Device and method for data processing, and recording medium

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention relates to a data processing apparatus, a data processing method, and a recording medium, and in particular, for example, when data is broadcast by a satellite line or the like, a terminal (user) capable of acquiring the data can be easily provided. It relates to a data processing apparatus and a data processing method that can be restricted, and a recording medium.

【0002】

[Conventional technology]

For example, when transmitting images, sounds, etc. as digital data, it is possible to secure multiple channels in the same transmission band as when transmitting with analog signals, and to provide higher quality images and sounds. Therefore, in fields such as satellite broadcasting and satellite communication, systems that provide images and audio as digital data are becoming widespread. For example, digital satellite broadcasting services such as SkyPerfecTV! And DirecTV in Japan, DirecTV in North America, and Canal Plus in Europe have been launched. Digitization of broadcasting makes it possible to reduce transmission costs per channel, provide programs and data handled by computers, etc., and digitize programs, etc. and images, etc. in conjunction with each other. Services are also becoming widespread.

【0003】

In the digital satellite broadcasting service, digital data of images and sounds is converted into a format compliant with MPEG (Moving Picutre Experts Group) 2 and the DVB (Digital Video Broadcasting) standard derived from this MPEG2, and further multiplexed. , Is transmitted as radio waves. Radio waves are received by satellite transponders, amplified and other necessary processing, and then transmitted to the ground.

【0004】

The transmission band of the transponder is as large as 30 Mbps (Mega bit per second), for example (however, since an error correction code is generally added to the transponder, even if it has a transmission band of 30 Mbps, it is a substantial transmission band. By using the entire large transmission band (up to about 27 Mbps), it is possible to deliver digital data with high quality and high speed.

【0005】

However, in general, the transmission band of the transponder is often divided into multiple channels and used mainly for cost reasons. In this case, even if the content of the digital data transmitted on each channel is different, the receiving side mechanism for receiving the digital data on each channel is the same, so that only a specific user receives the provision of a certain digital data. A conditional access (CA) mechanism is required to enable this.

【0006】

That is, in particular, for example, in the case of so-called data broadcasting, it is expected that the amount of data per program will be smaller and the billing unit or billing form will be complicated as compared with the case of delivering images and audio. To deal with this, a limited reception mechanism capable of performing finer reception control is required. In addition, a limited reception mechanism is required to prevent leakage of confidential information even when it is distributed.

【0007】

Generally, the conditional access mechanism is realized by encrypting the data stream to be distributed. The encryption methods are roughly classified into a common key encryption method (private key encryption method) and a public key encryption method. In digital satellite broadcasting, the common key cryptosystem is often used because the load of encryption / decryption processing is lighter than that of the public key cryptosystem.

【0008】

In the common key encryption method, the same code string as the encryption key, which is the same as the encryption key, is passed to a certain contractor A in some way, and the data is encrypted with the encryption key and distributed. The encrypted data is then difficult to infer by back-calculating the encryption key (decryption key) or the original data, so user B, who is not a contractor, is encrypted. Even if you receive the data, you cannot restore it to the original data correctly. In addition, the contractor, User A, can restore the original data by decrypting the encrypted data with the decryption key passed by the contract. Therefore, the reception contract is equivalent to delivering the decryption key.

【0009】

[Problems to be Solved by the Invention]

By the way, for example, when users A and C are contractors, and the contract with only user A is terminated or user A commits an illegal act, the encryption key used up to now is used. If the user C is changed and the same decryption key as the changed encryption key is provided only to user C, then user A who is no longer a contractor or commits an illegal act is encrypted with the new encryption key. In addition to being unable to recover the encrypted data, user C, who is a legitimate contractor, subsequently recovers the data encrypted with the new encryption key normally by decrypting it with the new decryption key. can do.

【0010】

However, it is troublesome to change the encryption key every time a user's contract is terminated or discover a fraudulent act, and to provide a legitimate contractor with the same decryption key as the changed encryption key. Is.

【0011】

The present invention has been made in view of such a situation, and makes it possible to easily limit the users who can normally acquire (receive) data.

【0012】

[Means for solving problems]

The data processing apparatus of the present invention refers to a table having an entry in which a destination and an entry valid information indicating whether or not the entry in which the destination is registered is registered are registered, and a data block is obtained from the table. A search means for searching for an entry having a destination matching the destination of the attention entry as an attention entry, a determination means for determining whether or not the attention entry is valid based on the entry valid information registered in the attention entry, and a determination by the determination means. It is characterized by including an output control means for controlling the output of data arranged in a data block based on the result.

【0013】

The output control means can output the data to the destination arranged in the data block when the attention entry is valid, and discard the data when the attention entry is not valid.

