System, apparatus, method and computer program for transferring content

• US 20070162753A1
• Filed: 12/28/2006
• Published: 07/12/2007
• Est. Priority Date: 01/11/2006
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Nakano, Takehiko, Shima, Hisato
• Granted Patent: US 8,074,290 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys

Abstract

A content transfer system for transferring content between a source device transmitting the content and a sink device receiving the content, includes a content specifying unit for specifying the content to be transferred between the source device and the sink device, an authentication unit for performing an authentication exchange key process between the source device and the sink device, a content transfer unit for performing a content transfer process by encrypting and transferring the content specified by the content specifying unit from the source device to the sink device using the key exchanged by the authentication unit, and a content transfer finalizing unit for performing a content transfer finalizing process by validating the content at the sink device and invalidating the original content at the source device in response to the end of the content transfer process performed by the content transfer unit, the content thus being moved from the source device to the sink device.

Claims

1. A content transfer system for transferring content between a source device transmitting the content and a sink device receiving the content, comprising:

content specifying means for specifying the content to be transferred between the source device and the sink device;

authentication means for performing an authentication exchange key process between the source device and the sink device;

content transfer means for performing a content transfer process by encrypting and transferring the content specified by the content specifying means from the source device to the sink device using a key exchanged by the authentication means; and

content transfer finalizing means for performing a content transfer finalizing process by validating the content at the sink device and invalidating the original content at the source device in response to the end of the content transfer process performed by the content transfer means, the content thus being moved from the source device to the sink device.

2. The content transfer system according to claim 1, wherein together with the authentication and key exchange process, the authentication means verifies a capability of each of the source device and the sink device as to whether both the source device and the sink device comply with the finalizing process of the content transfer finalizing means.

3. The content transfer system according to claim 1, wherein the content specifying means specifies the content using a content directory service (CDS) defined by universal play and plug (UPnP) standards, and

wherein the authentication means, the content transfer means, and the content transfer finalizing means perform the respective processes thereof using digital transmission content protection-Internet protocol (DTCP-IP).

4. The content transfer system according to claim 3, wherein the content is moved when the sink device operated by a user transfers the content in a download fashion from the source device functioning as a server providing the content.

5. The content transfer system according to claim 4, wherein the content specifying means at the sink device acquires socket information for authentication and key exchange of the content to be moved based on information contained in a CDS:

;

Browse response supplied from the source device in response to a CDS;

;

browse request and determines whether the content is movable from the source device.

6. The content transfer system according to claim 4, wherein the content transfer means at the sink device acquires the encrypted content from the source device using a hyper text transfer protocol (HTTP) get method with a header containing header information indicating movement of the content.

7. The content transfer system according to claim 1, wherein the source device operated by a user transfers the content in an upload fashion to the sink device operating as a server providing the content, thereby moving the content.

8. The content transfer system according to claim 7, wherein the content specifying means at the source device requests the sink device to produce a destination location of the content using a CDS:

;

CreateObject request, and receives a uniform resource identifier (URI) as a reply from the sink device in response to the request, and

wherein the content transfer means transmits the encrypted content from the source device to the URI received as the destination location of the content using a hyper text transfer protocol (HTTP) post method.

9. The content transfer system according to claim 8, wherein the content specifying means at the source device notifies the sink device of socket information for authentication and key exchange using the CDS:

;

CreateObject request, and

wherein the authentication means allows the sink device to establish a transmission control protocol (TCP) connection for authentication and key exchange based on the socket information.

10. The content transfer system according to claim 8, wherein the content specifying means at the source device notifies the URI of the content movement destination at the sink device, received in response to the CDS:

;

CreateObject request, of socket information for authentication and key exchange using header information of the HTTP post method (containing no content), and

wherein the authentication means allows the sink device to establish a TCP connection for authentication and key exchange based on the socket information.

11. The content transfer system according to claim 7, wherein the content transfer means at the source device transmits to the sink device the encrypted content using a hyper text transfer protocol (HTTP) post method with a header containing header information indicating movement of the content.

12. The content transfer system according to claim 2, wherein the authentication means exchanges a key dedicated to content movement in accordance with an authentication and key exchange (AKE) procedure on a per content basis of each content to be moved.

13. The content transfer system according to claim 12, wherein the authentication means destroys the exchange key dedicated to content movement at the source device and the sink device in response to the end of the content transfer finalizing process of the content transfer finalizing means.

14. The content transfer system according to claim 1, wherein while the content is being moved to the sink device, the source device rejects another sink device'"'"'s request to move the content.

