JP4441303B2 - Rights data delivery apparatus and rights data delivery method - Google Patents

Description

  The present invention relates to a right data distribution apparatus and a right data distribution method, and is suitable for application to, for example, a server in a right data distribution system for protecting copyright of digital contents.

  Information disclosed on the Internet or the like may be accessed by an unspecified number of users. In addition, when a server or the like must be installed in a place where many users physically access, it is necessary to prevent illegal acts such as hacking. For this reason, PKI (Public Key Infrastructure) using public key cryptography was considered as a mechanism for safely transmitting and receiving data.

  Hereinafter, a general PKI described in Patent Document 1 will be described. In electronic commerce on the Internet or the like, there is a certification authority called CA (Certification Authority), for example, as a third party that objectively guarantees the trust of a trading partner. For the public key used in PKI, a certificate for the key is issued by the CA. The CA creates a message digest (hash value) using a hash function, and encrypts the created message digest with the CA's private key to create a signature. The certificate describes the method of obtaining the message digest. When verifying the validity of the other party or the validity of the data, a message digest obtained by the method described in the certificate, a message digest obtained by decrypting the signature attached to the public key with the CA public key, and Compare As a result of the comparison, if they are the same, it can be seen that the public key is a CA-certified key.

  In such a PKI, when a key is lost or leaked to another person, it is necessary to invalidate the private key, the public key paired with the private key, the public key certificate of the public key, etc. is there. This is called revocation. In PKI, a public key certificate is used to verify the validity of the principal and data, and it is important to know whether or not the public key certificate has been revoked. There are the following methods for knowing certificate revocation.

  A first method is to create a list of revoked certificates called CRL (Certification Revocation List), and a trusted organization such as CA distributes the CRL to the verifier.

  Second, a method using a protocol called OCSP (Online Certificate Status Protocol). This method is a method in which a trusted organization has a list such as CRL, and each time a verifier verifies an electronic signature, it inquires of the organization whether the certificate is valid. This method requires less communication cost for transmitting information related to revocation than the first method described above.

  In any of the above methods, it is possible to know whether the certificate is valid or invalid. By the way, when considering a service for distributing copyright-protected digital content (hereinafter simply referred to as “content”) to a client (such as a mobile terminal), the client guarantees the safety of the distributed content, In some cases, a DRM (Digital Rights Management) system is supported in order to prevent unauthorized copying or illegal leakage of content.

  In the DRM system, a use authority corresponding to each content is given (described as right data regarding handling), and use such as reproduction of content is managed based on this right data. Therefore, if there is no right data, the content cannot be used, and if the use authority in the right data is lost, the content cannot be used.

  Therefore, the distribution side distributes the right data only to clients for which the DRM system is guaranteed to be safe. The content corresponding to the rights data may be combined with the rights data, or may be separated from the rights data.

  Here, client authentication is required at the time of distribution when rights data is distributed. If the content is separated from the right data, the content is distributed without authenticating the client. Also good.

  If the content and rights data are combined, the distribution side only combines the rights data only for the clients for which the DRM system is guaranteed to be secure, as in the case of distributing only the right data. Right data and contents are distributed.

  As described above, since the distribution of the right data is performed only for the client for which the DRM system is guaranteed to be safe, the right data is distributed to the client for which the safety of the DRM system is not guaranteed. Absent. As a cause of this happening, unauthorized detection of the DRM system can be cited. The fraud detection of the DRM system includes leakage of a secret key, hacking, etc., and the content cannot be protected by such fraud detection, and illegal copying, falsification, impersonation, etc. are possible. Here, the content protection means that in order to use the content, the right data corresponding to the content is required, and the use of the content is limited to the range permitted by the right data.

  FIG. 18 is a system configuration diagram showing a server and a client that supports the DRM system. In this figure, the server 11 receives a client certificate from the client 12. Then, the authenticity of the client certificate is determined, and it is determined from the revocation list whether or not the client certificate has been revoked. The authenticity of the client certificate means that the client certificate is signed by a third party that is trusted by the server 11 and that the contents are not incomplete. If there is no problem with the client certificate, that is, if the client certificate is credible and not included in the revocation list, the server 11 distributes the right data to the client 12.

  In recent years, with the diversification of services, a service for exporting distributed rights data and contents corresponding to the rights data to an external memory such as a memory card is desired. Export refers to converting and outputting rights data managed by a DRM system and content corresponding to the rights data so that it can be used by another DRM system. In such a service, the client manages the distributed rights data and the content corresponding to the rights data (an export source DRM system, hereinafter referred to as “DRM1”), the rights data after the export, and the rights data. It is necessary to support two DRM systems of a DRM system (hereinafter referred to as “DRM2”) that manages content corresponding to the above. Therefore, the distribution side needs to confirm the safety of not only DRM1 but also DRM2 when distributing the right data.

FIG. 19 is a system configuration diagram illustrating a server and a client that supports a plurality of DRM systems. In this figure, the server 21 determines the authenticity of the client certificate received from the client 22 and determines whether or not the client certificate has been revoked from the revocation list. Here, the client certificate of the client having an illegal DRM1 or an illegal DRM2 is shown in the revocation list. For this reason, if fraud is detected in either one of DRM1 and DRM2, the server 21 does not distribute right data.
JP 2003-143137 A

  However, if any one of a plurality of DRM systems has an illegal DRM system, if all rights data is not distributed and content cannot be reproduced, a great inconvenience occurs for the client. For example, even if fraud is detected only in the DRM system that manages the rights data after the export and the content corresponding to the rights data, if the rights data is not permitted to be exported, the rights data of the export source and the rights are originally exported. Since the user does not leave the normal management of the DRM system that manages the content corresponding to the data, the content can be protected. Nevertheless, if even such right data is not distributed, the server on the distribution side cannot provide the service requested by the client.

