as a reproduction apparatus 200 in Figure 6.

The key data generation apparatus 100, which is maintained by a key management organization, records content and key data to reproduce the content of the DVD 300. The key data is selected so that only valid reproduction apparatus are able to reproduce the content, and is managed with a tree structure.

The key data generation apparatus 100 previously assigns a plurality of device keys to the playback devices 200a, 200b, etc., which are maintained by respective users. In addition, each of the playback devices 200a, 200b, etc., selects an appropriate device key from among the assigned device keys, and uses the selected device key to decrypt and reproduce the encrypted content recorded on DVD 300.

Each structure is described below.

1.1 Key data generation device 100

The key data generation apparatus 100, shown in FIG. 1, is composed of a device key storage unit 101, a device key selection unit 102, a conversion unit 103, a generation unit of Conversion information 104, a media key encryption unit 105, a content key encryption unit 106, a content encryption unit 107, an input unit 108, a control unit 109, and a drive unit 110.

Specifically, the key data generation apparatus 100 is a computer system composed of a microprocessor, a ROM, a RAM, a hard disk drive, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or the hard disk drive, and the key data generation apparatus 100 performs its functions by means of the microprocessor that operates according to the computer program.

(1) Input unit 108 and drive unit 110

The input unit 108 receives inputs from a media key MK, a content key CK, and content, from an external source, and sends the media key MK to the conversion unit 103 and the content key encryption unit 106, the content key CK to the content key encryption unit 106 and the content encryption unit 107, and the content to the content encryption unit 107.

Note that the media key may be unique information for DVD 300, or it may be key data generated from unique information for DVD 300.

The drive unit 110 writes the conversion information, the encrypted key data, and the encrypted content on the DVD 300, under the control of the control unit 109.

(2) Control unit 109

The control unit 109 controls the device key selection unit 102 in order to make it select at least one device key, from among the managed device keys, commonly maintained by the largest number of playback devices.

In addition, the control unit 109 controls the conversion information generation unit 104 in order to cause it to generate conversion information for each key or one of the selected device keys.

Next, the control unit 109 controls the conversion unit 103 in order to make it convert the media key MK respectively using each conversion information element generated by the conversion information generation unit 104.

In addition, the control unit 109 controls the media key encryption unit 105 in order to make it encrypt the converted media keys MK using each of the respective selective device keys. The control unit 109 also controls the content key encryption unit 106 in order to make it encrypt the content key received using the media key, and controls the content encryption unit 107 in order to make it encrypt the content.

The control unit 109 has the respective encrypted key data, conversion information and encrypted content written on the DVD 300 via the drive unit 110.

(3) Device key storage unit 101

The device key storage unit 101 stores all the device keys given to the playback devices belonging to the copyright protection system.

The device keys stored by the device key storage unit 101 are generated and assigned to the playback apparatus using the tree structure key management method depicted in Figure 2.

Note that, although the tree structure is described as a tertiary tree with three layers in the present embodiment, the tree structure is not limited to a tertiary tree, and may have even more layers. The tree structure management method is described in detail in document 2.

The tree structure is briefly described below.

The tree structure is made up of nodes and paths. Each "union" in the tree is called a node, and the nodes are connected by paths. Each level at which the no-two are placed in the tree structure is called a layer. A node that is above a particular node and connected to that node by a route is called a parent node, and the nodes that are below a parent node and connected to the parent node by routes are called child nodes.

In addition, the node in the highest layer is called a root, and the nodes in the lowest layer are called leaves. Reproduction devices are assigned one by one to the sheets. In Figure 2 the reproduction apparatus is represented with numbers 0 to 8 assigned respectively to them.

In addition, each node is assigned a node ID. Node IDs are a concatenation of route numbers from the root to the particular node. Route numbers 00, 01, and 10 are assigned to the routes in the order indicated from left to right. For example, the node ID of the sheet to which the playback apparatus 6 is assigned is "1000".

The following briefly describes how device keys are assigned in the copyright protection system.

<Root>

A plurality of device keys are assigned to the root. In Figure 2, these device keys are expressed as identification information Ka0000, Ka-0001, Ka-0010, Ka0011, Ka-0100, Ka-0101, and Ka0110. In the identification information "Ka-" indicates that the device key is assigned to the root. The four bits after "Ka-" are an NRP (node revocation configuration), and the highest bit of the NRP identifies whether the node is a parent node in relation to the leaf. The highest bit is "1" when the node is a parent node, and "0" in the case of any other node.

The lower three bits in the NRP express revocation information. The revocation information indicates, for each of the root child nodes, if a key

or device keys to revoke exist in the device keys assigned to the child node. Here, "1" expresses a child node that has a device key or keys to revoke, and "0" indicates a child node that does not have a device key or keys to revoke. The revocation information consists of information for each child node, concatenated in order from left to right of the tree structure.

Here, "revoke" means invalidating a playback device and device keys for a reason such as that the playback device is analyzed and the device keys are exposed. The nodes corresponding to device keys revoked in this way are revoked. Such a node is called a revoked node.

Ka-0000 is a key maintained by all the reproduction apparatus belonging to the tree structure, and this is the device key used in an initial state in which none of the reproduction apparatus in the tree structure has been revoked

Other device keys are used to encrypt the media key when there is a device key revoked on the child nodes.

For example, when there is a replayed device under the left child node of the root, and there is no replayed device under the other child nodes, the device key with the revocation information "100", identified by Ka-0100 In this way, a device key is assigned to each corresponding revocation information, and, according to the position of the reproduction apparatus revoked in the tree structure, a selection of device keys identified by the revocation information elements is made to use later.

In addition, device keys that have revocation information "111" are not assigned. This is because the device keys assigned to the nodes of the lowest layer are used when all the child nodes have a revoked playback device.

<Nodes>

Six device keys Kb-1001, Kb-1010, Kb1011, Kb-1100, Kb-1101, and Kb-1110 are assigned to the left node in layer 1. Here, “Kb” indicates a device key assigned to the left node Layer 1. In the same way as the root device keys, each device key is identified by revocation information about the child nodes. In addition, device keys with revocation information "000" are not assigned. This is because when there are no replayed devices for nodes under a particular node, a device key assigned to the root that is the node above the particular node is used. In addition, device keys that have revocation information "111" are not assigned. This is because when all the playback devices corresponding to the three sheets that are the child nodes are revoked, the device keys assigned to the node are not used.

Other nodes are assigned six device keys identified by revocation information in the manner described.