15. The content transfer system according to claim 1, whereat the sink device comprises reproducing means for reproducing content that is being moved from the source device but not yet validated.

16. The content transfer system according to claim 2, further comprising content transfer canceling means for canceling the content transfer process using a transmission control protocol (TCP) connection for authentication and key exchange in response to a request from at least one of the sink device and the source device before the content transfer means completes the content transfer process, wherein the authentication means stores the TCP connection for authentication and key exchange until the content transfer means ends the content transfer process.

17. The content transfer system according to claim 16, wherein the content transfer canceling means invalidates the content transmitted to the sink device when canceling the content transfer process.

18. The content transfer system according to claim 1, further comprising content transfer process aborting means for aborting the content transfer process in response to a request from at least one of the sink device and the source device when communication is interrupted between the sink device and the source device before the content transfer means completes the content transfer process.

19. The content transfer system according to claim 1, wherein the content transfer finalizing means shifts the original content at the source device to an interim invalid state in response to a transmission of a first command indicating the end of content reception from the sink device to the source device,

validates the content, transmitted to the sink device, in response to a first response replied from the source device in response to the first command transmitted from the sink device, and destroys a key dedicated to content movement and information transmitted in the first command, each stored on the sink device,

invalidates the original content at the source device in response to a second command, transmitted from the sink device to the source device, the second command indicating validation of the content, and destroys the key dedicated to content movement and information in the first response, each stored on the source device.

20. The content transfer system according to claim 19, further comprising content transfer finalizing process resuming means for resuming the content transfer finalizing process if the process of the content transfer finalizing means is interrupted regardless of a successful ending of the content transfer performed by the content transfer means from the source device to the sink device.

21. The content transfer system according to claim 20, wherein the content transfer finalizing process resuming means shifts the original content at the source device to an interim invalid state and returns the first response from the source device to the sink device in response to the first command if the source device still stores the exchange key dedicated to content movement and the information transmitted in the first response when the source device receives the first command indicating the end of the content reception from the sink device.

22. The content transfer system according to claim 20, wherein the content transfer finalizing process resuming means invalidates the original content at the source device, destroys the key dedicated to the content movement and the information transmitted in the first response, stored on the source device, and returns a second response from the source device to the sink device in response to the second command, if the source device still stores the exchange key dedicated to content movement and the information transmitted in the first response when the source device receives the second command indicating the end of the content reception from the sink device.

23. The content transfer system according to claim 20, wherein the content transfer finalizing process resuming means establishes a connection to the source device as a source device of content if the sink device still stores the exchange key dedicated to the content movement and the information transmitted in the first command, transmits the first command to the source device if the corresponding content is in an invalid state at the sink device, and transmits the second command if the corresponding content is already validated at the sink device.

24. The content transfer system according to claim 20, wherein the content transfer finalizing process resuming means comprises means for establishing a connection between the sink device and the source device to resume the content transfer finalizing process.

25. The content transfer system according to claim 24, wherein when the content transfer finalizing process in a download fashion is resumed, the content transfer finalizing process resuming means at the sink device acquires socket information for authentication and key exchange based on information contained in a CDS:

;

Browse response from the source device responsive to a CDS;

;

Browse request, thereby establishing a connection with the source device.

26. The content transfer system according to claim 24, wherein when the content transfer finalizing process in an upload fashion is resumed, the content transfer finalizing process resuming means at the source device notifies the sink device of socket information for authentication and key exchange (containing no content) using an HTTP post method, thereby establishing a connection with the sink device.

27. The content transfer system according to claim 1, further comprising anti-spoofing means for preventing a move transfer acknowledged by the authentication means between the source device and the sink device from being spoofed.

28. The content transfer system according to claim 27, wherein the anti-spoofing means changes, from content transfer method to content transfer method, the method of generating a content encrypting key from the key exchanged by the authentication means.

29. The content transfer system according to claim 27, wherein the anti-spoofing means changes, from content transfer method to content transfer method, the method of scrambling the key exchanged by the authentication means.

30. The content transfer system according to claim 27, wherein the anti-spoofing means includes information, relating to a content transfer method, in a communication message from the sink device to the source device in a challenge-response procedure for authentication and key exchange.

