Streaming system for distributing encrypted data, and streaming method therefor

• US 7,337,320 B2
• Filed: 01/28/2003
• Issued: 02/26/2008
• Est. Priority Date: 01/31/2002
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Ishiguro, Ryuji, Futagami, Motomasa, Tada, Keiko
• Primary Examiner(s): Peeso; Thomas R.
• Application Number:
  US10/473,436
• Publication Number:
  US 20040156508A1
• Time in Patent Office: 1,855 Days
• Field of Search: 713/171, 713/168, 713/189
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/764 at the destination reformatting of additional data in video clients H04N21/4355
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

The present invention is directed to a streaming system for encrypting encrypted data such as music and image, etc. to perform stream distribution thereof. Client terminals (30) used in this system structure leaves of the hierarchical tree structure, and hold a key set consisting of a route key, node keys and the own leaf key on a path of this tree structure, whereby SDP file is transmitted from a stream server (20). In the SDP file, there is stored encrypted information consisting of EKB including data encrypted by selection key that only specific client terminal holds and encrypted contents key data in which contents key has been encrypted. Only specific client terminal having selection key in key set (selected client terminal) decodes contents key from selection key to decode encrypted contents data caused to undergo stream distribution into contents data to perform real time reproduction thereof.

Claims

1. A client terminal including:

receiving means for receiving, from a stream server, decoding information for decoding encrypted contents data, wherein the contents data has been encrypted by a contents key;

stream receiving means for receiving the encrypted contents data that has undergone stream distribution from the stream server; and

decode means for performing decode processing using decoding information,

wherein the decoding information includes encrypted contents key data in which the contents key for decoding the encrypted contents data has been encrypted.

2. The client terminal as set forth in claim 1,

wherein the decoding information includes encrypted decode key data in which decode key for decoding the encrypted contents key data into the contents key has been encrypted.

3. The client terminal as set forth in claim 2,

wherein the client terminals are structured as leaves of a hierarchical tree structure, and each of the client terminals holds a key set in a key tree comprising a specific leaf key, node keys and a route key corresponding to leaves, nodes and a route along a path of the hierarchical tree structure,

wherein the encrypted decode key data is stored in an Effective Key Block (EKB),

wherein the Effective Key Block (EKB) includes data portion in which the encrypted decode key data is encrypted by a selection key which is either one of the route key, the node keys and the leaf keys, and a tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the decode means comprises a first decode means for decoding the decode key by the selection key on the basis of information from the tag portion that identifies either one of the key sets, a second decode means for decoding the contents key from the encrypted contents key data which is encrypted by the decode key, and a third decode means for decoding the contents data from the encrypted contents data which is encrypted by the contents key.

4. The client terminal as set forth in claim 3,

wherein the route and the route key are respectively a root node and a root node key specific to the root node when a single node of the hierarchical tree structure is the root.

5. The client terminal as set forth in claim 3,

wherein the decode key is an updated route key or an updated node key in which the route key and/or the node keys of the key set have been updated by decode processing using the Effective Key Block (EKB) by the first decode means.

6. The client terminal as set forth in claim 1,

wherein the decoding information is stored within a Session Description Protocol (SDP) file received from the stream server prior to the stream reception.

7. A contents data decoding method including:

receiving, from a stream server, decoding information for decoding encrypted contents data, wherein the contents data has been encrypted by a contents key;

receiving the encrypted contents data that has undergone stream distribution from the stream server; and

performing decode processing using decoding information,

wherein the decoding information includes encrypted contents key data in which the contents key for decoding the encrypted contents data has been encrypted.

8. The contents data decoding method as set forth in claim 7,

wherein the decoding information includes encrypted decode key data in which decode key for decoding the encrypted contents data into the contents key has been encrypted.

9. The contents data decoding method as set forth in claim 8,

wherein the encrypted decode key data is stored in an Effective Key Block (EKB),

wherein the Effective Key Block (EKB) includes data portion for storing the encrypted decode key data encrypted by a selection key which is either one of a route key, node keys and leaf keys which are respectively specific to the route, nodes and leaves of the hierarchical tree structure, and tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the decode processing includes:

decoding the decode key by the selection key on the basis of information from the tag portion that identifies either one of key sets each comprising a specific leaf key that a client terminal structured as leaf of the hierarchical tree structure has, node keys and a route key on a path to the route in a key tree comprising the route key, node keys and leaf keys which are specific to the route, nodes and leaves of the hierarchical tree structure,

decoding the contents key from the encrypted contents key data which is encrypted by the decode key, and

decoding the contents data from the encrypted contents data which is encrypted by the contents key.

