Authentication and encryption utilizing command identifiers

• US 7,669,052 B2
• Filed: 12/20/2006
• Issued: 02/23/2010
• Est. Priority Date: 01/21/2000
• Status: Expired due to Fees

• Current Assignee: Sony Computer Entertainment Incorporated (Sony Group Corp.)
• Original Assignee: Sony Computer Entertainment Incorporated (Sony Group Corp.), Sony Corporation (Sony Group Corp.)
• Inventors: Asano, Tomoyuki, Tanaka, Makoto, Ishibashi, Yoshihito, Akishita, Toru, Shirai, Taizo, Yoshimori, Masaharu
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Gee; Jason K
• Application Number:
  US11/642,704
• Publication Number:
  US 20100005301A1
• Time in Patent Office: 1,161 Days
• Field of Search: 713/167, 713/171, 713/160
• US Class Current: 713/167
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00123 the record carrier being identified by recognising some of its unique characteristics, e.g. a unique defect pattern serving as a physical signature of the record carrier
• CPC Class Codes: G11B 20/00173 wherein the origin of the content is checked, e.g. determining whether the content has originally been retrieved from a legal disc copy or another trusted source
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00224 wherein the key is obtained from a remote server
• CPC Class Codes: G11B 20/00246 wherein the key is obtained from a local device, e.g. device key initially stored by the player or by the recorder
• CPC Class Codes: G11B 20/00492 wherein content or user data is encrypted
• CPC Class Codes: G11B 20/00507 wherein consecutive physical data units of the record carrier are encrypted with separate encryption keys, e.g. the key changes on a cluster or sector basis
• CPC Class Codes: G11B 20/00536 wherein encrypted content data is subjected to a further, iterated encryption, e.g. interwoven encryption
• CPC Class Codes: G11B 20/00557 wherein further management data is encrypted, e.g. sector headers, TOC or the lead-in or lead-out areas
• CPC Class Codes: G11B 20/00739 wherein the usage restriction is associated with a specific geographical region
• CPC Class Codes: G11B 20/00753 wherein the usage restriction limits the number of copies that can be made, e.g. CGMS, SCMS, or CCI flags
• CPC Class Codes: G11B 20/00775 wherein said copy control information is encoded in an encryption mode indicator [EMI]
• CPC Class Codes: G11B 2020/00057 MPEG-1 or MPEG-2 audio layer III [MP3]
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0897 : involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 : involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A data processing system, recording device, data processing method and program providing medium are provided to execute authentication processing and content storing processing between apparatuses. Program localization is employed to restrict access to program content. A plurality of key blocks store key data for authentication processing. Key block designation information is set in a recorder/reproducer, which is configured for executing authentication processing with the recording device by designating a key block. The recorder/reproducer can set a key block for each product, model or the like. In addition, data stored according to a selected key block cannot be utilized in a recorder/reproducer in which a different key block is set. Furthermore, an encryption processing controlling section of a recording device executes control in accordance with a pre-defined setting sequence. Furthermore, an illegal instrument that has not completed the authentication processing can be prevented from utilizing program content.

Claims

1. A data processing system operable to transmit encryption data, said data processing system comprising:

a first apparatus having a command identifier; and

a second apparatus having an encryption processing section for executing encryption processing on data transmitted to and from said first apparatus, said encryption processing section including a control section operable to receive said command identifier in accordance with a pre-defined setting sequence, to retrieve a command from a register, said command corresponding to said command identifier, and to have said command executed,

wherein, if said command identifier differs from said predefined setting sequence, said control section is operable to cancel execution of said command, said pre-defined setting sequence is a command number setting sequence in which numbers are sequentially incremented, and said control section is operable to store a value of said command identifier received from said first apparatus in a memory, to compare a new command identifier received from said first apparatus with said pre-defined setting sequence based on said received value stored in said memory and, if said new command identifier is different from said pre-defined setting sequence, to reset said command identifier stored in said memory without performing command processing corresponding to said new command identifier.

2. The data processing system according to claim 1, further comprising:

a command register within said second apparatus for storing said command in accordance with said pre-defined setting sequence;

an authentication processing command sequence for executing authentication processing between said first apparatus and said second apparatus;

an encryption processing command sequence for executing said encryption processing; and

a sequence set such that an authentication command identifier corresponding to said authentication processing command sequence is executed prior to a command sequence corresponding to said encryption processing command sequence.

3. The data processing system according to claim 2, wherein said encryption processing command sequence includes encryption key exchange processing for encryption data stored in a storage unit in said second apparatus.

4. The data processing system according to claim 2, wherein:

if authentication is established between said first apparatus and said second apparatus, said control section is operable to;

(i) set an authentication flag indicating that said authentication processing is finished,

(ii) execute command management control to enable execution of said encryption processing command sequence during setting of said authentication flag, and

(iii) reset said authentication flag when repeating said authentication processing command sequence.

5. The data processing system according to claim 3, wherein:

said control section is operable to manage an order of command execution based on said pre-defined setting sequence and said command identifier in said encryption key exchange processing; and

said control section does not accept command processing from an external apparatus, including said first apparatus during command execution relating to said encryption key exchange processing, when said command processing is different from said pre-defined setting sequence.

6. The data processing system according to claim 1, wherein:

said second apparatus is a storage device having a data storage section for storing said encryption data;

said first apparatus is a recorder/reproducer for storing data in said storage device, and for retrieving said data stored in said storage device to reproduce and execute said data; and

said recorder/reproducer includes an encryption processing section for executing said encryption processing of transmitted data with said storage device.

