Apparatus and method for secure content key updates

BACKGROUND OF THE INVENTION

Field of the Invention

0001The present invention relates to an information processing apparatus that receives or transmits contents requiring copyright protections.

Related Art

0002Along with the diffusion of computer networks and digitalization in recent years, products called digital information home appliances are widespread. Furthermore, with the starting of digital broadcasting, digital TV, set-top boxes and DVD recorders for digital broadcasting are expected to be more widely spread from now on. When these digital information home appliances are connected to a home network, users can enjoy the contents via the network, and this is beneficial for users.

0003The contents refer to various kinds of digital data, for example, audiovisual data such as MPEG2 or MPEG4, audio data, document data such as text data and still image data. The contents of this kind of digital data have an advantage in that the data can be easily copied without degradation. On the other hand, there is a problem that users must pay attention to the copyright of the contents (see "Digital Transmission Licensing Administrator", http://www.dtcp.com). We assume a case of transmitting copyright-protected contents from a certain transmitter to a receiver. It is desirable that exchanges of copyright-protected contents are limited to within a certain range. For example, the contents are exchanged within a range of a legitimate right, such as within a range of private utilization as prescribed in the copyright law, or within a narrower range than the range prescribed by the law. Exchanges of the contents with a third party outside this range should be prohibited.

0004However, a transmission of audio and audiovisual data via a network has a risk of infringement on the copyright law. For example, in the case of transmitting copy-prohibited contents from a transmitter to a receiver, the data can be illegally copied with a device connected to the network, unless the transmitted contents are encrypted. Upon transferring the audio and audiovisual data by using the internet protocol (IP), a general technique of filtering and monitoring the data on the network is used. The use of this technique makes it possible for a user to filer and obtain arbitrary data transferred between a specific transmitter and a receiver. In other words, the user can efficiently collect only the contents excluding control information out of the data transmitted from the transmitter to the receiver.

0005Considering the user's convenience, it is important to provide a system in which the receiver can securely receive the desirable contents from transmitter. For example, according to the IP, if there is a device called a proxy server between a transmitter and a receiver, the following problems may occur. The proxy server blocks a request for contents transmitted from the receiver, just before the transmitter. The proxy server sends, on behalf of the receiver, a request for contents that are different from the contents requested by the receiver, to the transmitter. Furthermore, the proxy server sends a request for contents that are different from the contents requested by the receiver, to a different transmitter. In this way, the proxy server enables a receiver to receive contents that are different from the contents originally requested by the receiver.

0006<patcit id="pcit0001" dnum="US20040174874A"><text>US 2004/0174874</text></patcit> describes a system in which encrypted content is sent from a transmitter to a receiver in encrypted form. Key information is sent with the encrypted content. The receiver is able to detect if transmission has been interrupted and to request a transmitter to transmit key information.

0007<patcit id="pcit0002" dnum="EP1182825A"><text>EP 1182825</text></patcit> and <patcit id="pcit0003" dnum="US20030046565A"><text>US 2003/0046565</text></patcit> each describes systems for transmitting encrypted content in which a transmitter and receiver share a first key, and the content is encrypted using a second key generated using the first, shared key.

SUMMARY OF THE INVENTION

0008The present invention has been achieved in the light of the above problems. It is an object of the present invention to provide an information processing apparatus and an information processing method that make it possible to effectively utilize contents, by securely preventing an unfair utilization of the contents and by enabling users to correctly receive desired contents.

0009According to one embodiment of the present invention, a information processing apparatus which receives encrypted contents and key information attached to the contents transmitted from a communication apparatus connected via a network, comprising: <ul id="ul0001" list-style="none" compact="compact"><li>authentication &amp; key exchange unit configured to perform authentication &amp; key exchange processing by using a given protocol with the communication apparatus and generates a first key shared with the communication apparatus;</li><li>a contents receiver configured to receive encrypted contents obtained by encrypting the contents with a second key generated by using the first key and the key information, and the key information attached to the encrypted contents;</li><li>a contents decryption unit configured to decrypt the encrypted contents by using the first key and the key information; and</li><li>a contents confirmation request unit configured to instruct the communication apparatus to transmit or confirm the key information held by the communication apparatus, when the contents decryption unit decrypts the contents based on the second key firstly generated by using the first key.</li></ul>

0010Preferably the contents confirmation request unit is configured to instruct the communication apparatus to transmit or confirm the key information held by the communication apparatus, when the key information transmitted from the communication apparatus does not change in order agreed with the communication apparatus in advance.

0011The contents confirmation request unit may be configured to instruct the communication apparatus to transmit or confirm the key information held by the communication apparatus, when the key information transmitted from the communication apparatus is updated at a timing different from a timing predicted in advance.

0012The contents confirmation request unit may be configured to instruct the communication apparatus to transmit or confirm the key information held by the communication apparatus, when a connection for contents transmission with the communication apparatus is once cut off and the connection with the communication apparatus is again established to begin the contents transmission.

0013Furthermore, according to one embodiment of the present invention, an information processing apparatus which transmits encrypted contents to a communication apparatus connected via a network, comprising: <ul id="ul0002" list-style="none" compact="compact"><li>an authentication &amp; key exchange unit configured to perform authentication &amp; key exchange processing by using a given protocol with the communication apparatus;</li><li>a key generation unit configured to operate a given function by using the key information including a random number and the first key to generate a second key;</li><li>an encryption unit configured to encrypt contents by using the second key;</li><li>a contents transmitter configured to transmit the encrypted contents with the key information in plain text, to the communication apparatus;</li><li>a key information updating unit configured to update the key information based on a given condition;</li><li>a random number acquisition unit configured to acquire the random number included in a contents confirmation request transmitted from the communication apparatus;</li><li>a key information acquisition unit configured to acquire the key information being currently used to encrypt the contents; and</li><li>a contents confirmation response unit configured to transmit a message including the key information acquired by the key information acquisition unit and the random number acquired by the random number acquisition unit to the communication apparatus, as a contents confirmation response for the contents confirmation request.</li></ul>

