Cryptographic key system

The present invention relates to an encryption key system used in a television system, a database system, a commercial transaction system using Electronic Data Interchange (EDI), or the like.

Today, which is said to be the information age, in addition to ordinary terrestrial broadcasting, satellite broadcasting called broadcasting satellites (BS) and communication satellites (CS), and cable TV broadcasting called CATV using coaxial cables or optical cables are becoming widespread. ..

In satellite broadcasting or CATV broadcasting, which can deliver dozens of channels at the same time, in addition to general unscrambled channels that can be viewed under a comprehensive contract, viewing is possible under a comprehensive contract. There are specialized channels for scrambled movies, sports, music, etc. that cannot be done. In order to watch these channels, it is necessary to make a contract to descramble, but since this contract period is usually done in units of about one month, it cannot be watched by a contract at any time.

The inventors of the present invention<patcit num="1"><text>Japanese Patent Application Laid-Open No. 6-46419</text></patcit><patcit num="2"><text>In Japanese Patent Application Laid-Open No. 6-1410004, a viewing permission key is obtained from a billing center through a public telephony telephone line, and billing is performed. Using the viewing permission key, the scramble performed in a different scramble pattern for each program is released and the program is released. The viewing system,</text></patcit><patcit num="3"><text>Japanese Patent Application Laid-Open No. 6-132916 proposed a device for that purpose.</text></patcit>

In these systems and devices, scrambled program users apply to the billing center via the communication line using the communication device, and the billing center sends the permission key to the communication device in response to this usage application. At the same time, the billing process is performed and the fee is collected. The user who receives the permission key in the communication device sends the permission key to the receiving device by direct means for connecting the communication device and the receiving device or indirect means such as a flexible disk, and the receiving device to which the permission key is sent. Descrambles the program with the permission key, and the applicant uses the program.

As an application of these systems and devices, Japanese Patent Application Laid-Open No. 6-132916 sells or rents tapes or disks on which multiple data scrambled with different scramble patterns are recorded, and supplies license keys using IC cards, etc. Systems and devices that utilize specific data are also described.

In addition, in today's era of computerization, various types of data that were stored independently by each computer until now are stored on a LAN (Local Area Network), WAN (Wide Area Network), and an Internet system that connects these to each other. Database systems that configure computer communication networks and use them mutually are becoming widespread.

On the other hand, a technology has been developed that enables practical digitization by reducing the amount of information by compressing the television video signal that could not be digitized because the amount of information becomes enormous when digitized. From the H.261 standard for television conferences, the JPEG (Joint Photographic image coding Experts Group) standard for still images, the MPEG1 (Moving Picture image coding Experts Group 1) standard for image storage, and current television broadcasting. An MPEG2 standard for high-definition television broadcasting has been created.

Digitization technology using these image compression technologies will not only be used for television broadcasting or video image recording, but will also be able to handle television video data that computers could not handle before. A "multimedia system" that simultaneously handles various types of data handled by computers and digitized television video data is attracting attention as a future technology. This multimedia system is also incorporated into data communication and used as one of the data on the database.

As the scope of use of the database expands in this way, how to charge for the use of data on the database and copyright issues caused by copying or forwarding other than direct use of data. And how to deal with the secondary copyright problem caused by the processing of data becomes a big problem. To ensure billing and copyright processing, it is necessary to make the data available only to authorized users, and encrypting the data is the best way to do so. ..

In addition, an electronic market system that converts information in various transactions that have been described on paper into electronic data and conducts electronic commerce using electronic information interchange (EDI) that is transmitted and received to and from each other using data communication technology. It is being considered, and it is also being considered to go further and settle the electronic commerce system by electronic payment. In commercial transactions, the reliability of the transaction content is required, and in settlement, security is required. Therefore, in electronic commerce systems and electronic payment systems that require such reliability and security, it is necessary to encrypt data so that the data is not falsified or stolen.

In these television systems, database systems, electronic commerce systems, etc., an encryption key is required in order to encrypt data and decrypt and use the encrypted data, and the encryption key is given to the data user. It must be handed over, but this task is very cumbersome as it requires safety and certainty.

Although data encryption technology plays an important role in the configuration of the present invention, a general description of data encryption technology will be given first. In data encryption technology, C = E (K, M) when plaintext data M is encrypted using encryption key K to obtain ciphertext data C. M = D (K, C) when the ciphertext data C is decrypted using the encryption key K to obtain the plaintext data M. It is expressed as.

Typical methods used in data encryption technology include a private key encryption method and a public key encryption method. The private key method is an encryption method that uses the same private key Ks for encryption and decryption. Cmks = E (Ks, M) M = D (Ks, Cmks)

The public key method is an encryption key method in which an encryption key and a decryption key are used as encryption keys, the encryption key is open to the public, and the decryption key is not open to the public. The encryption key is called the public key Kb, and the decryption key is called the private key Kv. To use this encryption method, the information sender encrypts the plaintext data M using the public key Kb of the data receiver, and Cmkb = E (Kb, M). The side receiving the data decrypts it using the dedicated key Kv and obtains the plaintext data M. M = D (Kv, Cmkb) This public key method is extremely difficult to break the code.

As an application of data encryption technology, digital signatures may be used as an electronic data authentication means to ensure the reliability of data. There are two types of digital signatures, one that uses a private key and the other that uses a public key. Generally, a signature is made using a public key. In the digital signature performed using the public key, the signer obtains the digital signature by encrypting the document m obtained by compressing the document M with the hash algorithm using the signer's private key Kv, and Smkv = E. (Kv, m) Send the original document M or compressed document m and the digital signature Smkv to the recipient. The recipient decrypts the digital signature Smkv using the signer's public key Kb and m'= D (Kb, Smkv) If m'= m, the signature is confirmed to be correct.