  The present invention has been made in view of this point, and an object of the present invention is to provide a right data distribution apparatus and a right data distribution method that flexibly control right data to be distributed while protecting content.

The right data distribution apparatus of the present invention converts the first right data managed by the first DRM system and the content corresponding to the first right data so that they can be used by the second DRM system, and exports them. A right data distribution apparatus in the right data distribution system, the receiving means for receiving a client certificate sent from a client, and the first DRM system in the client corresponding to the client certificate A first revocation list issued by a third-party organization indicating that the right data and the content management corresponding to the first right data are illegal, and the second DRM system after the export The third right data indicates that the content management corresponding to the second right data is illegal. An acquisition means for acquiring a second revocation list issued by an institution, and (1) if the client certificate corresponds to the first revocation list, the right data permitting export and the export are prohibited. (2) When the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export can be distributed. On the other hand, it is determined that the right data permitting export cannot be distributed. (3) If the client certificate does not correspond to the first revocation list and the second revocation list, the right data permitting export. And determination means for determining that the right data prohibiting export can be distributed .

In the above configuration, the right data distribution apparatus of the present invention is configured such that, when the client certificate does not have the signature of the third party organization, the determination unit includes right data that permits export and right data that prohibits export. Use a configuration that determines that delivery is not possible.

The right data distribution method of the present invention converts the first right data managed by the first DRM system and the content corresponding to the first right data so that they can be used by the second DRM system and exports them. The right data distribution method in the right data distribution system for receiving the client certificate sent from the client, wherein the right data distribution device for distributing the first right data and the content corresponding to the first right data Indicating that there is a fraud in the receiving step and the first rights data remaining in the first DRM system in the client corresponding to the client certificate and the content management corresponding to the first rights data, A first revocation list issued by a tripartite organization and a second DRM system second after export An acquisition step in which the right data distribution apparatus acquires a second revocation list issued by the third party that indicates that there is fraud in interest data and content management corresponding to the second right data And (1) when the client certificate corresponds to the first revocation list, the right data distribution device determines that the right data that permits export and the right data that prohibits export cannot be distributed, 2) If the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export is determined to be deliverable, while the right data permitting export (3) If the client certificate does not correspond to the first revocation list and the second revocation list, e.g. It adopts a configuration comprising a determining step of determining that can be delivered right data to prohibit the rights data and export to allow port, the.

  As described above, according to the present invention, the right data to be distributed can be flexibly protected while determining the type of right data that can be distributed according to the content protection capability of the client at the time of distributing the right data. Can be controlled.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(Embodiment 1)
In the first embodiment of the present invention, the content protection capability of the client at the time of distribution of right data is expressed for each level as a revocation level, and the right data type permits export (hereinafter referred to as “export permission right data”). A case will be described in which data is classified into two types of right data for which export is prohibited (hereinafter referred to as “export prohibited right data”), and which type of right data can be distributed is determined according to the revocation level.

  FIG. 1 is a configuration diagram of a right data distribution system according to Embodiment 1 of the present invention. In this figure, a client 101 has a function of exporting right data distributed from a server 105 via the Internet network and content corresponding to the right data to an external memory 102 such as a memory card. Among them, DRM1 for managing the right data remaining in the client 101 and the content corresponding to the right data, and DRM2 for managing the right data after export and the content corresponding to the right data are supported. When the client 101 needs rights data corresponding to desired content, the client 101 sends a client certificate to the server to request delivery of the rights data.

  If the DRM 1 of the client 101 is invalid, the certificate authority 103 determines that there is a serious defect in the right data and content management corresponding to the right data (high revocation level), and the client certificate of the client 101 is revoked in the revocation list 1. If the DRM 2 is fraudulent, the client certificate is registered in the revocation list 2 because the right data and the content management corresponding to the right data have a minor defect (low revocation level). That is, the revocation list 1 corresponds to a high revocation level, and the revocation list 2 corresponds to a low revocation level. The certificate authority 103 thus issues the revocation lists 1 and 2 according to the revocation level in a timely manner, and distributes the issued revocation list to the revocation list storage device 104.

  The revocation list storage device 104 stores the latest revocation list distributed from the certificate authority 103 and distributes the revocation list to the server 105.

  The server 105 acquires the latest revocation list from the revocation list storage device 104 in a timely manner. The server 105 authenticates the client certificate and confirms the revocation lists 1 and 2, and determines the right data type that can be distributed to the client 101. If there is a right data type that can be distributed, a list of right data corresponding to the right data type is notified to the client 101 as right data that can be distributed, and if there is no right data type that can be distributed, an authentication error is notified to the client 101 To do. As a result, the client 101 selects desired right data from the distributable right data list notified from the server 105, and requests the selected right data from the server 105 to receive distribution of the desired right data. be able to.

  FIG. 2 is a block diagram showing an internal configuration of the server according to Embodiment 1 of the present invention. In this figure, the transmission / reception unit 201 transmits / receives data to / from the client 101 and the revocation list storage device 104. Specifically, in the transmission / reception with the client 101, the client certificate is received or the right data is transmitted. Further, in the transmission / reception with the revocation list storage device 104, the revocation list sent is received or a revocation list acquisition request is transmitted.

  The client certificate authenticating unit 202 confirms that the client certificate received by the transmitting / receiving unit 201 has a signature of a third party and that there is no defect, that is, authenticity. If there is credibility, it requests the revocation list confirmation unit 205 to confirm whether or not the client certificate corresponds to the revocation list, and outputs revocation list reference destination information included in the client certificate to the revocation list acquisition unit 203. If there is no credibility, the client 101 is notified of an authentication error via the transmission / reception unit 201.