7. The data processing system according to claim 6, wherein:

said storage device includes a key block for storing an authentication key and a storing key, said authentication key being usable in authentication processing between said recorder/reproducer and said storage device, and said storing key being usable as an encryption key for said encryption data stored in said data storing section of said storage device; and

said control section is operable to receive a command identifier from said recorder/reproducer, to execute authentication processing using said authentication key in accordance with said pre-defined setting sequence, and, after completing said authentication processing, to execute said encryption processing of data accompanying key exchange processing using said storing key.

8. The data processing system according to claim 7, wherein:

said key block includes a plurality of key blocks each storing said authentication key and said storing key, said authentication key being different from said storing key; and

said recorder/reproducer is operable to notify said storage device of one key block as a designated key block out of said plurality of key blocks, said designated key block being used in said authentication processing and said encryption processing; and

said storage device is operable to execute said authentication processing using said authentication key stored in said designated key block and to execute said encryption processing of said data using said storing key in said designated key block.

9. A recording device, comprising:

a data storage section operable to store content data that is transferable to an external apparatus; and

an encryption processing section operable to execute encryption processing of transmission data with said external apparatus, said encryption processing section including a control section operable to receive a command identifier transferred from said external apparatus in accordance with a setting sequence, to retrieve a command from a register, said command corresponding to said command identifier, and to have said command executed;

wherein, if said command identifier differs from said setting sequence, said control section is operable to cancel processing of said command,

and wherein said control section further includes a command number setting sequence in which numbers are sequentially incremented as said setting sequence, said control section is further operable to store a received value of said command identifier in a memory, to compare a new command identifier received from said external apparatus with said setting sequence based on said received value and, if it is determined that said new command identifier is different from said setting sequence, to reset said received value stored in said memory without performing command processing corresponding to said new command identifier.

10. The recording device according to claim 9, further comprising:

a command register for storing said command in accordance with said setting sequence;

an authentication processing command sequence for executing authentication processing between said external apparatus and said recording device;

an encryption processing command sequence for executing said encryption processing relating to transferred data between said external apparatus and said recording device; and

a sequence set such that said command identifier corresponding to said authentication processing command sequence is executed prior to a command sequence corresponding to said encryption processing command sequence.

11. The recording device according to claim 10, wherein said encryption processing command sequence includes encryption key exchange processing for encryption data stored in a storage unit in said recording device.

12. The recording device according to claim 10, wherein said control section is operable to set an authentication flag, to execute command management control, and to reset said authentication flag when repeating said authentication processing command sequence, wherein,

if authentication is established between said external apparatus and said recording device, said authentication flag is set to indicate that said authentication processing is finished, and

said command management control enables execution of said encryption processing command sequence during setting of said authentication flag.

13. The recording device according to claim 11, wherein:

said control section is operable to manage an order of command execution based on said setting sequence and said command identifier in said encryption key exchange processing; and

said control section does not accept command processing from said external apparatus during said command execution relating to said encryption key exchange processing when said command processing is different from said setting sequence.

14. The recording device according to claim 9, further comprising:

a key block for storing an authentication key and a storing key, said authentication key being usable in authentication processing between said external apparatus and said recording device, and said storing key being usable as an encryption key for said data stored in said data storage section; and

said control section being operable to receive said command identifier from said external apparatus, to execute said authentication processing using said authentication key, and after completing said authentication processing, to execute said encryption processing of data accompanying key exchange processing using said storing key.

15. The recording device according to claim 14, wherein:

said key block includes a plurality of key blocks, each storing said authentication key and said storing key;

said external apparatus is operable to notify said recording device of one key block out of said plurality of key blocks, said one key block being a designated key block used in authentication processing and encryption processing of selected data; and

said recording device is operable to execute said authentication processing using said authentication key stored in said designated key block to execute said encryption processing using said storing key in said designated key block.

16. A data processing method in a data processing system having a first apparatus and a second apparatus operable to transmit encryption data to each other, said method comprising:

executing command processing control in said second apparatus for receiving a command identifier in accordance with a setting sequence, said command identifier being transferred from said first apparatus;

retrieving a command corresponding to said command identifier from a register;

processing said command; and

if said command identifier is different from said setting sequence, canceling said processing of said command;

wherein;

said setting sequence is a command number setting sequence in which numbers are sequentially incremented; and

said command processing control includes;

storing a receiving value of said command identifier in a memory;

determining compare a new command identifier received from said first apparatus with said setting sequence based on said receiving value; and

if said new command identifier is different from said setting sequence, resetting said receiving value stored in said memory without performing command processing corresponding to said new command identifier.

17. The data processing method according to claim 16, wherein:

said command processing control includes;

executing an authentication processing command sequence for executing authentication processing between said first apparatus and said second apparatus, and

executing an encryption processing command sequence for executing encryption processing relating to transferred data between said first apparatus and said second apparatus; and

said setting sequence is a sequence for executing said authentication processing command sequence prior to said encryption processing command sequence.

18. The data processing method according to claim 17, wherein said encryption processing command sequence includes encryption key exchange processing for encryption data stored in a storage unit in said second apparatus.

19. The data processing method according to claim 17, further including:

if authentication is established between said first apparatus and said second apparatus, setting an authentication flag indicating that said authentication processing is finished; and

executing command management control during said command processing control to enable execution of said encryption processing command sequence when setting said authentication flag.

20. The data processing method according to claim 19, further including resetting said authentication flag when executing a new authentication processing command sequence.

21. The data processing method according to claim 18, wherein said command processing control includes:

during processing of a series of commands relating to said encryption key exchange processing, managing an order of command processing based on said setting sequence and said command identifier; and

not accepting command processing from an external apparatus when said command processing is different from said setting sequence.