【0014】

When the data is encrypted, the data processing device may be further provided with decryption means for decrypting the encrypted data.

【0015】

Decryption if the data is encrypted with the key assigned to the destination of the data and each entry in the table contains the destination and entry valid information, as well as the key assigned to that destination. As the means, the data can be decrypted by using the key registered in the table.

【0016】

The decryption means can decrypt the data arranged in the data block by using the key assigned to the destination of the data block in the table.

【0017】

If each entry in the table contains a destination, entry valid information, and a key, as well as key valid information that indicates whether the key is valid, the decryption means is assigned to the destination of the data block. Based on the key valid information of the key, it is possible to determine whether or not the key is valid, and when it is valid, the key can be used to decrypt the data.

【0018】

Each entry in the table can contain a destination and entry valid information, as well as two or more keys assigned to that destination.

【0019】

Key valid information indicating whether or not the key is valid can also be registered in each entry of the table for each of two or more keys.

【0020】

The data processing apparatus of the present invention may be further provided with a table storage means for storing a table.

【0021】

The destination can be the MAC (Media Access Control) address of the communication terminal that should receive the data.

【0022】

The data block may conform to the DVB (Digital Video Broadcasting) standard.

【0023】

The data processing device of the present invention can be configured by a one-chip IC (Integrated Circuit).

【0024】

The data processing method of the present invention refers to a table having an entry in which a destination and an entry valid information indicating whether or not the entry in which the destination is registered is registered are registered, and a data block is obtained from the table. A search step for searching for an entry having a destination matching the destination of the attention entry as an attention entry, a determination step for determining whether or not the attention entry is valid based on the entry valid information registered in the attention entry, and a determination by the determination step. It is characterized by including an output control step that controls the output of data arranged in a data block based on the result.

【0025】

The recording medium of the present invention refers to a table having an entry in which a destination and an entry valid information indicating whether or not the entry in which the destination is registered is registered are registered, and from the table, a data block is displayed. A search step for searching for an entry having a destination matching the destination as an attention entry, a determination step for determining whether or not the attention entry is valid based on the entry valid information registered in the attention entry, and a determination result by the determination step. Based on the above, a program including an output control step for controlling the output of data arranged in the data block is recorded.

【0026】

In the data processing apparatus and data processing method of the present invention, and in the recording medium, a table having an entry in which a destination and entry valid information indicating whether or not the entry in which the destination is registered is valid is registered. By referencing, an entry having a destination that matches the destination of the data block is searched from the table as a noteworthy entry. Then, it is determined whether or not the attention entry is valid based on the entry valid information registered in the attention entry, and the output of the data arranged in the data block is controlled based on the determination result.

【0027】

BEST MODE FOR CARRYING OUT THE INVENTION

FIG. 1 shows an implementation of a broadcasting system to which the present invention is applied (a system is a logical assembly of a plurality of devices, regardless of whether or not the devices of each configuration are in the same housing). A configuration example of the form of is shown.

【0028】

In the embodiment of FIG. 1, the broadcasting system is composed of a transmitting system 1, a satellite 2, a receiving system 3, and a network 4. In FIG. 1, only one receiving system (reception system 3) is shown in order to avoid complicating the figure, but two or more receiving systems can be provided.

【0029】

The transmission system 1 is composed of a control device 11, a data server 12, a transmission processing device 13, an antenna 14, a line connection device 15, and a cable 16, and is composed of a control device 11, a data server 12, a transmission processing device 13, and a line connection device. 15 constitutes a LAN (Local Area Network) by being connected to each other via a cable 16.

【0030】

By controlling the data server 12, the control device 11 causes the transmission processing device 13 to supply data to be distributed by satellite broadcasting. Further, the control device 11 controls the line connection device 15 to acquire data to be distributed by satellite broadcasting from an external network 4 such as the Internet and supply the data to the transmission processing device 13. Further, the control device 11 controls various processes in the transmission processing device 13.

【0031】

The data server 12 stores data to be distributed by satellite broadcasting, and supplies necessary data to the transmission processing device 13 under the control of the control device 11.

【0032】

The transmission processing device 13 packetizes the data supplied from the data server 12 and the line connection device 15 into, for example, an IP (Internet Protocol) packet according to the control of the control device 11, and further, the IP packet is converted into DVB data. Sections that comply with broadcast specifications, ie, for example, EN 301 192 V1.1.1 (1997-12), Blocks into data blocks called sections described by descriptors based on Multiprotocol Encapsulation specified by the DVB specification for data broadcasting ETSI (European Telecommunications Standards Institute). Then, the transmission processing device 13 divides the section into payloads having a predetermined length, and adds a header of a packet (hereinafter, appropriately referred to as a TS (Transport Stream) packet) constituting an MPEG2 transport stream to each payload. As a result, a packet similar to a TS packet is constructed, further subjected to necessary processing such as modulation and amplification, and transmitted as a satellite broadcast wave from the antenna 14.