<Leaves>

Each sheet has a reproduction apparatus assigned to it. Here, the reproduction devices are identified with the numbers 0 to 8.

The left sheet of layer 2 is assigned device keys Ka-0000, Ka-0001, Ka-0010, Ka-0011, Kb-1001, Kb-1010, and Kb-1011.

The sheet is assigned all device keys that are assigned to the nodes in the routes from the root to the leaf, excluding the device key corresponding to a revocation configuration for when the playback device 0 is revoked. In other words, the device keys Ka-0100, Ka0101, Ka0110, Kb-1100, Kb-1101, and Kb-1110 are not assigned to the playback device 0 since these are the device keys, among those assigned to the root and the left node of layer 1, which are used when the reproduction apparatus 0 is revoked.

The other sheets are assigned device keys in the same way.

(4) Device key selection unit 102

The device key selection unit 102 selects device keys such that revoked playback devices are unable to use the content, and sends the selected device keys to the media key encryption unit 105.

In the initial state, the device key selection unit 102 selects Ka-0000, and sends this selected device key to the media key encryption unit 105.

The method of selecting device keys when one or more playback devices are revoked is described using Figure 3.

If the reproduction apparatus 0 and 8 are revoked, all nodes in the root paths to each of the leaves corresponding to the reproduction apparatus 0 and 8 are revoked. Each revoked node is indicated by an x (x) in Figure 3. When one or more playback devices are revoked, the device key that was used can no longer be used. In other words, Ka0000 that was used in the initial state cannot be used.

Next, the device key selection unit 102 selects, for each revoked node, a device key corresponding to the revocation configuration of the node. In the case of the root, the device key selection unit 102 selects the device key Ka-0101 whose revocation information is "101" since the left and right child nodes are revoked.

In the case of the left node of layer 1, the device key selection unit 102 selects the device key Kb1100 whose revocation information is 100 ", because the left child node is revoked. The middle node in layer 1 has no revoked child nodes and therefore the device key assigned to the previous layer is used, in this case Ka-0101 assigned to the root. The device key selection unit 102 selects the device key Kd-1001 whose revocation information is "001" for the right child node of layer 1, since its right child node is revoked.

(5) Conversion Information Generation Unit 104

The conversion information generation unit 104 generates conversion information for each of the device keys selected by the device key selection unit 102.

The NRP information is generated by concatenating the NRPs from the root to the node to which the selected device key is assigned.

As shown in Figure 3, when the playback devices 0 and 8 are revoked, the conversion information generation unit 104 generates conversion information for the device keys Ka0101, Kb-1100 and Kd-1001 selected by the unit of device key selection 102.

First, the conversion information generation unit 104 generates conversion information for the device key Ka-0101 shared by the playback devices 3 to 5. Here, since the only NRP for the root nodes up to the node to which the Ka-0101 device key is assigned is "101", the conversion information generation unit 104 sends "101" to the conversion unit 103 as information of

conversion.

Next, the conversion information generation unit 104 generates conversion information for the Kb-1100 device key shared by the playback devices 1 and 2. Since the NRPs for the root nodes to the node to which they are Assigns the device key Kb-1100 are "101" and "100", the conversion information generation unit 104 concatenates these NRPs to generate "101100" conversion information, and sends the generated conversion information to the conversion unit 103.

Next, the conversion information generation unit 104 generates conversion information for the device key Kd-1001 that is shared by the playback devices 6 and 7. Since the NRPs for the nodes of the root to the node at the The device code assigned Kb-1001 is "101" and "001", the conversion information generation unit 104 concatenates these NRPs to generate conversion information "101001", and sends the generated conversion information to the unit Conversion 103.

In addition, the conversion information generation unit 104 has the NRPs used to generate the conversion information written in the conversion information recording area 301 of the DVD 300, by the drive unit 110. Here, the NRPs are written in the order of height of the layers to which they are assigned.

Note that if the header information attached to the encrypted media key or the encrypted content key is used as conversion information, conversion information must be recorded. In addition, it is unnecessary for the conversion information to be recorded if the reproduction apparatus has a structure that allows conversion information to be generated.

(6) Conversion unit 103

The conversion unit 103 receives the media key from an external source through the input unit 108, and receives the conversion information from the conversion information generation unit 104. The conversion unit 103 applies respective XOR operations to the key of media using each conversion information element, thereby converting the media key.

Specifically, as shown in Figure 4A, the conversion unit 103 first converts the media key MK using the conversion information "0101" corresponding to the device key Ka-0101, thereby generating a converted media key MK '. Next, as shown in Figure 4B, the conversion unit 103 converts the media key MK using the conversion information "01011100" corresponding to the device key Kb-1100, thereby generating a converted media key MK " In addition, the conversion unit 103 converts the media key MK using the conversion information "01011001" corresponding to the device key Kd-1001, thereby generating a converted media key MK ".

The conversion unit 103 sends the generated converted media keys MK ', MK "and MK" ’to the media key encryption unit 105.

(7) Media key encryption unit 105

The media key encryption unit 105 receives the device keys of the device key selection unit 102, and receives the converted media keys of the conversion unit 103. The media key encryption unit 105 encrypts each Media key converted with the respective device key received.

Specifically, as depicted in Figure 4A, the media key encryption unit 105 first applies an encryption algorithm E1 to the converted media key MK 'using the device key Ka-0101, thereby generating an encrypted key E (Ka-0101, MK '). Here, the E1 encryption algorithm is, as in the example, AES (advanced encryption standard). Since AES is commonly known, its description is omitted. Note that E (X, Y) denotes an encrypted text obtained by encrypting Y data with X key data.

In the same way, as shown in Figure 4B, the media key encryption unit 105 applies the encryption algorithm E1 to the converted media key MK 'using the device key Kb-1100, thereby generating a key of encrypted medium E (Kb-1100, MK). Next, as shown in Figure 4C, the media key encryption unit 105 encrypts the converted media key MK "'using the device key Kd-1001, thereby generating an encrypted media key E (Kd- 1001, MK ”').

In addition, the media key encryption unit 105 writes the generated encrypted media keys E (Ka-0101, MK '), E (Kb-1100, MK "), and E (Kd-1001, MK"') by the drive unit 110 to the media key data recording area 302 of the DVD 300.

(8) Content key encryption unit 106

The content key encryption unit 106 receives the content key CK and the media key MK via the input unit 108. The content key encryption unit 106 applies the encryption algorithm E1 to the content key CK using the received media key MK to encrypt the content key CK, thereby generating an encrypted content key E (MK, CK). The content key encryption unit 106 then writes the encrypted generated content key E (MK, CK) by the drive unit 110 in the content key data recording area 303.