<p> As a method of passing these encryption keys to the user, the present inventors proposed an invention entitled "encryption key system" in Japanese Patent Application No. 6-70643, which was a prior application.</p><p> While the encryption key is passed only to the user in the generally used encryption key system, the encryption key in the encryption key system of the present invention is passed to other than the user.</p><p> Figure 1 shows the configuration of the encryption key system proposed in Japanese Patent Application No. 6-70643. This system consists of a broadcasting station 1, a database 2, a billing center 3, a receiving device 4, a data communication device 5, and a user terminal device 8 that perform multiplex broadcasting or data broadcasting such as BS / CS / terrestrial television or FM. ing. The broadcasting station 1 and the database 2 and the database 2 and the billing center 3 are connected by a communication line such as a dedicated line or a means such as a flexible disk. The database 2 and the data communication device 5 are connected by a communication line 7 such as a public line or a CATV line. Broadcasting station 1 and receiving device 4 are connected by broadcasting radio waves 6. The receiving device 4 and the user terminal device 8 and the data communication device 5 and the user terminal device 8 are connected by a direct means such as a connection cable or an indirect means such as a flexible disk.</p><p> In this figure, the solid line shows the path of unencrypted information, and the broken line shows the path of encrypted data.</p><p> In this system, the database 2 supplies the broadcasting station 1 in advance with a usage permission key Kp (hereinafter referred to as permission key) including an encryption key Kd that differs for each data. For the sake of clarity, the authorization key Kp will be described as being composed of only the encryption key Kd. The encryption key Kd is encrypted using the common encryption key K0 and when it is supplied unencrypted, and Ckdk0 = E (K0, Kd). It may be supplied as an encryption encryption key Ckdk0. When the encryption key Kd is encrypted and supplied, the common encryption key K0 for decrypting the encryption encryption key Ckdk0 is supplied to the user. This common encryption key K0 may be supplied when the user registers in the database, or may be passed to the user together with the encrypted data Cmkd when the encrypted data Cmkd is sent.</p><p> (a) When the encryption key is not encrypted. In this encryption key system, the broadcasting station 1 broadcasts the encryption key Kd supplied from the database 2 using the radio wave 6. The receiving device 4 supplies the received encryption key Kd to the user terminal device 8, and the user terminal device 8 stores the received encryption key Kd in a recording medium such as a semiconductor memory, a flexible disk, or a hard disk. A data user (user) applies for the use of data M to the database 2 via the communication line 7 using the data communication device 5. Database 2 that received the application for use of data M encrypts the data M that was requested to be used using the encryption key Kd, which is the permission key Kp, and Cmkd = E (Kd, M). The encrypted data Cmkd is transmitted to the user's data communication device 5 via the communication line 7, and billing processing is performed with the billing center 3. The data communication device 5 supplies the received encrypted data Cmkd to the user terminal device 8, and the user terminal device 8 decrypts the encrypted data Cmkd using the encryption key Kd stored in the recording medium. M = D (Kd, Cmkd)</p><p> (b) When the encryption key is encrypted and the common encryption key is distributed to users in advance. In this encryption key system, when the user registers to use the database, the common encryption key K0 is supplied to the user by a recording medium such as a ROM or a flexible disk, and the supplied common encryption key K0 is the user terminal device 8 It is stored in. Database 2 encrypts the encryption key Kd using the common encryption key K0, and Ckdk0 = E (K0, Kd) The encryption encryption key Ckdk0 is supplied to the broadcasting station 1. Broadcasting station 1 broadcasts the encryption encryption key Ckdk0 supplied from database 2 using radio waves 6. The receiving device 4 supplies the received encryption encryption key Ckdk0 to the user terminal device 8, and the user terminal device 8 first decrypts the encryption encryption key Ckdk0 using the pre-stored common encryption key K0, and Kd = D (K0, Ckdk0) The decrypted encryption key Kd is stored in a recording medium such as a semiconductor memory, a flexible disk, or a hard disk.</p><p> A data user wishes to use the data communication device 5 to apply for the use of data M to the database 2 via the communication line 7. Database 2 that received the application for data use encrypts the data M that was requested to be used using the encryption key Kd, and Cmkd = E (Kd, M). It transmits to the data communication device 5 via the communication line 7 and performs billing processing with the billing center 3. The data communication device 5 supplies the received encrypted data Cmkd to the user terminal device 8, and the user terminal device 8 decrypts the encrypted data Cmkd using the stored encryption key Kd. M = D (Kd, Cmkd)</p><p> (c) When the encryption key is encrypted and the common encryption key is distributed to users together with the encrypted data. In this encryption key system, database 2 encrypts the encryption key Kd using the common encryption key K0, and Ckdk0 = E (K0, Kd). Supply to broadcasting station 1. Broadcasting station 1 broadcasts the encryption encryption key CkdK0 supplied from database 2 using radio waves 6. The receiving device 4 supplies the received encryption encryption key Ckdk0 to the user terminal device 8, and the user terminal device 8 stores the encryption encryption key CKdk0 in a recording medium such as a semiconductor memory, a flexible disk, or a hard disk.</p><p> A data user wishes to use the data communication device 5 to apply for the use of data M to the database 2 via the communication line 7. Database 2 that received the application for data use encrypts the data M that was requested to be used using the encryption key Kd, and Cmkd = E (Kd, M). It is transmitted to the data communication device 5 via the communication line 7 together with the common encryption key K0, and billing processing is performed with the billing center 3. The data communication device 5 supplies the received encrypted data Cmkd and the common encryption key K0 to the user terminal device 8, and the user terminal device 8 uses the common encryption key K0 to supply the encryption encryption key Ckdk0 stored in the recording medium. Decrypt and Kd = D (K0, Ckdk0) The encrypted data Cmkd is decrypted using the decrypted encryption key Kd. M = D (Kd, Cmkd)</p>

<p> The present application provides a specific configuration for applying the invention of the encryption key system described in the prior application to a television system, a database system, an electronic commerce system, or the like. This system consists of a broadcasting station, a database, a receiving device, a data communication device, and a user terminal device. As an encryption key method, a private key method and a public key method are adopted, and a digital signature is used, and the encryption used at this time is used. Keys are provided by broadcast, encrypted or unencrypted. The present invention is effective in preventing unauthorized use in database systems, pay-per-view systems, and video-on-demand systems, in managing copyrights, and is also an effective means in realizing an electronic market using an electronic information information system.</p>

Hereinafter, examples of the present invention will be described with reference to FIGS. 2 to 4. [First Example] Fig. 2 shows the encryption key system of the first example in which the present invention is applied to a database system, and this system is based on BS / CS / terrestrial television or FM broadcasting. Broadcasting station 11 that broadcasts data by multiplex broadcasting or digital broadcasting, database 12 that stores various data including video data, billing center 13, receiving device 14 that receives data broadcasting broadcast by broadcasting station 11, database 12 It is composed of a data communication device 15 that communicates with and a user terminal device 18 that uses data.