【0033】

Further, the transmission processing device 13 is a terminal 24 constituting the reception system 3.₁,24₂, ... (The same applies to the terminals that make up the receiving system (not shown in Fig. 1)) A tabular encryption that associates each MAC address with the encryption key assigned to each MAC (Media Access Control) address. It has an encryption key table storage unit 13A that stores the key table. The encryption keys assigned to each MAC address are basically all different. However, the same encryption key may be assigned to some MAC addresses.

【0034】

Here, the MAC address is an address system applied to IEEE (Institute of Electrical Electronics Engineers) 802.3, etc., and is a 48-bit value unique to each communication port, and is guaranteed to be unique. The upper 24 bits of the 48-bit MAC address are the manufacturer (vendor) identification numbers registered / managed by the IEEE, and the lower 24 bits are the device identification numbers managed by each vendor. It has become. According to the MAC address, each terminal of receiving system 3 24_i(i = 1,2, ...) can be specified.

【0035】

According to the multi-protocol encapsulation described above, the section header (section header) is the terminal that delivers the data placed in the payload of that section 24_iThe MAC address of the terminal is placed as the destination of. If the data placed in the payload of the section, that is, here the IP packet, needs to be encrypted, the transmit processor 13 is the terminal 24 as the destination placed in the header of the section._iThe encryption key assigned to the MAC address of is read from the encryption key table stored in the encryption key table storage unit 13A, and the encryption key is used to encrypt the IP packet placed in the payload of that section. There is.

【0036】

The encryption key table may have the same format as the key table of the receiving device 22 that constitutes the receiving system 3, or may have a different format. Further, here, the encryption key table is built in the transmission system 1, but the encryption key table is stored in, for example, a server (not shown) on the network 4, and a line is required as needed. It is also possible to read and use it via the connecting device 15.

【0037】

The line connection device 15 is composed of, for example, a modem, a TA (Terminal Adapter), a DSU (Digital Service Unit), or the like, and controls communication via the network 4.

【0038】

The receiving system 3 includes an antenna 21, a receiving device 22, a line connecting device 23, and a terminal 24.₁,24₂, ..., and cable 25, receiving device 22, line connecting device 23, terminal 24₁,24₂, ... are connected to each other via a cable 25, thereby forming a LAN such as Ethernet (trademark).

【0039】

In addition, the receiving device 22 and the terminal 24₁,24₂, ... can be configured by, for example, a computer.

【0040】

Also, here, the receiving device 22 and the terminal 24₁,24₂, ... is a LAN configured by connecting to each other with a cable 25, but the receiving device 22 and the terminal 24₁,24₂It is also possible to connect directly with ,.

【0041】

Further, the receiving device 22 is a single terminal 24._iIt can be configured as a board that can be mounted in a slot of a computer.

【0042】

Further, the receiving device 22 and the line connecting device 23 can be configured by one computer.

【0043】

The satellite broadcast wave transmitted from the transmission system 1 via the satellite 2 is received by the antenna 21, and the received signal is supplied to the receiving device 22. The receiving device 22 performs a process as described later on the received signal from the antenna 21, and outputs the data obtained as a result to the predetermined terminal 24._iSupply to.

【0044】

The line connection device 23 is configured in the same manner as the line connection device 15, and controls communication via the network 4.

【0045】

Terminal 24₁,24₂, ... Is composed of, for example, a computer, receives necessary data from the receiving device 22, displays, outputs, stores, and the like.

【0046】

Next, the data transmission process performed by the transmission system 1 will be described with reference to the flowchart of FIG.

【0047】

First of all, in step S1, the control device 11 is the terminal 24._iDetermines if there is data to send to.

【0048】

Here, the control device 11 has a schedule table in which a schedule for transmitting data is described, and the terminal 24 is based on the schedule table._iDetermines if there is data to send to. Also, terminal 24_iBy controlling the line connection device 23, data can be requested from the transmission system 1 via the network 4, and the control device 11 can request such a request from the network. Depending on whether it was received by the line connection device 15 via 4, the terminal 24_iDetermines if there is data to send to.

【0049】

In step S1, terminal 24₁If it is determined that there is no data to be transmitted to, the process proceeds to step S2, and the control device 11 determines whether or not to change the period.

【0050】

Here, in the transmission system 1, the encryption key described in the encryption key table in the encryption key table storage unit 13 is updated periodically or irregularly, and is obtained by, for example, an even number of updates. The period during which encryption is performed using the obtained encryption key is called the Even period, and the period during which encryption is performed using the encryption device obtained by the odd-numbered update is called the Odd period. Therefore, the Even period and the Odd period appear alternately, but in step S2, it is determined whether or not it is time to change from the Even period to the Odd period or from the Odd period to the Even period.