BRIEF DESCRIPTION OF THE DRAWINGS

0014<ul id="ul0003" list-style="none" compact="compact"><li><figref idref="f0001">Fig. 1</figref> is a block diagram showing a schematic configuration of a contents transmitting and receiving system having an information processing apparatus according to a first embodiment of the present invention.</li><li><figref idref="f0001">Fig. 2</figref> is a block diagram showing a schematic configuration of the transmitter A according to the present embodiment.</li><li><figref idref="f0002">Fig. 3</figref> is a diagram showing one example of a transfer format that is used when the transmitter A transmits encrypted contents to the receiver B.</li><li><figref idref="f0002">Fig. 4</figref> is a block diagram showing a schematic configuration of the receiver B according to the present embodiment.</li><li><figref idref="f0003">Fig. 5</figref> is a flowchart showing a processing procedure of the contents transmitting and receiving system according to the present embodiment.</li><li><figref idref="f0004">Fig. 6</figref> is a flowchart showing one example of a detailed processing procedure of the contents confirmation processing that the receiver B carries out.</li><li><figref idref="f0004">Fig. 7</figref> is a flowchart showing one example of a detailed processing procedure of the contents confirmation processing that the transmitter A carries out.</li><li><figref idref="f0005">Fig. 8</figref> is a diagram showing one example of a format of a message of the contents confirmation request.</li><li><figref idref="f0005">Fig. 9</figref> is a diagram showing one example of a format of the contents confirmation response including the message M that the transmitter A transmits.</li><li><figref idref="f0006">Fig. 10</figref> is a diagram showing a seed update timing of the transmitter A and a seed update timing of the receiver B.</li><li><figref idref="f0006">Fig. 11</figref> is a flowchart showing a processing procedure of the receiver B according to a modification of the process shown in <figref idref="f0004">Fig. 6</figref>.</li><li><figref idref="f0007">Fig. 12</figref> is a graph showing a seed update timing of the transmitter A and a seed update timing of the receiver B.</li><li><figref idref="f0007">Fig. 13</figref> is a sequence diagram showing an example different from that shown in <figref idref="f0007">Fig. 12</figref>.</li><li><figref idref="f0008">Fig. 14</figref> is a flowchart showing one example of a time limit processing of the contents confirmation response that the receiver B carries out.</li><li><figref idref="f0008">Fig. 15</figref> is a flowchart showing a modification of the processing shown in <figref idref="f0008">Fig. 14</figref>.</li><li><figref idref="f0009">Fig. 16</figref> is a diagram showing one example of a format of the contents confirmation response message including the message M2 transmitted from the transmitter A.</li><li><figref idref="f0009">Fig. 17</figref> is a flowchart showing a processing procedure of the receiver B according to the second embodiment.</li><li><figref idref="f0010">Fig. 18</figref> is a block diagram showing a schematic configuration of the transmitter A according to the third embodiment.</li><li><figref idref="f0010">Fig. 19</figref> is a block diagram showing a schematic configuration of the receiver B according to the third embodiment.</li><li><figref idref="f0011">Fig. 20</figref> is a sequence diagram showing one example of a processing procedure that is carried out between the transmitter A shown in <figref idref="f0010">Fig. 18</figref> and the receiver shown in <figref idref="f0010">Fig. 19</figref>.</li><li><figref idref="f0012">Fig. 21</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the receiver B carries out.</li><li><figref idref="f0012">Fig. 22</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the transmitter A carries out.</li><li><figref idref="f0013">Fig. 23</figref> is a diagram showing one example of a message format of the contents confirmation request.</li><li><figref idref="f0013">Fig. 24</figref> is a diagram showing one example of a message format of the contents confirmation response.</li><li><figref idref="f0014">Fig. 25</figref> is a diagram showing one example of a message format of the contents confirmation response when the seed check processing is unsuccessful.</li><li><figref idref="f0014">Fig. 26</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the receiver B carries out.</li><li><figref idref="f0015">Fig. 27</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the transmitter A carries out.</li><li><figref idref="f0015">Fig. 28</figref> is a diagram showing one example of a format of the contents confirmation response message.</li><li><figref idref="f0016">Fig. 29</figref> is a diagram showing one example of a message format of the contents confirmation response.</li></ul>

DETAILED DESCRIPTION OF THE INVENTION

0015Hereafter, an embodiment of the present invention will be described more specifically with reference to the drawings.

(First Embodiment)

0016<figref idref="f0001">Fig. 1</figref> is a block diagram showing a schematic configuration of a contents transmitting and receiving system having an information processing apparatus according to a first embodiment of the present invention. The contents transmitting and receiving system shown in <figref idref="f0001">Fig. 1</figref> has an object of transmitting and receiving mainly audio and audiovisual data within a range in which individual persons use the data. This system includes a transmitter A, a receiver B, and a receiver C that are connected to a local area network 1. Alternatively, these devices can be connected to each other with a router or a bridge (both not shown). At least one of the transmitter A, and the receivers B and C can be an information processing apparatus according to the embodiment of the present invention.

0017A physical layer and a link layer of the local area network (hereinafter, LAN) 1 can be implemented by various forms such as a wireless LAN based on the IEEE802.11, Ethernet (a registered trademark), and the IEEE1394. The network layer of the LAN 1 can be IPv4 or IPv6, when the Internet Protocol (hereinafter simply referred to as IP) is used. The LAN 1 can be connected with devices other than the transmitter A, the receiver B, and the receiver C. To simplify <figref idref="f0001">Fig. 1</figref>, these other devices are not shown.

0018Here, we assume that the transmitter A transmits contents to the receivers B and C. To simplify the explanation, the contents are digital contents (hereinafter simply referred to as contents) to be transmitted in a state that the contents are copyright-protected. In other words, when the receiver B requests the transmitter A for desired contents, the receiver B can detect a device other than the transmitter A and the receiver B illegally obtains and copies the contents and that the transmitter A or other device transmits contents different from the contents requested by the transmitter B.

0019The present embodiment has broadly the following two characteristics.

(A first characteristic)

0020When there is no means for encryption, the contents can be easily copied on a transmission path between the transmitter and the receiver. To overcome this problem, according to the present embodiment, prior to the transmission and reception of the contents, a processing is carried out to enable the transmitter and the receiver to share a secret in advance. The transmitter and the receiver encrypt and decrypt the contents using this secret. In this way, it is possible to prevent the contents from being copied by a device having no common secret. In order to increase the encryption strength, a key used to encrypt the contents is updated periodically.

(A second characteristic)

0021When the receiver transmits a request for the contents to the transmitter, there is a risk that this request for the contents is changed on the transmission path between the transmitter and the receiver. As a result, the receiver may receive contents different from the requested contents. To overcome this problem, according to the present embodiment, during the reception of the contents, the receiver inquires the transmitter about whether the contents being received by the receiver and the contents being transmitted from the transmitter are encrypted with the same key. In this way, it is confirmed that the contents being processed by the receiver and the contents currently being processed by the transmitter are the same contents.

0022An example of the operation that the receiver B shown in <figref idref="f0001">Fig. 1</figref> requests the transmitter A to transmit contents, and the receiver B receives the contents, is explained below.

0023<figref idref="f0001">Fig. 2</figref> is a block diagram showing a schematic configuration of the transmitter A according to the present embodiment. The transmitter A shown in <figref idref="f0001">Fig. 2</figref> has the network interface 1, a packet processor 2, a data connection manager 3, an authentication &amp; key exchange connection manager 4, an authentication &amp; key exchange processor 5, an encryption processor 6, a contents supplier 7 and a seed collector 8.

0024The network interface 1 executes processings of a physical layer and a data link layer to communicate with the receiver B. The packet processor 2 executes a network layer and transport layer processing to communicate with the receiver B. The authentication &amp; key exchange processor 5 carries out an authentication &amp; key exchange processing with the receiver B. The data connection manager 3 manages a connection for transmitting and receiving contents (a connection B). The authentication &amp; key exchange connection manger 4 manages a connection for exchanging authentication &amp; key (a connection A).

0025When the authentication &amp; key exchange processing is successful, the authentication &amp; key exchange processor 5 generates an authentication key as a private key to be used to encrypt and decrypt the contents with each receiver B. The authentication key is a value of a key that is shared with all receivers that are successful in the authentication &amp; key exchange processing. The authentication &amp; key exchange processing refers to the following processing. The transmitter A and the receiver B mutually authenticate that both devices have properly received a license from a certain licensing organization. When it is confirmed that the transmitter A and the receiver B are compliant devices, a common key is generated. To execute the authentication, a known method such as the ISO/IEC 9798-3 or the ISO/IEC 9798-2 can be used.

0026The encryption processor 6 calculates a key to encrypt contents, and decrypt the contents. The encryption processor 6 generates a key to encrypt the contents using the key (authentication key (K)) shared by the authentication &amp; key exchange processing. The key (contents key Kc) that is used to encrypt the contents is calculated from a function (F) using parameters K (the authentication key) and S (seed): <maths id="math0001" num=""><math display="block"><mi>Kc</mi><mo mathvariant="normal">=</mo><mi mathvariant="normal">F</mi><mfenced><mi mathvariant="normal">K</mi><mo>⁢</mo><mi mathvariant="normal">S</mi></mfenced></math><img file="EP1648112B1_D0001.tif" /></maths>

0027The function F can be calculated according to (1) a method using an encryption algorithm such as the AES (advanced encryption standard), (2) a method using a hash function such as the SHA-1, and (3) a method combining the methods (1) and (2). The parameters of the function F can include parameters other than the authentication key K and the seed S.