31. A content transfer device functioning as a source device transmitting content in accordance with digital content transmission protection (DTCP) specification, comprising:

content specifying means for specifying the content to be transmitted to a sink device;

authentication means for performing an authentication and key exchange (AKE) process with the sink device in accordance with an AKE procedure;

content transfer means for performing a content transfer process by encrypting and transferring the content specified by the content specifying means to the sink device using a key exchanged by the authentication means; and

content transfer finalizing means for performing a content transfer finalizing process by invalidating the original content in response to the end of the content transfer process of the content transfer means, the content thus being moved to the sink device.

32. The content transfer device according to claim 31, wherein together with the authentication and key exchange process, the authentication means verifies a capability as to whether the sink device supports the content transfer finalizing means.

33. The content transfer device according to claim 31, wherein when the source device operating as a server providing the content downloads the content to the sink device in response to a user operation at the sink device, the content specifying means returns a CDS:

;

Browse response describing socket information for authentication and key exchange of each content and describing whether the content is movable from the source device, in response to a CDS;

;

Browse request from the sink device, and

wherein the content transfer means transmits the encrypted content using a hyper text transfer protocol (HTTP) get method with a header containing header information indicating movement of the content.

34. The content transfer device according to claim 31, wherein when the source device transfers the content in an upload fashion to the sink device in response to a user operation with the sink device operating as a server providing the content, the content specifying means requests the sink device to create a destination location of the content using a CDS:

;

CreateObject request, and receives a uniform resource identifier (URI) as a reply from the sink device in response to the request, and

wherein the content transfer means transmits the encrypted content to the URI received as the destination location of the content using a hyper text transfer protocol (HTTP) post method with a header containing header information indicating movement of the content.

35. The content transfer device according to claim 34, wherein the content specifying means notifies the sink device of socket information for authentication and key exchange using the CDS:

;

CreateObject request, and

wherein the authentication means allows the sink device to establish a transmission control protocol (TCP) connection for authentication and key exchange based on the socket information.

36. The content transfer device according to claim 34, wherein the content specifying means notifies the URI of the content movement destination at the sink device, received in response to the CDS:

;

CreateObject request, of socket information for authentication and the key exchange (containing no content) using the header information of the hyper text transfer protocol (HTTP) post method (containing no content); and

wherein the authentication means allows the sink device to establish a transmission control protocol (TCP) connection for authentication and key exchange using the HTTP post method based on the socket information.

37. The content transfer device according to claim 31, wherein the authentication means exchanges a key dedicated to content movement using an authentication and key exchange (AKE) procedure on a per content basis of each content moved to the sink device.

38. The content transfer device according to claim 31, wherein the authentication means destroys the exchange key dedicated to content movement in response to the end of the content transfer process of the content transfer means.

39. The content transfer device according to claim 31, wherein while the content is being moved to the sink device, the content transfer means rejects another sink device'"'"'s request to move the content.

40. The content transfer device according to claim 31, further comprising content transfer canceling means for canceling the content transfer process using a transmission control protocol (TCP) connection for authentication and key exchange before the content transfer means completes the content transfer process, wherein the authentication means stores the TCP connection for authentication and key exchange until the content transfer means ends the content transfer process.

41. The content transfer device according to claim 31, further comprising content transfer process aborting means for aborting the content transfer process when communication is interrupted between the sink device and the source device before the content transfer means completes the content transfer process.

42. The content transfer device according to claim 31, wherein the content transfer finalizing means shifts the original content to an interim invalid state in response to a reception of a first command indicating the end of content reception from the sink device and returns to the sink device a first response in response to the first command, and

invalidates the original content at the source device in response to a second command indicating content validation from the sink device.

43. The content transfer device according to claim 42, further comprising content transfer finalizing process resuming means for resuming the content transfer finalizing process if the process of the content transfer finalizing means is interrupted regardless of a successful ending of the content transfer performed by the content transfer means to the sink device.

44. The content transfer device according to claim 43, wherein the content transfer finalizing process resuming means shifts the original content to an interim invalid state and returns the first response to the sink device in response to the first command if the authentication means still stores the exchange key dedicated to content movement and the information transmitted in the first response when the source device receives the first command indicating the end of the content reception from the sink device.

45. The content transfer device according to claim 43, wherein the content transfer finalizing process resuming means invalidates the original content, destroys the key dedicated to content movement stored on the authentication means, and returns to the sink device a second response in response to the second command if the authentication means still stores the exchange key dedicated to content movement and the information transmitted in the first response when the source device receives the second command indicating the end of the content reception from the sink device.

46. The content transfer device according to claim 43, wherein the content transfer finalizing process resuming means comprises means for establishing a connection with the sink device to resume the content transfer finalizing process.