The database 12 and the broadcasting station 11 and the database 12 and the billing center 13 are connected by a direct means such as a dedicated line or an indirect means such as a flexible disk. The database 12 and the data communication device 15 are connected by a communication line 17 such as a public line or a CATV line. The broadcasting station 11 and the receiving device 14 are connected by radio waves 16 such as terrestrial television broadcasting, satellite television broadcasting, CATV broadcasting, FM broadcasting or satellite data broadcasting. The receiving device 14 and the user terminal device 18 and the data communication device 15 and the user terminal device 18 are connected by a direct means such as a connection cable or an indirect means such as a flexible disk. In this figure, the solid line shows the path of unencrypted data, and the broken line shows the path of encrypted data. In principle, data is exchanged between the database 12 and the broadcasting station 11 and between the database 12 and the billing center 13 via a dedicated line or flexible disk, but in addition to this, public lines, broadcasting satellites, communication satellites, and terrestrial broadcasting are used. It can also be done by wave broadcasting. In that case, the data is encrypted.

In this system, a private key method and a public key method are adopted as the encryption key method. Database 12 prepares a public key Kbd and a private key Kvd, and supplies the public key Kbd to the broadcasting station 11. The broadcasting station 11 that received the public key Kbd is a character multiplex broadcast using the scanning line during the return erasure period of the analog television video signal, a data broadcast using the sub-audio band of the analog television audio signal, and an FM multiplex data broadcast. Alternatively, the public key Kbd is broadcast by digital data broadcasting. In this case, the public key Kbd can be digitally signed with the database 11.

At this time, for convenience of data use, we will supply a table of contents with the title of the data that can be used, an introduction of the data contents, a product catalog, a purchase order, an unstated check, and copyright information without encryption. You can also do it. The receiving device 14 that receives the broadcast public key Kbd transfers the public key Kbd to the user terminal device 18, and the user terminal device 18 that receives the transferred public key Kbd records the semiconductor memory, flexible disk, hard disk, or the like. Save the public key Kbd on the medium.

The user who selects the data to be used by the table of contents or the content introduction applies for the use of the data M to the database 12 via the communication line 17 using the data communication device 15. At this time, the user encrypts using the public key Kbd of the database 12 that received his private key Ksu, and Cksukbd = E (Kbd, Mksu). Send to database 12.

Database 12 decrypts the encrypted user's private key Cksukbd using the private key Kvd, and Ksu = D (Kvd, Cksukbd). The data M for which the usage application has been made is encrypted using the decrypted user's private key Ksu, and Cmksu = E (Ksu, M). It is transmitted to the user's data communication device 15 via the communication line 17.

The user who receives the data Cmksu encrypted using his / her private key Ksu decrypts the encrypted data Cmksu encrypted using his / her private key Ksu on the user terminal device 18, and M = D (Ksu). , Cmksu) Use.

This system is provided with a billing center 13 linked to the database 12. This billing center 13 is used when the data is provided for a fee, but is not used when the data is data provided free of charge such as shopping information. However, even data provided free of charge, such as shopping information, is used when the price is settled in connection with receiving / ordering.

[Second Example] FIG. 3 shows a second embodiment in which the present invention is applied to a video on demand (VOD) system that broadcasts a television program according to a request from a user. An example encryption key system. This system consists of a CATV broadcasting station 21, a billing center 23, a receiving device 24, a data communication device 25, and a user terminal device 28. The billing center 23 is used when the television program is provided for a fee, but is not used when the television program is provided free of charge such as with an advertisement. In this system, the encrypted television broadcast program and the encryption key are transmitted on the CATV line 27, which is a single route.

The CATV broadcasting station 21 and the billing center 23 are connected by a direct means such as a dedicated line or other communication line or an indirect means such as a flexible disk. The CATV broadcasting station 21 and the receiving device 24 and the CATV broadcasting station 21 and the data communication device 25 are connected by a CATV line 27. The receiving device 24 and the user terminal device 28 and the data communication device 25 and the user terminal device 28 are connected by a direct means such as a connection cable or an indirect means such as a flexible disk. In this figure, the solid line shows the path of unencrypted data, and the broken line shows the path of encrypted data. In principle, data is transferred between the CATV broadcasting station 21 and the billing center 23 by a dedicated line or a flexible disk, but it can also be performed by a public line, a broadcasting satellite, a communication satellite, or a terrestrial broadcasting. In that case, the data is encrypted.

In this system, the CATV system is also treated as a kind of database, and the private key method and the public key method are adopted as the encryption key method. A user who uses this VOD system either registers his / her public key Kbu in the CATV broadcasting station 21 in advance, or transmits it using the communication device 25 at the time of application for use.

CATV broadcasting station 21 encrypts the private key Ksb of CATV broadcasting station 21 using the transmitted user's public key Kbu, and Cksbkbu = E (Kbu, Ksb) It transmits to the data communication device 25 via the CATV line 27. On the other hand, the television program M is encrypted using the private key Ksb of CATV broadcasting station 21, and Cmksb = E (Ksb, M). It is broadcast to the receiving device 24 via the CATV line 27.