0028The contents key Kc is calculated from the seed S and the authentication key K, thereby encrypting the contents. As an encryption algorithm for the encryption and the decryption, a known method such as the AES can be used. The contents supplier supplies the contents to the encryption processor.

0029The seed S is a value that changes based on time or an accumulated amount of data to be encrypted. To update the seed, there are (1) a method of changing the seed based on a constant time or a constant time range, (2) a method of changing the seed based on an accumulated amount of transmission data, and (3) a method of selecting the time or the accumulated amount of transmission data whichever is updated earlier. Because the contents key is generated using the seed, the contents key is also updated based on time and a data amount.

0030When the transmitter A transmits contents to plural receivers B, the transmitter A transmits the contents asynchronously to each receiver B, depending on a transfer protocol to be used for the transmission and a band of the network. Therefore, when the transmitter A starts simultaneously transmitting the contents to the receiver B and the receiver C at a certain time T, for example, data of M megabytes is transmitted to the receiver B and data of N megabytes is transmitted to the receiver C, at a point of time of the time T+X. Accordingly, when the method (2) is used, the timing of updating the seed is also different for each receiver B. For example, when the seed is updated each time when the transmitter A transmits one megabyte data, the seed is updated M times for the receiver B, and the seed is updated N times for the receiver C. As methods of updating the value of the seed, there are (a) a method of generating a random number each time, and (b) a method of generating a random number at a first time, and changing the random number by a constant number at a second time and after (for example, a method of increasing the value of the random number by one at each time). It is assumed that the random number is changed based on the method (b) in the following explanation.

0031The seed collector 8 collects all seed values while the transmitter A is carrying out a processing, and accumulates the seed values as a seed list. When any one of the seeds that the transmitter A manages is updated, the seed list is also updated.

0032<figref idref="f0002">Fig. 3</figref> is a diagram showing one example of a transfer format that is used when the transmitter A transmits encrypted contents to the receiver B. As shown in <figref idref="f0002">Fig. 3</figref>, the contents are divided into an optional data length, and the contents are transferred as a contents packet including a header d1 and contents d2. The contents d2 mean the encrypted contents. The header d1 consists of a seed S (S1, S2, etc.) that is used to calculate a contents key, and a contents length d3. The seed S is used to generate the contents key, and can be transmitted in a plain text, because a device having no authentication key K cannot obtain the contents key Kc. The header d1 can contain other information concerning contents. The contents d2 contains the encrypted contents.

0033<figref idref="f0002">Fig. 4</figref> is a block diagram showing a schematic configuration of the receiver B according to the present embodiment. As shown in <figref idref="f0002">Fig. 4</figref>, the receiver B has a network interface 11, a packet processor 12, a data connection manager 13, an authentication &amp; key exchange connection manger 14, an authentication &amp; key exchange processor 15, an encryption processor 16, a contents processor 17 and a seed check processor 18.

0034The network interface 11, the packet processor 12, the data connection manager 13, the authentication &amp; key exchange connection manger 14, and the authentication &amp; key exchange processor 15 have functions similar to those of the corresponding blocks within the transmitter A, and can be configured with similar blocks.

0035The encryption processor 16 calculates the contents key Kc, and decrypts the contents. The contents key Kc is obtained by the function F using the authentication key K calculated by the authentication &amp; key exchange processing with the transmitter A, and the value of the seed S included in the contents header of the contents packet received from the receiver B. The encryption processor 16 decrypts the contents of the contents packet corresponding to the contents header using the contents key Kc. The contents processor 17 outputs the received contents to a display unit, or stores the contents.

0036The seed check processor 18 checks whether the seed value included in the header of the contents packet currently being processed coincides with the seed value that the transmitter A is processing at present, or whether these seed values are within a certain range, when a certain condition is satisfied.

0037<figref idref="f0003">Fig. 5</figref> is a flowchart showing a processing procedure of the contents transmitting and receiving system according to the present embodiment. According to the present embodiment, two communication connections A and B are present between the transmitter A and the receiver B. The connection A is used to exchange the authentication &amp; key, and the connection B is used to transmit contents.

0038First, the transmitter A carries out the authentication &amp; key exchange processing with the receiver B (steps S1 to S3). As a result, the transmitter A and the receiver B share the authentication key K.

0039Next, the receiver B transmits a contents reception request to the transmitter A (step S4). The contents reception request is generally transmitted using a plain text in the form of an HTTP GET request, when HTTP (hypertext transfer protocol) is used as a contents transfer protocol. When RTP (real-time transport protocol) is used as a contents transfer protocol, the connection B is used to transfer the contents. The connection C that is different from the contents transfer connection B is used to carry out the contents reception request.

0040Upon receiving this request, the transmitter A generates a contents key (Kc1) from the seed S1 and the authentication key K calculated in advance (step S5). Next, the transmitter A encrypts the contents with the generated contents key (Kc1) (step S6), and transmits the contents packet to the receiver B, by including the seed S1 in the contents header and including the encrypted contents in the contents of the contents packet (step S7).

0041Thereafter, after transmitting a certain amount of data, the transmitter A updates the seed (S2), and re-calculates the contents key (Kc2) (step S8). The transmitter A encrypts the contents with the recalculated contents key (Kc2) (step S9), generates a contents packet in a manner similar to that at step S7, and transmits the generated contents packet (step S10).

0042On the other hand, the receiver B confirms the seed value included in the header of the contents packet transmitted at step S7 from the transmitter A, calculates the contents key (step S11), and decrypts the contents (step S12).

0043The receiver B confirms the seed value included in the header of the contents packet transmitted at step S10 from the transmitter A, updates the contents key when the seed is updated (step S13), and decrypts the data included in the contents with the updated contents key (step S14).

0044As the internal processing of the transmitter A, it is not always necessary to calculate the contents key after updating the seed. Instead, the transmitter A can calculate a contents key using a seed value updated in advance, and update the contents key in time with the updating of the contents packet. Similarly, when the next seed value can be read beforehand, the receiver B can calculate the contents key in advance from the seed value read beforehand, and update the contents key simultaneously with the updating of the seed value of the header of the contents packet. By devising the updating of the key in this way, the contents key can be updated without a delay, in time with the updating of the contents header of the contents packet. As a result, encryption and decryption can be carried out at a high speed.

0045Logically different connections can be used for the authentication &amp; key exchange and for the contents transfer. (For example, when TCP/IP is used for the communication protocol, different TCP connections are used. TCP is used for the authentication &amp; key exchange, and UDP is used for the contents transfer. Alternatively, when IEEE1394 is used for the communication protocol, the asynchronous channel is used for the authentication &amp; key exchange, and the Isochronous channel is used for the contents transfer). In the following explanation, it is assumed that communications are carried out using separate connections. A connection for the authentication &amp; key exchange is called an authentication key exchange connection, and a connection for the contents transfer is called a data connection.

0046The transmitter A periodically updates the seed value. When the seed value is updated to Sn, the transmitter A recalculates the contents key (step S15). The transmitter A encrypts the contents (step S16), and transmits the encrypted contents packet (step S17).

0047The receiver B calculates a contents key Kcn using a seed value Sn (step S18), and decrypts the contents (step S 19), in a manner similar to that at steps S11 to S14.

0048The receiver B makes a contents confirmation request to the transmitter A at a predetermined timing (step S20). The timing for making the contents confirmation request is described in detail later.

0049The receiver B collects seeds, and creates a list of seed values (a seed list) owned at present by the receiver B (step S21). The transmitter A transmits the created seed list to the receiver B, in response to the contents confirmation request (step S22).

