JP4663390B2 - Content distribution system, content distribution method, server device and terminal device, and program. - Google Patents

Description

  The present invention relates to a technical field of digital rights management (DRM) that encrypts digital content to prevent unauthorized use of the digital content by a malicious user, and in particular, a user who views the digital content. Content distribution management technology for the purpose of improving the convenience of users.

  In recent years, digital contents such as music, video, and games have been actively distributed through networks such as the Internet and cable television, or information recording media such as CDs and DVDs. On the other hand, digital information has the feature that it is easy to copy and does not deteriorate, and it becomes a problem that illegal copies of digital contents are created and distributed without the copyright holders between pirated vendors or consumers. ing. For this reason, development of a DRM system for preventing unauthorized copying of digital contents and the spread of pirated versions and protecting / managing copyrights has been underway.

  In the DRM system, a content distributor encrypts digital content and distributes the encrypted content to the market. A user obtains encrypted content distributed in the market and obtains an encryption key (license) necessary for decrypting the encrypted content from a content distributor or an intermediary, thereby viewing the content. (For example, Non-Patent Document 1).

  As a conventional technique, for example, in the scramble system, a server device encrypts a scramble key (Ks) used for content scramble encryption using a work key (Kw) (Kw (Ks)), and further works a key. (Kw) is encrypted (Km (Kw)) using a master key (Km) shared between the server device and the terminal device, and the encrypted scramble key (Kw (Ks)) and the encrypted key are encrypted. The work key Km (Kw)) is multiplexed with the encrypted content and transmitted to the terminal device. In the terminal device, a master key (Km) previously held in the terminal device is taken out by a tamper-proof device such as an IC card, and an encrypted work key sent from the server device by the master key (Km). (Km (Kw)) is decrypted to obtain the work key (Kw). Further, the encrypted scramble key (Kw (Ks)) sent from the server device is similarly decrypted with the work key (Kw) to obtain the scramble key (Ks) used for content encryption. . The content is decrypted with this scramble key (Ks) (for example, Non-Patent Document 2).

“Digital Rights Management-Business and Technology”, Bill Rosenblatt, etc., M & T Books Radio Industry (ARIB) Standard "Access Control Method for Digital Broadcasting" ARIB STD-B25

  In the above scramble method, a user can access content on a plurality of terminal devices by moving a master key (Km) held in advance in the terminal device to another terminal device via a tamper resistant device such as an IC card. Can be watched. However, there is a problem that the IC card storing the master key needs to be distributed in advance to each user, and the advance procedure becomes complicated.

  In general, in the prior art, it is necessary to hold secret key information and a master key in a black box and an IC card installed in a terminal device in advance. Since unauthorized use of the content becomes possible, there is a problem that a completely tamper-resistant configuration is required so that the secret key information and the master key are not leaked to the outside, and the implementation becomes complicated.

  Also, if the secret key information or master key information is leaked to the outside, in order to identify the user's identity of the leaked secret key information or master key information, check with the user management database held by the server device. Because it is necessary, there is a problem that unauthorized users cannot be monitored by a third party (partner).

  The present invention has been made in view of such a situation, and allows a user to easily view content on a plurality of terminal devices, and for each content terminal to view individual objects for content viewing. User management database for identifying the identity of the source user when license information is leaked without the need for prior procedures such as installation and distribution of IC cards, and without the need to implement a tamper-resistant mechanism on the terminal device It is an object of the present invention to provide a content distribution method that does not require the.

  In the content distribution system according to the present invention, Japanese Patent Application No. 2003-2003 relating to the applicant's already filed application, which is an extension of the conventionally known (k, n) threshold secret sharing method and (d, k, n) threshold secret sharing method. The restoration control type secret information distribution method described in US Pat.

The (k, n) threshold secret sharing method is a (k−1) -degree polynomial f (x) with a constant term that is an integer distribution number n of 2 or more, which is a number for distributing distributed information, and secret information S.
f (x) = S + r ₁ x +... + r _k-1 x ^k-1 (mod P) (1)
(R ₁ ,..., R _k-1 : random number, P: prime number) and the secret information distributor who owns or distributes the original secret information S by deposit is each shared information holder i that stores the distributed information. The distributed information Wi = f (i) is distributed to (i = 1, 2,..., N).

  This (k, n) threshold secret sharing method can restore the original secret information S by solving simultaneous equations relating to f (x) if any k pieces of distributed information are gathered among n pieces of shared information. However, there is a feature that the original secret information S cannot be restored because the simultaneous equations relating to f (x) cannot be solved even if up to (k−1) pieces of distributed information are collected. Therefore, even if up to (n−k) pieces of shared information are lost or destroyed, the original secret information S can be restored, and up to (k−1) pieces of shared information can be obtained by leakage or theft. However, it is possible to realize a method for safely storing the secret information in which the original secret information S cannot be restored.

Further, the (d, k, n) threshold secret sharing method is an extension of the (k, n) threshold secret sharing method, and an integer distribution number n of 2 or more, which is the number for distributing distributed information, and a secret An integer threshold k of 2 or more and n or less, which is the minimum number of shared information necessary for complete restoration of the information S, and a shortage of shared information that allows partial restoration of the secret information S with respect to the threshold k The secret information S is divided into S ₀ , S ₁ ,..., S _d−1 from an integer division number d of 2 or more and k or less, and the divided secret information (division information) is a constant term (k -1) The following polynomial f (x) is
_{f (x) = S 0 +} S 1 x + ... + S d-1 x d-1 r 1 x d ... + r kd x k-1 (mod P) ... (2)
, (R ₁ ,..., R _kd : random number, P: prime number) and the secret information distributor who owns or distributes the original secret information S by deposit is each shared information holder i ( The distributed information Wi = f (i) is distributed to i = 1, 2,..., n).

This (d, k, n) threshold secret sharing method is similar to the (k, n) open-value secret sharing method described above. If any k pieces of shared information are obtained from n pieces of shared information, then f Although the original secret information S can be restored by solving the simultaneous equations for (x), the simultaneous equations for f (x) cannot be solved even if any (k−d) pieces of distributed information are collected. The original secret information S cannot be restored. However, if any (k−d + 1) to (k−1) pieces of distributed information are collected, the division information S ₀ , S ₁ ,..., S _{d−1 is} obtained from simultaneous equations relating to f (x). since the relationship for is sought, division information S _0, S 1, _..., it is possible to obtain the possible values as S _d-1, can restore the original secret information S partially.