The user decrypts the received encryption private key Cksbkbu of the CATV broadcasting station 21 using the user's private key Kvu, and Ksb = D (Kvu, Cksbkbu). Decrypt the encrypted television program Cmksb using the decrypted private key Ksb of CATV broadcasting station 21, and M = D (Ksb, Cmksb) Use.

In addition, this encryption key system can be applied to television broadcasting, audio broadcasting, or data broadcasting other than CATV if encryption is possible. In addition, as a method of transmitting the encryption key from the broadcasting station, character multiplex broadcasting using the scanning line during the return erasing period of the analog television video signal, data broadcasting using the sub-audio band of the analog television audio signal, FM Multiplex data broadcasting or digital data broadcasting is available.

Furthermore, this encryption key system is a prior application proposed by the present inventors, Japanese Patent Application No. 6-64889, Japanese Patent Application No. 6-237673, Japanese Patent Application No. 6-264199, Japanese Patent Application No. 6-264201, It can also be used when distributing the encryption key in the data copyright management system described in Japanese Patent Application No. 6-269959. Further, this encryption key system is a record of a CD-ROM or the like in which a plurality of information is encrypted and recorded in a plurality of different patterns, which is proposed by the present inventors described in Japanese Patent Application Laid-Open No. 6-132916. It is also applicable when using a medium. These prior inventions will be described.

The outline of the data copyright management system described in Japanese Patent Application No. 6-64889 is as follows. In order to manage the copyright in the display (including audio conversion), storage, copying, processing, and transfer of digital data in the database system including real-time transmission of digital video, the encrypted data is sent to the applicant. In addition to the permission key, send one or more of the copyright management program, copyright information, or copyright management message as needed. The copyright management message is displayed on the screen when the application or permission is attempted to be used, giving caution or warning to the user, and the copyright management program is used against the application or permission. Monitor and manage so that there is no such thing.

The copyright management program, copyright information and copyright management message are supplied in their entirety with the authorization key, in whole with the data, in part with the authorization key and in part with the data. May be done. Data, authorization key, copyright management message, copyright information and copyright management program are sent in encrypted form, but if the encryption is broken at the time of use, they are sent in encrypted state and displayed. There are three cases: when the encryption is broken only and the other cases are encrypted, and when it is not encrypted at all.

The outline of the data copyright management system described in Japanese Patent Application No. 6-237673 is as follows. This database copyright management system records encrypted data of a database in which unencrypted data is stored, a broadcasting station such as a satellite broadcasting station that broadcasts encrypted data from the database, or a database. It consists of a data supply means that is a recording medium such as a CD-ROM, a communication network, a key management center that manages encryption keys, and a copyright management center that manages the copyright of the database. A copyright management program for managing copyrights, a first encryption key, and a second encryption key are used.

The primary user registers in advance with the key management center in order to use the database, and the database use program is distributed at that time. This database utilization program includes a program that uses information about the primary user and information to generate an encryption key unique to the primary user by a predetermined algorithm. The data is stored in the database unencrypted, and when it is broadcast, recorded on a recording medium, or distributed via a communication network, it is encrypted with the first encryption key and becomes encrypted data. To. When the encrypted data is distributed via a broadcast or communication network, it is stored in a recording medium such as a semiconductor memory, flexible disk, or hard disk of the primary user terminal device, and is recorded and distributed on a CD-ROM recording medium. If so, it is saved as it is or in a recording medium such as a semiconductor memory, a flexible disk, or a hard disk of the primary user terminal device.

The primary user who uses the data directly from the database requests the key to decrypt and use the encrypted data from the key management center via the communication network, but at this time, the information about the primary user is presented. To do. The key management center transfers the information about the primary user to the copyright management center, and the copyright management center uses the information I about the primary user to generate and generate an encryption key unique to the primary user by a predetermined algorithm. The copyright management program, the first encryption key, and the second encryption key are encrypted using the primary user encryption key and transferred to the key management center. The copyright management program encrypted using the encryption key generated by using the information about the primary user is unique to the primary user.

The key management center that received the encrypted copyright management program sends the encrypted copyright management program, the first encryption key, and the second encryption key to the primary user terminal device via the communication network. And the primary user saves the received encryption copyright management program, encryption first encryption key, and encryption second encryption key in a recording medium such as a semiconductor memory, flexible disk, or hard disk. To do.

The primary user generates an encryption key unique to the primary user by using the information about the primary user by a predetermined algorithm using a database usage program distributed in advance, and the encrypted work is performed using the generated encryption key. The rights management program, the encrypted first encryption key and the encrypted second encryption key are decrypted, and the encrypted data is decrypted using the decrypted first encryption key.

After that, when saving, copying or transferring the decrypted data, encryption is performed using the second encryption key decrypted by the decrypted copyright management program, and the encrypted data is stored in the primary user terminal device. When the encrypted data saved in the semiconductor memory, flexible disk, hard disk, etc. is used by the primary user, it is decrypted using the second encryption key, and this operation is repeated for the primary use. Will be done.

When the encrypted data is copied to an external storage medium or transferred to a secondary user terminal device via a communication network, the copyright management program discards the first and second encryption keys. The primary user will not be able to use the encrypted data. At this time, when the encrypted data is stored in the primary user terminal device, unencrypted information about the primary user is added to the stored encrypted data.

When the primary user uses the encrypted data again, the copyright management center reissues the first encryption key and the second encryption key, and this reissuance results in the reissuance from this primary user. It is confirmed that there is a secondary user who has received a copy or transfer of the encrypted data, and the existence of the secondary user is recorded in the copyright management center.

The secondary user who receives the copied or transferred encrypted data applies to the copyright management center for the secondary use of the encrypted data. Unlike the primary user, the secondary user does not need to be registered in the key management center in advance, and the information of the primary user who received the copy or transfer of the encrypted data at the time of application for use must be presented to the copyright management center. The usage application will be accepted. If the primary user information is not presented at this time, it is recognized that the user is not the secondary user who received the copy or transfer of the encrypted data from the primary user, but the secondary user. The usage application will not be accepted. The copyright management center that received the secondary usage application has a second encryption key for decrypting the encrypted data, a third encryption key for re-encrypting and re-decrypting the decrypted encrypted data, these Sends a copyright management program that decrypts, re-encrypts, and re-decrypts to the secondary user.