0050The receiver B confirms the seed value included in the seed list (step S23). In this case, the receiver B confirms whether the seed owned by the receiver B itself is included in the seed list transmitted from the transmitter A. When the seed owned by the receiver B is included in the seed list transmitted from the transmitter A, the receiver B determines that the seeds coincide with each other. When the seed is not included in the seed list, the receiver B determines that the seeds do not coincide with each other.

0051When the confirmation of the seed is successful, the transmission and reception of the contents are continued using the connection B. On the other hand, when the confirmation of the seed is not successful, the receiver B can transmit again the contents confirmation request to the transmitter A. When the seed confirmation is continuously unsuccessful even after making the contents confirmation request by a predetermined number of times, the receiver B stops decrypting the contents.

0052The timing for making the contents confirmation request at step S20 is explained next. The following four kinds of conditions (1) to (4) are considered to make the contents confirmation request. The contents confirmation request is started at a point of time when at least one of the following conditions (1) to (4) is satisfied. <ol id="ol0001" compact="compact" ol-style=""><li>(1) After a contents key Kc is generated for the fist time using the exchange key (K), the contents are decrypted with this contents key Kc.</li><li>(2) Although the receiver B knows a method of updating the seed in advance, the seed is updated to an unexpected value against the updating method. For example, although it is determined in advance between the transmitter A and the receiver B that a seed is increased by one each time, a contents packet including a seed having a seed value other than S or S+1 is decrypted next to the contents packet having the seed value S.</li><li>(3) Although the receiver B knows a timing of updating the seed in advance, the seed is updated at an unexpected timing against the updating timing. For example, although it is determined in advance between the transmitter A and the receiver B that a seed is increased when a predetermined amount of data is transmitted, the seed is updated before the seed value reaches the predetermined amount.</li><li>(4) After a TCP connection for data connection is once disconnected, the TCP connection is connected to the transmitter A again to start reception of a contents packet.</li></ol>

0053The contents confirmation processing includes a transmission of a contents confirmation request from the receiver B, and a transmission of a contents confirmation response from the transmitter A. A connection different from the data connection can be used for the contents confirmation data. When a different connection is used, the connection can be the same as the connection for the authentication key exchange.

0054<figref idref="f0004">Fig. 6</figref> is a flowchart showing one example of a detailed processing procedure of the contents confirmation processing that the receiver B carries out. <figref idref="f0004">Fig. 7</figref> is a flowchart showing one example of a detailed processing procedure of the contents confirmation processing that the transmitter A carries out. First, the receiver B generates a random number R1 (step S31), and obtains and stores a seed Sr1 of the contents header of the contents packet currently being received (step S32).

0055Next, the receiver B transmits a contents confirmation request including the random number R1 to the transmitter A (step S33). <figref idref="f0005">Fig. 8</figref> is a diagram showing one example of a format of a message of the contents confirmation request. As shown in <figref idref="f0005">Fig. 8</figref>, the message of the contents confirmation request has a TCP/IP header d4, an instruction type (request/response) d5, and a random number (R1) d6.

0056Upon receiving a contents confirmation request from the receiver B (step S51), the transmitter A obtains the random number R1 included in the contents confirmation request message (step S52). Next, the transmitter A creates a random number R2 that is obtained by copying the random number R1 (step S53). The transmitter A obtains all seeds that are currently used, and creates a seed list in which the whole seeds are collected (step S54).

0057A reason why the transmitter A returns the whole seeds being processed (in use) to the receiver B is explained below. When the transmitter A receives the contents confirmation request from the receiver B, there is a possibility that the transmitter A is in the middle of transmitting the contents to other receiver B at the same time, or transmitting plural contents to the receiver at the same time. To simplify the explanation, it is assumed that the transmitter A transmits the same contents to the receiver B and the receiver C.

0058When the RTP (real-time transfer protocol) is used as the contents transfer protocol, one set of contents can be distributed to plural receivers B by multicasting. Therefore, regardless of the number of receivers B, the transmitter A can encrypt only one set of contents. However, when the protocol of establishing a connection for each receiver B like the HTTP is used as the audiovisual data transfer protocol, the amount of data to be transmitted during a certain constant time is different for each connection. Therefore, the seed is updated for each connection. Accordingly, the transmitter A needs to manage seeds by the number of connections.

0059We assume that the receiver B transmits a contents confirmation request to the transmitter A. As described above, the data connection and the authentication key exchange connection are separate logical connections. Therefore, the transmitter A cannot identify the transmitter B that transmits the protocol confirmation request. Although there is a method of identifying the transmitter B using the IP address, it is not possible to identify the transmitter B when an NAT (network address translation) device is present between the transmitter A and the receiver B. Accordingly, the transmitter A transmits the whole seeds being processed to any receiver.

0060Next, the transmitter A obtains all the seeds (S1, S2, ..., and Sn) being processed (step S55). The transmitter A creates an encrypted message M based on a function G shown in the following expression (1) using the whole obtained seeds and the random number R2 obtained by copying the random number R1 with the authentication key K. <maths id="math0002" num="(1)"><math display="block"><mi mathvariant="normal">M</mi><mo mathvariant="normal">=</mo><mi mathvariant="normal">G</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mo mathvariant="normal">…</mo><mo mathvariant="normal">‖</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0002.tif" /></maths> where K denotes the authentication key, and a symbol of operation "||" denotes a concatenation. The function G denotes a processing of encrypting a message obtained by concatenating the random number R2 and the seed S using the key K.

0061Depending on the encryption algorithm, padding is necessary in addition to the message to be encrypted. In this case, a padding length field or a data length field of the data to be encrypted is defined in the header, and the encryption processing is carried out including the padding.

0062Next, the transmitter A transmits a response message including a message (M) to the receiver B (step S56). <figref idref="f0005">Fig. 9</figref> is a diagram showing one example of a format of the contents confirmation response including the message M that the transmitter A transmits. As shown in <figref idref="f0005">Fig. 9</figref>, the message of the contents confirmation response has a TCP/IP header d7, an instruction type (request/response) d8, a random number (R1) d9, and a seed list d10. The random number and the seed list indicated by diagonal lines in <figref idref="f0005">Fig. 9</figref> are transmitted after being encrypted.

0063When the transmitter A transmits the contents confirmation response in the above process, the receiver B carries out the processing at step S34 and afterward shown in <figref idref="f0004">Fig. 6</figref>. First, the receiver B receives the contents confirmation response transmitted from the transmitter A (step S34), decrypts the message included in the contents confirmation response using the authentication key K, and obtains the random number R2 and the seed list (step S35).

0064The receiver B checks whether the obtained random number R2 coincides with the random number R1 owned by the receiver B (step S36). When the obtained random number R2 does not coincide with the random number R1, the receiver B returns an error message without carrying out the following processing (step S37). When the obtained random number R2 coincides with the random number R1, the receiver B obtains the header seed S1 from the seed list obtained at step S35 (step S38). The obtained seed S1 is input to a variable Sk.

0065The receiver B determines whether the seed Sr obtained at step S32 is included in the range of the following expression (2) (step S39). <maths id="math0003" num="(2)"><math display="block"><mi>Sk</mi><mo mathvariant="normal">-</mo><mi mathvariant="normal">X</mi><mo mathvariant="normal">≤</mo><mi>Sr</mi><mo mathvariant="normal">≤</mo><mi>Sk</mi><mo mathvariant="normal">+</mo><mi mathvariant="normal">Y</mi></math><img file="EP1648112B1_D0003.tif" /></maths> where X denotes a positive integer, and Y denotes zero.

0066Therefore, the expression (2) is equivalent to Sk-X ≤ Sr ≤ Sk.

0067When it is determined at step S39 that the seed Sr is included in the range, the processing ends. When it is determined at step S39 that the seed Sr is not included in the range, the receiver B determines whether seeds not yet checked are present in the seed list (step S40). When seeds not yet checked are present in the seed list, the receiver B selects one of the seeds not yet check (step S41), and the process shifts to step S39.