【0051】

If it is determined in step S2 that the period will not be changed, that is, if the data encryption is continued using the encryption key currently used for encryption, the process returns to step S1. The same process is repeated.

【0052】

Further, in step S2, when it is determined to change the period, that is, when the period is changed to the Odd period when it is the Even period, to the Even period when it is the Odd period, and when the period is changed, the process proceeds to step S3 to control. The device 11 updates the encryption key stored in the encryption key table with the encryption key previously generated in step S4 described later, whereby the transmission processing device 13 uses the updated encryption key. Is encrypted.

【0053】

Then, the process proceeds to step S4, and the control device 11 generates (or acquires) the encryption key to be used in the next period, supplies it to the transmission processing device 13, transmits it as a decryption key, returns to step S1, and then returns to step S1. The same process as in the above case is repeated. The decryption key can be transmitted via the satellite 2 or the network 4.

【0054】

That is, if the new decryption key used in the next period is transmitted to the receiving system 3 immediately before the start of the next period, the setting of the new decryption key in the receiving system 3 starts the next period. It may not be in time. Therefore, in the present embodiment, the new encryption key used in the next period is distributed to the receiving system 3 in the period immediately before that.

【0055】

On the other hand, in step S1, the terminal 24_iWhen it is determined that there is data to be transmitted to, the control device 11 controls the data server 12 or the line connection device 15 to supply the data to be transmitted to the transmission processing device 13. The transmission processing device 13 receives the data supplied from the data server 12 or the line connection device 15, packetizes it into an IP packet, and proceeds to step S5.

【0056】

In step S5, the transmission processing device 13 determines whether or not the IP packet requires encryption, and if it determines that the IP packet does not require encryption, skips steps S6 and S7 and steps. Proceed to S8.

【0057】

If it is determined in step S5 that the IP packet requires encryption, the process proceeds to step S6, and the transmission processing device 13 is the terminal 24 that is the destination of the IP packet._iThe encryption key assigned to the MAC address of is read from the encryption key table, and the process proceeds to step S7. In step S7, the transmission processing device 13 encrypts the IP packet with the encryption key read in step S6, and proceeds to step S8.

【0058】

In step S8, the transmission processing device calculates a CRC (Cyclic Redundancy Checking) code (or checksum) for the IP packet, uses the IP packet as a payload, places the CRC code at the end, and places the CRC code at the beginning. , By arranging the section header, the section as shown in Fig. 3 (A) is configured. A stuffing byte is inserted between the payload and the CRC code as needed.

【0059】

The section header is composed of 3 bytes (96 bits) as shown in Fig. 3 (B). Here, since the details of the section header are described in the above-mentioned EN 301 192 V1.1.1 (1997-12), the description thereof will be omitted, but the MAC addresses 1 to 6 in FIG. The destination 48-bit MAC address is placed. Here, 8 bits from the most significant bit of the MAC address are arranged in MAC address 1, and the next upper 8 bits are arranged in MAC address 2. Then, 8 bits of the MAC address are arranged in each of the MAC addresses 3 to 5 in the same manner, and the lowest 8 bits of the MAC address are arranged in the MAC address 6.

【0060】

The transmission processing device 13 is similar to a TS packet by forming a section, dividing the section into payloads having a predetermined length, and adding a header of the TS packet constituting the MPEG2 transport stream to each payload. Encapsulation that composes the packet. Then, the transmission processing device 13 proceeds to step S9, and with respect to the packet obtained as a result (since this packet can be basically processed in the same manner as the TS packet, hereinafter, as appropriate, it is referred to as a TS packet). Then, necessary processing such as modulation and amplification is performed, the wave is transmitted from the antenna 14 as a satellite broadcast wave, and the process returns to step S1.

【0061】

In the section header shown in Fig. 3 (B), the 2-bit PSC (payload_scrambling_control) placed in the 2nd bits of the 43rd and 44th bits from the beginning is, for example, the data placed in the payload of the section. It is used as an encryption determination flag indicating whether or not is encrypted, and as a period determination flag indicating whether the data belongs to the Even period or the Odd period.

【0062】

Specifically, for example, the lower bits of the PSC are used as an encryption determination flag, and are set to 1 when the data is encrypted and 0 when the data is not encrypted. The high-order bit of PSC is used as a period determination flag, and is set to 0 in the Even period and 1 in the Odd period. However, it is also possible to use the upper bit of the PSC as the encryption determination flag and the lower bit thereof as the period determination flag. Further, the assignment of the encryption determination flags 0 and 1 and the assignment of the period determination flags 0 and 1 can be reversed from the above-mentioned case.