The outline of the copyright management system described in Japanese Patent Application No. 6-264199 is as follows. In this copyright management system, the first public key prepared by the user, the first private key corresponding to the first public key, the second public key, and the second private key corresponding to the second public key are provided. The key and the first private key and the second private key prepared by the database side are used.

On the database side, unencrypted data is encrypted with the first private key, the first private key is encrypted with the first public key, and the second private key is made public. It is encrypted using a key, and these encrypted data, an encrypted first private key, and an encrypted second private key are transmitted to the user.

The user decrypts the encrypted first private key using the first dedicated key, decrypts the encrypted data using the decrypted first private key, uses it, and encrypts the second private key. Is decrypted using the second dedicated key, and the decrypted second private key is used as an encryption key when storing, copying, and transferring data after decryption.

The outline of the data copyright management system described in Japanese Patent Application No. 6-264201 is as follows. When creating new data by processing multiple encrypted data obtained from the database, encrypting it and supplying it to others, the encryption key of the multiple data that is the raw material and the processing program that is the processing process are used. Use the digitally signed data as the usage permission key. When the user who receives the processed and encrypted data presents the digital signature to the copyright management center and applies for use, the copyright management center confirms the processor based on the digital signature, and the processor processes the data. Only when it is confirmed that the user is a legitimate user of the data, the encryption key for use is provided to the user applicant.

The outline of the method described in Japanese Patent Application No. 6-269959 is as follows. The primary user receives the encrypted data whose original data is encrypted with the first encryption key from the database, decrypts it, and uses it. After that, the first encryption key, the primary user data, and the number of times the data is used are included. One or a combination of these is encrypted with a second encryption key generated by a predetermined algorithm, and storage, copying, and transfer are performed. When the secondary user requests the secondary use of the data, the copyright management center uses the first encryption key of the original data, the primary user data, one of the number of times the data is used, or a combination thereof and uses a second algorithm. Generate the encryption key of and provide it to the secondary user. The secondary user provided with the second encryption key decrypts and uses the original data encrypted using the second encryption key.

[Third Example] FIG. 4 shows the encryption key system of the third embodiment in which the present invention is applied to a database system or a VOD system. Similar to the encryption key system of the second embodiment shown in FIG. 3, this encryption key system also allows the encryption key and the television broadcast program to take a single route, which is a CATV line, but to take different routes. Of course it is possible to. This system consists of a CATV broadcasting station 31 that broadcasts data, a data management center 33 such as a database or video system, a receiving device 34, a data communication device 35, and a user terminal device 38.

The data management center 33 and the CATV broadcasting station 31 are connected by a direct means such as a dedicated line or an indirect means such as a flexible disk. A CATV line 37 is connected between the CATV broadcasting station 31 and the receiving device 34 and between the CATV broadcasting station 31 and the data communication device 35. In addition, instead of the CATV line 37, it is possible to use another suitable communication line capable of data broadcasting or data communication. The receiving device 34 and the user terminal device 38 and the data communication device 35 and the user terminal device 38 are connected by a direct means such as a connection cable or an indirect means such as a flexible disk. In this figure, the solid line shows the path of unencrypted data, and the broken line shows the path of encrypted data. In principle, data is transferred between the data management center 33 and the CATV broadcasting station 31 via a dedicated line or flexible disk, but it can also be performed via a public line, broadcasting satellite, communication satellite, or terrestrial broadcasting. .. In that case, the data is encrypted.

The encryption key method adopted in this system is a private key method and a public key method. The data management center 33 prepares a public key Kbd and a private key Kvd common to all the supplied data and a private key Ksdi different for each data, and supplies the data to the CATV broadcasting station 31. CATV Broadcasting Station 31 Received Secret encrypted with the public key Kbd of the data management center 33 Mitsukagi Ksdi, Cksdikbd = E (Kbd, Ksdi) Broadcast by character multiplex broadcasting using scanning lines during the return elimination period of analog television video signals, data broadcasting using the sub-audio band of analog television audio signals, FM multiplex data broadcasting, or digital data broadcasting. At this time, for convenience of data use, in order to promote the use of the data or the table of contents that describes the titles of the data that can be used, it is also possible to supply the content introduction that explains the outline of the data without encryption. it can.

The user who selects the data to be used by the table of contents or the content introduction applies to the data management center 33 via the CATV line 37 and the CATV broadcasting station 31 using the data communication device 35. At this time, the user sends his / her public key Kbu to the data management center 33. The data management center 33 that received the usage application from the user encrypts the data M using the private key Ksdi and Cmksdi = E (Ksdi, M). It is transmitted to the user terminal device 38. At that time, the dedicated key Kvd of the data management center is encrypted using the public key Kbu of the user who applied for use, and Ckvdkbu = E (Kbu, Kvd) It is transmitted to the user terminal device 38.

The user who receives the data management center encryption key Ckvdkbu decrypts the data management center encryption key Ckvdkbu using the user's private key Kvu, and Kvd = D (Kvu, Ckvdkbu). Decrypt the encrypted private key Cksdikbd using the decrypted data management center dedicated key Kvd, and Ksdi = D (Kvd, Cksdikbd) Decrypt the encrypted data Cmksdi using the decrypted data management center private key Ksdi and M = D (Ksdi, Cmksdi) Use.

[Fourth Example] Since the system configuration of the fourth embodiment is the same as that of the third embodiment shown in FIG. 4, the description thereof will be omitted. The encryption key method adopted in this system is the private key method and the public key method as in the third embodiment, but in the third embodiment, the public key Kbu of the user who applied for use is used as the dedicated key Kvd of the data management center. Is encrypted and transmitted to the user, whereas in the fourth embodiment, the dedicated key Kvd of the data management center is distributed in advance using an IC card or the like and stored in the user terminal device, and the third In the embodiment, the data M is distributed in response to the application for the use of the data, whereas in the fourth embodiment, the data M is broadcast by the CATV line or satellite broadcasting regardless of the usage request.