(9) Content encryption unit 107

The content key encryption unit 107 receives the content and the content key CK from an external source via the input unit 108. The content key encryption unit 107 applies the encryption algorithm E1 to the content using the content key content received CK to encrypt the content, thereby generating encrypted content E (CK, content). The content key encryption unit 107 writes the generated encrypted content E (CK, content) by the drive unit 110 in the content recording area 304 of the DVD 300.

1.2 DVD 300

DVD 300, as depicted in Figure 5, includes the conversion information recording area 301, the media key data recording area 302, the content key data recording area 303, and the zone of recording content 304.

The conversion information recording zone 301 is an area in which the NRPs used to generate conversion information are written. The NRPs are written in the order of height of the layers to which they are assigned.

The media key data recording zone 302 is a zone for recording the encrypted media keys. Encrypted media keys are written in order of the encrypted media key using the device key assigned to the highest layer in the tree structure.

The content key data recording zone 303 is a zone for recording the encrypted content key.

The content recording zone 304 is an area for recording the encrypted content.

1.3 Playback device 200

The reproduction apparatus 200 represents the structure common to the reproduction apparatus 200a, 200b, etc., and corresponds to one of the reproduction apparatus 0 to 8 in the tree structure.

The playback apparatus 200, as depicted in Figure 6, is composed of a device key selection unit 201, a device key storage unit 202, a media key decryption unit 203, a unit of Conversion 204, a content key decryption unit 205, a content decryption unit 206, a drive unit 207, a playback unit 208, a control unit 209, and an input unit 210. A monitor 220 and A speaker 221 is connected to the playback unit 209.

Similar to the key data generation unit 100, the playback apparatus 200 is, specifically, a computer system composed of a microprocessor, a ROM, a RAM, a hard disk drive, a display unit, etc. The reproduction apparatus 200 performs its functions by means of the microprocessor that operates according to a stored computer program

in RAM or hard drive.

(1) Drive unit 207 and input unit 210

The input unit 210 receives the input from an external source, and sends the input information received to the control unit 209.

Drive unit 207 reads from DVD 300, under the control of control unit 209.

First, under the control of the control unit 209, the drive unit 207 reads the conversion information of the conversion information recording zone 301, and sends the read conversion information to the key selection unit of device 201.

Next, the drive unit 207 reads the encrypted media keys from the media key data recording area 302, and sends the read encrypted media keys to the media key decryption unit 203.

In addition, the drive unit 207 reads the encrypted content key E (MK, CK) of the content key recording area 303, and sends the read encrypted content key E (MK, CK) to the decryption unit of content key 205.

Drive unit 207 also reads the encrypted content E (CK, content) of the content recording area 304, and sends the read encrypted content E (CK, content) to the content decryption unit

206.

(2) Reproduction unit 208

Under the control of the control unit 209, the playback unit 208 generates a video signal and an audio signal from the content received from the content decryption unit 206, and sends the generated video signal and audio signal to the monitor 220 and speaker 221, respectively.

(3) Control Unit 209

Upon receiving instructional information ordering the playback of content recorded on DVD 300 of the input unit 210, the control unit 209 controls the drive unit 207 to read various types of information from the DVD 300.

First, the control unit 209 controls the device key selection unit 201 to select a device key, specify a recording position of the encrypted media key, and generate conversion information.

Next, the control unit 209 controls the media key decryption unit 203 to decrypt the encrypted media key, thereby generating a converted media key, and causes the conversion unit 204 to convert the converted media key, thereby generating a middle key.

In addition, the control unit 209 controls the content key decryption unit 205 to decrypt the encrypted content key read using the media key, thereby generating a content key. The control unit 209 causes the content decryption unit 206 to decrypt the encrypted content read using the generated content key, thereby generating content, and controls that the reproduction unit 208 reproduces the content.

(4) Device key storage unit 202

The device key storage unit 202 stores a plurality of device keys assigned to the playback apparatus 200 by an administrator. The assigned device keys are indicated in Figure 2 by the identifiers represented below each of the playback devices 0 to 8. For example, the playback device 6 has device keys indicated by identification information Ka0000, Ka-0010 , Ka-0100, Ka0110, Kd-1001, Kd-1010 and Kd1011.

In addition, the device key storage unit 202 stores ID information indicating the position in the tree structure of the root to which the playback apparatus 200 corresponds.

(5) Device key selection unit 201

The device key selection unit 201 selects a device key, and sends the selected device key to the media key decryption unit 203. An example of a method used to select a device key is one in which Each device key is given an identifier beforehand, the key data generation device records the device key identifier to be selected on the DVD, and the playback device selects the device key indicated by the recorded identifier. on the DVD This method of device key selection is commonly known, and therefore its detailed description is omitted.

The device key selection unit 201 specifies the recording position of the encrypted media key that corresponds to the selected device key, generates conversion information, and sends the recording specification to the media key decryption unit 203 and the conversion information to the conversion unit 204. Note that the processing for recording the position designation and the generation of conversion information are described later.

(6) Media key decryption unit 203

The media key decryption unit 203 receives the device key and the encrypted media key recording position of the device key selection unit 201, and reads the encrypted media key recorded in the area indicated by the position Recording received from DVD 300 via drive unit 207.

The media key decryption unit 203 applies a decryption algorithm D1 to the encrypted media key using the device key, thereby generating a converted media key. Here, the decryption algorithm D1 performs the reverse processing of the encryption algorithm E1. The media key decryption unit 203 sends the converted media key generated to the conversion unit 204.

Taking Ka-0101 as a specific example of the selected device key, as shown in Figure 7A, the media key decryption unit 203 decrypts the encrypted media key E (Ka-0101, MK ') using the key of selected device Ka-0101, thereby generating an MK 'converted media key. In the event that the selected device key is Kb1100, the media key decryption unit 203 decrypts the decrypted media key E (Kb-1100, MK "), thereby generating a converted media key MK", such as It is depicted in Figure 7B. When the selected device key is Kd-1001, the media key decryption unit 203 decrypts the encrypted media key E (Kd-1001, MK "'), thereby generating a converted media key MK"', such as It is depicted in Figure 7C.

The media key decryption unit 203 sends the generated converted media key MK ', MK "or MK" ’to the conversion unit 204.

(7) Conversion Unit 204

The conversion unit 204 receives the converted media key from the media key decryption unit 203, and receives conversion information from the device key selection unit 201.