10. The contents data decoding method as set forth in claim 7,

wherein the decoding information is stored in a Session Description Protocol (SDP) file received from the stream server prior to the stream reception.

11. A data distribution method including:

transmitting decoding information to client terminal terminals; and

performing stream distribution of encrypted contents data to the client terminals, wherein the contents data has been encrypted by a contents key,

wherein decoding information includes encrypted contents key data in which the contents key for decoding the encrypted contents data into the contents data has been encrypted.

12. The data distribution method as set forth in claim 11,

wherein the decoding information includes encrypted decode key data in which decode key for decoding the encrypted contents data into the contents key has been encrypted.

13. The data distribution method as set forth in claim 12, further comprising,

receiving streaming distribution data prepared so that additional information is added to the encrypted contents data including an Effective Key Block (EKB) in which the encrypted decode key data has been stored and a Session Description Protocol (SDP) file in which the encrypted contents key data has been stored,

wherein the transmitting step of transmitting the decoding information is a step of transmitting the Session Description Protocol (SDP) file prior to the stream distribution,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf keys which are specific to the route, nodes and the leaves of a hierarchical tree structure in which a plurality of client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes data portion in which the encrypted decode key data has been stored, and tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information from the tag portion by either one of keys included in a key set of one or more selection client selected from the plurality of client terminals.

14. The data distribution method as set forth in claim 11,

wherein the decoding information is stored within a Session Description Protocol (SDP) transmitted prior to stream distribution of the encrypted contents data.

15. The data distribution method as set forth in claim 12, further comprising:

receiving streaming distribution data prepared so that additional information including a Session Description Protocol (SDP) file is added to the encrypted contents data, and

supplementing an Effective Key Block (EKB) in which the encrypted decode key data has been stored wirth the encrypted contents key data, to the Session Description Protocol (SDP) file,

wherein the step of transmitting decoding information includes transmitting the Session Description Protocol (SDP) file to which the Effective Key Block (EKB) and the encrypted contents key data have been supplemented prior to the stream distribution,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf key which are specific to the route, nodes and leaves of the hierarchical tree structure in which a plurality of client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes a data portion in which the encrypted decode key data has been stored, and a tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information of the tag portion by either one of keys included in a key set of one or more selection client terminals selected from the plurality of client terminals.

16. A stream server including:

transmitting means for transmitting decoding information to client terminals; and

distribution means for performing stream distribution of encrypted contents data to the client terminals, wherein the contents data has been encrypted by a contents key,

wherein decoding information includes encrypted contents key data in which the contents key for decoding the encrypted contents data into the contents data has been encrypted.

17. The stream server as set forth in claim 16,

wherein the decoding information includes encrypted decode key data in which decode key for decoding the encrypted contents data into the contents key has been encrypted.

18. The stream server as set forth in claim 17,

wherein there is delivered streaming distribution data prepared so that additional information is added to the encrypted contents data including an Effective Key Block (EKB) in which the encrypted decode key data has been stored and a Session Description Protocol (SDP) file in which the encrypted contents key data has been stored,

wherein transmitting means which transmits the decoding information serves to transmit the Session Description Protocol (SDP) file prior to the stream distribution,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf keys which are specific to the route, nodes and the leaves of a hierarchical tree structure in which a plurality of client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes data portion in which the encrypted decode key data has been stored, and tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information from the tag portion by either one of keys included in a key set of one or more selection client terminals selected from the plurality of client terminals.

19. The stream server as set forth in claim 18,

wherein the route and the route key are respectively a root node and a root node key specific to the summit node when a single node of the hierarchical tree structure is the root.

20. The stream server as set forth in claim 18,

wherein the decode key is an updated route key or an updated node key in which the route key and/or the node keys of the key set have been updated by decode processing using the Effective Key Block (EKB) by the first decode means.

21. The stream server as set forth in claim 16,

wherein the decoding information is stored in a Session Description Protocol (SDP) file transmitted before the enciphered contents data is caused to undergo stream distribution.