When the user concludes a comprehensive contract with the data management center to use the database, the dedicated key Kvd of the data management center common to all the supplied data is used by a recording medium such as an IC card or via the CATV line 37. It is distributed to users in advance and stored in a semiconductor memory, a hard disk device, or a flexible disk in the user terminal device 38. The data management center 33 prepares a different private key Ksdi for each of the public key Kbd and the supplied data and supplies it to the CATV broadcasting station 31. Upon receiving the private key Ksdi, the CATV broadcasting station 31 encrypts the private key Ksdi using the public key Kbd, and Cksdikbd = E (Kbd, Ksdi). Encrypted private key Ksdikbd is used for character multiplex broadcasting using scanning lines during the return erasure period of analog television video signals, data broadcasting using the sub-audio band of analog television audio signals, FM multiplex data broadcasting or digital data broadcasting. Broadcast by. At this time, for convenience of data use, in order to promote the use of the data or the table of contents that describes the titles of the data that can be used, it is also possible to supply the content introduction that explains the outline of the data without encryption. it can.

The CATV broadcasting station 31 encrypts the data M using the private key Ksdi, and Cmksdi = E (Ksdi, M). Broadcast unilaterally on the CATV line regardless of your wishes. The user captures desired data from the data broadcast on the CATV line based on the table of contents or the content introduction into the user terminal device 38 using the receiving device 34.

The user decrypts the encryption private key Cksdikbd using the dedicated key Kvd of the data management center distributed in advance and stored in the semiconductor memory, hard disk device, or flexible disk in the user terminal device 38, and Ksdi = D (Kvd, Cksdikbd) The encrypted data Cmksdi is decrypted using the decrypted private key Ksdi, and M = D (Ksdi, Cmksdi). Use.

Other modified embodiments for distributing the encryption key will be described. [Fifth Example] In the examples described so far, since the public key Kbd of the data management center is broadcast from the broadcasting station instead of via the communication line, it is possible to confirm whether or not it is genuine. Can not. In such a case, digitally sign the public key Kbd of the data management center using the dedicated key Kvd of the data management center, and Skbdkvd = E (Kvd, Kbd). Broadcast the digital signature Skbdkvd with the public key Kbd of the data management center. The user confirms the digital signature Skbdkvd using the received data management center public key Kbd, and Kbd = D (Kbd, Skbdkvd). Use if it is genuine.

[6th Example] When the data management center adopts the membership system in which the use of the database is registered in advance in the 5th embodiment, the public key Kbui of the user who is a member is further registered in the data management center in advance. Keep it. The data management center encrypts the public key Kbd of the data management center using the public key Kbui of each user. Ckbdkbui = E (Kbui, Kbd) In addition, the public key Kbd of the data management center is digitally signed using the dedicated key Kvd of the data management center, and Skbdkvd = E (Kvd, Kbd). A different encrypted public key Ckbdkbui and digital signature Skbdkvd are sent to the broadcasting station for each user, and the broadcasting station broadcasts the received encrypted public key Ckbdkbui and digital signature Skbdkvd. At this time, if necessary, the unencrypted user identification information of each user is added to the encrypted public key Ckbdkbui for broadcasting. The user who receives the broadcasted encrypted public key Ckbdkbui and the digitally signed Skbdkvd decrypts the encrypted public key Ckbdkbui of the data management center using the user's public key Kvui, and Kbd = D (Kvui, Ckbdkbui). Save the decrypted public key Kbd of the data management center in the user's terminal device. In addition, the user confirms the digital signature Skbdkvd using the received data management center public key Kbd, and Kbd = D (Kbd, Skbdkvd). If it is genuine, use the saved data management center public key Kbd. In this way, different encryption keys can be distributed to each user.

[7th Example] The user presents his / her public key Kbu to the data management center every time he / she accesses or requests the data management center. Upon receiving the request from the user, the data management center encrypts the requested data M using the user's public key Kbu, and Cmkbu = E (Kbu, M). It is sent to the broadcasting station, and the broadcasting station broadcasts the received encrypted data Cmkbu. The user who receives the broadcast encrypted data Cmkbu decrypts it using the user's private key Kvu, and M = D (Kvu, Cmkbu) Use.

FIG. 5 shows an application example using the encryption key system of the present invention. Each application example shown in this figure is for electronic market transactions using an electronic information exchange system, (a) is for credit card payments performed by retailers, and (b) is for electronic checks. The configuration shown in (c) is the configuration when these encryption key systems are applied to the wholesale sales performed by the manufacturers and the like. These systems use digital signatures in addition to the private key method, and consist of users 42, retail stores 43 that are WWW (World Wide Web) servers on the Internet, financial institutions 44, or wholesale stores 45 that are manufacturers. To.

[Eighth Example] In the credit settlement at the retail store shown in (a), the retail store 43 has a purchase order format, a credit card format, an advertisement, a catalog, a trailer, a product description, a database content introduction, and a table of contents / price. Broadcast data Ms such as tables / price lists via satellite 41 or CATV line. The user 42 who received the data Ms such as the purchase order format and the public key Kbs of the retail store 43 encrypts the user's private key Ksu using the public key Kbs of the retail store 43, and Cksukbs = E (Kbs, Ksu). Items such as order details, payment amount, credit card number, etc. based on information such as advertisements, catalogs, product descriptions, price lists, etc. Mu is encrypted and entered in the purchase order using the user 42's private key Ksu, and Cmuksu = E (Ksu, Mu) If necessary, make Mu a compressed document mu and digitally sign it using the user 42's dedicated key Kvu, and Smukvu = E (Kvu, mu) Attach the public key Kbu of user 42 and send it to retail store 43 via network 47.