  Note that the (k, n) threshold secret sharing method and the (d, k, n) threshold secret sharing method are respectively referred to as documents “A. Shamir,“ How to Share a Secret ”, Commun. ACM, Vol. 22, No. 11, pp. 612-613, 1979 ”,“ GR Blakley and C. Meadows, “Security of Ramp Scheme”, Proc. Of Crypto '84, Lecture Note in Computer Science, Vol. 242-268, 1984 ”.

The restoration control type secret information distribution method previously proposed by the present applicant is a method obtained by further extending the above (k, n) threshold secret distribution method and (d, k, n) threshold secret distribution method. If there are k pieces of shared information among the pieces of shared information, the original secret information S can be restored by solving simultaneous equations relating to f (x), but up to (k−d) pieces of shared information can be obtained. Even if all of them, simultaneous equations relating to f (x) cannot be solved, and thus the original secret information S cannot be restored. However, by defining a distribution function for distributing information in a specific format, if any (k−d + 1) to (k−1) pieces of distributed information are collected in a specific combination, f (x ), The specific division information S ₀ , S ₁ ,..., S _d−1 can be obtained from the simultaneous equations related to the above), and the original secret information S can be partially restored.

This restoration control type secret information distribution method is basically based on the threshold value k and the threshold value k, which are two or more integers, which is the minimum number of shared information necessary for complete restoration of the secret information S. An integer division number d of 2 or more and k or less that determines the number of shared information deficiencies that allow partial restoration of the secret information S, and d pieces of division information S ₀ , S _{1 ,.} A condition for distributing the secret information S such as ₋₁ is input, and a prime number P larger than the maximum division information St (0 ≦ t ≦ d−1) and smaller than the prime number P and not 0 (k−d) Generating random numbers r _i (1 ≦ i ≦ k−d) and (k (k−1) / 2) random numbers a _j (1 ≦ j ≦ k (k−1) / 2),

の式で表現される秘密情報Ｓの分散情報ｆ(ｘ)を生成するものである。

The shared information f (x) of the secret information S expressed by the following formula is generated.

For example, when the dispersion function f (x) in the above equation (3) is k = 3 and d = 2,
f (x) = S ₀ + S ₁ (x−a ₁ ) + r (x−a ₂ ) (x−a ₃ ) (mod P) (4)
The simultaneous equations for any two pieces of distributed information W _x and W _{x + b} (x> 0, b> 0) can be expressed by the following determinants.

上記行列式の左項を掃き出し法により変形すると、

When the left term of the above determinant is transformed by the sweep method,

となり、ａ_１，ａ_２，ａ_３の値によっては、
−ｘ²＋（２ａ₁−ｂ）ｘ＋ａ₁ｂ−ａ₁ａ₂−ａ₁ａ₃＋ａ₂ａ₃≡０
２ｘ＋ｂ−ａ₂−ａ₃≡０ （７）
のいづれかを満たすｘとｂがある場合に、連立方程式から分割情報（部分情報）のＳ_０のみ、もしくはＳ_１のみを求めることができる。

And depending on the values of a ₁ , a ₂ and a ₃ ,
_{^{-X 2 + (2a 1 -b)}} x + a 1 b-a 1 a 2 -a 1 a 3 + a 2 a 3 ≡0
2x + b−a ₂ −a ₃ ≡0 (7)
When there is x and b satisfying any of the above, it is possible to obtain only S ₀ or only S _{1 of the} division information (partial information) from the simultaneous equations.

  The present invention encrypts content that is a digital work so that it can be viewed only by a specific registered user, and distributes the decryption key only to the terminal device of the specific user. In performing the control, the restoration control type secret information distribution method technique is used.

  The server device includes a content database (content DB) that manages content, a key management database (key management DB) that manages an encryption key for each content, and a user that manages user identification information for each user It has a management database (user management DB).

  In the present invention, the server device encrypts the content recorded in the content DB using an encryption key corresponding to the content recorded in the key management DB, and generates encryption data; The encryption key used in the encryption means, the user identification information recorded in the user management DB and the content identification information for identifying the content are combined and distributedly encoded by a specific distribution function to generate a plurality of distributed data Distributing means, license transmitting means for transmitting a part of the distributed data generated by the distributing means to the terminal device as license information, encrypted data generated by the encrypting means, and distributed data generated by the distributing means And the content identification information is multiplexed with the remaining part other than the license information to generate distribution data and the terminal device. It transmits to and a multiplexing means.

  Distribution data and license information generated by the server device are taken into the terminal device through a network or a recording medium, respectively.

  The terminal device separates the content identification information, the encrypted data, and a part of the distributed data from the distribution data and obtains the content from license information that is another part of the distributed data. License receiving means for acquiring identification information, key recovery means for collecting distributed data based on the content identification information acquired by the separating means and the license receiving means, and restoring an encryption key from the distributed data by a specific recovery function And a content decrypting means device for making the content viewable by decrypting the encrypted data obtained by the separating means with the encryption key obtained by the key restoring means.

Specifically, the distribution means of the server device uses the three keys of the encryption key, the user identification information, and the content identification information as a result of the first restoration function if there are three or more pieces of generated distributed data. All of the information can be restored, and in the case of less than three pieces of distributed data, a condition that satisfies the condition that the user identification information and the content identification information of the three pieces of information can be restored but the encryption key cannot be restored by the second restoration function Three or more pieces of distributed data are generated by performing distributed encoding using a function. In the license transmission means, the terminal uses, as license information, less than three pieces of distributed data for restoring the user identification information and the content identification information by the second restoration function among the three or more pieces of distributed data generated by the distribution means. Send to device. In the multiplexing means, the encrypted data generated by the content encryption means and the distributed data excluding the license information among the three or more distributed data generated by the distribution means, the distributed data constituting the license information When combined with the data, three or more distributed data and the content identification information are multiplexed and transmitted to the terminal device as distribution data.