The conversion unit 204 performs an XOR operation on the converted media key received with the conversion information generated by the device key selection unit 201, thereby generating a media key.

Taking Ka-0101 as a specific example of the selected device key, as shown in Figure 7A, the conversion unit 204 converts the converted media key MK 'using the conversion information "0101" corresponding to the device key Ka0101, thereby generating an MK medium key. In the event that the selected device key is Kb1100, the conversion unit 204 converts the converted media key MK "using the corresponding conversion information" 01011100 ', thereby generating a media key MK, as depicted in the figure 7B. When the selected device key is Kd-1001, the conversion unit 204 converts the converted media key MK '"using the corresponding conversion information" 01011001 ", thereby generating an MK media key, as shown in the figure 7C.

The conversion unit 204 sends the generated media key MK to the content key decryption unit 205.

(8)

 Content key decryption unit 205

The content decryption unit 205 receives the encrypted content key of the drive unit 207, and the media key of the conversion unit 204. The content decryption unit 205 applies the decryption algorithm D1 to the key of encrypted content using the received media key, thereby generating a content key, and sends the generated content key to the content decryption unit 206.

(9)

 Content decryption unit 206

The content decryption unit 206 receives the encrypted content of the drive unit 207, and receives the content key of the content key decryption unit 205.

The content decryption unit 206 applies the decryption algorithm D1 to the encrypted content using the content key received, thereby generating content, and sends the generated content to the reproduction unit 208.

2. Operations in the copyright protection system

2.1 Operations performed by the key data generation apparatus 100

The operations performed by the key data generation apparatus 100 are described below.

using figure 8.

The device key selection unit 102 selects one or more device keys shared by the largest number of playback devices that have not been revoked (step S401), and sends the selected device keys to the encryption unit medium 105 and the conversion information generation unit 104.

Next, the conversion information generation unit 104, the conversion unit 103, and the media key encryption unit 105 repeat the following processing for each of the selected device keys. Note that in Figure 8, "A" indicates the number of device keys selected.

The conversion information generation unit 104 generates conversion information (step S403), and sends the conversion information to the conversion unit

103. The conversion unit 103 converts the media key obtained by the input unit 108, thereby generating a converted media key (step S404), and sends the generated converted media key to the media key encryption unit 105. The media key encryption unit 105 obtains the selected device key and the converted media key, and encrypts the converted media key using the obtained device key, thereby generating an encrypted media key (step S405) .

When the processing in steps S403 to S405 has been performed for all selected device keys, the generated conversion information and encrypted media keys are written to DVD 300 via drive unit 300 (step S406).

Next, the content key encryption unit 106 encrypts the content key using the unconverted media key (the media key before conversion), thereby generating an encrypted content key, and writes the content key. generated encrypted on DVD 300 by drive unit 110 (step S407).

In addition, the content encryption unit 107 encrypts the content using the content key, thereby generating encrypted content, and writes the encrypted content generated on the DVD 300 by the drive unit 110 (step S408).

2.2 Operations performed by the reproduction apparatus

Next, the operations performed by the playback apparatus 200 for reproducing content recorded on the DVD 300 are described using Fig. 9.

The device key selection unit 201 selects a device key on the basis of conversion information read by the drive unit 207, and performs encrypted media key recording position specification and conversion information generation (step S411) . The device key selection unit 201 sends the selected device key and the recording position to the media key decryption unit 203, and sends the conversion information to the conversion unit 204.

The media key decryption unit 203 reads the encrypted media key of the DVD 300 via the drive unit 207 according to the recording position, and decrypts the encrypted media key using the device key received from the key selection unit of device 201, thereby obtaining a converted media key (step S412). The media key decryption unit 203 then sends the converted media key to the conversion unit 204.

The conversion unit 204 applies an XOR operation to the converted media key using the conversion information received from the device key selection unit 201 (step S413), and sends the resulting media key to the content decryption unit 205.

The content decryption unit 205 decrypts the encrypted content key read from the DVD 300 by the drive unit 207, using the media key, thereby obtaining a content key (step S414), and sends the content key to the content decryption unit 206.

The content decryption unit 206 decrypts the encrypted content read from the DVD 300 by the drive unit 207, using the content key received from the content key decryption unit 205, thereby obtaining the content (step S415), and send the content to the playback unit

208.

Playback unit 208 reproduces the content received, and sends it to monitor 220 and speaker 221 (step S416).

2.3 Specification of encrypted media key and conversion information generation

(1) The following describes the selection of encrypted media key and the generation of conversion information in step S411, using Figure 10.

The device key selection unit 201 checks, in order, the NRPs recorded in the conversion information recording area 301. The device key selection unit 201 has a Y variable indicating the position of the verified NRP, a variable X indicating the recording position of the encrypted media key, a variable A indicating the position of the NRPs related to the reproduction apparatus 200, a variable W indicating the number of NRPs in a particular layer, and a D value that indicates the number of layers in the tree structure. Note that the NRPs related to the reproduction apparatus 200 are the NRPs of the nodes in the path from the sheet to which the user apparatus is assigned to the root in the tree structure.

The device key selection unit 201 performs analysis according to the following procedure, for layer i = 0 to layer i = D-1.

The device key selection unit 201 sets the following as initial values: variable A = 0, variable W = 1, variable i = 0, variable Y = 0, and X = 0 (step S421).

The device key selection unit 201 compares the variable i and the D value, and when the variable i is greater than the D value (step S422), the processing is terminated because the playback apparatus 200 is revoked.

When the variable i is equal to or less than the variable D (step S422), the device key selection unit 201 determines whether the lower three bits of the Y-th NRP recorded in the conversion information recording zone 301 they are "111" (step S423). When the three bits are "111", the device key selection unit 201 calculates Y = Y + 1 (step S426), and returns to the processing in step S423.

When the three bits are not "111", the device key selection unit 201 determines whether the value of variable Y and the value of variable A are the same or not (step S424). When the values differ, the device key selection unit 201 calculates X = X + 1 (step S425), calculates Y = Y + 1 (step S426), and returns to the processing in step S423.

When the value of variable Y and the value of variable A are equal, the device key selection unit 201 stores the value of the ith NRP in layer i (step S427).