【0063】

Here, in the DVB standard EN 301 192 V1.1.1 (1997-12), when the PSC is 00B (B means that the value placed before it is a binary number), the data is Therefore, it is better to set the encryption judgment flag to 1 when the data is encrypted and 0 when the data is not encrypted, according to the DVB standard. It is desirable because it does not go against it.

【0064】

As described above, in the broadcasting system of FIG. 1, each terminal 24_iSince the data is encrypted with the encryption key assigned to the unique MAC address of each terminal 24_iIt is possible to realize the ultimate limited reception mechanism, that is, reception control for each unit.

【0065】

The applicant has previously proposed, for example, a method for realizing a limited reception mechanism that performs fine-tuned reception control by assigning an encryption key to a value unique to the receiving side such as a MAC address or an IP address. The details are disclosed in Kaihei 10-215244. However, in the current situation where communication satellite broadcasting in Japan complies with the specifications derived from DVB-SI (Digtal Video Broadcasting --Service Information / EN300 468), as mentioned above, the MAC address is used for the specifications. Will be compatible with.

【0066】

Next, FIG. 4 shows a configuration example of the receiving device 22 of FIG.

【0067】

The antenna 21 receives the satellite broadcast wave transmitted from the transmission system 1 via the satellite 2, and outputs the received signal to the front end unit 31. The front end unit 31 selects a signal of a predetermined channel from the received signal from the antenna 21 according to the control of the CPU 34, and further demodulates the signal into a digital stream (IP_datagram_data_byte) of the TS packet to demultiplexer. Output to 32. The demultiplexer 32 extracts a predetermined TS packet from the digital stream from the front end unit 31 according to the control of the CPU 34, and outputs the predetermined TS packet to the decoding LSI (Large Scale Integrated Circuit) 33. That is, the demultiplexer 32 selects TS packets based on the PID (Packet Identification) arranged in the header of the TS packets constituting the digital stream from the front end unit 31, and selects only the selected TS packets. , Output to decoding LSI 33.

【0068】

The decoding LSI 33 is a one-chip LSI, and is composed of a filter 41, a decoder 42, a key table storage unit 43, a checker 44, and a FIFO (First In First Out) buffer 45.

【0069】

The filter 41, under the control of the CPU 34, inspects the data placed in the payload of the section consisting of TS packets from the demultiplexer 32 as needed, discards unnecessary TS packets, and discards the required TS. Only the packet is output to the decoder 42.

【0070】

The decoder 42 decodes the data (here, the IP packet) placed in the payload of the section composed of the TS packets from the filter 41 with the decryption key stored in the key table storage unit 43, and outputs the data to the checker 44. Output. Further, as described in FIG. 2, when the encryption key is updated in the transmission system 1 and the updated encryption key is transmitted, the decryptor 42 decrypts the encryption key according to the control of the CPU 34. As a key, the stored contents of the key table storage unit 43 are updated. Therefore, here, a common key cryptosystem is used as the encryption method. However, as the encryption method, it is also possible to use a public key encryption method.

【0071】

The key table storage unit 43 is a terminal 24 connected to the receiving device 22 via a cable 25.₁,24₂, ... The key table registered by associating each MAC address with the decryption key assigned to each is stored.

【0072】

According to the control of the CPU 34, the checker 44 detects an error in the IP packet output by the decoder 42 using the CRC code of the section in which the IP packet is located, whereby the decoding in the decoder 42 is normal. Judge whether or not it was done in. The IP packet processed by the checker 44 is supplied to the FIFO buffer 45, and the FIFO buffer 45 temporarily stores the IP packet from the checker 44 and stores the stored IP packet according to the control of the CPU 34. , Output to I / F (Interface) 35. This adjusts the data rate of the IP packet.

【0073】

The CPU 34 controls the front-end section 31, the demultiplexer 32, the decoding LSI 33, and the I / F 35. The I / F35 sends IP packets from the FIFO buffer 45 via the cable 25 to the terminal 24 according to the control of the CPU 34._iFunctions as an interface to supply to.

【0074】

Next, FIG. 5 shows a configuration example of the key table stored in the key table storage unit 43 of FIG.

【0075】

The key table is, for example, the terminal 24 connected to the cable 25.₁,24₂It consists of the same number of entries as the number of, ... In FIG. 5, the key table has N entries # 1 to # N, and therefore, in this embodiment, the cable 25 has N terminals 24.₁~ 24_NIs connected. The maximum number of key table entries is limited by the storage capacity of the key table storage unit 43 and the like.