0068As described above, at steps S38 to S41, the receiver B checks whether seeds currently being processed (in use) are included in the seed list transmitted from the transmitter A. When seeds are included in the list, the receiver B can confirm that the contents currently being received are certainly being transmitted from the transmitter A and that the contents are those which the transmitter A is currently processing.

0069When the receiver B transmits the contents confirmation request to a wrong transmitter A, a random number and a seed list cannot be correctly decrypted because the authentication key value is different. As a result, an error occurs in the match test of random numbers. When the random numbers coincide with each other but the seed Sr is not included in the range of the expression (2), the transmitter A and the receiver B have the authentication key K. However, the contents that the receiver B is currently processing are the contents that the transmitter A processed in the past or is going to process in future. Therefore, it is possible to confirm that the contents are not those currently being processed. In this case, an error occurs, because the processing normally ends only when the contents are those currently being processed.

0070At the time of checking whether the seed Sr currently being processed is included in the seed list at step S39, a reason why the seed Sr is compared with a range in which the seed is present, instead of checking a complete matching, is explained below.

0071<figref idref="f0006">Fig. 10</figref> is a diagram showing a seed update timing of the transmitter A and a seed update timing of the receiver B. In <figref idref="f0006">Fig. 10</figref>, a horizontal axis expresses time. The receiver B updates a seed after the seed is received from the transmitter A. Therefore, the transmitter A updates the seed earlier than the receiver B does.

0072The contents are divided into pieces of an optional size, and are transmitted from the transmitter A to the receiver B as contents packets. The contents confirmation request and the contents confirmation response (hereinafter, contents confirmation data) are transmitted and received using a connection different from that for the contents packet.

0073In this case, there is a possibility that different delays occur between the data connection and the authentication key exchange connection on the network or within the devices due to a retransmission processing or the like attributable to a packet loss. For example, at the time of transmitting audiovisual data, a transmission/reception data amount of the contents data during a constant time is larger than that of the authentication key exchange data and the contents confirmation data as management data. Therefore, the data connection manager 3 has a possibility of having a buffer larger than that of the authentication &amp; key exchange connection. Because of this buffer, there is a possibility that the encryption processor 6 and the authentication key exchange processor 5 have a larger delay in the processing of the contents data in the application layer.

0074We assume that, at the point of time when the receiver B transmits the contents confirmation request, the value of the seed Sr of the contents packet is Sa. When the transmitter A receives the contents confirmation request, the value of the seed of the contents packet is Sb after being updated from Sa. Therefore, the transmitter A returns a contents confirmation response S1 to the receiver B by inserting Sb into this response. The receiver B receives the contents confirmation response, checks whether Sr (=Sa) coincides with S1 (=Sb), and detects that these values do not coincide with each other.

0075As explained above, even when the receiver B and the transmitter A are valid devices, respectively, the disagreement of the seeds is detected due to the delay in the seed attributable to the buffer. As a result, the transmitter A cannot transmit the contents to the receiver B.

0076Accordingly, at step S39 in <figref idref="f0004">Fig. 6</figref>, at the time of checking the coincidence between Sr and S1, the check is carried out by providing a constant range, instead of checking a complete matching. The value of X in the above expression (2) can be determined based on a method of updating a seed, and a delay generated on the transmission path or inside the devices.

0077While <figref idref="f0004">Fig. 6</figref> shows the example of receiving the message M from the transmitter A after the receiver B obtains the seed Sr currently being processed, the receiver B can obtain the seed Sr currently being processed after receiving the message M.

0078<figref idref="f0006">Fig. 11</figref> is a flowchart showing a processing procedure of the receiver B according to a modification of the process shown in <figref idref="f0004">Fig. 6</figref>. In the process shown in <figref idref="f0006">Fig. 11</figref>, after receiving the message M from the transmitter A (step S62), the receiver B obtains the seed Sr currently being processed (step S63). Operations at steps other than these steps are similar to those shown in <figref idref="f0004">Fig. 6</figref>.

0079<figref idref="f0007">Fig. 12</figref> is a graph showing a seed update timing of the transmitter A and a seed update timing of the receiver B. In <figref idref="f0007">Fig. 12</figref>, a horizontal axis represents time. As is obvious from <figref idref="f0007">Fig. 12</figref>, the timing when the receiver B obtains the seed Sr currently being used is shifted to a later timing. Therefore, there is a possibility that a difference between the timing of the seed Sr and the timing of the seed currently being used becomes smaller than that shown in <figref idref="f0006">Fig. 10</figref>. However, both seeds are different in <figref idref="f0007">Fig. 12</figref>.

0080Therefore, a range is provided to each seed within the seed list, as shown at step S68 in <figref idref="f0006">Fig. 11</figref>. Values of X and Y can be determined based on a method of updating a seed, and a delay generated on the transmission path or inside the devices.

0081<figref idref="f0007">Fig. 13</figref> is a sequence diagram showing an example different from that shown in <figref idref="f0007">Fig. 12</figref>. In the process shown in <figref idref="f0007">Fig. 12</figref>, the transmitter A inserts a seed Sc currently being processed into the seed S1 of the contents confirmation response. However, a delay in the contents data is large like that shown in <figref idref="f0007">Fig. 12</figref>. Therefore, the seed Sc obtained in the contents confirmation response does not coincide with the seed Sb added to the contents packet received in advance by the receiver B. In other words, Sc > Sb, that is, Sr > S1. Accordingly, the search processing is unsuccessful even when the seeds coincide completely with each other or in the case of <figref idref="f0007">Fig. 13</figref>. In this case, the receiver B provides a range to each seed within the seed list, and compares the seed with the seed Sr, as shown at step S 68 in <figref idref="f0006">Fig. 11</figref>. X and Y are positive integer values.

0082It is explained above that the contents confirmation request and the contents confirmation response end in one return processing. However, in some cases, the contents confirmation response is delayed extremely due to the processing load of the transmitter A, or due to a network delay or a router processing delay between the transmitter A and the receiver B. In this case, the receiver B cannot easily receive the contents confirmation response, and cannot confirm the seed or transmit the contents accordingly. Therefore, in order to realize the present embodiment, it is necessary to prescribe a timeout value of completing the contents confirmation processing since the receiver B starts this processing.

0083<figref idref="f0008">Fig. 14</figref> is a flowchart showing one example of a time limit processing of the contents confirmation response that the receiver B carries out. When the contents confirmation processing is started, a timer starts measuring time (step S81), and the receiver B transmits the contents confirmation request to the transmitter A (step S82).

0084Thereafter, the receiver B receives a contents response corresponding to the contents confirmation request (step S83), and executes a contents confirmation check processing (step S84). When this processing is successful, the processing normally ends (step S85). When this processing is unsuccessful, a lapse time of the timer is confirmed (step S86). When the timer indicates a lapse of a certain time, the processing ends abnormally (step S87). When the time is within the limit, the receiver B transmits the contents confirmation request again (step S82).

0085In the processing shown in <figref idref="f0008">Fig. 14</figref>, a timer is used to limit the time taken until when the contents confirmation processing is successful. Alternatively, the timer can be set to the contents confirmation request and the contents confirmation response for one time, and a limit can be set to a number of times of carrying out the contents confirmation request and the contents confirmation response.

0086<figref idref="f0008">Fig. 15</figref> is a flowchart showing a modification of the processing shown in <figref idref="f0008">Fig. 14</figref>. First, a variable N for counting the number of times when the timer is off is initialized to zero (step S91). Next, the timer starts measuring time (step S92), and the receiver B transmits a contents confirmation request (step S93). The receiver monitors the timer until when the contents confirmation response is received (step S94).