Next, the device key selection unit 201 checks whether, from the four bits that make up the Y-th NRP, the value B at the bit position corresponding to the value of the 2nd highest bit and 2i-1- that bit is "0" or "1" (step S428). Here, the corresponding bit position is the left bit of the Y-th NRP in the case of the value of the 2nd highest bit and the 2nd-1st bit is "00", the middle bit of the Y-th NRP in the case of "01", and the right bit of the Y-th NRP in the case of "10". The ID information is composed based on the rule that, as shown in Figure 2, in the tree structure the left routes are assigned “00”, the middle routes are assigned “01”, and the right routes are assigned "10", and therefore represents the route from the root to the sheet corresponding to the reproduction apparatus.

When the value B is "1" (step S428), the device key selection unit 201 counts the number of "ones" in the WNRPs in layer i. However, the device key selection unit 201 does not count the "ones" in NRPs whose highest bit is "1". The device key selection unit 201 assigns the counted value to the variable W. The variable W obtained in this way indicates the number of NRPs in the next layer i + 1 (step S429).

Next, the device key selection unit 201 counts the number of "ones" in the NRPs of the first NRP to the NRP at the corresponding bit position. However, the device key selection unit 201 does not count the "ones" in NRPs whose highest bit is "1". The device key selection unit 201 assigns the counted value to the variable A. Here, the device key selection unit 201 does not count the value of the corresponding bit position. The variable A obtained in this way indicates the position of the NRP related to the reproduction apparatus 200 (step S430).

Next, the device key selection unit 201 calculates X = X + 1 (step S431), Y = 0 (step S432), and i = i + 1 (step S433), and returns to the processing in step S422. When the value B = 0 in step S428, the device key selection unit 201 sends the value of the variable X to the media key decryption unit 203 as the recording position of the encrypted media key, sends the conversion information generated to the conversion unit 204 (step S434), and the processing ends.

(2) The specific processing for selecting an encrypted media key and generating conversion information is described below, using as an example the case of the reproduction apparatus 6 in Figure 2. The reproduction apparatus 6 maintains Ka-0000,

Ka0010, Ka-0100, Ka-0110, Kd-1010, Kd-1011 previously as device keys, and "1000" as ID information.

a) The device key selection unit 201 determines whether the lower three bits of the 0 th NRP "0101" recorded in the conversion information recording zone 301 are "111" (step S423).

b) since the three lowest bits are not "111", the device key selection unit 201 compares the values of the variable Y and the variable A (step S424), and since these values are equal, it saves the value "0101" of the 0 th NRP in layer 0 (step S427).

c) since the value of the upper two bits of the ID information is "10", the device key selection unit 201 checks the right bit of the lower three bits of the 0 th NRP (step S428) . Since the right bit is "1", the device key selection unit 201 proceeds to processing from step S429 onwards.

d) the device key selection unit 201 counts the number of "ones" in the lower three bits of the NRP "0101" in layer 0 (step S429). Since the counted value is "2", it is known that it has two NRPs in the next layer 1.

e) Next, the device key selection unit 201 counts the number of "ones" in the three lowest bits of "0101" of the NRP to the corresponding bit position. Note that the device key selection unit 201 does not count the value of the corresponding bit position. Since the counted value is "1", it is known that position A of the corresponding NRP in the next layer 1 is position 1.

f) The device key selection unit 201 calculates X = X + 1, Y = 0, and i = i + 1 (steps S431 to S433). As a result, the value of variable X is "1".

g) The device key selection unit 201 determines whether the lower three bits of the 0 th NRP "1100" in layer 1 recorded in the conversion information recording zone 301 are "111" or not (step S423), and since the three lowest bits are not "111", compare the values of variable Y and variable A (step S424).

h) Since the values of the variables Y and A differ, the device key selection unit 201 calculates X = X + 1 (step S425). As a result, the value of X is "2". The device key selection unit 201 also calculates Y = Y + 1 (step S426). As a result, the value of Y is "1".

i) The device key selection unit 201 determines whether the lower three bits of the first NRP "1001" in layer 1 are "111" or not, and since the lower three bits are not "111", Compare the values of variable Y and variable A (step S424).

j) Since the values of the variables Y and A are equal, the device key selection unit 201 concatenates the NRP "1001" at position 1 in layer 1 with the NRP "0101" stored the previous time, and Save the resulting concatenated value (step S427).

k) Since the value of the third and fourth upper bits of the ID information is "00", the device key selection unit 201 checks the left bit of the lower three bits of the NRP at position 1 ( step S428). The left bit is "0", and therefore the analysis ends.

l) The device key selection unit 201 sends the value 2 "of the variable X to the media key decryption unit 203 as the recording position, and sends" 01011001 "to the conversion unit 204 as information of conversion (step S434). The described processing results in the key of me

The encrypted E (Kd-1001, MK) is specified from the recording position 2 of the playback device 6, and the conversion information "01011001" is generated.

3. Modifications

Although the present invention has been described based on a preferred embodiment, the present invention is not limited thereto. Cases such as the following are also included in the present invention.

(one)

 The encryption method used is not limited to AES, and another encryption method can be used.

(2)

 Although the media key and the content key are entered from an external source in the preferred embodiment, they can instead be stored in the key data generation apparatus. Alternatively, a media key and a content key can be generated each time the key data generation apparatus is used.

(3)

 Two layers of encryption are used in preferred embodiments, in other words, the content is encrypted using the content, and the content key is encrypted using the media key. However, it is possible, however, to use an encryption layer so that the content is encrypted with the media key, or provide an additional key or keys and increase the number of encryption layers. If the number of encryption layers is increased, it is sufficient to convert one of the encrypted keys.

(4)

 The conversion information is not limited to the NRPs described in the preferred embodiment. The conversion information can be any information generated to indicate the relationship in the tree structure between the position of a node at

that a device key is assigned and other nodes, and follow predetermined rules about route numbers, node position information, NRPs, etc. Examples of conversion information in (a) to (f) are described below.

(a) The conversion information generation unit 104 finds the node ID of the node to which the selected device key is assigned, and also finds the NRP. These are concatenated to generate conversion information. Follow a specific example.

In a case where playback devices 0 and 8 are revoked as in Figure 3, the device key selection unit 102 selects the device keys Ka-0101, Kb-1100, and Kd-1001.

The conversion information generation unit 104 first generates conversion information for the device key Ka0101. Here, the node to which the Ka-0101 device key is assigned is the root, and since there is no node ID for it, "0101", which is the NRP, is the conversion information.

Next, the conversion information generation unit 104 generates conversion information for the Kb-1100 device key. Here, the node ID of the node to which the device key Kb-1100 is assigned is "00" and the NRP is "1100", and these are concatenated to generate conversion information "001100".