  The revocation list acquisition unit 203 checks whether or not the latest revocation list 1 and / or revocation list 2 is stored in the revocation list storage unit 204. If the revocation list is not stored, the revocation list provided outside the server 105 is checked. The latest revocation list 1 and / or revocation list 2 not stored in the revocation list storage unit 204 is acquired from the storage device 104 via the transmission / reception unit 201, and the acquired revocation lists 1 and 2 are stored in the revocation list storage unit 204. Output. Note that the acquisition source of the revocation list 1 and / or the revocation list 2 is determined based on the revocation list reference destination information output from the client certificate authentication unit 202.

  When the revocation list is output from the revocation list acquisition unit 203, the revocation list storage unit 204 updates the revocation list that has been output, and stores the revocation list for each revocation list, that is, for each revocation level. The stored revocation list is referred to by the revocation list confirmation unit 205 as necessary.

  The revocation list confirmation unit 205 confirms whether the certificate confirmed as authentic by the client certificate authentication unit 202 corresponds to either the revocation list 1 or the revocation list 2 stored in the revocation list storage unit 204. . The confirmation result is notified to the distributable right data type judgment unit 206.

  Distributable right data type determination unit 206 determines the right data type that can be distributed to client 101 based on the revocation list confirmation result notified from revocation list confirmation unit 205. If there is a right data type that can be distributed, it is stored in the right data storage unit 207, and a list of right data corresponding to the right data type that can be distributed is notified to the client 101 via the transmission / reception unit 201. If there is no right data type that can be distributed, an authentication error is notified to the client 101 via the transmission / reception unit 201. Details of the distributable right data type determination unit 206 will be described later.

  The right data storage unit 207 stores the right data distributed by the server 105, and the right data provision unit 208 acquires the right data requested by the client 101 from the right data storage unit 207 via the transmission / reception unit 201. . The acquired right data is distributed to the client 101 via the transmission / reception unit 201.

  FIG. 3 is a diagram showing the format of the client certificate according to the first embodiment of the present invention. In this figure, the certificate ID 301 stores unique ID information (client identification information) indicating a client certificate.

  The expiration date 302 indicates the expiration date of the client certificate by the start date and the expiration date, and the public key 303 stores information on the public key corresponding to the private key owned by the client.

  In the revocation list 1 reference destination 304 and the revocation list 2 reference destination 306, information (address such as URL) indicating the location of the revocation list stored in the revocation list storage device 104 is stored.

  The revocation list 1 level 305 and the revocation list 2 level 307 show the levels of the revocation list, the revocation list 1 level 305 is set to a high revocation level, and the revocation list 2 level 307 is set to a low revocation level. Yes. However, if revocation level information is added to the target revocation list, it may be omitted.

  The signature 308 of the certificate issuer indicates the signature of the issuer (certificate authority) that issued the client certificate. The certificate issuer must be an issuer trusted by the server 105.

  As described above, the reference destinations of the revocation lists 1 and 2 and the revocation level of each revocation list are stored in the client certificate, and the server 105 confirms the corresponding revocation list based on such information. Become.

  FIG. 4 is a diagram showing a revocation list format according to the first embodiment of the present invention. In this figure, the revocation level 401 stores revocation level information of the entire revocation list. However, if the revocation level information of the revocation list referred to the client certificate is added, it may be omitted.

  The revoked certificate ID 402 stores the certificate ID of a revoked client certificate corresponding to the revocation level of the revocation list.

  The signature 403 of the revocation list issuer indicates the signature of the issuer (certificate authority) that issued the revocation list.

  The format shown in FIG. 4 is applied to both the revocation lists 1 and 2 formats.

  Next, the operation of the server 105 having the above configuration will be described. FIG. 5 is a flowchart showing client authentication and distributable right data type determination processing of the server 105 according to Embodiment 1 of the present invention. In this figure, in step (hereinafter abbreviated as “ST”) 501, the transmission / reception unit 201 receives the client certificate sent from the client. In ST502, the client certificate authentication unit 202 receives the authenticity of the client certificate. If there is credibility, the process proceeds to ST503, and if there is no credibility, the process proceeds to ST507.

  In ST503, for the client confirmed to be credible in ST502, the revocation list confirmation unit 205 refers to the revocation list 1 of the high revocation level from the revocation list storage unit 204, and the client certificate corresponds to the revocation list 1 If it does not correspond to the revocation list 1, the process proceeds to ST504, and if it corresponds to the revocation list 1, the process proceeds to ST507.

  In ST504, similarly, the revocation list confirmation unit 205 refers to the revocation list 2 of the low revocation level from the revocation list storage unit 204, confirms whether the client certificate corresponds to the revocation list 2, and does not correspond to the revocation list 2. If it corresponds to the revocation list 2, the process proceeds to ST506.

  In ST505, the distributable rights data type determination unit 206 sets both the export permission right data and the export prohibition right data as distributable, and in ST506, the distributable right data type determination unit 206 sets the export prohibition right data as distributable. Then, the client authentication and the distributable right data type determination process are finished. Further, in ST507, an authentication error is notified to the client confirmed as having no credibility in ST502. Further, since there is no right data type that can be distributed to a client that has been confirmed to be in the revocation list 1 in ST503, the client is an unauthorized client in the same manner as a non-credible client, so an authentication error is notified to the client. When the authentication error is notified, the client authentication and the distributable right data type determination process are terminated.

  FIG. 6 is a diagram for explaining the determination criteria of the distributable rights data type determination unit 206 according to Embodiment 1 of the present invention. First, in this embodiment, two levels of revocation levels are set, a high revocation level and a low revocation level, and therefore three patterns of clients including normal clients can be considered. Hereinafter, the rights data types that can be distributed for these three patterns will be described. In the figure, ○ indicates that distribution is possible, and x indicates that distribution is not possible.