The license receiving means of the terminal device receives the license information and restores the user identification information and content identification information from the license information using the second restoration function. The key recovery means collects the distributed data constituting the license information received by the license receiving means corresponding to the same content identification information and the distributed data acquired by the separating means, and the first data is collected from the collected distributed data. The encryption key is restored by the restoration function 1.

  The user identification information includes information that can uniquely identify the user, such as a name, a telephone number, and an e-mail address. If there is fraud, the user identification information is partially restored from the license information to identify the unauthorized user. Identify (allows unauthorized users to be tracked).

  Alternatively, the distribution unit of the server device fixes a part of the generated distributed data and sets it as common distributed data, and sets the content encryption so that a part of the generated distributed data becomes the common distributed data. The encryption key used in the conversion means, the user identification information recorded in the user management DB, and the content identification information for identifying the content are combined and distributedly encoded by a specific distribution function, so that the The remaining distributed data is generated, and the multiplexing means multiplexes the common distributed data, the encrypted data, and the content identification information to generate distribution data.

  In addition, the data to be distributed encoded includes authentication information for restricting viewing of the content, and authentication processing is performed to determine whether or not the content can be viewed when displaying the content.

  According to the present invention, the server device transmits a part of the shared information as license information to the user's terminal device, and the terminal device uses the part of the distributed information added to the encrypted content and the license information to determine the content of the content. Viewing is possible. In addition, since the user can save the license information in a recording medium or the like and transfer (copy) it to another terminal device, the content can be viewed on a terminal device other than the terminal device that has issued the license. The user convenience in the viewing environment is improved.

  In addition, a terminal device for viewing content only needs to have at least a processing function for restoring shared data common to the terminal devices and a processing function for decrypting encrypted content, and different individual objects are prepared for each terminal device. Therefore, there is an effect that no special setting is required on the terminal device.

  In addition, since the terminal device for viewing the content does not require shared data with the server device such as a common key, there is an effect that a preliminary procedure is not necessary.

  Further, since it is not necessary to hold the secret key information in the terminal device that views the content, there is an effect that it is not necessary to mount a tamper resistant mechanism on the terminal device.

  In addition, if the license information leaks out to the outside, the partial identification processing is performed from the distributed data included in the license information, and the user identification information can be obtained by calculating the partial information. The effect is that it can deter use.

  In addition, the user identification information includes information such as a telephone number that can identify the user, and it is possible to instantaneously identify the user who performed the fraud from only the user identification information. Since verification with a database is not required, there is an effect that unauthorized users can be monitored by a third party (partner).

  Further, the distributed data to be added to the encrypted content is fixed (for example, universal common distributed data is set in the user identification information), and distributed data other than the fixed common distributed data is generated in the distributed processing, By transmitting the distributed data to the terminal device as a license, the server device does not need to transmit the distributed data to be added to the encrypted content to the terminal device for the number of users (or for each user individually) at the time of content distribution. Since only the common distributed data needs to be transmitted to all users, there is an effect that overhead can be reduced particularly when contents are multicast-distributed.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[Example 1]
FIG. 1 is a block diagram showing the overall system configuration of this embodiment. In FIG. 1, the server device 10 includes a content encryption processing unit 11, a decentralization processing unit 12, a license transmission processing unit 13, a data multiplexing processing unit 14, and the like. The server device 10 also includes a content database (hereinafter referred to as content DB) 15, a key management database (hereinafter referred to as key management DB) 16, and a user management database (hereinafter referred to as user management DB) 17. The terminal device 20 includes a data separation processing unit 21, a license reception processing unit 22, a key restoration processing unit 23, a content decryption processing unit 24, a display unit 25, and the like. The server device 10 and the terminal device 20 exchange delivery data and license information via a network such as the Internet or cable television or a recording medium 30.

  First, the flow of processing in the server device 10 of this embodiment will be described in detail. FIG. 2 is an example of a processing flow of the server device 10 in the present embodiment.

  The content encryption processing unit 11 receives the content C to be distributed recorded in the content DB 15 and the encryption key K corresponding to the content C recorded in the key management DB 16 and uses the encryption key K. By encrypting the data of the content C, the encrypted content K (C) is generated (step 101). Here, as the encryption method, for example, a DES encryption method developed by IBM Corporation of America or an encryption method such as AES (Advanced Encryption Standard) can be used (reference: current status of information security 2000 version) Information processing promotion business association security center, etc.). For the association between the content C and the encryption key K, identification information (content ID) for uniquely identifying the content is used. For the content ID, for example, a standard defined in the content ID forum (http://www.cidf.org/) can be used.

  Specifically, as shown in FIG. 4, the content DB 15 stores information on the location (address) where the content is stored for each content ID, and the key management DB 16 specifically shows FIG. As shown, key information used for encryption is stored for each content ID. In addition, as shown in FIG. 6, the user management DB 17 stores information that can specify a user such as a name, a telephone number, and an e-mail address for each user ID.

In the decentralization processing unit 12, the encryption key K used in the content encryption processing unit 11, the identification information Ic for uniquely identifying the content C, and the user identification information Ip for identifying the user are input. Then, partial information S ₀ and partial information S ₁ are generated from these input information, and distributed data W 1, W ₂ , W ₃ are generated from the partial information S ₀ , S ₁ by using the above-described restoration control type secret information distribution method. Generate (step 102). Here, for example, the above-mentioned content ID is used for the content identification information Ic, and for example, a name, a telephone number, a mail address, etc. are used for the user identification information Ip. The user identification information Ip is recorded in advance in the user management DB 17 at the time of user registration or the like.

Hereinafter, the dispersion processing in the present embodiment will be described in more detail with reference to FIG.
First, the partial information S ₀ and S ₁ are determined. In this embodiment, it is assumed that the data string of the encryption key K is used as the partial information S _{0 and} the data string of the content ID and the user identification information (here, the telephone number) is used as the partial information S ₁ . Specifically, a 14-byte key information data string “1234567890123456789012345678” corresponding to the content ID “0001” is used for the partial information S ₀ (FIG. 5), and the 4-byte content ID “0001” is used for the partial information S1. And a 14-byte data string “3030303130313233343343373739” obtained by encoding an ASCII code to a character string “00010123456789” concatenated with a 10-byte telephone number “0123456789” (FIG. 6) corresponding to the user ID “yama”. The present embodiment does not particularly define the configuration of partial information and the encoding method for the input value. Further, the partial information may include other information, and it may be possible to improve the safety against leakage or falsification of the partial information by using a method such as calculating a hash value or encrypting the partial information.