【0076】

Each entry #i (I = 1,2, ..., N) has a terminal 24_iThe 48-bit MAC address MAC address # i and the m-bit decryption key assigned to that MAC address (m depends on the encryption format used) are registered in association with each other. In the present embodiment, as described above, there are an Even period and an Odd period, and encryption is performed with a different encryption key in each period. Therefore, each entry #i is encrypted in the Even period. Decryption key for decrypting encrypted data (hereinafter, appropriately referred to as the Even decryption key) K_{Even # i}And the decryption key for decrypting the data encrypted during the Odd period (hereinafter, appropriately referred to as the Odd decryption key) K_{Odd # i}Two decryption keys are registered.

【0077】

Further, a Valid bit (hereinafter, appropriately referred to as an entry Valid bit) indicating whether or not the entry #i is valid is added to the beginning of the MAC address MAC address # i of each entry #i. Also, the Even decryption key K for each entry #i_{Even # i}And Odd decryption key K_{Odd # i}Also, a Valid bit (hereinafter, appropriately referred to as a decryption key Valid bit) indicating whether or not each of them is valid is added.

【0078】

Here, the entry Valid bit and the decryption key Valid bit indicate, for example, that 1 is valid and 0 is not valid. However, the assignment of 0 and 1 of the entry Valid bit and the decryption key Valid bit can be reversed from the above-mentioned case.

【0079】

As described above, in the transmitting system 1, the same decryption key as the new encryption key used in the next period is delivered to the receiving system 3 in the period immediately before that. Therefore, in the Even period, the same decryption key (Odd decryption key) as the encryption key used in the next Odd period is delivered, and in the Odd period, the same decryption key as the encryption key used in the next Even period is delivered. The key (Even decryption key) is delivered. Then, in the decoder 42, under the control of the CPU 34, the decryption key distributed in this way is set (for example, overwritten) in the key table. Therefore, in this case, the decryption key used in the next period is set in the key table by the end of the current period, and the decryption key change due to the change of the period does not involve the CPU 34. , Since it is only necessary to switch the position (address) of the key table to be read by the decoder 42, it can be performed instantly.

【0080】

Next, the operation of the receiving device 22 of FIG. 4 will be described with reference to the flowchart of FIG.

【0081】

The antenna 21 receives the satellite broadcast wave transmitted from the transmission system 1 via the satellite 2, and the received signal obtained as a result is a digital TS packet by passing through the front end portion 31 and the demultiplexer 32. It is made into a stream and supplied to the decoding LSI 33.

【0082】

In the decoding LSI 33, a section composed of TS packets output by the demultiplexer 32 is supplied to the decoder 42 via the filter 41. The decoder 42 receives the section, and in step S11, sets the MAC address arranged in the section header to the variable MA as a built-in register.

【0083】

By referring to the key table, the decoder 42 searches for the MAC address entry that matches the variable MA, that is, reads the MAC address registered in each entry #i in order from the key table entry # 1. Then, the MAC address is compared (matched) with the variable MA, and in step S12, it is determined whether or not there is an entry for the MAC address that matches the variable MA. If it is determined in step S12 that there is no entry for the MAC address that matches the variable MA, that is, if the terminal with the MAC address located in the section header is not connected on the cable 25, step S13. Proceeding, the decoder 42 discards the section supplied there and ends the process.

【0084】

If it is determined in step S12 that there is an entry with a MAC address that matches the variable MA, the entry proceeds to step S14 with that entry as the entry of interest.

【0085】

In step S14, the decoder 42 determines whether the attention entry is valid based on the entry Valid bit of the attention entry. If it is determined in step S14 that the noteworthy entry is not valid, that is, if the entry Valid bit of the noteworthy entry is 0, the process proceeds to step S13, where the decoder 42 discards the section supplied therein and processes it. To finish.

【0086】

Therefore, even if a terminal with a MAC address located in the section header of the section supplied to the decoder 42 is connected on cable 25, that section if the entry for that MAC address is not valid. Is not supplied to the terminal on cable 25.

【0087】

Further, in step S14, if it is determined that the attention entry is valid, that is, if the entry Valid bit of the attention entry is 1, the process proceeds to step S15, and the decoder 42 determines the PSC of the section header (FIG. 3 (FIG. 3). B)) Refers to the lower bits, that is, the encryption determination flag, and determines whether the data (IP packet) in the payload of the section is encrypted. If the encryption determination flag is determined to be 0 in step S15, that is, if the IP packet placed in the payload of the section is not encrypted, steps S17 and S18 are skipped and the process proceeds to step S19. , The decoder 42 outputs the unencrypted IP packet to the FIFO buffer 45 via the checker 44, and ends the process.

【0088】

Then, the IP packet stored in the FIFO buffer 45 is sent to the terminal 24 on the cable 25 via the I / F35, which is identified by the MAC address in the section header of the section in which the IP packet is placed._iIs supplied to.