0087When the contents confirmation response is received before the timer is off (step S95), the receiver executes the contents confirmation check processing (step S96). When the contents confirmation check processing is successful, the processing ends normally (step S97). When the contents confirmation check processing is unsuccessful, the processing ends abnormally (step S98). When the timer is off before the receiver B receives the contents confirmation response, the contents confirmation check processing is interrupted/canceled (step S99). The variable N for counting the number of times when the timer is off is increased by "1" (step S100), and it is determined whether the variable is less than a maximum number of times (MAX) (step S101). When the number is less than the maximum number of times, the processing at step S92 and the subsequent processings are repeated. When the number is equal to or exceeds the maximum number of times, the processing ends abnormally (step S98).

0088When the contents confirmation check processing shown in <figref idref="f0008">Figs. 14 and 15</figref> is unsuccessful, i.e. the contents confirmation check processing is suspended abnormally, the receiver B carries out at least one of the following abnormal processing (1) to (3). <ol id="ol0002" compact="compact" ol-style=""><li>(1) Abandon the authentication key K.</li><li>(2) Stop decryption of the contents packet at the point of time when the contents confirmation processing is unsuccessful. When the contents confirmation processing is successful after repeating this processing and also when the authentication key K is held, the receiver B can start again the decryption of the contents.</li><li>(3) Stop decryption of the contents packets after the point of time when the contents confirmation processing is unsuccessful.</li></ol>

0089As described above, according to the first embodiment, the receiver B performs a contents confirmation request to the transmitter A. In response to this request, the transmitter A collects the seed currently being processed, and transmits the seed list including all collected seeds to the receiver B. The receiver B compares the seed with the seed currently owned. Therefore, the receiver B can accurately determine whether the transmitter A that transmits the contents to the receiver B is the intended transmitter. Accordingly, it is possible to avoid the risk of transmitting and receiving the contents between the devices other than the transmitter A and the receiver B. Therefore, the copyright of the contents can be protected.

0090More specifically, according to the present embodiment, when the receiver B requests desired contents to the transmitter A, the receiver B can securely detect misconducts such as illegal acquisition and copy by an intermediate device, that the transmitter A or the other device transmits contents different from that request by the receiver B, and that contents being processed by the receiver B is different from contents being transmitted by the transmitter A. illegally

(Second Embodiment)

0091According to a second embodiment, the transmitter A transmits the contents confirmation response to the receiver B by including the seed list as a plain text. An example that the receiver uses a hash function to check the validity of the seed list is explained.

0092Internal configurations of the transmitter A and the receiver B according to the second embodiment are similar to those shown in <figref idref="f0001">Fig. 2</figref> and <figref idref="f0002">Fig. 4</figref>. Therefore, differences between the second embodiment and the first embodiment are mainly explained below.

0093The transmitter A that receives the contents confirmation request transmitted from the receiver B copies all seeds (S1, S2, ..., and Sn) currently being processed, and, the random number R1 included in the contents confirmation request, and generates the message M2 using the following function H. A well-known unidirectional hash function such as the SHA-1 can be used as the hash function for the function H. <maths id="math0004" num="(3)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mo>…</mo><mo mathvariant="normal">‖</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0004.tif" /></maths> where K denotes an authentication key, and the symbol of operation "||" denotes a concatenation.

0094The transmitter A transmits a response message including the message M2 and the plain text seed list, to the receiver B. <figref idref="f0009">Fig. 16</figref> is a diagram showing one example of a format of the contents confirmation response message including the message M2 transmitted from the transmitter A. In <figref idref="f0009">Fig. 16</figref>, an encrypted text d11 denotes the message M2, and the seed list includes the seeds S1, S2, ..., and Sn that the transmitter A is currently processing. The seed list d12 includes values that are used for the confirmation processing, and therefore, can be transmitted in a plain text.

0095The receiver B checks whether the seed Sr currently being processed is included in the contents confirmation response. <figref idref="f0009">Fig. 17</figref> is a flowchart showing a processing procedure of the receiver B according to the second embodiment. The processing at steps S111 to S118 is similar to the processing at steps S31 to S34 and steps S38 to S41 shown in <figref idref="f0004">Fig. 6</figref>.

0096The receiver B checks whether the seed Sr is included in the plain text seed list included in the contents confirmation response (steps S115 to S118). When the seed Sr is not included in the plain text seed list, an error processing is carried out (step S119). When the seed Sr is included in the plain text seed list, the receiver B concatenate the authentication key, the random number R1 included in the contents confirmation request, and the plain text seed list included in the contents confirmation response, and obtains a message M3 from the function H (step S120). <maths id="math0005" num="(4)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">3</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mo mathvariant="normal">…</mo><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0005.tif" /></maths>

0097Next, the receiver B determines whether the calculated message M3 coincides with the message M2 transmitted from the transmitter A (step S121). When the calculated message M3 coincides with the message M2, the receiver B ends the processing normally (step S122), and when they do not coincide with each other, the receiver B returns an error message (step S120).

0098As described above, according to the second embodiment, the transmitter A transmits the seed list in a plain text, and the receiver B checks the processing before operating the encryption processor 16. Therefore, when the check processing is unsuccessful, the encryption processing can be omitted, thereby making the processing more efficient. Even if an intermediate device illegally rewrites the seed list such that the receiver B can check the coincidence of seeds, the intermediate device cannot calculate a correct hash value because the intermediate device has no authentication key, although the receiver B is successful in the seed confirmation processing. Therefore, the receiver B cannot subsequently confirm the coincidence of hash values. In this way, it is possible to prevent the intermediate device from illegally changing the seed list.

0099As described above, according to the second embodiment, the transmitter A receives a contents confirmation request, calculates a hash value using a random number included in the contents confirmation request, and transmits a contents confirmation response including the calculated hash value. The receiver B receives this contents confirmation response, and checks whether the hash value calculated by the receiver B coincides with the hash value included in the contents confirmation response. Therefore, the receiver B can verify whether the transmitter A that transmits the contents confirmation response is the intended communication partner, more efficiently than the process according to the first embodiment.

(Third Embodiment)

0100In the first and the second embodiments, examples that the receiver B confirms the seed have been explained. According to the third embodiment, the transmitter A also confirms the seed.

0101<figref idref="f0010">Fig. 18</figref> is a block diagram showing a schematic configuration of the transmitter A according to the third embodiment. The transmitter A shown in <figref idref="f0010">Fig. 18</figref> has the seed check processor 18, and is different, in this respect, from the transmitter A shown in <figref idref="f0004">Fig. 7</figref>. The seed check processor 18 checks whether the value of the seed received by the contents confirmation request from the receiver B is included in the seed list of the seed collector 8.

0102<figref idref="f0010">Fig. 19</figref> is a block diagram showing a schematic configuration of the receiver B according to the third embodiment. The receiver B shown in <figref idref="f0010">Fig. 19</figref> has a seed storage 19 in place of the seed check processor 18, and is different, in this respect, from the receiver B shown in <figref idref="f0004">Fig. 6</figref>. The seed storage 19 stores a seed value included in the header of the contents packet currently being processed. The authentication &amp; key exchange processor 15 refers to the seed value at the time of transmitting a contents confirmation request to the transmitter A. When the seed value of the header changes, the seed storage 19 updates the seed value to the changed value.

0103<figref idref="f0011">Fig. 20</figref> is a sequence diagram showing one example of a processing procedure that is carried out between the transmitter A shown in <figref idref="f0010">Fig. 18</figref> and the receiver shown in <figref idref="f0010">Fig. 19</figref>. <figref idref="f0012">Fig. 21</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the receiver B carries out. <figref idref="f0012">Fig. 22</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the transmitter A carries out.