47. The content transfer device according to claim 46, wherein when the content transfer finalizing process in a download fashion is resumed, the content transfer finalizing process resuming means returns a CDS:

;

Browse response containing socket information for authentication and key exchange responsive to a CDS;

;

Browse request from the sink device, thereby establishing a connection with the sink device.

48. The content transfer device according to claim 46, wherein when the content transfer finalizing process in an upload fashion is resumed, the content transfer finalizing process resuming means notifies the sink device of socket information for authentication and key exchange using an hyper text transmission protocol (HTTP) post method, thereby establishing a connection with the sink device.

49. The content transfer device according to claim 31, further comprising anti-spoofing means for preventing a move transfer to the sink device acknowledged by the authentication means from being spoofed.

50. The content transfer device according to claim 49, wherein the anti-spoofing means changes, from content transfer method to content transfer method of device capability, the method of generating a content encrypting key from the key exchanged by the authentication means.

51. The content transfer device according to claim 49, wherein the anti-spoofing means changes, from content transfer method to content transfer method, the method of scrambling the key exchanged by the authentication means.

52. A content transfer device functioning as a sink device receiving content in accordance with digital transmission content protection (DTCP) specification, comprising:

content specifying means for specifying with a source device the content to be transferred;

authentication means for performing an authentication and key exchange (AKE) process with the source device in accordance with an AKE procedure;

content transfer means for performing a content transfer process by encrypting and transferring the content specified by the content specifying means from the source device using a key exchanged by the authentication means; and

content transfer finalizing means for performing a content transfer finalizing process by validating the received content in response to the end of the content transfer process of the content transfer means, the content thus being moved from the source device.

53. The content transfer device according to claim 52, wherein together with the authentication and key exchange process, the authentication means verifies a capability as to whether the sink device supports the content transfer finalizing means.

54. The content transfer device according to claim 52, wherein when the sink device transfers the content in a download fashion from the source device operating as a server providing the content in response to a user operation, the content specifying means transmits a CDS:

;

Browse response, acquires socket information for authentication and key exchange of the content to be moved, based on information contained in a CDS;

;

Browse response from the source device, and determines whether the content is movable from the source device, and

wherein the content transfer means acquires the encrypted content using a hyper text transfer protocol (HTTP) get method with a header containing header information indicating movement of the content.

55. The content transfer device according to claim 52, wherein when the sink device operating as a server providing the content transfer the content in an upload fashion from the source device in response to a user operation at the source device, the content specifying means creates a destination location of the content based on a CDS:

;

CreateObject request received from the source device, and

wherein the content transfer means receives the encrypted content using a hyper text transfer protocol (HTTP) post method with a header containing header information indicating movement of the content

56. The content transfer device according to claim 52, wherein the authentication means destroys the exchange key dedicated to content movement in response to the end of the content transfer process of the content transfer means.

57. The content transfer device according to claim 52, further comprising reproducing means for reproducing content that is being moved from the source device but not yet validated.

58. The content transfer device according to claim 52, further comprising content transfer canceling means for canceling the content transfer process using a transmission control protocol (TCP) connection for authentication and key exchange before the content transfer means completes the content transfer process.

59. The content transfer device according to claim 58, wherein the content transfer canceling means invalidates the content transferred from the source device when canceling the content transfer process.

60. The content transfer device according to claim 52, further comprising content transfer process aborting means for aborting the content transfer process when communication with the source device is interrupted before the content transfer means completes the content transfer process.

61. The content transfer device according to claim 52, wherein the content transfer finalizing means transmits to the source device a first command indicating the end of content reception, validates the content transmitted to the sink device in response to a first response transmitted in response to the first command from the source device to the sink device, and destroys a key dedicated to content movement and information transmitted in the first command, stored on the authentication means.

62. The content transfer device according to claim 61, further comprising content transfer finalizing process resuming means for resuming the content transfer finalizing process if the process of the content transfer finalizing means is interrupted regardless of a successful ending of the content transfer performed by the content transfer means with the source device.

63. The content transfer device according to claim 62, wherein the content transfer finalizing process resuming means establishes a connection with the source device if the authentication means still stores the exchange key dedicated to content movement and the information transmitted in the first command, transmits the first command to the source device if the corresponding content is in an invalid state, and transmits a second command if the corresponding content is validated at the sink device.

64. The content transfer device according to claim 62, wherein the content transfer finalizing process resuming means comprises means for establishing a connection with the source device to resume the content transfer finalizing process.

