Content management method, and content storage system

• US 7,506,367 B1
• Filed: 09/15/1999
• Issued: 03/17/2009
• Est. Priority Date: 09/17/1998
• Status: Expired due to Fees

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Ishibashi, Yoshihito
• Primary Examiner(s): Popovici; Dov
• Assistant Examiner(s): ABEL JALIL, NEVEEN
• Application Number:
  US09/396,054
• Time in Patent Office: 3,471 Days
• Field of Search: 380/4, 380/23, 380/25, 380/30, 380/42, 713/164, 713/165, 713/183, 713/189, 713/193, 713/201, 713/159, 713/163, 340/5.28, 705/53, 705/64, 705 51- 52
• US Class Current: 726/10
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A content management method and content storage system are provided in which a content key encrypted with a first storage key and stored along with a content encrypted with the content key in a first content storing means is decrypted with the first storage key, the content key obtained by the above decryption is encrypted with a newly generated second storage key and stored along with the encrypted content in a second content storing means. Thus, the content management method enables to safely duplicate (back up) a content while preventing the content from being copied fraudulently.

Claims

1. A content management method for managing content data provided to user equipment, comprising the steps of:

storing a content key encrypted with a first storage key, content data encrypted with the content key, and a second storage key in the user equipment, wherein the second storage key, is encrypted with a public key for a key management unit for management of the storage keys to generate a third storage key and the third storage key is stored in the user equipment;

sending the encrypted content key and the second storage key to the key management unit;

at the key management unit, decrypting the encrypted content key using the first storage key, the first storage key being stored in the key management unit;

encrypting the decrypted content key using the second storage key;

sending the content key encrypted with the second storage key to the user equipment; and

at the user equipment, decrypting the encrypted content key using the second storage key and decrypting the content data using the decrypted content key.

2. The method as set forth in claim 1, wherein the second storage key is generated based on a random number.

3. The method as set forth in claim 1, wherein the decrypted content key is encrypted with identification information of the user equipment and stored into the user equipment.

4. The method as set forth in claim 1, wherein the content key is encrypted, in the user equipment, with the first storage key and identification information of the user equipment, and the content key stored in the user equipment is decrypted with the first storage key and the identification information of the user equipment.

5. The method as set forth in claim 1, wherein the second storage key is generated by a decrypted key generating means provided in the user equipment.

6. The method as set forth in claim 1, wherein the user equipment deletes the second storage key depending upon whether the third storage key has been stored in the user equipment.

7. The method as set forth in claim 6, wherein, when decrypting the content key stored in the user equipment, the user equipment sends the third storage key to the key management unit;

and the key management unit generates the second storage key based on the third storage key while performing an accounting following a predetermined procedure.

13. The method as set forth in claim 1, wherein the user equipment has stored therein identification information of the user equipment.

14. The method as set forth in claim 13, wherein the user equipment starts decrypting the content key stored in the user equipment depending upon the result of an inspection of the identification information of the user equipment, stored in the user equipment.

15. The method as set forth in claim 1, wherein the decrypted content key supplied from the user equipment has added thereto information that the content key has been obtained by restoration.

16. The method as set forth in claim 15, wherein when moving the content key having added thereto the information that the content key has been obtained by restoration, the user equipment performs an error process based on the result of comparison between the content key and another content key stored in a destination to which the content key is to be moved.

17. The method as set forth in claim 1, wherein the content key has added thereto frequency information that limits the number of times the content key can be used.

8. A content management method for managing content data provided to user equipment, comprising the step of:

storing a content key encrypted with a first storage key, content data encrypted with the content key, and a second storage key in the user equipment, wherein the second storage key is generated by a storage key generating means provided in a key management unit which manages the storage keys;

sending the encrypted content key and the second storage key to the key management unit, wherein the key management unit has stored therein the second storage key and identification information of the user equipment in which the content key encrypted with the generated second storage key is stored;

at the key management unit, decrypting the encrypted content key using the first storage key, the first storage key being stored in the key management unit;

encrypting the decrypted content key using the second storage key;

sending the content key encrypted with the second storage key to the user equipment; and

at the user equipment, decrypting the encrypted content key using the second storage key and decrypting the content data using the decrypted content key.

9. The method as set forth in claim 8, wherein upon the generation of the second storage key, the key management unit performs an accounting following a predetermined procedure.

10. The method as set forth in claim 8, wherein the key management unit encrypts the second storage key with the management key to generate a third storage key, and sends the third storage key to the user equipment;

and the user equipment stores the received third storage key.

11. The method as set forth in claim 10, wherein the user equipment deletes the second storage key depending upon whether the third storage key has been stored.

