Information processing system and method

• US 20070098177A1
• Filed: 12/15/2006
• Published: 05/03/2007
• Est. Priority Date: 12/26/2000
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Asano, Tomoyuki, Oishi, Tateo, Osawa, Yoshitomo, Ishiguro, Ryuji, Taki, Ryuta
• Granted Patent: US 7,738,662 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00855 involving a step of exchanging information with a remote server
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

An information processing system and method are disclosed in which information processing is performed in a highly efficient manner using an enabling key block (EKB) on the basis of a tree structure including category subtrees. A key tree is produced so as to include a plurality of subtrees that are grouped in accordance with categories and managed by category entities. An EKB is produced so as to include data produced by selecting a path in the key tree and encrypting an upper-level key in the selected path using a lower-level key in the selected path. The resultant EKB is provided to a device. If a change occurs in state of a category tree capable of processing an EKB identified in the EKB type definition list, a notification of the change in state is sent to an entity that uses the EKB thereby making it possible for an EKB requester to perform processing in accordance with a newest EKB.

Claims

1. An information processing system, comprising:

a plurality of category entities;

a key tree including a plurality of leaves, a root, a plurality of nodes existing in paths from the plurality of leaves to the root, and a plurality of sub-trees serving as category trees grouped in accordance with categories and managed by the plurality of category entities;

a plurality of devices assigned to at least some of the leaves;

a plurality of keys assigned to the root, to at least some of the leaves and to at least some of the nodes;

an enabling key block (EKB) including encrypted data, the encrypted data being produced by selecting one of the paths in the key tree and encrypting an upper-level key in the selected path using a lower-level key in the selected path such that the encrypted data can be decrypted only by a selected one of the plurality of devices which can use a node key set corresponding to the selected path, the EKB being provided to the selected device and being capable of being decrypted in common in at least one of the category trees; and

a key distribution center (KDC) adapted to produce and issue the EKB, the KDC having an EKB type definition list representing a correspondence between an EKB type identifier and identification data for identifying at least one of the category trees that can process EKB having a particular EKB type identified by the EKB type identifier;

wherein the KDC is operable to send a notification of a change in state of a selected one of the category trees which is capable of processing the particular EKB to a selected one of the category entities that uses the particular EKB.

2. An information processing system according to claim 1, wherein the change in state arises from a revocation of one of the devices in the selected category tree.

3. An information processing system according to claim 1, wherein the change in state arises from a change of a key stored in a specific one of the plurality of devices that belongs to the selected category tree.

4. An information processing system according to claim 1, wherein the selected category entity includes an EKB requester that issues an EKB production request to the KDC.

5. An information processing system according to claim 1, wherein the selected category entity manages one of the category trees that is capable of processing the particular EKB.

6. An information processing system according to claim 1, wherein the KDC is adapted to send the notification of the change in state to all of the category entities that issue an EKB production request to the KDC or that manage one of the category trees.

7. An information processing system according to claim 1, wherein the KDC is adapted to receive state change information indicating a change in state of a specific one of the category trees from a specific one of the category entities that manages the specific category tree, to produce the notification of the change in state in accordance with the state change information, and to send the notification.

8. An information processing method for use in a system having a key tree including a plurality of leaves, a root, and a plurality of nodes existing in paths from the plurality of leaves to the root, the method comprising:

assigning a plurality of devices to at least some of the leaves;

assigning a plurality of keys to the root, to at least some of the leaves, and to at least some of the nodes;

producing an enabling key block (EKB), the EKB including encrypted data produced by selecting one of the paths in the key tree and encrypting an upper-level key in the selected path using a lower-level key in the selected path such that the encrypted data can be decrypted only by a selected one of the plurality of devices which can use a node key set corresponding to the selected path;

providing the EKB to the selected device;

generating an EKB type definition list representing a correspondence between an EKB type identifier and identification data; and

sending a notification from a key distribution center (KDC) of a change in state of a selected one of a plurality of category trees to an entity that uses the EKB, the selected category tree being capable of processing the EKB based upon the EKB type definition list.

9. An information processing method according to claim 8, wherein the change in state arises from a revocation of one of the devices in the selected category tree.

10. An information processing method according to claim 8, wherein the change in state arises from a change of a key stored in a specific one of the plurality of devices which belongs to the selected category tree.

11. An information processing method according to claim 8, wherein the entity includes an EKB requester that issues an EKB production request to the KDC.

12. An information processing method according to claim 8, wherein the entity includes a selected category entity that manages the selected category tree capable of processing the EKB defined in the EKB type definition list.

13. An information processing method according to claim 8, wherein the entity comprises a plurality of entities and the KDC sends the notification of the change in state to all of the entities that issue an EKB production request to the KDC or that manage one of the category trees.

14. An information processing method according to claim 8, further comprising:

receiving state change information indicating a change in state of a specific one of the category trees from a category entity that manages the specific category tree; and

producing the notification of the change in state in accordance with the state change information.

15. A recording medium recorded with a computer program for executing an information processing method in an information processing system having a key tree that includes a plurality of leaves, a root, and a plurality of nodes existing in paths from the plurality of leaves to the root, the information processing method comprising:

receiving state change information indicating a change in state of a category tree from a category entity that manages the category tree;

producing a notification of the change in state in accordance with the state change information received from the category entity; and

sending the notification to an entity that uses an enabling key block (EKB) that is capable of being processed in the category tree.