  A fraud is detected in the DRM 1 that manages the distributed right data in the client, and the client having a high revocation level (high revocation level) has no ability to protect the distributed right data and the content corresponding to the right data. Therefore, it is determined that the right data permitting export (export permission right data) and the right data prohibiting export (export prohibition right data) cannot be distributed.

  Further, it is determined that only export-prohibited rights data can be distributed to a client whose DRM 2 that manages the rights data after export and the contents corresponding to the rights data is found to be invalid and whose revocation level is low (low revocation level). The Since the export prohibition rights data originally does not permit the export of the rights data and the contents corresponding to the rights data, there is no need for management after the export, and if DRM1 is normal, the rights data and its data are distributed. There is no problem in protecting the content corresponding to the rights data.

  It is determined that the export permission right data and the export prohibition right data can be distributed to normal clients not registered in the revocation list.

  In this way, by determining the right data type that can be distributed according to the revocation level, it is possible to prevent the distribution of the right data and content corresponding to the right data to clients that may be illegally used. be able to. Thus, even when fraud is detected in DRM2, the right data corresponding to the export prohibition right data can be distributed. Therefore, if the right data desired by the client is the export prohibition right data, the client's request is satisfied. Can do.

  As described above, according to the present embodiment, which right data type of export permission right data and export prohibition right data can be distributed based on the revocation level indicating the content management capability of the client at the time of distribution of the right data. By determining the right data corresponding to the right data type within the content management capability of the client, the right data can be distributed flexibly while satisfying the client's request while protecting the content. it can.

  In this embodiment, when a client already registered in a revocation list with a low revocation level is also registered with a higher revocation level, the revocation list with a low revocation level is prevented in order to prevent an increase in the data amount of the revocation list. Registration from may be deleted.

(Embodiment 2)
In the first embodiment, the server acquires the revocation list and confirms the revocation list. However, in the present embodiment, the device outside the server acquires the revocation list and confirms the revocation list. explain.

  FIG. 7 is a configuration diagram of a right data distribution system according to the second embodiment of the present invention. However, the parts in FIG. 7 common to FIG. 1 are denoted by the same reference numerals as those in FIG. 7 is different from FIG. 1 in that the server 105 is changed to the server 701 and the revocation list storage device 104 is changed to the revocation list confirmation device 702.

  The server 701 requests the revocation list confirmation device 702 to confirm the revocation list based on the client certificate sent from the client 101.

  The revocation list confirmation device 702 acquires and stores a revocation list issued from the certificate authority 103 in a timely manner, and when a revocation list confirmation request is made from the server 701, confirms whether the client certificate is registered in the revocation list, The confirmation result is returned to the server 701.

  FIG. 8 is a block diagram showing an internal configuration of the server 701 according to Embodiment 2 of the present invention. However, the parts in FIG. 8 that are the same as those in FIG. 2 are denoted by the same reference numerals as those in FIG. 8 differs from FIG. 2 in that the revocation list confirmation unit 205 is changed to a revocation list confirmation request unit 801 and the revocation list acquisition unit 203 and the revocation list storage unit 204 are deleted.

  The client certificate authentication unit 202 confirms that the client certificate output from the transmission / reception unit 201 has a signature of a third party and that there is no defect, that is, credibility. If there is authenticity, the client requests the revocation list confirmation requesting unit 801 to confirm whether the client certificate corresponds to the revocation list. If there is no authenticity, the client 101 is notified of an authentication error via the transmission / reception unit 201. To do.

  The revocation list confirmation request unit 801 transmits and receives confirmation of whether or not the certificate is registered in the revocation list based on the revocation list reference destination information included in the client certificate output from the client certificate authentication unit 202. The request is sent to the revocation list confirmation device 702 via the unit 201.

  In accordance with the revocation list confirmation request, the revocation list confirmation device 702 confirms whether or not the requested client certificate is registered in the revocation list and distributes the confirmation result via the transmission / reception unit 201 of the server 701. The type determination unit 206 is notified.

  The distributable right data type determination unit 206 determines the right data type that can be distributed to the client 101 based on the revocation list confirmation result notified from the revocation list confirmation device 702 via the transmission / reception unit 201. If there is a right data type that can be distributed, it is stored in the right data storage unit 207, and a list of right data corresponding to the right data type that can be distributed is notified to the client 101 via the transmission / reception unit 201. If there is no right data type that can be distributed, an authentication error is notified to the client 101 via the transmission / reception unit 201.

  The format of the client certificate in this embodiment is the same as the format shown in FIG. 3, but the revocation list reference destinations 304 and 306 are changed to information indicating the location in the revocation list confirmation apparatus.

  Next, the operation of the server 701 having the above configuration will be described. FIG. 9 is a flowchart showing client authentication and distributable right data type determination processing of the server 701 according to the second embodiment of the present invention. However, in this figure, the same reference numerals as those in FIG. In ST901, the revocation list confirmation requesting unit 801 requests the revocation list confirmation device 702 to confirm the revocation list 1 via the transmission / reception unit 201 for the client confirmed to be credible in ST502.

  In ST902, the distributable right data type determination unit 206 acquires the revocation list 1 confirmation result from the revocation list confirmation device 702 via the transmission / reception unit 201.

  In ST903, the revocation list confirmation request unit 801 requests the revocation list confirmation apparatus 702 to confirm the revocation list 2 via the transmission / reception unit 201 for the client confirmed in ST503 as not corresponding to the revocation list 1.

  In ST904, the distributable right data type determination unit 206 acquires the revocation list 2 confirmation result from the revocation list confirmation device 702 via the transmission / reception unit 201.