The conversion information generation unit 104 then generates conversion information for the device key Kd1001. Here, the node ID of the node to which the device key Kd-1001 is assigned is "10" and the NRP is "1001", and these are concatenated to generate conversion information "101001".

In addition, rather than concatenating the node ID with the NRP, the node ID can only be used as the conversion information. In such a case, since there is no conversion information for the Ka0101 device key, the Ka-0101 device key can be encrypted without being converted, or converted using previously established conversion information for the root. Here, the value used for this conversion information differs from other conversion information and is not part of the invention.

(b)

Each node in the tree structure receives an identification number in order from upper to lower and left to right, starting at the root, as shown in Figure 2, and the identification numbers are used as conversion information.

In other words, when the reproduction apparatus 0 and 8 are revoked as shown in Figure 3, the conversion information of Ka-0101 is "0", the conversion information of Kb-1100 is "01", and the Conversion information of Kd-1001 is "11".

(C)

 Each layer in the tree structure receives a layer number as shown in Figure 2, and nodes in the same layer receive relative node numbers in order from left to right. The node position information is generated based on the number of

layer and the relative node number, and this generated position information is used as the conversion information.

(d)

 The NRPs of all nodes in the root to the node to which the selected device key is assigned are retrieved in order from the highest layer to the lowest layer, and from left to right within each layer, and concatenated to Generate conversion information. If necessary, this generated conversion information can be compressed and converted to a series of arbitrary length, and this series is used as the conversion information.

(and)

 The nodes are retrieved in order from the highest layer to the lowest layer starting at the root, and the number of "ones" (or "zeros") is counted to the node to which the device key corresponds. The counted value is used as the conversion information. Here, the counted value can be converted to binary, and the binary data concatenated with NRPs to generate the conversion information. The NRPs used here may be those from the root to the node to which the device key is assigned, or they may be all NRPs retrieved based on those rules. Alternatively, binary data can be concatenated with only the NRP that was last recovered. Another alternative is to concatenate the binary data with an identifier of the device key used.

(F)

 All NRPs from the root to the node to which the device key corresponds are retrieved and converted to decimal numbers,

and the total is used as the conversion information. Alternatively, the NRPs can be subjected, as binary, to an XOR operation, and their result can be used as the conversion information.

(5)

 In the preferred embodiment, the highest bit of an NRP indicates whether a node is in a layer one higher than the leaf; however, this bit can be used to carry other information. For example, the highest bit can be used to indicate whether or not there are valid devices in the descendants of the node. Alternatively, it is possible to use only the lowest two or three bits of the four bits of the NRP. Likewise, it is not necessary for the path number to be two bits. As with NRPs, the route number may have other information attached to it. In addition, it is possible to use all or some bits of the route numbers.

(6)

 In the present invention, the described recovery is not limited to its realization in the order of the highest layer to the lowest layer and from left to right. Any method based on a default rule is possible. For example, recovery can be performed in a direction to the left in the tree structure, or with precedence to depth.

(7)

 In the present invention, the operation to which the conversion information and the media key are subjected is not limited to an XOR operation described in the preferred embodiment. For example, one of the four fundamental arithmetic operations can be used.

(8)

 In the case of a format that includes parity bits in the media key data, the conversion information can be embedded in the bits

parity of the media key, instead of submitting the media key and conversion information to an operation.

For example, when DES encryption is used, eight bits of the 64-bit media key data are parity bits, and the key data generation apparatus 100 converts the media key that has embedded conversion information in these eight bits

It is not necessary for the reproduction apparatus 200 to generate conversion information. Instead, the playback apparatus 200 can read the encrypted media key of the DVD 300, erase the eight parity bits of the media key data, and use the 56 bits of valid key data as the media key.

In addition, with a technique that is not part of the invention, the media key can be converted by embedding a different random number as parity bits each time the media key is encrypted with the device key. Also in this case, the playback apparatus 200 deletes the unverified parity bits, and uses the 56 bits of valid key data as the media key.

(9)

 When parity bits are included as described in (5), the conversion information or a random number can be embedded in some of the parity bits, and the remaining parity bits can be used to carry information. For example, if there are eight parity bits, a random number can be embedded in seven of the bits, and the remaining bit can be used to transport information. An example of how the bit can be used to transport information is to use the bit as a flag indicating, for example, whether or not there is

a list of key identifiers to be revoked on the recording medium in which the key data is recorded. Here, the bit used to transport information is a fixed value for the particular recording medium, but since a random number is embedded as the remaining seven parity bits, the converted media key is different for each device key. However, such an arrangement is not part of the invention.

(10)

 In the preferred embodiment, the key data generation apparatus 100 generates key data, encrypts the content, and writes the key data and the encrypted content on the recording medium. However, it is not necessary for all these operations to be performed by the key data generation apparatus 100. In other words, it is possible to have different devices that respectively generate key data, record key data, and record the content.

In addition, the key data generation apparatus 100 can manage the device keys of the recording apparatus in addition to those of the reproduction apparatus.

In this case, a recording device contains the device keys assigned to the leaves of the tree structure. The key data generation apparatus 100 performs the processing described in the embodiment, generates conversion information and media key data, and writes them to the DVD.

By encrypting the content key to encrypt the content, the recording apparatus performs the same processing as the playback apparatus 200, and selects and obtains an appropriate device key from among the device keys maintained. The recording device encrypts the content key using the media key obtained, and writes the encrypted content key and the encrypted content on the DVD.

In addition, the recording apparatus may use as the content key the key data recorded by the key generating apparatus 100.

(eleven)

 The key data is not limited to burning a DVD. Any recording medium that is portable and mountable in the key data generation apparatus 100 and the playback apparatus 200, such as a CD, MD, MO, or a BD (Blu-ray disc) can be used. In addition, the key data and content may be transmitted from the key data generation apparatus 100 to the reproduction apparatus by Internet communication or the like.

(12)

 The present invention may be the methods shown above. In addition, the methods may be a computer program performed by a computer, and may be a digital signal from the computer program. In addition, the present invention can be a computer readable recording medium such as a flexible disk, a hard disk, a CD-ROM (compact disk-reading memory only), and MO (magneto-optical), a DVD-ROM (versatile digital disk-read memory only), a DVDRAM (versatile digital disk-random access memory), a BD (Blu-ray disc) or semiconductor memory, which saves the computer program

or the digital signal. In addition, the present invention may be the computer program or the digital signal recorded on some of said recording medium devices.