0104The transmitter A and the receiver B carry out the authentication &amp; key exchange processing, and generate a contents key using the authentication key K and the seed value. The transmitter A encrypts the contents, and transmits the encrypted contents to the receiver B. The receiver B makes a contents confirmation request. (Steps S131 to S150). The processing up to this stage is common to that shown in <figref idref="f0003">Fig. 5</figref>.

0105The receiver B stores the seed (Sr1) of the header of the contents packet currently being received, generates the random number R1, and transmits a content confirmation request including the seed (Sr1) and the random number to the transmitter A (steps S161 to S163). In the example shown in <figref idref="f0011">Fig. 20</figref>, the seed value of the contents header is Sa. Therefore, the seed Sa and the random number R1 are included in the contents confirmation request, and this contents confirmation request is transmitted.

0106<figref idref="f0013">Fig. 23</figref> is a diagram showing one example of a message format of the contents confirmation request. As shown in <figref idref="f0013">Fig. 23</figref>, the contents confirmation request includes the random number (R1) d6 generated by the receiver B, and the seed (Sr, in this case, Sa) d13.

0107The transmitter A receives the contents confirmation request, collects the seeds (steps S151 and S184), and confirms the collected seeds (steps S152, and S185 to S191). More specifically, the transmitter A checks whether the seed Sr included in the contents confirmation request from the receiver B is included within the range of the following expression (5) out of all seeds (S1, S2,..., and Sn) currently being processed (step S186). <maths id="math0006" num="(5)"><math display="block"><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">-</mo><mi mathvariant="normal">X</mi><mo mathvariant="normal">≤</mo><mi>Sr</mi><mo mathvariant="normal">≤</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">+</mo><mi mathvariant="normal">Y</mi></math><img file="EP1648112B1_D0006.tif" /></maths> where X denotes a positive integer value, and Y denotes 0.

0108When the comparison check is successful, the transmitter A obtains the random number R2 obtained by copying the random number R1 included in the contents confirmation request, and creates a message M4 using the function I shown in <figref idref="f0004">Fig. (6</figref>) (steps S187 and S191). As the encryption algorithm used for the function I, a well-known algorithm like the AES can be used. <maths id="math0007" num="(6)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">4</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">I</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">C</mi></mfenced></math><img file="EP1648112B1_D0007.tif" /></maths> where K denotes an authentication key, and the symbol of operation "||" denotes a concatenation. A success message C is a constant determined in advance between the transmitter A and the receiver B. At the time of creating M4, it is preferable that M4 includes the seed Sr included in the contents confirmation request, in addition to the random number R2 and the success message C. The function I denotes the processing of encrypting the message in which R2 and C are concatenated, using the key K. Depending on the encryption algorithm, padding is necessary in addition to the message to be encrypted. In this case, a padding length field or a data length field of the data to be encrypted is defined in the header, and the encryption processing is carried out including the padding.

0109The transmitter A transmits a response message including the message M4 to the receiver B (steps S153 and S188). <figref idref="f0013">Fig. 24</figref> is a diagram showing one example of a message format of the contents confirmation response. In this case, the contents confirmation response includes an encrypted random number (R2) d14, and a success message (C) d15.

0110When the comparison check of the seed value is unsuccessful, the transmitter A creates the message M4 based on a function J shown in the following expression (7), using all seeds (S1, S2, ..., and Sn) currently being processed, the value R2 obtained by copying the random number R1 included in the contents confirmation request, and a constant (C2). As the encryption algorithm used for the function J, a well-known algorithm like the AES can be used. <maths id="math0008" num="(7)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">4</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">J</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">C</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mo mathvariant="normal">…</mo><mo mathvariant="normal">‖</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0008.tif" /></maths> where K denotes the authentication key, and the symbol of operation "||" denotes a concatenation. The failure message C2 is the constant determined in advance between the transmitter A and the receiver B. The function I denotes the processing of encrypting the message in which R2 and C2 are concatenated, using the key K. Depending on the encryption algorithm, padding is necessary in addition to the message to be encrypted. In this case, a padding length field or a data length field of the data to be encrypted is defined in the header, and the encryption processing is carried out including the padding.

0111The transmitter A transmits a response message including the message M4 to the receiver B. <figref idref="f0014">Fig. 25</figref> is a diagram showing one example of a message format of the contents confirmation response when the seed check processing is unsuccessful. In this case, the contents confirmation response includes the encrypted random number (R2) d14, the failure message (C2) d16, and a seed list d17.

0112The receiver B decrypts the message M4 using the authentication key K (step S165), and checks whether the random number R2 included in the message M4 coincides with the value R1 transmitted at step S150 (steps S154 and S166). When the random number R2 does not coincide with the value R1, the receiver B returns an error message without carrying out the following processing (step S169). When the random number R2 coincides with the value R1, the receiver B checks whether the constant is a failure message or a success message (step S167). The order of the random number check processing and the constant check processing can be changed. When the constant is a success message (step S168), the receiver B continues the decryption processing. When the constant is a failure message, the receiver B compares the value of the seed S1 included in the message M4 with the value of the seed S1 obtained at step S140 (steps S170 to S174). Specifically, the receiver B checks whether the seed S1 is included within the range of the following expression (8) (step S171). <maths id="math0009" num="(8)"><math display="block"><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">-</mo><mi mathvariant="normal">Z</mi><mo>≤</mo><mi>Sr</mi><mo>≤</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">+</mo><mi mathvariant="normal">Y</mi></math><img file="EP1648112B1_D0009.tif" /></maths> where Z denotes a positive integer larger than Y, and Y denotes 0.

0113What is important in this case is to increase the range of comparing the seed value to be larger than the range of the comparison check carried out by the transmitter A. As described in the first embodiment, there is a risk that the transmitter A is unsuccessful in the match test of the range due to a delay in the network or a buffer held by the device. At this point of time, the transmitter A transmits a contents confirmation response as the failure message C2. When this seed list is included in the contents confirmation response, the receiver B searches for the seed list by increasing the range of the comparison match test to be larger than the range of the comparison match test that the transmitter A carries out.

0114Therefore, it possible to determine whether the transmitter A is unsuccessful in the confirmation test due to a too small range of the comparison match test or the confirmation is completely unsuccessful. In other words, the receiver B can confirm whether the failure message C2 is transmitted because the search range of the transmitter A is too small or the failure message C2 is transmitted because of other reasons. When the range is too small, the comparison check test is an error, and the receiver B can make the contents confirmation request again. When the receiver is unsuccessful in the search processing despite the increased range, the receiver B can stop the contents confirmation processing.

0115When the receiver B receives the failure message C2, the receiver B does not necessarily carry out the search processing, and can determine that the search processing is unsuccessful by skipping this processing.

0116When it can be confirmed that the contents confirmation response includes the success message C, the receiver B determines that the confirmation processing is successful, and continues to decrypt the contents. When it can be confirmed that the contents confirmation response includes the failure message C2, the receiver B returns an error message. When the contents confirmation response includes the failure message C2, the processing to be carried out after the error processing can be changed, by determining whether the confirmation processing will be successful when the seed search range is enlarged.

0117As described above, according to the third embodiment, not only the receiver B, but also the transmitter A confirms the seed. Therefore, the processing load of the receiver B can be lightened. Even when the transmitter A cannot confirm the match of the seed, the receiver B checks the seed value again, and can identify a cause of mismatch of the seed value.

(Fourth Embodiment)

0118According to the third embodiment, the transmitter A encrypts the seed list and transmits the message M4 at the time of generating the contents confirmation response. On the other hand, according to a fourth embodiment, in order to verify the completeness of the contents confirmation response, a hash function is used. In this respect, the fourth embodiment is different from the third embodiment.

0119Differences between the fourth embodiment and the third embodiment are mainly explained below. The transmitter A and the receiver B carry out the whole contents confirmation processing similar to the processing sequence shown in <figref idref="f0011">Fig. 20</figref>.