【0089】

On the other hand, if it is determined in step S15 that the encryption determination flag is 1, that is, if the IP packet placed in the payload of the section is encrypted, the process proceeds to step S16, and the decoder 42 determines that The upper bit of the PSC (FIG. 3 (B)) of the section header of the section, that is, the period determination flag is set in the variable EO as the built-in register, and the process proceeds to step S17.

【0090】

In step S17, the decoder 42 corresponds to the variable EO in the entry of interest whose MAC address matches the variable MA, i.e. the Even period if the variable EO is 0 and the Odd period if it is 1. Determines if the decryption key Variable bit # (MA, EO) of the decryption key is valid. If it is determined in step S17 that the decryption key Valid bit # (MA, EO) is not valid, that is, if the decryption key Valid bit # (MA, EO) is 0, the process proceeds to step S13, and the decoder 42 proceeds to step S13. , Discard the section supplied there and end the process.

【0091】

Therefore, even if a terminal with a MAC address located in the section header of the section supplied to the decoder 42 is connected on cable 25 and the entry for that MAC address is valid, the period determination flag If the decryption key for the period represented by is not valid, the section will not be supplied to the terminal on cable 25.

【0092】

On the other hand, if it is determined in step S17 that the decryption key Valid flag # (MA, EO) is valid, that is, if the decryption key Valid bit # (MA, EO) is 1, the process proceeds to step S18 to decrypt. The vessel 42 reads the decryption key Key (MA, EO) of the period corresponding to the variable EO in the noteworthy entry whose MAC address matches the variable MA from the key table, and uses the decryption key Key (MA, EO) as the section. Decrypts the IP packet placed in the payload of, and proceeds to step S19.

【0093】

In step S19, the decoder 42 outputs the decrypted IP packet to the FIFO buffer 45 via the checker 44, and ends the process.

【0094】

Then, the IP packet stored in the FIFO buffer 45 is sent to the terminal 24 on the cable 25 via the I / F35, which is identified by the MAC address in the section header of the section in which the IP packet is placed._iIs supplied to.

【0095】

Note that the processing according to the flowchart of FIG. 6 is performed every time a section is supplied to the decoder 42.

【0096】

As described above, based on the entry Valid bit registered in the entry of the key table, it is judged whether the entry is valid and the output of the data to the terminal is controlled, so the data is acquired normally ( It is possible to easily limit the users (terminals) that can receive).

【0097】

Furthermore, since the data output is controlled based on the decryption key Valid bit of the key table, for example, a certain terminal can receive data only during either the Even period or the Odd period. It is easy to allow and prohibit the reception of data for the other period.

【0098】

The entry Valid bit and the decryption key Valid bit can be set by the receiving device 22 voluntarily, or based on the information transmitted from the transmission system 1. is there.

【0099】

Further, in the present embodiment, the decryption key (also the encryption key) is assigned to the MAC address unique to the terminal, but the decryption key is set to, for example, the terminal ID (Identification) unique to the terminal. , It is also possible to assign it to the terminal ID. Further, the decryption key can be set to a unique group ID for each of a plurality of terminals and assigned to each group ID. However, when assigning a decryption key to a MAC address, a fine-grained conditional access mechanism as described above is used for digital satellite broadcasting that complies with the DVB standard EN 301 192 V1.1.1 (1997-12). It can be easily incorporated into the framework.

【0100】

Further, in the present embodiment, the filter 41, the decoder 42, the key table storage unit 43, the checker 44, and the FIFO buffer 45 are configured by the decoding LSI 33 of one chip, but the filter 41, the decoder 42, The key table storage unit 43, the checker 44, and the FIFO buffer 45 can be configured as separate chips. However, if the filter 41, the decoder 42, the key table storage 43, the checker 44, and the FIFO buffer 45 are configured by the decoding LSI 33 of one chip, the data decoding is completely hidden from the outside of the decoding LSI 33. Since it is done in the form, security can be improved. Further, from the viewpoint of reducing the circuit mounting area and speeding up the processing, the filter 41, the decoder 42, the key table storage unit 43, the checker 44, and the FIFO buffer 45 are composed of a one-chip decoding LSI 33. Is desirable.

【0101】

Further, in the present embodiment, the case where data is distributed by digital satellite broadcasting has been described, but the present invention can also be applied to other cases such as distribution of data by multicast.

【0102】

Further, in the present embodiment, two periods, an Even period and an Odd period, are provided, but it is possible not to provide such a period, and a period of 3 or more is provided. It is also possible. Similarly, the number of decryption keys registered in each entry in the key table can be only one or three or more.