In addition, the present invention may be the computer program or the digital signal transmitted on an electrical communication line, a wireless or cable communication line, or a network of which the Internet is representative.

In addition, the present invention may be a computer system that includes a microprocessor and a memory, the memory being saved by the computer program, and the microprocessor operating according to the computer program.

In addition, by transferring the program or the digital signal to the recording device medium, or by transferring the program or the digital signal via a network or the like, the program or the digital signal can be executed by another independent computer system.

(13) The present invention can be any combination of the embodiment described above and the modifications.

4. Conclusion

As described, the present invention is a content protection system in which the content is only usable by a valid terminal device, including: a key data generation apparatus that includes: a conversion unit operable to convert, based on a default conversion rule, first key data for use when using the content, thereby generating second key data; an operable encryption unit to encrypt the second key data using a device key maintained by the valid terminal apparatus, thereby generating encrypted key data; and an operable output unit for sending the encrypted key data, and a terminal apparatus that includes: an operable obtaining unit for obtaining the encrypted key data; an operable decryption unit to decrypt the encrypted key data using a device key maintained by the terminal apparatus, thereby generating second key data; an operable conversion unit for converting, based on a predetermined conversion rule, the second key data, thereby obtaining first key data; a content use unit operable to use the content, based on the first key data.

In addition, the present invention is a key data generating apparatus that generates key data such that the content can only be used by a valid terminal apparatus, including: an operable conversion unit for converting, based on a rule default conversion, first key data for use when using the content, thereby generating second key data; an operable encryption unit to encrypt the second key data using a device key maintained by a valid terminal apparatus, thereby generating encrypted key data; and an operable output unit to send the encrypted key data.

In addition, the present invention is a terminal apparatus that uses content, including: an operable procurement unit for obtaining encrypted key data that has been generated by a key data generation apparatus converting first key data based on a rule of default conversion to generate second key data and encrypt the second key data using a device key, the first key data being used when using the content; an operable decryption unit to decrypt the encrypted key data using a device key maintained by the terminal apparatus, thereby obtaining second key data; an operable conversion unit for converting, based on a predetermined conversion rule, the second key data, thereby obtaining first key data; and a unit of use of operable content to use the content, based on the first key data.

Depending on the structures indicated, even if the device keys have identical values, the encrypted key data will not necessarily have identical values. In addition, it is not possible to determine whether or not the device keys have identical values using the encrypted key data. Therefore, the illegal acquisition of the first key data can be avoided. Consequently, the revocation of reproduction devices that should not be revoked is avoided.

Here, in the key data generation apparatus, the conversion unit can generate the second key data by generating conversion information for the device key, and perform a reversible operation on the generated conversion information and the first key data. , and the output unit can also send the conversion information.

In addition, the terminal apparatus may further include: a conservation unit operable to maintain a plurality of device keys; and an operable selection unit to select one of the device keys, where the obtaining unit obtains the encrypted data that has been generated by the key data generation apparatus obtaining the second key data by performing a reversible operation on the first key data and conversion information generated for the device key, and encrypting the second key data, the decryption unit decrypted using the selected device key, and the conversion unit generates the first key information generating conversion information for the selected device key, and applying a predetermined operation to the selected device key with the use of conversion information.

According to the indicated structure, the key data generation apparatus applies a reversible operation to the first key data, using the conversion information generated for the selected device key, thereby generating the second key data. Only a terminal device containing the device key is capable of converting the second key data in order to generate the first key data.

Here, the key data generation apparatus may further include: an operable key management unit for corresponding device keys, which are maintained by end devices, with nodes in a tree structure that defines relationships between shared device keys between the terminal devices; and an operable selection unit to select, from among device keys maintained by valid terminal devices, one or more device keys that correspond to a node in a higher position in the tree structure, where the conversion unit generates the Conversion information based on positional information of each of the one or more device keys selected in the tree structure, and the encryption unit encrypts the second key data respectively with the use of each of the one or more keys of selected device.

In addition, in the terminal apparatus, the conversion unit can generate the conversion information from header information attached to the encrypted key data.

In addition, in the terminal apparatus, the header information may be used to generate the conversion information, and may have been generated by the key data generation apparatus, which manages device keys using a tree structure, by selecting, from between device keys maintained by valid terminal devices, one or more device keys that correspond to a node in a higher position in the tree structure, and generating the header information based on positional information of each of the one or more device keys selected in the tree structure, the maintenance unit can maintain positional information of the terminal apparatus, and the conversion unit can generate the conversion information with the use of header information and the positional information maintained.

According to the indicated structure, the key data generation apparatus converts the first key data using conversion information generated based on the position of the selected device key in the tree structure. Therefore, even if the device keys have identical values, a device key in a different position in the tree structure cannot be used to convert the second key data correctly. Consequently, the illegal acquisition of the first key data can be avoided.

Here, the data generation apparatus may further include: an operable key management unit for corresponding device keys, which are maintained by terminal devices, with nodes in a tree structure defining relationships between the device keys shared between the terminal devices and defines whether each of the device keys is revoked or not; and an operable selection unit for selecting, from among device keys maintained by valid terminal devices, one or more device keys that correspond to a node in a higher position in the tree structure, where the conversion unit generates information Conversion for each of the one or more selected device keys based on revocation information defined based on the node to which the selected device key corresponds and a revocation status of other nodes.

In addition, in the terminal apparatus, the header information may be to generate conversion information, and may have been generated by corresponding device keys, which are maintained by terminal devices, with nodes in a tree structure that defines relationships between the keys of device shared between the terminal devices and defines whether each of the device keys is revoked or not, select, from among device keys maintained by valid terminal devices, at least one device key that corresponds to a node in a position higher in the tree structure, and base the header information on revocation information defined based on the node with which the selected device key corresponds and a revocation state of other nodes, the maintenance unit can maintain positional information of the terminal apparatus in a tree structure to manage parking device keys terminal data in the key data generation apparatus, and the conversion unit can generate the conversion information with the use of the header information and the positional information maintained.

According to the indicated structure, the conversion information is generated according to the positional relationship in the tree structure of the revoked device key, and therefore a device key that has a different position in the tree structure cannot be used for convert the second key data correctly. Consequently, the illegal acquisition of the first key data can be avoided.

Here, in the key data generation apparatus, the conversion unit can generate the conversion information for each of the one or more selected device keys concatenating ID information elements, each of which identifies a path in a path from a root to the node that corresponds to the device key selected in the tree structure.