Next, a special function f (x) called a dispersion function for performing dispersion coding on the partial information is set. The dispersion function f (x) in the present embodiment is expressed by the following equation (8) as a1 = 7, a2 = 1, and a3 = 5 in the above equation (4).
f (x) = S ₀ + S ₁ (x−7) + R (x−1) (x−5) (mod P) (8)
In equation (8), x is a variable, S ₀ and S ₁ are the partial information, R is a random number (previous to prevent the partial information S ₀ and S ₁ from being estimated from the distributed data W ₁ , W ₂ , W ₃ . (Corresponding to r in equation (14)), P represents a constant for the remainder calculation.

The dispersion function f (x) of equation (8), the result was calculated by substituting 4 results f (6) calculated by substituting 6 x distributed data W _1, x f (4) dispersion S ₁ can be partially restored from W ₂ and W ₃ by using the result f (2) calculated by substituting 2 for data W ₂ and x, and distributed data W _3, and W ₁ , W ₂ , W _{From 3} to S ₀ and S ₁ are dispersion functions that can be completely restored. Further, since the original partial information S ₀ and S 1 is not known at all from the individual distributed data, the safe distribution of the partial information S ₀ and S ₁ can be realized. Such a special distribution function f (x) can be obtained by the restoration control type secret information distribution method described in Japanese Patent Application No. 2003-366538, and is not limited to the expression in this embodiment.

In the present embodiment, since the lengths of the partial information S ₀ and S ₁ are 14 bytes, a 14-byte hexadecimal character string R = f0c1d2c3b4a5968778695a4b3c5d is used as the random number R, and a 14-byte hexadecimal character string P = is used as the constant P. Use ffffffffffffffffffffffffffb5. The constant P is preferably a prime number, and the size and value are not particularly defined in the present embodiment. From the viewpoint of the assumed length of data to be distributed and encoded, the security strength against brute force attacks, and the like. It may be determined arbitrarily. The random number R is a random number generated by a random number generator or the like.

Next, distributed data W ₁ , W ₂ , W ₃ are generated from the set dispersion function, prime number P, partial information S ₀ , S ₁ , and constant (random number) R. That is, f (6) obtained by substituting x = 6 into the dispersion function f (x) of Expression (8) is distributed data W ₁ , f (4) obtained by substituting x = 4 is distributed data W ₂ , and x = 2. The substituted f (2) is calculated as the distributed data W ₃ . In this embodiment, each distributed data is calculated as follows.
W ₁ = f (6) = S ₀ −S ₁ + 5R = 966d4419e71cf2c89e699f754c4c (mod P)
_{W 2 = f (4) =} S 0 -3S 1 -3R = aefe4d99e18dda2672b460acf81a (mod P)
_{W 3 = f (2) =} S 0 -5S 1 -3R = 4e9ded37812b75c00a49f43e87a8 (mod P)
... (9)

Here, from the calculated distributed data, the partial information S ₁ can be partially restored from the distributed data W ₂ and W _{3 according} to the characteristics of the dispersion function f (x) described above, and the distributed data W ₁ , W ₂ , W ₃ partial information S0 and S ₁ is a fully recoverable from. FIG. 7 is a table summarizing calculation examples of decentralization processing in this embodiment.

The license transmission processing unit 13 receives the distributed data W ₂ and W ₃ that are a part of the distributed data W ₁ , W ₂ , and W ₃ generated by the distributed processing unit 12 as input, and at least the distributed data W ₂ and W ₃ is transmitted as license information to the terminal device 20 of the predetermined user (step 103). Here, the license information may be transmitted via a network such as the Internet each time in response to a user request, or may be generated in advance and stored in a recording medium or the like and sent offline. Also, when sending via a network, it is desirable to encrypt the communication path by SSL or the like to increase the security on the communication line. Alternatively, user authentication may be performed at the time of a license request from the user, and the license information may be transmitted only to the terminal device 20 of the authorized user.

On the other hand, in the data multiplexing processing unit 14, the encrypted content K (C) generated by the content encryption processing unit 11, identification information Ic for uniquely identifying the content C, and the distributed data generated by the decentralization processing unit 12 The distributed data W ₁ , which is a part of W ₁ , W ₂ , and W ₃ , is input, the encrypted content K (C), the content identification information Ic, and the distributed data W ₁ are multiplexed, and the distribution data is transmitted to the terminal device. 20 (step 104). As a multiplexing method, for example, a time division multiplexing communication system is used, and a plurality of data can be equally divided and transmitted every time.

In this embodiment, since the shared data W ₁ is different for each user identification information Ip, in reality, the number of users is created in the distribution unit 12, and identification information such as user IDs is added to the distributed data to obtain encrypted content. It is multiplexed with K (C) and content identification information Ic and transmitted to the terminal device. Further, the content ID information Ic can use the above-mentioned content ID (in this example, “0001”), and the content ID is unique for each content, so it is attached to the header portion of the encrypted content and transmitted. May be. However, since the header portion of the encrypted content to which the content ID is assigned is not normally encrypted, it is desirable to perform a process such that the header portion is not tampered with by performing a signature.

  Here, the method of distributing data via a network has been described. However, the data may be distributed to each terminal device via a separate network, or an offline distribution means such as a storage medium. The multiplexed data may be sent to the terminal device using.

  Next, the flow of processing in the terminal device 20 of the present embodiment will be described in detail. FIG. 3 is an example of a processing flow of the terminal device 20 in the present embodiment.

The data separation processing unit 21 receives the multiplexed distribution data sent from the server device 10 and separates the distribution data into encrypted content K (C), content identification information Ic, and distributed data W _1. And stored in the internal memory or the like (step 201). Here, since the shared data W ₁ is sent by the number of users, only the necessary shared data W ₁ is acquired from the identification information such as the user ID given to the distributed data, and others are discarded. The content ID is used as the content identification information Ic, and “0001” is acquired in this embodiment.