  In this way, by causing the revocation list confirmation device to perform the revocation list confirmation operation, there is no need to acquire, store, and confirm the revocation list that has been performed by the server according to the first embodiment, and the processing load on the server Can be reduced.

  As described above, according to the present embodiment, the revocation list confirmation apparatus provided outside the server performs acquisition and storage of the revocation list and confirmation of whether or not the client certificate is registered in the revocation list. The processing burden can be reduced.

  In this embodiment, when a client already registered in a revocation list with a low revocation level is also registered with a higher revocation level, the revocation list with a low revocation level is prevented in order to prevent an increase in the data amount of the revocation list. Registration from may be deleted.

(Embodiment 3)
In the first and second embodiments, the case where the revocation list is issued for each revocation level has been described. In the third embodiment of the present invention, the case where one revocation list including different revocation levels is issued will be described. Since the configuration of the right data distribution system and the internal configuration of the server are the same as those of the first embodiment, FIG. 1 and FIG. 2 are used, and detailed descriptions thereof are omitted.

  FIG. 10 is a diagram showing a revocation list format in the third embodiment of the present invention. As shown in this figure, the revocation list includes information in which a revoked certificate ID is associated with a revocation level of the certificate. Thereby, client certificates having different revocation levels can be combined into one revocation list. When this revocation list is used, the format of the client certificate may be as shown in FIG. 11, and the amount of revocation list reference destination information described in the client certificate can be reduced.

  FIG. 12 is a flowchart showing server client authentication and distributable right data type determination processing according to Embodiment 3 of the present invention. However, the parts in FIG. 12 that are the same as those in FIG. 5 are given the same reference numerals as those in FIG. In ST1201, the revocation list confirmation unit 205 refers to the revocation list from the revocation list storage unit 204 for the client confirmed to be credible in ST502, and confirms whether the client certificate corresponds to the revocation list. If so (YES), the process proceeds to ST1202, and if not applicable (NO), the process proceeds to ST505.

  In ST1202, for the client confirmed to be in the revocation list in ST1201, the revocation list confirmation unit 205 determines whether or not the revocation list is at a high revocation level. If it is level (NO), the process proceeds to ST506.

  As described above, according to the present embodiment, by issuing one revocation list including different revocation levels, it is possible to reduce the amount of revocation list reference destination information described in the client certificate. The amount of information in the book can be reduced.

  In the present embodiment, the configuration of the right data distribution system and the internal configuration of the server have been described as being the same as those in the first embodiment, but the same configuration as that in the second embodiment may be used. That is, the certificate authority issues the revocation list shown in FIG. 10, the revocation list confirmation device 702 acquires and stores the revocation list, and returns the corresponding revocation level to the server 701 in response to the revocation list confirmation request of the server 701. You may do it. In this case, the client certificate uses the format shown in FIG. 11, and the revocation list reference destination is information indicating the location in the revocation list confirmation device.

  In the first and second embodiments, all revocation list reference destinations are included in the client certificate format, but the revocation list storage device 104 and the revocation list confirmation device 702 manage the revocation lists in association with each revocation level. In this case, only one revocation list reference destination needs to be stored in the client certificate. Thereby, the data amount of the client certificate can be reduced.

  Further, as shown in FIG. 13, by adding another revocation list reference destination to the revocation list format, the revocation list acquisition unit 203 of the server 105 is based on another revocation list reference destination indicated in the acquired revocation list. Other revocation lists can also be obtained. Thus, the client certificate only needs to store one revocation list reference destination for one client, and the data amount of the client certificate can be reduced. For example, the revocation list reference destination of the client certificate shows only the revocation list reference destination of the high revocation level, and the revocation list of the high revocation level shows the revocation list reference destination of the low revocation level as another revocation list reference destination. In this way, if the server confirms that the client certificate is on the high revocation list, it does not need to obtain the low revocation list and does not fall on the high revocation list. If it is confirmed, a revocation list with a low revocation level may be obtained. For example, the server acquires the revocation list indicated in the revocation list reference destination of the client certificate, and acquires another revocation list based on the other revocation list reference destination indicated in the acquired revocation list. The revocation list corresponding to the client certificate may be confirmed.

(Embodiment 4)
In the first to third embodiments, the case where there is one export destination external memory has been described. In the fourth embodiment of the present invention, the case where there are two export destination external memories will be described.

  FIG. 14 is a configuration diagram of a right data distribution system according to Embodiment 4 of the present invention. However, the parts in FIG. 14 that are the same as those in FIG. 1 are given the same reference numerals as those in FIG. FIG. 14 differs from FIG. 1 in that the client 101 is changed to a client 1401.

  The client 1401 has a function of exporting the right data distributed from the server 105 via the Internet network and the content corresponding to the right data to the external memory 102 such as a memory card and the external memory 1402, and the distributed right data Among them, DRM1 for managing the right data remaining in the client 1401 and the content corresponding to the right data, DRM2 for managing the right data after being exported to the external memory 102 and the content corresponding to the right data, and the external memory The rights data after being exported to 1402 and the DRM 3 that manages the content corresponding to the rights data are supported. When the client 1401 needs rights data corresponding to the desired content, the client 1401 sends a client certificate to the server to request delivery of the rights data.

  The external memory 1402 is a memory that must correspond to a DRM system (DRM3) different from the DRM system (DRM2) corresponding to the external memory 102. For example, when the external memory 102 is an SD memory card and the external memory 1402 is a magic gate memory stick, a DRM system for exporting to each external memory is required.