0120<figref idref="f0014">Fig. 26</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the receiver B carries out. <figref idref="f0015">Fig. 27</figref> is a flowchart showing one example of a processing procedure of a contents confirmation processing that the transmitter A carries out. The receiver B carries out the processing similar to that shown in <figref idref="f0001">Fig. 2</figref> until when the receiver B transmits the random number R1 to the transmitter A. The processing is explained sequentially with reference to <figref idref="f0014">Fig. 26</figref> and <figref idref="f0015">Fig. 27</figref>. The processing carried out by the transmitter A and the receiver B after the random number R1 is transmitted to the transmitter A is described below.

0121The transmitter A that receives the contents confirmation request checks whether the received seed (Sr) is included within the range of the following expression (9) out of all seeds (S1, S2,..., and Sn) currently being processed (step S226). <maths id="math0010" num="(9)"><math display="block"><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">-</mo><mi mathvariant="normal">X</mi><mo>≤</mo><mi>Sr</mi><mo>≤</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">+</mo><mi mathvariant="normal">Y</mi></math><img file="EP1648112B1_D0010.tif" /></maths> where X denotes a positive integer value, and Y denotes 0.

0122When the comparison check is successful, the transmitter A obtains the random number R2 obtained by copying the random number R1 included in the contents confirmation request, and creates a message M5 using the following function H (step S227). A well-known unidirectional hash function shown in the expression (10), such as the SHA-1, can be used as the hash function for the function H. <maths id="math0011" num="(10)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">5</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo>‖</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo>‖</mo><mi>Sr</mi></mfenced></math><img file="EP1648112B1_D0011.tif" /></maths> where K denotes an authentication key, and the symbol of operation "||" denotes a concatenation.

0123The transmitter A transmits a contents confirmation response including the message (M5) to the receiver B. <figref idref="f0015">Fig. 28</figref> is a diagram showing one example of a format of the contents confirmation response message. In <figref idref="f0015">Fig. 28</figref>, a success message (C) d15 denotes a constant determined in advance between the transmitter A and the receiver B, and an encrypted text d19 denotes M5. The random number R is not always necessary, and can be omitted. The success message is transmitted in a plain text.

0124When the comparison check of the seed value is unsuccessful, the transmitter A creates the message (M5) based on a function H shown in the following expression (11), using the random number R1 and all seeds (S1, S2, ..., and Sn) currently being processed (step S231). A well-known unidirectional hash function such as the SHA-1 can be used as the hash function for the function H. <maths id="math0012" num="(11)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">5</mn><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mo>⋯</mo><mo mathvariant="normal">|</mo><mo mathvariant="normal">|</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0012.tif" /></maths> where K denotes the authentication key, and the symbol of operation "||" denotes a concatenation.

0125The transmitter A transmits a response message including the message (M5) and a plain text seed list, to the receiver B (step S228). <figref idref="f0016">Fig. 29</figref> is a diagram showing one example of a message format of the contents confirmation response. In <figref idref="f0016">Fig. 29</figref>, a failure message (C2) d20 is the constant determined in advance between the transmitter A and the receiver B. An encrypted text d22 denotes M5. A seed list d23 denotes (S1, S2, ..., and Sn). The failure message C2, the random number, and the seed list are used for the confirmation processing, and therefore, can be transmitted in a plain text.

0126The receiver B calculates a hash value based on the function H shown in the following expression (12) from the authentication key, the random number R1, and the seed (Sr) included in the header of the contents packet (step S203). <maths id="math0013" num="(12)"><math display="block"><mi>hash</mi><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo>‖</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo>‖</mo><mi>Sr</mi></mfenced></math><img file="EP1648112B1_D0013.tif" /></maths> where K denotes an authentication key, R1 denotes a random number transmitted in the contents confirmation request, and Sr denotes a seed value included in the header of the contents packet. The symbol of operation "||" denotes a concatenation.

0127Upon receiving the message (M5) in the contents confirmation response, the receiver B checks which one of the success message C and the failure message C2 is included in the message (M5).

0128When the success message C is included, the receiver B checks whether the encrypted text included in the message (M5) coincides with the hash value (hash) calculated in advance (step S208). When the match test of the hash value is successful (step S209), the receiver B determines that the contents confirmation processing is successful, and continues the contents decryption processing. When the match test of the hash value is unsuccessful, the receiver B determines that the contents confirmation response is unsuccessful, and returns an error message (step S207).

0129When the failure message C2 is included, the receiver B compares the value of the seed S1 included in the message (M5) with the value of the seed (Sr1) obtained at step (1) based on the following expression (13) (step S211). <maths id="math0014" num="(13)"><math display="block"><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">-</mo><mi mathvariant="normal">Z</mi><mo>&lt;</mo><mi>Sr</mi><mo>&lt;</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">+</mo><mi mathvariant="normal">Y</mi></math><img file="EP1648112B1_D0014.tif" /></maths> where Z denotes a positive integer larger than Y, and Y denotes 0.

0130When the seed is included in the seed list, the receiver B determines that the confirmation test of the transmitter A is unsuccessful due to the timing of transmitting the contents confirmation response. In other cases, the receiver determines that the transmitter A is completely unsuccessful in the confirmation processing. When the range is too small, the contents confirmation request processing carried out this time is treated as an error, to make the contents confirmation request again. When the search is completely unsuccessful even if the seed range is enlarged, the receiver B determines that the search processing is unsuccessful.

0131In order to check whether an intermediate device changes the seed list, the receiver B can check whether the encrypted text included in the contents confirmation response coincides with the hash value shown in the expression (14) calculated by the receiver B. <maths id="math0015" num="(14)"><math display="block"><mi>hash</mi><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mfenced separators=""><mi mathvariant="normal">K</mi><mo mathvariant="normal">,</mo><mo>|</mo><mo>|</mo><mi mathvariant="normal">R</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">‖</mo><mi mathvariant="normal">S</mi><mo>⁢</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">‖</mo><mo>…</mo><mo mathvariant="normal">‖</mo><mi>Sn</mi></mfenced></math><img file="EP1648112B1_D0015.tif" /></maths> where K denotes the authentication key, R1 denotes a random number transmitted in the contents confirmation request, and S1, S2, and Sn denote values of the seed list included in the contents confirmation response. The symbol of operation "||" denotes a concatenation.

0132When the receiver B receives the failure message C2, the receiver B does not necessarily carry out the search processing, and can determine that the search processing is unsuccessful by skipping this processing.

0133When the contents confirmation response includes a success message and also when the hash value matches, the receiver B determines that the confirmation processing is successful, and continues to decrypt the contents. When it is confirmed that the contents confirmation response includes a failure message, the receiver B returns an error message. When the contents confirmation response includes a failure message, the receiver B can change the processing to be executed after the error processing, by determining whether the search is successful when the seed search range is enlarged.

0134As described above, according to the fourth embodiment, the receiver B can not only obtain a seed value confirmation result of the transmitter A but also determine a result of the contents confirmation response before calculating a hash value. Therefore, the efficiency of the processing can be improved. Furthermore, it is possible to prevent the intermediate device from illegally obtaining the contents.

0135In the above embodiments, the information processing apparatus can be in a hardware configuration or a software configuration. When the information processing apparatus is configured by software, a program for realizing at least a part of the functions of the information processing apparatus can be stored in a recording medium such as a floppy disk and a CD-ROM, and a computer can read and execute this program. The recording medium is not limited to a portable medium such as a magnetic disk and an optical disk, but can be a fixed recording medium such as a hard disk unit and a memory.

0136Furthermore, a program for realizing at least a part of the functions of the information processing apparatus can be distributed via a network (including radio communications) such as the Internet. The program can be distributed via a wireless network or wired network such as the Internet, and can be distributed by storing the program in a recording medium, in an encrypted, modulated, or compressed state.