The license receiving section 22 receives as input license information sent from the server device 10 acquires the distributed data W _2, W ₃ included in the license information (step 202), from the distributed data W ₂ and W ₃ above Partial restoration processing is performed by using the restoration control type secret information distribution method, and partial information S ₁ is obtained, and content identification information Ic and user identification information Ip are obtained from the partial information S ₁ (step 203). Note that the license information sent from the server device 10 can be temporarily recorded in a recording device and used when viewing the content later, or can be used by another terminal device owned by the user.

Hereinafter, the partial restoration processing in the present embodiment will be described in more detail with reference to FIG.
Since the distributed data W ₂ and W ₃ in this embodiment are f (4) and f (2) obtained by substituting x = 4 and x = 2 in the dispersion function f (x) of the equation (8), respectively. The following simultaneous equations can be established.
W ₂ = f (4) = S ₀ -3S ₁ -3R (mod P)
W ₃ = f (2) = S ₀ -5S ₁ -3R (mod P) (10)

Therefore, the equation for obtaining the partial information S ₁ from the distributed data W ₂ and W ₃ is as shown in the following equation (11). However, the partial information S ₀ and the random number R cannot be obtained from this equation.

In this embodiment, the distributed data W ₂ and W ₃ are respectively
W ₂ = aefe4d99e18dda2672b460acf81a
W ₃ = 4e9ded37812b75c00a49f43e87a8
(FIG. 7), substituting the values of W ₂ and W ₃ into equation (11),
S ₁ = 3030303130313233343343373739
Is calculated (FIG. 8). When the calculated S ₁ is divided according to a predetermined configuration (in this embodiment, a 4-byte content ID and a 10-byte telephone number) and reverse-encoded, the content identification information Ic (content ID) is “0001”, “0123456789” is obtained as the user identification information Ip (telephone number).

As described above, since the partial information S ₁ is obtained from the distributed data W ₂ and W ₃ and the user identification information Ip can be obtained from the partial information S ₁ , when the user distributes the license information illegally. Can immediately identify an unauthorized person from the user identification information Ip.

In the key restoration processing unit 23, content identification information Ic and shared data W ₁ acquired by the data separation processing unit 21 and content identification information Ic and distributed data W ₂ and W ₃ acquired by the license reception processing unit 22 are used for content identification. The information Ic is matched, and the distributed data W ₁ , W ₂ , W ₃ having the same content identification information Ic (content ID “0001” in this embodiment) is collected (step 204), and these distributed data W ₁ are collected. , W ₂ , W ₃ , complete restoration processing is performed using the above-described restoration control-type secret information distribution method, and partial information S ₀ , S ₁ and random number R are acquired, and content encryption is performed from partial information S _0. The used encryption key K is acquired (step 205).

Hereinafter, the complete restoration processing in the present embodiment will be described in more detail with reference to FIG.
The distributed data W ₁ , W ₂ , and W ₃ in this embodiment are f (6), f obtained by substituting x = 6, x = 4, and x = 2, respectively, in the dispersion function f (x) of Equation (8). Since (4) and f (2), the following simultaneous equations can be established.
W ₁ = f (6) = S ₀ −S ₁ + 5R (mod P)
W ₂ = f (4) = S ₀ -3S ₁ -3R (mod P) (12)
_{W 3 = f (2) =} S 0 -5S 1 -3R (mod P)
This simultaneous equation is expressed as a determinant as follows.

By solving the above equation (13) by a sweeping method or the like, the calculation formulas for the partial information S ₀ and S ₁ and the random number R can be obtained. Each calculation formula is as follows.

In the present embodiment, the distributed data W ₁ , W ₂ , W ₃ are respectively
W ₁ = 966d4419e71cf2c89e699f754c4c
W ₂ = aefe4d99e18dda2672b460acf81a
W ₃ = 4e9ded37812b75c00a49f43e87a8
(FIG. 7), substituting the above values into equation (14) W ₁ , W ₂ , W ₃ ,
S ₀ = 1234567890123456789012345678
S ₁ = 3030303130313233343343373739
R = f0e1d2c3b4a5968778695a4b3c2d
Is calculated (FIG. 9). From the calculated partial information S ₀ , “1234567890123456789012345678” is obtained as the encryption key K used for content encryption.

  In the content decryption processing unit 24, the encrypted content K (C) acquired by the data separation processing unit 21 and the encryption key K acquired by the key recovery processing unit 23 are input, and the encrypted content K ( The content C is acquired by decrypting the encrypted data C) (step 206). By outputting the obtained content C to the display device 25 such as a display, the user can view the content. When the content C is a storage location (address) of the actual content, the user can view the content by accessing the storage location.

  In this embodiment, user-specific information (name, telephone number, e-mail address, etc.) is used as user identification information. However, group-specific content distribution can be performed by using group information. .

  In this embodiment, the license information user can view the content unconditionally. However, by including authentication information in the partial information, the user can always authenticate and view the content. It is possible to limit the number of users.

  Further, in the present embodiment, the case has been described where the content C is encrypted and delivered using only one encryption key K. However, the content C is divided into a plurality of blocks, each using a plurality of encryption keys Ki. It may be encrypted and distributed.

In this embodiment, distributed data is created for the number of users, identification information such as user IDs is added to the distributed data, multiplexed with encrypted content and content identification information, and transmitted to the terminal device. A stream may be created for each request, and the distributed data W _{1 of the} requesting user, the encrypted content, and the content identification information may be multiplexed and distributed by unicast.

[Example 2]
FIG. 10 is a block diagram showing the overall system configuration of the present embodiment. 10, the server device 10 includes a content encryption processing unit 11, a decentralization processing unit 12, a license transmission processing unit 13, a data multiplexing processing unit 14, and the like, and further includes a content DB 15, a key management DB 16, and a user management DB 17. It has. The terminal device 20 includes a data separation processing unit 21, a license reception processing unit 22, a key restoration processing unit 23, a content decryption processing unit 24, a display unit 25, and the like. These are basically the same as those in the first embodiment shown in FIG. The server device 10 and the terminal device 20 exchange delivery data and license information via a network such as the Internet or cable television or a recording medium 30.