The retail store 43, which receives the purchase order, decrypts the user 42's encrypted private key Cksukbs using the retail store 43's dedicated key Kvs, and Ksu = D (Kvs, Cksukbs). Decrypt the encrypted purchase order Cmuksu using the decrypted user 42's private key Ksu, and Mu = D (Ksu, Cmuksu) Execute order processing. Furthermore, using the public key Kbu attached by the user 42, the digital signature Smukvu of the user 42 is confirmed, and mu = D (Kbu, Smukvu). Return the receipt to user 42 via network 47. In this system, the credit card number entered in the purchase order is encrypted and sent, so that the theft of the credit number can be prevented.

In addition, retailer 43 uses digital data Ms1 such as purchase order format, credit card format, advertisement, catalog, trailer, product description, database contents introduction and table of contents / price list / price list as compressed document ms1. Digitally sign using 43 dedicated keys Kvs, Sms1kvs = E (Kvs, ms1) Broadcast with the public key Kbs of retail store 43 attached, and the user confirms the digital signature Sms1kvs using the public key Kbs of retail store 43 ms'= D (Kbs, Smskvs) By doing so, the transaction will be more reliable.

[Example 9] In the settlement by the electronic check shown in (b), the financial institution 44 attaches the public key Kbf of the financial institution 44 to the blank check format Mf, which is digital data, and connects the satellite 41 or the CATV line. Broadcast via. The user 42 who receives the blank check format Mf encrypts the private key Ksu of the user 42 using the public key Kbf of the financial institution, and Cksukbf = E (Kbf, Ksu). Items about payee and payment amount Mu is encrypted using the private key Ksu of user 42 and filled in, and Cmuksu = E (Ksu, Mu) If necessary, set Mu as a compressed document mu, digitally sign it with the user 42's dedicated key Kvu, and Smukvu = E (Kvu, mu). The public key Kbu of the user 42 and the encryption private key Cksukbf of the user 42 encrypted with the public key Kbf of the financial institution 44 are attached and transmitted to the financial institution 44 via the network 47.

Upon receiving the written check, the financial institution 44 decrypts the user 42's encrypted private key Cksukbf using the financial institution's private key Kvf, and Ksu = D (Kvf, Cksukbf). Decrypt the encrypted data Cmuksu of the payee and the payment amount using the decrypted user's private key Ksu, and Mu = D (Ksu, Cmuksu) Check the contents described and execute the exchange exchange process. Furthermore, if the digital signature Smukvu is present, the user 42 is confirmed using the public key Kbu attached by the user 42, and mu'= D (Kbu, Smuksu). Confirmation Ms2 is encrypted using the public key Kbu attached by user 42, and Cms2kbu = E (Kbu, Ms2) Reply to user 42 via network 47.

The user who received the encryption confirmation Cms2kbu from the financial institution 44 decrypts the encryption confirmation Cms2kbu using the user 42's dedicated key Kvu and Ms2 = D (Kvu, Cms2kbu). checking the content. According to this system, the payee and the payment amount are encrypted and written on the check, so that the contents written on the check can be prevented from being stolen.

In addition, the blank check format Mf, which is digital data, is used as the compressed document mf, which is digitally signed using the dedicated key Kvf of the financial institution 44, and Smfkvf = E (Kvf, mf). Broadcast with the public key Kbf of financial institution 44 attached, and the user confirms the digital signature Smskvf using the public key Kbf of financial institution 44 mf'= D (Kbf, Smfkvf) Smskbu = E (Kbu, ms), which uses the public key Kbu attached by the user to digitally sign the confirmation Ms as the compressed document ms. By doing so, the financial institution can confirm the writer.

[10th Example] In the wholesale store 45 of a manufacturer or the like shown in (c), the wholesale store 45 uses the quotation request format Mw1 as compressed data mw1 and digitally signs it using the wholesale store 45's dedicated key Kvw. Do, Smw1kvw = E (Kvw, mw1) Broadcast via satellite 41 or CATV line with the public key Kbw of wholesale store 45 attached. User 42, who is a retailer who receives the broadcast quotation request format Mw1 and the public key Kbw of the wholesale store 45, encrypts the quotation request Mu using the public key Kbw of the wholesale store 45 and Cmukbw = E (Kbw). , Mu) Send to wholesaler 45 via network 47. At this time, if necessary, the quotation request form Mu is used as compressed data mu, and this is digitally signed using the user 42's dedicated key Kvu, and Smkvu = E (Kvu, mu). Send to wholesaler 45 with user 42's public key Kbu.

The wholesale store 45 that received the encrypted quotation request form Cmukbw decrypts the encrypted quotation request form Cmukbw using the dedicated key Kvw of the wholesale store 45, and Mu = D (Kvu, Cmukbw). Confirm the stated quotation request content Mu and execute the quotation work. Furthermore, if the digital signature is Smkvu, the digital signature is confirmed using the sent user 42's public key Kbu, and mu = D (Kbu, Smkvu). Check the quotation request form. The wholesale store 45 that performed the quotation encrypted the quotation Mw2 using the public key Kbu of the user 42, and Cmw2kbu = D (Kbu, Mw2). Send to user 42 via network 47.

The user 42 who receives the encryption quotation Cmw2kbu of the wholesale store 45 decrypts it using the user 42's private key Kvu. Mw2 = D (Kvu, Cmw2kbu) According to this system, since the public key and the private key are used, there is no possibility that the contents of the quotation will be stolen, and it is possible to make a different quotation for each user.

In the systems shown in (a) to (c), various formats and advertisements that do not require confidentiality are broadcast by satellite broadcasting or CATV broadcasting, so that data can be effectively transmitted.

As described above, by using the encryption key system of the present invention, general information media such as television broadcasting or audio broadcasting, which have existed as separate systems, and data communication media using a computer are fused. A multimedia system can be realized. Hereinafter, a specific configuration that realizes the multimedia system will be described.