22. The stream server as set forth in claim 17,

wherein there is delivered streaming distribution data prepared so that additional information including a Session Description Protocol (SDP) file is added to the encrypted contents data,

the stream server including

data supplement means for supplementing an Effective Key Block (EKB) within which the encrypted decode key data has been stored with the encrypted contents key data, to the Session Description Protocol (SDP) file,

wherein transmitting means which transmits the decoding information serves to transmit the Session Description Protocol (SDP) file to which the Effective Key Block (EKB) and the encrypted contents data have been supplemented by the data supplement means prior to the stream distribution,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf keys which are respectively specific to the route, nodes and leaves of the hierarchical tree structure in which a plurality of client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes data portion in which the encrypted decode key data has been stored, and tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information of the tag portion by either one of keys included in a key set of one or more selection client terminal selected from the plurality of client terminals.

23. The stream server as set forth in claim 22,

wherein the route and the route key are respectively a root node and a root node key specific to the summit node when a signal node of the hierarchical tree structure is the root.

24. The stream server as set forth in claim 22,

wherein the decode key is an updated route key or an updated node key in which the route key and/or the node keys of the key set have been updated by decode processing using the Effective Key Block (EKB) by the first decode means.

25. An authoring apparatus including:

file preparation means for adding decoding information for decoding encrypted contents data to the encrypted contents data to prepare stream distribution data used when a stream server performs stream distribution,

wherein the encrypted contents data comprises contents data encrypted by a contents key,

wherein the decoding information includes encrypted contents key data in which the contents key has been encrypted.

26. The authoring apparatus as set forth in claim 25,

wherein the decoding information includes encrypted decode key data in which a decode key for decoding the encrypted contents data into the contents key has been encrypted.

27. The authoring apparatus as set forth in claim 26,

wherein the file preparation means adds additional information including an Effective Key Block (EKB) in which the decoding key data has been stored and a Session Description Protocol (SDP) file in which the encrypted contents key data has been stored to the encrypted contents data to prepare streaming distribution data when the stream server performs stream distribution of contents data utilizable only at one or more selection client terminals selected from a plurality of different client terminals,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf keys which are respectively specific to the route, nodes and leaves of a hierarchical tree structure in which the plurality of client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes a data portion which stores the encrypted decode key data in which the decode key for decoding the encrypted contents key data has been encrypted, and a tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information from the tag portion by either one of the keys included in a key set that the selection client terminal has.

28. The authoring apparatus as set forth in claim 27,

wherein the route and the route key are respectively a root node and a root node key specific to the root node when a single node of the hierarchical tree structure is the root.

29. The authoring apparatus as set forth in claim 27,

wherein the decode key is an updated route key or an updated node key in which the route key and/or the node keys of the key set have been updated by decode processing using the Effective Key Block (EKB) by the first decode means.

30. The authoring apparatus as set forth in claim 25,

wherein the stream distribution data includes a Session Description Protocol (SDP) file, and

wherein the decoding information is stored in the Session Description Protocol (SDP) file.

31. An authoring method including:

preparing stream distribution data used when a stream server performs stream distribution, wherein decoding information for decoding encrypted contents data is added to the encrypted contents data, and further wherein the encrypted contents data comprises contents data that has been encrypted by a contents key, and

wherein the decoding information includes encrypted contents key data in which the contents key has been encrypted.

32. The authoring method as set forth in claim 31,

wherein the decoding information includes encrypted decode key data in which decode key for decoding the encrypted contents key data into the contents key has been encrypted.

33. The authoring method as set forth in claim 32,

further comprising adding additional information including an Effective Key Block (EKB) in which decoding key data has been stored and a Session Description Protocol (SOP) file in which the encrypted contents key data has been stored to the encrypted contents data to prepare streaming distribution data used when the stream server performs stream distribution of contents data utilizable at one or more selection client terminals selected from different client terminals,

wherein the client terminal holds a key set comprising keys on a path to the route in a key tree comprising a route key, node keys and leaf keys which are respectively specific to the route, nodes and leaves of a hierarchical tree structure in which the client terminals are structured as leaves,

wherein the Effective Key Block (EKB) includes a data portion in which the encrypted decode key data has been stored, and a tag portion for identifying the position of the encrypted decode key data in the hierarchical tree structure, and

wherein the encrypted decode key data can be decoded into the decode key on the basis of information from the tag portion by either one of the keys included in a key set that the selection client terminal has.

34. The authoring method as set forth in claim 31,

wherein the stream distribution data includes a Session Description Protocol (SDP) file, and

wherein the decoding information is stored in the Session Description Protocol (SDP) file.