In the first embodiment, the distributed data W ₁ differs for each user identification information Ip, and the distributed processing unit creates the distributed data W ₁ for the number of users, and assigns identification information such as user IDs to the distributed data W ₁ . As described above, the encrypted content K (C) and the content identification information Ic are multiplexed and transmitted to the terminal device 20, but in this embodiment, the encrypted content K (C) and the content identification information Ic are multiplexed. the distributed data W ₁ for fixed (set universal common distributed data W _F to the user identification information Ip), is a distributed process, generates the distributed data W ₂ and W ₃ other than the fixed common distributed data WF The license information is transmitted to the terminal device. In the present embodiment, the server apparatus 10 during content distribution, there is no need to transmit the distributed data W ₁ in number of users terminals may for simply transmitting only the common distributed data W _F to all users Effective when multicasting content.

First, the flow of processing in the server device 10 of this embodiment will be described in detail. FIG. 11 is an example of a processing flow of the server device 10 in this embodiment.
The content encryption processing unit 11 receives the content C to be distributed recorded in the content DB 15 and the encryption key K corresponding to the content C recorded in the key management DB 16 and uses the encryption key K. Then, the encrypted content K (C) is generated by encrypting the data of the content C (step 301). The operation of the content encryption processing unit 11 is the same as that of the first embodiment.

Distributed processing unit 12, an encryption key used in content encryption processing unit 11 K, the identification information Ic for uniquely identifying the content, user identification information for identifying the user Ip, further uniform distributed data W _F , The partial information S ₀ and the partial information S ₁ are generated from the encryption key K, the content identification information Ic and the user identification information Ips, and the above-described restoration is performed from the partial information S ₀ and S ₁ and the common distributed data WF. Distributed data W ₂ and W ₃ are generated using the control-type secret information distribution method (step 302). Here, the content identification information Ic and the user identification information Ip are the same as in the first embodiment, and the content identification information Ic uses the content Ic, and the user identification information Ip uses a telephone number. The common distributed data W _F, for example key management DB16 are recorded in association with the advance content ID to be the use of this common distributed data. FIG. 13 shows an example of the data structure of the key management DB 16 in this embodiment, in which key information and common distributed data are stored for each content ID.

Hereinafter, the dispersion processing in this embodiment will be described in more detail with reference to FIG.
First, partial information S _0, S ₁ and to determine a common distributed data W _F. Here, the partial information S ₀ and S ₁ are the same as those described in the first embodiment. The common as the distributed data W _F, used to obtain the value "aabbccddeeff0011223344556677" associated with the content ID "0001" from the key management DB 16 (FIG. 13).

  Next, a special function f (x) called a dispersion function for performing dispersion coding on the partial information is set. Here, the dispersion function f (x) in the present embodiment uses the same expression (8) as that described in the first embodiment.

Next, the variable R is calculated. In a distributed function f of formula (8) (x), as a result calculated by substituting x = 6 f (6) is a common distributed data W _F, it is determined by calculating the variables R. That is,
W _F = f (6) = S ₀ −S ₁ + 5R (mod P) (15)
Is transformed with respect to the variable R to obtain the following equation.

Calculating the variable R by substituting the partial information S _0, S ₁ and the common distributed data W _F in the equation (16). In this example,
S ₀ = 1234567890123456789012345678
S ₁ = 3030303130313233343343373739
W _F = aabbccddeeff0011223344556677
Therefore, the above value is substituted into equation (16),
R = 8e8b21514fd2cc62c5f814de74ba
Get.

Next, distributed data W ₂ and W ₃ are generated from the distributed function f (x), the prime number P, the partial information S ₀ and S ₁ , the common distributed data W _F , and the variable R. That is, f (2) obtained by substituting x = 2 into the dispersion function f (x) of Expression (8) is calculated as the distributed data W ₂ , and f (4) obtained by substituting x = 4 is calculated as the distributed data W ₃ . In the present embodiment, the distributed data W ₂ and W ₃ are calculated as follows.
_{W 2 = f (2) =} S 0 -5S 1 -3R = 75a2018eafa3d42e219dc484de4c (mod P)
W ₃ = f (4) = S ₀ -3S ₁ -3R = d60261f1100638948a0830f34ebe (mod P)
... (17)

Here, from the calculated variance data, the characteristics of the above-mentioned dispersion function f (x), distributed data W ₂ and W ₃ partial information S ₁ from a partial recoverable, common distributed data W _F and distributed data W ₂ , partial information S ₀ and S ₁ can be completely restored from W ₃ . FIG. 14 is a table summarizing calculation examples of decentralization processing in the present embodiment.

The license transmission processing unit 13 inputs the distributed data W ₂ and W ₃ generated by the distributed processing unit 12, and transmits at least the distributed data W ₂ and W ₃ to the terminal device 20 as license information (step 303). The operation of the license transmission processing unit 13 is the same as that of the first embodiment.

On the other hand, the data multiplexing unit 14, the content encryption processing unit 11 with the generated encrypted content K (C), the identification information Ic for uniquely identifying the content, as the input common distributed data W _F, these encryption encrypted content K (C) and content identification information Ic common distributed data W _F multiplexes, transmits the distribution data to the terminal device 20 (step 304). The multiplexing method is basically the same as in the first embodiment. In the present embodiment, since the common distributed data W _F is unique for each content, as in the case of the content ID described in Example 1, be transmitted by assigning to the header portion of the encrypted content Good.

Next, the flow of processing in the terminal device 20 of the present embodiment will be described in detail. FIG. 12 is a processing flow example of the terminal device 20 in the present embodiment.
The data separation processing section 21, and inputs the distribution data multiplexed sent from the server apparatus 10, the distribution data, the encrypted content K (C) and the content identification information Ic and the common distributed data W _F separation Then, it is stored in the internal memory or the like (step 401).