12. The method as set forth in claim 11, wherein the key management unit has stored therein the identification information of the user equipment in which the content key encrypted with the second storage key is stored;

the user equipment sends, when decrypting the content key stored in the user equipment, the identification information of the user equipment to the key management unit; and

the key management unit generates the second storage key based on the result of comparison between identification information of the user equipment, sent from the user equipment, and the identification information of the user equipment, held in the key management unit itself, while accounting the data service following the predetermined procedure.

18. The method as set forth in claim 8, further comprising storing the content key encrypted with the second storage key in a first storage of the user equipment along with identification information of the first storage;

storing the content key that is stored in the first storage, and the identification information of the first storage, into a second storage of the user equipment; and

performing, when a request is made to decrypt the content key in the first storage, an error process based on the result of comparison between the identification information of the first storage and the identification information of the second storage.

19. A content management system for managing content data, comprising:

a storing means having stored therein a content key encrypted with a first storage key, content data encrypted with the content key, and a second storage key;

a sending means for sending the encrypted content key and the second storage key to a key management unit;

a first decrypting means, in the key management unit, for decrypting the encrypted content key using the first storage key, the first storage key being stored in the key management unit;

an encrypting means for encrypting the decrypted content key using the second storage key;

a second decrypting means for decrypting the encrypted content key using the second storage key and decrypting the content data using the decrypted content key; and

means for storing a public key of the key management unit;

wherein the storing means has stored therein the second storage key along with a third storage key obtained by encrypting the second storage key with the public key.

20. The system as set forth in claim 19, further comprising storage key generating means for generating the second storage key by means of a random number generator.

21. The system as set forth in claim 19, wherein the encrypting means encrypts the decrypted content key with identification information of the storing means.

22. The system as set forth in claim 19, wherein the content key is encrypted, in the storing means, with the first storage key and identification information of the storing means;

and the content key stored in the storing means is decrypted with the first storage key and the identification information of the storing means.

23. The system as set forth in claim 19, wherein the storing means, first decrypting means and encrypting means form together a data storage, and wherein the key management unit manages the second storage key of the data storage.

24. The system as set forth in claim 23, wherein the data storage is a data receiver that receives a content data encrypted and sent from a data transmitter.

25. The system as set forth in claim 19, wherein the data storage deletes the second storage key depending upon whether the third storage key is stored in the storing means.

26. The system as set forth in claim 25, wherein, when decrypting the content key stored in the storing means, the data storage sends the third storage key to the key management unit;

and the key management unit sends the second storage key generated based on the third storage key to a data transmitter while performing an accounting following a predetermined procedure.

27. The system as set forth in claim 23, wherein the storing means has stored therein identification information of the data storage.

28. The system as set forth in claim 27, wherein the data storage starts decrypting the content key stored in the storing means depending on the result of inspection of the identification information of the data storage, stored in the storing means.

29. The system as set forth in claim 19, wherein the storing means, first decrypting means, and encrypting means form together a data storage;

and further comprising a storage key generating means, wherein the key management unit manages the second storage key of the data storage.

30. The system as set forth in claim 29, wherein the data storage is a data receiver that receives a content data encrypted and sent from a data transmitter.

31. The system as set forth in claim 29, wherein the key management unit comprises an identification information storing means in which identification Information of the storing means is stored.

32. The system as set forth in claim 29, wherein the key management unit performs an accounting following a predetermined procedure depending upon a generation of the second storage key.

33. The system as set forth in claim 29, wherein the key management unit comprises means for storing storage keys;

the key management unit generates a third storage key by encrypting the second storage key with a management key and sends the third storage key to the data storage; and

the data storage stores the third storage key into the storing means.

34. The system as set forth in claim 33, wherein the data storage deletes the second storage key depending upon whether the third storage key is stored in the storing means.

35. The system as set forth in claim 34, wherein the key management unit comprises means for storing the second storage key and identification information of the storing means in which the content key encrypted with the second storage key is stored;

the key management unit performs an accounting when the data storage decrypts the content keys following a predetermined procedure based on the result of comparison between the identification information of the storing means, sent from the data storages and identification information stored in an identification information storing means.

36. The system as set forth in claim 29, wherein the storing means has stored therein identification information of the data storage.

37. The system as set forth in claim 36, wherein the data storage starts decrypting the content key stored in the storing means.

38. The system as set forth in claim 19, wherein the content key obtained by decryption from the storing means has added thereto information that the content key has been obtained by restoration, as requirement information.

39. The system as set forth in claim 19, wherein the content key has added thereto frequency information that limits the number of times the content key can be used.