【0103】

Further, in the present embodiment, the data is distributed in a form conforming to the DVB standard, but the data can be distributed in a form not conforming to the DVB standard.

【0104】

Next, the series of processes described above can be performed by hardware or software. When a series of processes are performed by software, the programs constituting the software are installed on a general-purpose computer, a one-chip microcomputer, or the like.

【0105】

Therefore, FIG. 7 shows a configuration example of an embodiment of a computer in which a program for executing the above-mentioned series of processes is installed.

【0106】

The program can be pre-recorded on the hard disk 105 or ROM 103 as a recording medium built in the computer.

【0107】

Alternatively, the program can be applied to removable recording media 111 such as floppy (registered trademark) discs, CD-ROMs (Compact Disc Read Only Memory), MO (Magneto optical) discs, DVDs (Digital Versatile Discs), magnetic discs, and semiconductor memories. , Can be stored (recorded) temporarily or permanently. Such a removable recording medium 111 can be provided as so-called package software.

【0108】

In addition to installing the program on the computer from the removable recording medium 111 as described above, the program can be wirelessly transferred from the download site to the computer via an artificial satellite for digital satellite broadcasting, or LAN (Local Area Network). It is transferred to a computer by wire via a network such as the Internet, and the computer can receive the program transferred in this way by the communication unit 108 and install it on the built-in hard disk 105.

【0109】

The computer has a built-in CPU (Central Processing Unit) 102. The input / output interface 110 is connected to the CPU 102 via the bus 101, and the CPU 102 operates the input unit 107 composed of a keyboard, a mouse, or the like by the user via the input / output interface 110. When a command is input by, the program stored in the ROM (Read Only Memory) 103 is executed accordingly. Alternatively, the CPU 102 is also transferred from a program stored on the hard disk 105, a satellite or a network, received by the communication unit 108 and installed on the hard disk 105, or from a removable recording medium 111 mounted on the drive 109. The program that was read and installed on the hard disk 105 is stored in RAM (Random Access). Load it into Memory) 104 and execute it. As a result, the CPU 102 performs processing according to the above-mentioned flowchart or processing performed according to the above-mentioned block diagram configuration. Then, the CPU 102 outputs the processing result from the output unit 106 composed of an LCD (Liquid CryStal Display), a speaker, or the like, or from the communication unit 108, if necessary, via the input / output interface 110, for example. Send it, and record it on the hard disk 105.

【0110】

Here, in the present specification, the processing steps for describing a program for causing a computer to perform various processes do not necessarily have to be processed in chronological order in the order described as a flowchart, and may be processed in parallel or individually. It also includes processing to be executed (for example, parallel processing or processing by objects).

【0111】

Further, the program may be processed by one computer or may be distributed by a plurality of computers. Further, the program may be transferred to a distant computer and executed.

【0112】

[Effect of the invention]

According to the data processing apparatus and data processing method of the present invention, and a recording medium, a table having an entry in which a destination and entry-valid information indicating whether or not the entry in which the destination is registered is registered is registered. By referring to, an entry having a destination that matches the destination of the data block is searched for as a noteworthy entry from the table. Then, it is determined whether or not the attention entry is valid based on the entry valid information registered in the attention entry, and the output of the data arranged in the data block is controlled based on the determination result. Therefore, it is possible to easily limit the users who can acquire the data normally.

[Simple explanation of drawings]

[Figure 1]

It is a block diagram which shows the structural example of one Embodiment of the broadcasting system to which this invention is applied.

[Figure 2]

It is a flowchart for demonstrating the process of the transmission system 1 of FIG.

[Fig. 3]

It is a figure which shows the format of a section and a section header.

[Fig. 4]

It is a block diagram which shows the configuration example of the receiving apparatus 22 of FIG.

[Fig. 5]

It is a figure which shows the key table.

[Fig. 6]

It is a flowchart for demonstrating the process of the receiving apparatus 22 of FIG.

[Fig. 7]

It is a block diagram which shows the structural example of one Embodiment of the computer to which this invention is applied.

[Explanation of symbols]

1 transmission system, 2 satellites, 3 reception system, 4 network, 11 controller, 12 data server, 13 transmission processing device, 13A encryption key table storage, 14 antenna, 15 line connection device, 16 cable, 21 antenna, 22 reception Equipment, 23 line connection equipment, 24₁,24₂ Terminal, 31 Front-end, 32 Demultiplexer, 33 Decoding LSI, 34 CPU, 35 I / F, 41 Filter, 42 Decoder, 43 Key table storage, 44 Checker, 45 FIFO buffer, 101 bus, 102 CPU, 103 ROM, 104 RAM, 105 hard disk, 106 output unit, 107 input unit, 108 communication unit, 109 drive, 110 input / output interface, 111 removable recording medium