The license reception processing unit 22 receives the license information sent from the server device 10, acquires the distributed data W ₂ and W ₃ included in the license information (step 402), and distributes the distributed data W ₂ and W _3. from using the restoration control type secret dispersion method described above by performing the partial restoration process, it acquires the partial information S _1, and acquires the content identification information Ic and the user identification information Ip from partial information S ₁ (step 403) . Note that the license information sent from the server device can be recorded in a recording device and used when viewing the content later, or can be used by another terminal device owned by the user.

Hereinafter, the partial restoration process in the present embodiment will be described in more detail with reference to FIG.
The distributed data W ₂ and W ₃ in this embodiment are f (2) and f (4) obtained by substituting x = 2 and x = 4, respectively, in the dispersion function f (x) of the equation (8). The following simultaneous equations can be established.
W ₂ = f (2) = S ₀ -5S ₁ -3R (mod P)
W ₃ = f (4) = S ₀ -3S ₁ -3R (mod P) (18)

Therefore, the equation for obtaining the partial information S ₁ from the distributed data W ₂ and W ₃ is as the following equation (19).
However, the partial information S ₀ and the random number R cannot be obtained from this equation.

In this embodiment, the distributed data W ₂ and W ₃ are respectively
W ₂ = 75a2018eafa3d42e219dc484de4c
W ₃ = d60261f1100638948a0830f34ebe
Therefore (FIG. 14), if the values of W ₂ and W ₃ are substituted into the above equation (19),
S ₁ = 3030303130313233343343373739
Is calculated (FIG. 15). From the calculated S ₁ , “0001” as the content identification information Ic (content ID) and “0123456789” as the user identification information Ip (phone number) are obtained by the same method as described in the first embodiment.

In the key recovery processing unit 23, the content identification information Ic and common shared data W _F acquired by the data separation processing unit 21 and the content identification information Ic acquired by the license reception processing unit 22 and the distributed data W ₂ and W _{3 are used.} it matches the content identification information Ic, common distributed data W _F and variance data W ₂ having the same content identification information Ic, W ₃ collects (step 404), distributed data W ₂ and these common distributed data W _F, A complete restoration process is performed from W ₃ using the restoration control type secret information distribution method described above to obtain partial information S ₀ , S ₁ and a random number R, and an encryption key used for content encryption from the partial information S ₀ K is acquired (step 405).

Hereinafter, the complete restoration process in the present embodiment will be described in more detail with reference to FIG.
Uniform distributed data W _F and distributed data W _2, W ₃ in the present embodiment, the dispersion function f (x) of formula (8), respectively x = 6, x = 2, x = 4 was substituted for f (6 ), F (2), and f (4), the following simultaneous equations can be established.
W _F = f (6) = S ₀ −S ₁ + 5R (mod P)
W ₂ = f (2) = S ₀ -5S ₁ -3R (mod P) (20)
W ₃ = f (4) = S ₀ -3S ₁ -3R (mod P)
This simultaneous equation is expressed as a determinant as follows.

By solving the above equation (21) by a sweeping method or the like, the calculation formulas for the partial information S ₀ , S ₁ and the random number R can be obtained. Each calculation formula is as follows.

In the present embodiment, the common distributed data W _F and distributed data W _2, W _3, respectively,
W _F = aabbccddeeff0011223344556677
W ₂ = 75a2018eafa3d42e219dc484de4c
W ₃ = d60261f1100638948a0830f4ebe
(FIG. 14), substituting the above W _F , W ₂ , and W ₃ values into equation (22),
S ₀ = 1234567890123456789012345678
S ₁ = 3030303130313233343343373739
R = 8e8b21514fd2cc62c5f814de74ba
Is calculated (FIG. 16). From the calculated partial information S ₀ , “1234567890123456789012345678” is obtained as the encryption key K used for content encryption.

  The content decryption processing unit 24 receives the encrypted content K (C) acquired by the data separation processing unit 21 and the encryption key K acquired by the key decryption processing unit 23, and uses the encryption key K to store the encrypted content K (C). Content C is acquired by decrypting (step 406). The content decryption process is the same as in the first embodiment.

  In this embodiment, user-specific information (name, phone number, e-mail address, etc.) is used as user identification information. However, in the same manner as in the first embodiment, group information is used to Limited content distribution can be performed.

  Further, in this embodiment, the user who holds the license information was able to view the content unconditionally, but like the one described in the first embodiment, by including authentication information or the like in the partial information, It is also possible to always authenticate at the time of viewing and limit the users who can view.

  In the present embodiment, the case where the content C is encrypted and distributed using only one encryption key K has been described, but the content C is divided into a plurality of blocks in the same manner as described in the first embodiment. However, each of the encrypted keys Xi may be encrypted and distributed.

  The processing functions of some or all of the units in the devices 10 and 20 shown in FIGS. 1 and 10 can be configured by a computer program, and the program can be executed using the computer to realize the present invention. Alternatively, it goes without saying that the processing procedures shown in FIG. 2, FIG. 3, FIG. 11, and FIG. 12 can be configured by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

1 is a block diagram showing a system configuration example in Embodiment 1 of the present invention. The processing flowchart of the server apparatus of Example 1 of this invention. The processing flowchart of the terminal device of Example 1 of this invention. The figure which shows the data structure example of content DB. The figure which shows the data structure example of key management DB. The figure which shows the data structure example of user management DB. The figure which shows the calculation example of the dispersion | distribution process in Example 1 of this invention. The figure which shows the calculation example of the partial decompression | restoration process in Example 1 of this invention. The figure which shows the calculation example of the complete restoration process in Example 1 of this invention. The block diagram which shows the system configuration example in Example 2 of this invention. The processing flowchart of the server apparatus of Example 2 of this invention. The processing flowchart of the terminal device of Example 2 of this invention. The figure which shows another example of a data structure of key management DB. The figure which shows the calculation example of the dispersion | distribution process in Example 2 of this invention. The figure which shows the calculation example of the partial decompression | restoration process in Example 2 of this invention. The figure which shows the example of a calculation of the complete restoration process in Example 2 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Content delivery server 11 Content encryption process part 12 Decentralization process part 13 License transmission process part 14 Data multiplexing process part 15 Content DB
16 Key management DB
17 User management DB
20 Content Receiving Terminal 21 Data Separation Processing Unit 22 License Reception Processing Unit 23 Key Recovery Processing Unit 24 Content Decryption Processing Unit 25 Display Unit