  In the present embodiment, there are the following four types of right data. One is the right data that prohibits all exports (hereinafter referred to as “right data type 1”), and the second is that export to the external memory 102 is permitted, and export to the external memory 1402 is prohibited. Right data (hereinafter referred to as “right data type 2”), and three types of right data that permit export to the external memory 1402 and prohibit export to the external memory 102 (hereinafter referred to as “right data type”). 4 ”is the right data that permits both the export to the external memory 102 and the external memory 1402.

  FIG. 15 is a diagram showing a revocation list format according to the fourth embodiment of the present invention. As shown in this figure, the revocation list includes information in which a revoked certificate ID is associated with an external memory (export prohibited medium) that prohibits export of the corresponding client. Here, export prohibited medium information is used as the revocation level indicating the content management capability of the client at the time of right data distribution.

  Since the revoked certificate ID 1501 is found to be illegal in DRM2, the export prohibited medium is the external memory 102, and the right data corresponding to right data type 1 and right data type 3 can be distributed to the client. It is shown that.

  Since the revoked certificate ID 1502 is found to be fraudulent in DRM 3, the export prohibited medium is the external memory 1402, and the right data corresponding to right data type 1 and right data type 2 can be distributed to the client. It is shown that.

  The revoked certificate ID 1503 indicates that the DRM 1 has been found to be fraudulent, so that no export-prohibited medium is designated and all right data cannot be distributed.

  Since the revoked certificate ID 1504 is found to be illegal in DRM2 and DRM3, the export prohibited medium is the external memory 102 and the external memory 1402, and the export prohibited medium is continuously designated. In this case, only the right data corresponding to the right data type 1 can be distributed to the client.

  FIG. 16 is a flowchart showing server client authentication and distributable rights data type determination processing according to Embodiment 4 of the present invention. However, the parts in FIG. 16 that are the same as those in FIG. 12 are given the same reference numerals as those in FIG. In addition, since the internal structure of the server which concerns on this Embodiment is the same as FIG. 2, it demonstrates using FIG.

  In ST1601, for the client whose client certificate does not correspond to the revocation list in ST1201, the distributable right data type determination unit 206 sets the right data types 1 to 4 as the distributable right data type, and the client authentication and the distributable right The data type determination process ends.

  In ST1602, the revocation list confirmation unit 205 refers to the revocation list from the revocation list storage unit 204, confirms whether a client corresponding to the revocation list is prohibited from being exported to the external memory 102, and is prohibited from being exported to the external memory 102. If yes (YES), the process proceeds to ST1603, and if not prohibited (NO), the process proceeds to ST1606.

  In ST1603, the revocation list confirmation unit 205 refers to the revocation list from the revocation list storage unit 204, confirms whether the client corresponding to the revocation list is prohibited from exporting to the external memory 1402, and prohibits export to the external memory 1402. If yes (YES), the process proceeds to ST1604, and if not prohibited (NO), the process proceeds to ST1605.

  In ST1604, since the export prohibition media are both the external memory 102 and the external memory 1402, the distributable right data type determination unit 206 sets the right data type 1 as the distributable right data type, and the client authentication and distributable right data. The type determination process ends.

  In ST1605, since the export prohibited medium is only the external memory 102, the distributable right data type determination unit 206 sets right data type 1 and right data type 3 as the distributable right data type, and the client authentication and distributable right data. The type determination process ends.

  In ST1606, the revocation list confirmation unit 205 refers to the revocation list from the revocation list storage unit 204, confirms whether the client corresponding to the revocation list is prohibited from being exported to the external memory 1402, and is prohibited from exporting to the external memory 1402. If yes (YES), the process proceeds to ST1607, and if not prohibited, the process proceeds to ST507.

  In ST1607, since the export-prohibited medium is only the external memory 1402, the distributable right data type determination unit 206 sets right data type 1 and right data type 2 as the distributable right data type, and the client authentication and distributable right data. The type determination process ends.

  In ST507, since it corresponds to the revocation list in ST1201, the external memory 102 does not indicate the export prohibited medium in ST1602, and the external memory 1402 also does not indicate the export prohibited medium in ST1606, the DRM1 is invalid. Since there is no distributable right data type and the client is an unauthorized client as well as a non-credible client, an authentication error is notified to the client, and the client authentication and distributable right data type determination process ends.

  Note that the order of the determination flow of ST1602, ST1603, and ST1606 described here is not limited to this.

  FIG. 17 is a diagram for explaining the determination criteria of the distributable right data type determination unit 206 according to Embodiment 4 of the present invention. In this embodiment, there are cases where DRM1 is illegal, DRM2 is illegal, DRM3 is illegal, and combinations thereof. First, only one of these DRM systems is illegal. The right data types that can be distributed will be described for each of the four patterns including normal clients and normal patterns. In the figure, ○ indicates that distribution is possible, and x indicates that distribution is not possible.

  Since a client who detects fraud in DRM1 can be regarded as having no ability to protect the distributed rights data and the content corresponding to the rights data, all rights data types 1 to 4 cannot be delivered. To be judged.

  Next, it is determined that the right data type 2 and the right data type 4 cannot be distributed, and the right data type 1 and the right data type 3 can be distributed to the client whose fraud is detected in the DRM2.

  Further, a client whose fraud is detected in the DRM 3 is determined that the right data type 3 and the right data type 4 cannot be distributed, and it is determined that the right data type 1 and the right data type 2 can be distributed.

  Further, it is determined that a normal client can distribute all the right data types 1 to 4.

  Next, a case where a plurality of DRM systems outlaw each of the DRM systems will be described in detail. There are four possible combinations of DRM systems with fraud: DRM1 and DRM2, DRM1 and DRM3, DRM2 and DRM3, DRM1, DRM2 and DRM3. Among these, if the DRM 1 is fraudulent, it is determined that distribution of each right data type is not possible regardless of other fraudulent DRM systems. If the remaining DRM2 and DRM3 are illegal, it is determined that only the right data type 1 can be distributed.