Current television broadcasting is carried out in analog form by terrestrial broadcasting, satellite broadcasting or CATV broadcasting, while the most common data communication line is a public line using electric wires. In such a system configuration, the encryption key system of the first embodiment shown in FIG. 2 can be used as the basic configuration as a system that realizes video on demand. The broadcasting station broadcasts the public key Kbb of the broadcasting station by multiplexing the scanning line during the vertical return period of the analog television broadcasting program or the sub-audio band of the audio band.

Those who wish to use the television program encrypt their private key Ksu using the public key Kbb of the broadcasting station, and Cksukbb = E (Kbb, Ksu) Send the encrypted private key Cksukbb to the broadcasting station via the communication line to apply for use.

The broadcasting station decrypts the encryption private key Cksukbb of the applicant using the broadcasting station's dedicated key Kvb, and Ksu = D (Kvb, Cksukbb). The broadcast program is scrambled and broadcast using the decrypted private key Ksu.

Those who wish to use it use their private key Ksu to descramble the scrambled broadcast program. By adopting such a configuration, it becomes impossible for anyone other than the person who wants to use the program to use the program.

As a system that realizes video-on-demand and pay-per-view in such a system configuration, the encryption key system of the fourth embodiment or the fifth embodiment shown in FIG. 4 can be used as the basic configuration. The broadcasting station 31 encrypts the private key Ksb of the broadcasting station 31 using the public key Kbb of the broadcasting station 31 by multiplexing the scanning line during the vertical return period of the analog television broadcast program or the sub-audio band of the audio band. , Cksbkbb = E (Kbb, Ksb) Broadcast via communication line 37.

The television program user 38 sends his / her public key Kbu to the broadcasting station 31 via the communication line 37 to apply for use. Broadcasting station 31 scrambles the broadcast program using the broadcasting station's private key Ksb and broadcasts it via the communication line 37. At that time, the dedicated key Kvb of the broadcasting station 31 is encrypted with the public key Kbu of the user 38, and Ckvbkbu = E (Kbu, Kvb) Broadcast via communication line 37.

The user 38 decrypts the encryption key Ckvbkbu of the broadcasting station 31 using his own key Kvu, and Kvb = D (Kvu, Ckvbkbu). Decrypt the encrypted private key Cksbkbb of broadcasting station 31 using the decrypted private key Kvb of broadcasting station 31, and Ksb = D (Kvb, Cksbkbb) The scrambled broadcast program is unscrambled and used using the decrypted broadcast station 31's private key Ksb. By adopting such a configuration, it becomes impossible for anyone other than the person who wants to use the program to use the program.

Furthermore, this encryption key system can be applied to the recent popular television shopping that combines television broadcasting and telephone. Currently, television shopping using analog television broadcasting displays product introductions and sales methods on the television screen, and users manually record information on sales methods based on the recorded information. I am making a purchase application using the telephone. On the other hand, in the encryption key system of the present invention, it is proposed to multiplex and transmit purchase order format and check format data in the scanning line of the vertical return period of analog television broadcasting or the sub-audio band of the audio band. To do. On the other hand, television images can be captured by a device called a personal computer television that integrates a personal computer and a television device, or a device that combines a video capture device realized as an IC card, a PC card, or an insertion board and a personal computer. It is done.

By combining these purchase order format, check format multiplex data, and a video capture device, it is possible to carry out TV shopping electronically. In this TV shopping, when the product introduction screen of the TV shopping is being broadcast, the purchase order format and the check format are data-multiplexed and broadcast in the scanning line of the vertical return period or the sub-audio band of the audio band. When the user operates while the introduction screen of the product to be purchased is displayed, the purchase order format and check format data are imported together with the still screen. The user fills in the required items in the imported purchase order format and check format, and makes a purchase application. At this time, in order to ensure the security of the transaction, the system described in the first to fifth embodiments performs encryption and digital signature by the public key method or the private key method. At this time, if the purchase application is made by attaching the still screen of the product introduction together with the purchase order and the check, the transaction contents can be confirmed.

As a simple method, the purchase order format and the check format may also be transmitted as a television image, and the necessary items may be filled in the purchase order format and the check format captured as a still screen. In addition, the purchase order format and the check format can also be transmitted by facsimile broadcasting that is multiplexed in the sub-audio band of the audio band.

By adopting such a method, it is possible to realize an electronic market using electronic information interchange (EDI) by television shopping even by the current analog television system.

These video-on-demand systems and pay-per-view systems are also applicable to digital television broadcasting other than analog television broadcasting. When a CATV line is used as a communication line, both broadcasting and data communication can be performed only by this CATV line.

In addition, these video-on-demand systems and pay-per-view systems are computer communication network systems that use low-speed general public lines or high-speed ISDN (Integrated Services Digital Network) lines, and Internet systems that connect multiple computer communication network systems. It is also applicable to the transmission and reception of high-quality audio data and video data performed in.

As the device to be used, a receiving device and a communication device can be incorporated in the television receiving device, but it can also be configured separately by using a set-top box or the like. In addition, a device called a personal computer TV that integrates a personal computer and a television device, which has been gradually becoming widespread recently, or a video capture device realized as an IC card, a PC card, or an insertion board that sends a television signal to the personal computer. It can also be configured in combination.

<figref num="1">The block diagram of the encryption key system of the prior invention.</figref><figref num="2">The block diagram of the encryption key system of 1st Embodiment of this invention.</figref><figref num="3">The block diagram of the encryption key system of 2nd Embodiment of this invention.</figref><figref num="4">The block diagram of the encryption key system of 3rd Example and 4th Example of the present invention.</figref><figref num="5">The block diagram of the 5th Example which applied the invention of this application.</figref>

Code description

1,11 Broadcasting station 2,12 database 3,13,23 Billing center 4,14,24,34 Receiver 5,15,25,35 Data communication equipment 6,16 radio waves 7,17,27,37,47 Communication line 8,18,28,38 User terminal device 21,31 CATV station 33 Management Center 41 artificial satellite 42 users 43 retail store 44 financial institution 45 wholesale store