Claims (11)

By encrypting the content that is a digital work in the server device so that it can be viewed only by a specific registered user and distributing the decryption key only to the terminal device of the specific user, the user of the terminal device can A content distribution system that enables the use of content,
The server device
A content database that records content;
A key management database that records encryption keys for each content;
A user management database that records user identification information for each user;
Content encryption means for encrypting content recorded in the content database using an encryption key corresponding to the content recorded in the key management database, and generating encrypted data;
There must be at least three pieces of distributed data generated from three types of information: the encryption key used in the content encryption means, the user identification information recorded in the user management database, and the content identification information for identifying the content. For example, the first restoration function can restore all the three pieces of information. With less than three pieces of distributed data, the second restoration function can restore the user identification information and the content identification information among the three pieces of information. A decentralized means for generating three or more distributed data by performing distributed encoding with a distributed function, which satisfies the condition that the key cannot be restored ;
A license that transmits less than three pieces of distributed data for restoring the user identification information and the content identification information by the second restoration function among the three or more pieces of distributed data generated by the distribution means to the terminal device as license information A transmission means;
When the encrypted data generated by the content encryption unit and the distributed data excluding the license information among the three or more distributed data generated by the distribution unit and combined with the distributed data constituting the license information are 3 Multiplexing means for multiplexing the number of pieces of distributed data and the content identification information and transmitting it to the terminal device as distribution data,
The terminal device
The content identification information from the distribution data, separating means the encrypted data and the distributed data are separated respectively acquired,
License receiving means for receiving the license information and restoring the user identification information and the content identification information from the license information using the second restoration function ;
The distributed data constituting the license information received by the license receiving means corresponding to the same content identification information and the distributed data acquired by the separating means are collected, and the first restoration function is obtained from the collected distributed data. A key recovery means for recovering the encryption key;
Content decrypting means for decrypting the encrypted data acquired by the separating means with the encryption key restored by the key restoring means to make the content viewable;
A content distribution system characterized by that. The content distribution system according to claim 1,
The user identification information includes information that can uniquely identify a user or a group. If there is an illegality, the user identification information is partially restored from the license information by the second restoration function to obtain an unauthorized user. Or identify a group,
A content distribution system characterized by that. The content distribution system according to claim 1 or 2,
The distribution means of the server device fixes a part of a plurality (three or more) of distributed data to be generated and sets it as common distributed data, and a part of the plurality of generated distributed data is a common distribution. Three types of information such as the encryption key used in the content encryption unit, the user identification information recorded in the user management database, and the content identification information for identifying the content so as to be data, To generate the remaining distributed data other than the common shared data,
The multiplexing means of the server device multiplexes the common distributed data, the encrypted data, and the content identification information to generate distribution data.
A content distribution system characterized by that. In the content delivery system of any one of Claims 1-3,
The server device includes authentication information for performing content viewing restriction in data distributed and encoded by the distribution means,
The terminal device performs an authentication process as to whether or not the content can be viewed when displaying the content;
A content distribution system characterized by that. By encrypting the content that is a digital work in the server device so that it can be viewed only by a specific registered user and distributing the decryption key only to the terminal device of the specific user, the user of the terminal device can A content distribution method that enables the use of content,
The server device
A content encryption process for encrypting content recorded in the content database using an encryption key corresponding to the content recorded in the key management database, and generating encrypted data;
If there are three or more pieces of distributed data generated by generating three pieces of information: the encryption key used in the content encryption process, the user identification information recorded in the user management database, and the content identification information for identifying the content All of the three information can be restored by the first restoration function, and the user identification information and the content identification information of the three pieces of information can be restored by the second restoration function in the case of less than three distributed data. Is a dispersion process that generates 3 or more pieces of distributed data by performing dispersion coding with a dispersion function that satisfies the condition that cannot be restored,
A license that transmits less than three pieces of distributed data for restoring the user identification information and the content identification information by the second restoration function among the three or more pieces of distributed data generated by the decentralization processing to the terminal device as license information Send processing and
The encrypted data generated by the content encryption process and the distributed data excluding the license information among the three or more distributed data generated by the distributed process, together with the distributed data constituting the license information, 3 A multiplexing process that multiplexes the pieces of distributed data and the content identification information and transmits them to the terminal device as distribution data,
The terminal device
A separation process for separating and acquiring the content identification information, the encrypted data, and the distributed data from the distribution data;
Receiving the license information, the license receiving process for restoring the User chromatography The identification information and the content identification information from the license information using the second restoration function,
The distributed data constituting the license information received in the license receiving process corresponding to the same content identification information and the distributed data acquired by the separating unit are collected, and the first restoration function is obtained from the collected distributed data. A key recovery process for recovering the encryption key;
A content decrypting process for making the content viewable by decrypting the encrypted data acquired by the separating means with the encryption key restored in the key restoring process,
A content distribution method characterized by the above. The content distribution method according to claim 5,
The user identification information includes information that can uniquely identify a user or a group, and if there is a fraud, identifies the unauthorized user or group by partially restoring the user identification information from the license information.
A content distribution method characterized by the above. The content distribution method according to claim 5 or 6,
In the distributed processing of the server device, a part of a plurality of (three or more) distributed data to be generated is fixed and set as common distributed data, and a part of the plurality of generated distributed data is commonly distributed. Three types of information such as an encryption key used in the encryption process, user identification information recorded in the user management database, and content identification information for identifying the content are used as the distribution function so as to be data. To generate the remaining distributed data other than the common shared data,
In the multiplexing process of the server device, the common shared data, the encrypted data, and the content identification information are multiplexed to generate distribution data.
A content distribution method characterized by the above. In the content delivery method of any one of Claims 5-7,
The server device includes authentication information for performing content viewing restriction in the data to be distributed and encoded by the distributed processing,
The terminal device performs an authentication process as to whether or not the content can be viewed when displaying the content;
A content distribution method characterized by the above. The server apparatus used for the content delivery system of any one of Claims 1-4. The terminal device used for the content delivery system of any one of Claims 1-4. The program for making a computer perform the content delivery method of any one of Claims 5-8.

Images