65. The content transfer device according to claim 64, wherein when the content transfer finalizing process in a download fashion is resumed, the content transfer finalizing process resuming means acquires socket information for authentication and key exchange based on information contained in a CDS:

;

Browse response from the source device responsive to a CDS;

;

Browse request, thereby establishing a connection with the source device.

66. The content transfer device according to claim 64, wherein when the content transfer finalizing process in an upload fashion is resumed, the content transfer finalizing process resuming means notifies the sink device of socket information for authentication and key exchange using an hyper text transmission protocol (HTTP) post method (containing no content), thereby establishing a connection with the source device.

67. The content transfer device according to claim 52, further comprising anti-spoofing means for preventing a move transfer from the source device acknowledged by the authentication means from being spoofed.

68. The content transfer device according to claim 67, wherein the anti-spoofing means includes information, relating to a content transfer method, in a communication message to the source device in a challenge-response procedure for authentication and key exchange.

69. A content transfer method of transmitting content from a DTCP source device, comprising steps of:

specifying the content to be transferred to a sink device;

performing an authentication and key exchange (AKE) process with the sink device in accordance with an AKE procedure;

performing a content transfer process by encrypting and transferring the specified content to the sink device using the exchanged key; and

performing a content transfer finalizing process by invalidating the original content in response to the end of the content transfer process, the content thus being moved to the sink device.

70. A content transfer method of receiving content at a DTCP sink device, comprising steps of:

specifying with a source device the content to be transferred;

performing an authentication and key exchange (AKE) process with the source device in accordance with an AKE procedure;

performing a content transfer process by encrypting and transferring the specified content from the source device using the exchanged key; and

performing a content transfer finalizing process by validating the received content in response to the end of the content transfer process, the content thus being moved from the source device.

71. A computer readable program for causing a computer system as a DTCP source device to transmit content, comprising steps of:

specifying the content to be transmitted to a sink device;

performing an authentication and key exchange (AKE) process with the sink device in accordance with an AKE procedure;

performing a content transfer process by encrypting and transferring the specified content to the sink device using the exchanged key; and

performing a content transfer finalizing process by invalidating the original content in response to the end of the content transfer process, the content thus being moved to the sink device.

72. A computer readable program for causing a computer system as a DTCP sink device to receive content, comprising steps of:

specifying with a source device the content to be transferred;

performing an authentication and key exchange (AKE) process with the source device in accordance with an AKE procedure;

performing a content transfer process by encrypting and transferring the specified content from the source device using the exchanged key; and

performing a content transfer finalizing process by validating the received content in response to the end of the content transfer process, the content thus being moved from the source device.

73. A content transfer system for transferring content between a source device transmitting the content and a sink device receiving the content, comprising:

a content specifying unit specifying the content to be transferred between the source device and the sink device;

an authentication unit performing an authentication exchange key process between the source device and the sink device;

a content transfer unit performing a content transfer process by encrypting and transferring the content specified by the content specifying unit from the source device to the sink device using a key exchanged by the authentication unit; and

a content transfer unit performing a content transfer process by encrypting and transferring the content specified by the content specifying unit from the source device to the sink device using a key exchanged by the authentication unit; and

a content transfer finalizing unit performing a content transfer finalizing process by validating the content at the sink device and invalidating the original content at the source device in response to the end of the content transfer process performed by the content transfer unit, the content thus being moved from the source device to the sink device.

74. A content transfer device functioning as a source device transmitting content in accordance with DTCP, comprising:

a content specifying unit specifying the content to be transmitted to a sink device;

an authentication unit performing an authentication and key exchange process (AKE) with the sink device in accordance with an AKE procedure;

a content transfer unit performing a content transfer process by encrypting and transferring the content specified by the content specifying unit to the sink device using a key exchanged by the authentication unit; and

a content transfer finalizing unit performing a content transfer finalizing process by invalidating the original content in response to the end of the content transfer process of the content transfer unit, the content thus being moved to the sink device.

75. A content transfer device functioning as a sink device receiving content in accordance with DTCP, comprising:

a content specifying unit specifying with a source device the content to be transferred;

an authentication unit performing an authentication and key exchange (AKE) process with the source device in accordance with an AKE procedure;

a content transfer unit performing a content transfer process by encrypting and transferring the content specified by the content specifying unit from the source device using a key exchanged by the authentication unit; and

a content transfer finalizing unit performing a content transfer finalizing process by validating the received content in response to the end of the content transfer process of the content transfer unit, the content thus being moved from the sink device.