In addition, in the key data generation apparatus, the conversion unit can generate, such as the conversion information for each of the one or more selected device keys, data expressing a node position corresponding to the key of selected device, expressing the position in terms of a positional relationship between layers in the tree structure and between nodes in the same layer.

In addition, the conversion unit can generate the conversion information by concatenating revocation information elements, each of which refers to a node placed in a path from a root to the node to which the selected device key corresponds.

In addition, in the key data generation apparatus, the conversion unit may generate the conversion information by concatenating, from among revocation information corresponding to nodes arranged in a predetermined order, a first revocation information element through a node revocation information element that corresponds to the selected device key.

According to the indicated structure, since there are numerous configurations according to the position of the device key in the tree structure, a terminal device that does not have the positional information of the valid device key in the tree structure is unable to generate information from conversion, and therefore unable to acquire the first key data.

Here, in the key data generation apparatus, the conversion unit can generate the second key data by generating conversion information for the device key, and embedding the conversion information in at least part of a redundant portion of the first key data

In addition, in the key data generation apparatus, the conversion unit generates the second key data by generating a random number for the device key, and embedding the random number generated in at least part of a redundant portion of the first data. of key.

In addition, in the terminal apparatus, the second key data may be generated by the key data generation apparatus by embedding conversion information generated for the device key in at least part of a redundant portion of the first key data, and The conversion unit can generate the first key data by deleting a redundant portion of the second key data.

According to the indicated structure, when a redundant bit is included in the first key data, the redundant bit is embedded with conversion information or with a value that is different for each conversion, thus making it difficult to find encrypted key data with a key. of device of identical value. Therefore, only a terminal device that is capable of specifying the correct position of the key data is able to acquire the first key data.

Here, in the key data generation apparatus, the conversion unit can use a remaining part of the redundant portion in which the random number is not embedded to carry other information.

According to the indicated construction, a random number is embedded in some of the redundant bits, and the remaining redundant bits are used to transport information. Therefore, the other information can be

5 transported while preventing the illegal acquisition of the first key data. INDUSTRIAL APPLICABILITY

The present invention can be used in a key management method that uses a tree structure, and 10 is especially suitable for preventing ile acquisition.

gal of key data.

Claims (7)

1. A content protection system including a key data generation apparatus (100) that uses a tree structure to manage a plurality of device keys maintained by a terminal apparatus (200), and the terminal apparatus (200) , the key data generation apparatus (100) for generating header information based on positional information of selected device keys in the tree structure, a selection unit (102), operable to select one or more device keys corresponding to revocation information, a conversion unit (103) operable to convert first key data used to encrypt content, performing a predetermined conversion with the use of conversion information generated for a selected device key used for encryption of the first key data, generating by it second key data; an encryption unit (105) operable to encrypt the second key data using the device key, thereby generating encrypted key data; an output unit (110) operable to send the encrypted key data, which has the header information attached and The terminal apparatus (200) includes: a conservation unit (202) operable for maintain a plurality of device keys and to maintain positional key information of device of the terminal apparatus in the structure of tree; a procurement unit (207) operable to obtain the encrypted key data and the header information that is attached to the encrypted key data; a selection unit (201) operable for se read one of the device keys you run concerning revocation information, an decryption unit (203) operable to decrypt the encrypted key data using the selected device key maintained by the conservation unit (202), thereby generating the second key data; a conversion unit (204) operable to generate conversion information from the header information and positional information, and convert the second key data, performing a predetermined conversion with the use of the generated conversion information; thereby generating the first key data; Y a content use unit (205, 206, 208) operable to send the decrypted content using the first key data. 2. A terminal device that decrypts content in crypto, including: a procurement unit (207) operable to obtain (a) encrypted key data generated by a key data generation apparatus that uses a tree structure to manage a plurality of device keys maintained by the terminal apparatus, the key data generation apparatus generating key data encrypted by submitting first key data, which is used to encrypt the content, to a predetermined conversion with the use of conversion information generated for a selected device key thereby generating second key data, and encrypting the second key data using the selected device key, and (b) header information that is information to generate the conversion information, and that is generated based on tree structure positional information of the selected device key used to generate the encrypted key data; a conservation unit (202) operable to maintain a plurality of device keys; Y to maintain positional information of the device keys of the terminal apparatus in the tree structure; a selection unit (201) operable to select one of the device keys corresponding to revocation information; an decryption unit (203) operable to decrypt the encrypted key data using the selected key of the device keys maintained by the conservation unit (202), thereby generating the second key data; a conversion unit (204) operable to generate conversion information from the header information and positional information, and convert the second key data, performing a predetermined conversion with the use of the generated conversion information, thereby generating the first key data; Y a content use unit (205, 206, 208) operable to send the decrypted content using the first key data.

3.

 The terminal apparatus of claim 2, wherein the revocation information defines whether each of the device keys is revoked or not, based on the node with which the selected device key corresponds and a revocation status of other nodes.

Four.

 The terminal apparatus of claim 2 or 3, wherein the content use unit (208) further includes: a content obtaining sub-unit (205) ope

rable to get encrypted content; a decryption sub-unit (206) operable to decrypt the encrypted content, based on the pri mere key data, thereby generating content; and a reproduction sub-unit (208) operable for Play the content.

5.

 The terminal apparatus of any of claims 2-4, wherein the header information is appended to the encrypted key data and has been generated by the key data generation apparatus.

6.

 A method in a terminal apparatus including an operable conservation unit to maintain a plurality of device keys, and to maintain positional information of the terminal apparatus in a tree structure,

including the method: an obtaining step consisting of obtaining (a) encrypted key data generated by a key data generation apparatus that uses the tree structure to manage a plurality of device keys maintained by the terminal apparatus, generating the generation apparatus of key data encrypted key data by submitting first key data, which is used to encrypt content using default conversion with the use of conversion information generated for a selected device key, thereby generating second key data, and encrypting the second key data using the selected device key, and (b) header information that is information to generate the conversion information, and that is generated based on tree structure positional information of the selected device key used to generate the encrypted key data; a selection step to select one of the device keys corresponding to revocation information; an decryption step consisting of dec encrypt encrypted key data using one of device keys maintained by the device 5 terminal, thereby generating second key data; a conversion step consisting of generating conversion information from the information header and positional information, and convert 10 the second key data performing a predetermined conversion with the use of the generated conversion information, thereby generating the first key data; Y A content use step consisting of sending the decrypted content using the first key data. 7. A computer-readable recording medium that stores a computer program used in a terminal device, making the computer program that switches it 20 to terminal perform a method including the steps of claim 6.