  As described above, according to the present embodiment, in a client that can be exported to a plurality of external memories, the recording medium information that prohibits export is used as the revocation level indicating the content management capability of the client at the time of right data distribution. Based on the information, the right data within the content management capability of the client can be distributed by determining which right data type of export permission right data and export prohibition right data can be distributed to the specified external memory. For example, rights data can be distributed flexibly while content protection is achieved, and client requests can be satisfied.

  In the present embodiment, the case where the number of export destination external memories is two has been described. However, the present invention is not limited to this, and the case where two or more external memories are used can be similarly handled. Further, as described in the present embodiment, information indicating the export prohibited medium (export prohibited medium information) is included in the concept of the revocation level.

  Further, in each of the above-described embodiments, the case where notification of rights data that can be distributed after client authentication has been described as an example. However, the present invention is not limited to this, and the right data that is distributed by the client is not limited thereto. After the designation, client authentication is performed, and if the right data can be distributed, the right data may be distributed. If the right data cannot be distributed, the client may be notified of this.

  The rights data distribution device according to the present invention flexibly controls the rights data to be distributed while protecting the contents by determining the rights data type that can be distributed according to the content protection capability of the client at the time of rights data distribution. It can be applied to a server or the like in a right data distribution system.

Configuration diagram of right data distribution system according to embodiments 1 and 3 of the present invention The block diagram which shows the internal structure of the server which concerns on Embodiment 1, 3 and 4 of this invention The figure which shows the format of the client certificate in Embodiment 1 of this invention The figure which shows the format of the revocation list in Embodiment 1 of this invention. The flowchart which shows the client authentication of the server which concerns on Embodiment 1 of this invention, and the distributable right data type judgment process The figure for demonstrating the judgment criteria of the distributable right data type judgment part which concerns on Embodiment 1 of this invention. Configuration diagram of right data distribution system according to Embodiment 2 of the present invention The block diagram which shows the internal structure of the server which concerns on Embodiment 2 of this invention. The flowchart which shows the client authentication of the server which concerns on Embodiment 2 of this invention, and a distributable right data type judgment process The figure which shows the format of the revocation list in Embodiment 3 of this invention. Diagram showing client certificate format The flowchart which shows the client authentication of the server which concerns on Embodiment 3 of this invention, and a distributable right data type judgment process Diagram showing revocation list format Configuration diagram of right data distribution system according to Embodiment 4 of the present invention The figure which shows the format of the revocation list in Embodiment 4 of this invention. The flowchart which shows the client authentication of the server which concerns on Embodiment 4 of this invention, and a distributable right data type judgment process The figure for demonstrating the judgment standard of the distributable right data type judgment part which concerns on Embodiment 4 of this invention. System configuration diagram showing server and client supporting DRM system System configuration diagram showing server and client supporting multiple DRM systems

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Client 102 External memory 103 Certificate authority 104 Revocation list storage device 105, 701 Server 201 Transmission / reception unit 202 Client certificate authentication unit 203 Revocation list acquisition unit 204 Revocation list storage unit 205 Revocation list confirmation unit 206 Distributable right data type determination unit 207 Rights data storage unit 208 Rights data provision unit 702 Revocation list confirmation device 801 Revocation list confirmation request unit

Claims (12)

Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A device,
A receiving means for receiving a client certificate sent from a client;
By a third party that indicates that the first rights data staying in the first DRM system in the client corresponding to the client certificate and the content management corresponding to the first rights data are illegal The third party indicating that the first revocation list to be issued, the second right data of the second DRM system after export, and the content management corresponding to the second right data are invalid. Obtaining means for obtaining a second revocation list issued by the institution;
(1) If the client certificate corresponds to the first revocation list, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
(2) If the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export is determined to be distributable, while the right to permit export The data is considered undeliverable,
(3) If the client certificate does not correspond to the first revocation list and the second revocation list, a determination unit that determines that right data that permits export and right data that prohibits export can be distributed;
A right data distribution apparatus comprising: The right data distribution apparatus according to claim 1, wherein the determination unit determines an authentication error when the client certificate does not have the signature of the third party organization . Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A device,
A receiving means for receiving a client certificate sent from a client;
Regarding the client certificate sent from the client, the first right data remaining in the first DRM system in the client corresponding to the client certificate and the content management corresponding to the first right data are invalid. Corresponding to the second revocation data and the second right data of the second DRM system after the export. Confirmation request means for requesting the revocation list confirmation device to confirm whether or not the second revocation list issued by the third-party organization indicates that the content management is illegal.
Obtain confirmation results from the revocation list confirmation device,
(1) If the client certificate corresponds to the first revocation list, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
(2) If the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export is determined to be distributable, while the right to permit export The data is considered undeliverable,
(3) If the client certificate does not correspond to the first revocation list and the second revocation list, a determination unit that determines that right data that permits export and right data that prohibits export can be distributed;
A right data distribution apparatus comprising: 4. The right data distribution apparatus according to claim 3 , wherein the determination unit determines an authentication error when the client certificate does not have the signature of the third party organization . Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A device,
A receiving means for receiving a client certificate sent from a client;
The client certificate is listed as a high revocation level when the first rights data staying in the first DRM system in the client and content management corresponding to the first rights data are illegal. If the second right data of the second DRM system after the export does not correspond to the revocation level and the content management corresponding to the second right data is illegal, the client certificate is listed as a low revocation level. An acquisition means for acquiring a revocation list issued by a third party,
(1) If the client certificate corresponds to the revocation list and has a high revocation level, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
(2) If the client certificate corresponds to the revocation list and has a low revocation level, the right data prohibiting the export is determined to be deliverable, while the right data permitting the export is determined to be undeliverable,
(3) If the client certificate does not correspond to the revocation list, a determination unit that determines that right data that permits export and right data that prohibits export can be distributed;
A right data distribution apparatus comprising: 6. The right data distribution apparatus according to claim 5 , wherein the determination unit determines an authentication error when the client certificate does not have a signature of the third party organization . The first right data managed by the first DRM system and the content corresponding to the first right data are stored in the second DRM system in the first external memory or the third right data in the second external memory. A rights data distribution apparatus in a rights data distribution system that converts and exports data for use in a DRM system,
A receiving means for receiving a client certificate sent from a client;
An acquisition unit that lists a revoked client certificate and an external memory that prohibits export, and acquires a revocation list issued by a third party;
(1) If the client certificate does not correspond to the revocation list, it is determined that right data permitting export to the first external memory and right data permitting export to the second external memory can be distributed. And
  (2) When the client certificate corresponds to the revocation list and the first external memory corresponds, it is determined that the right data permitting export to the first external memory cannot be distributed;
  (3) If the client certificate corresponds to the revocation list and the second external memory corresponds, it is determined that the right data permitting export to the second external memory cannot be distributed;
  (4) When the client certificate corresponds to a revocation list and the first external memory and the second external memory correspond, right data permitting export to the first external memory and the first Determining means for determining that the right data permitting export to the external memory of 2 is undeliverable;
A right data distribution apparatus comprising: The determination unit determines an authentication error if the client certificate does not have the signature of the third party organization.
8. The right data distribution apparatus according to claim 7. Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A method,
A receiving step in which a right data distribution device for distributing the first right data and the content corresponding to the first right data receives a client certificate sent from a client;
Issued by a third party indicating that the first rights data staying in the first DRM system in the client corresponding to the client certificate and the content management corresponding to the first rights data are illegal The third party that indicates that the first revocation list to be used, the second rights data of the second DRM system after export, and the content management corresponding to the second rights data are illegal An acquisition step in which the right data distribution device acquires a second revocation list issued by
The right data distribution device is
  (1) If the client certificate corresponds to the first revocation list, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
  (2) If the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export is determined to be distributable, while the right to permit export The data is considered undeliverable,
  (3) If the client certificate does not correspond to the first revocation list and the second revocation list, a determination step of determining that right data that permits export and right data that prohibits export can be distributed;
A right data distribution method comprising: Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A method,
A receiving step in which a right data distribution device for distributing the first right data and the content corresponding to the first right data receives a client certificate sent from a client;
Regarding the client certificate sent from the client, the first right data remaining in the first DRM system in the client corresponding to the client certificate and the content management corresponding to the first right data are invalid. Content management corresponding to the second right data and the right data of the second DRM system after the export, whether or not it falls under the first revocation list issued by a third party A confirmation requesting step in which the right data distribution device requests the revocation list confirmation device to confirm whether or not it corresponds to a second revocation list issued by the third-party organization.
The right data distribution device acquires a confirmation result from the revocation list confirmation device,
(1) If the client certificate corresponds to the first revocation list, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
(2) If the client certificate does not correspond to the first revocation list and does not correspond to the second revocation list, the right data prohibiting export is determined to be distributable, while the right to permit export The data is considered undeliverable,
(3) If the client certificate does not correspond to the first revocation list and the second revocation list, a determination step of determining that right data that permits export and right data that prohibits export can be distributed;
A right data distribution method comprising: Rights data distribution in a rights data distribution system that converts and exports the first rights data managed by the first DRM system and the content corresponding to the first rights data so that it can be used in the second DRM system A method,
A receiving step in which a right data distribution device for distributing the first right data and the content corresponding to the first right data receives a client certificate sent from a client;
The client certificate is listed as a high revocation level when the first rights data staying in the first DRM system in the client and content management corresponding to the first rights data are illegal. If the second right data of the second DRM system after the export does not correspond to the revocation level and the content management corresponding to the second right data is illegal, the client certificate is listed as a low revocation level. An acquisition step in which the rights data distribution device acquires a revocation list issued by a third party.
The right data distribution device is
(1) If the client certificate corresponds to the revocation list and has a high revocation level, it is determined that the right data that permits export and the right data that prohibits export cannot be distributed;
(2) If the client certificate corresponds to the revocation list and has a low revocation level, the right data prohibiting the export is determined to be deliverable, while the right data permitting the export is determined to be undeliverable,
(3) If the client certificate does not correspond to the revocation list, a determination step of determining that right data that permits export and right data that prohibits export can be distributed;
A right data distribution method comprising:   The first right data managed by the first DRM system and the content corresponding to the first right data are stored in the second DRM system in the first external memory or the third right data in the second external memory. A rights data delivery method in a rights data delivery system that converts and exports data for use in a DRM system,
A receiving step in which a right data distribution device for distributing the first right data and the content corresponding to the first right data receives a client certificate sent from a client;
The revoked client certificate and the external memory prohibiting export are listed, and the right data distribution device for acquiring the revocation list issued by a third party is an acquisition step;
The right data distribution device is
(1) If the client certificate does not correspond to the revocation list, it is determined that right data permitting export to the first external memory and right data permitting export to the second external memory can be distributed. And
  (2) When the client certificate corresponds to the revocation list and the first external memory corresponds, it is determined that the right data permitting export to the first external memory cannot be distributed;
  (3) If the client certificate corresponds to the revocation list and the second external memory corresponds, it is determined that the right data permitting export to the second external memory cannot be distributed;
  (4) When the client certificate corresponds to a revocation list and the first external memory and the second external memory correspond, right data permitting export to the first external memory and the first A determination step of determining that the right data permitting export to the external memory of 2 is not distributed;
A right data distribution method comprising:

Images