Information processing apparatus and method

• US 7,779,260 B2
• Filed: 12/19/2007
• Issued: 08/17/2010
• Est. Priority Date: 07/06/2000
• Status: Expired due to Fees

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Nakano, Takehiko
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US12/002,805
• Publication Number:
  US 20080141032A1
• Time in Patent Office: 972 Days
• Field of Search: 713/171, 726/27, 726/31
• US Class Current: 713/171
• CPC Class Codes: H04H 20/76 Wired systems
• CPC Class Codes: H04H 60/23 using cryptography, e.g. encryption, authentication, key distribution
• CPC Class Codes: H04H 60/80 characterised by transmission among terminal devices
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3252 using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

In order to limit use of content, when a source receives a request for transmitting content from a sink, the source performs an authentication process. When the authentication is successful, the source transmits to the sink key information necessary for decrypting the encryption applied to the content. The sink can receive the content by receiving the key information and by decrypting the encryption applied to the content by using the key information.

Claims

1. An information processing apparatus for carrying out secure transmission of content to another apparatus over a network, said information processing apparatus comprising:

an encryption unit operable to encrypt the content;

an authentication unit operable to receive authentication information from the another apparatus when the another apparatus requests permission to receive the encrypted content, and to determine whether the authentication information is valid;

a first obtaining unit operable to obtain identification information of the another apparatus from the authentication information when the authentication information is valid and to determine whether the identification information of the another apparatus is already stored in a storage unit, said storage unit being operable to store the identification information of the another apparatus when the identification information of the another apparatus is not already stored in said storage unit;

a transmitting unit operable to transmit a key to the another apparatus when the authentication information of the another apparatus is valid, the key being associated with decryption of the encrypted content;

a first counting unit operable to increment by one a count of a total number of apparatuses having permission to receive the encrypted content when (i) the identification information of the another apparatus is not already stored in said storage unit and (ii) the count of the total number of apparatuses having permission to receive the encrypted content is less than a maximum value; and

an information updating unit operable to delete the stored identification information of the another apparatus to reset the count of the total number of apparatuses having permission to receive the encrypted content when the key associated with decryption of the encrypted content is changed.

2. An information processing apparatus according to claim 1, wherein the another apparatus is operable to transmit the encrypted content to a plurality of further apparatuses over the network, and said information processing apparatus further comprises:

a second obtaining unit operable to obtain a first value and a second value from the another apparatus when the authentication information is valid, the first value being a number of further apparatuses in the plurality of further apparatuses that are newly requesting permission to receive the encrypted content, and the second value being a total number of further apparatuses in the plurality of further apparatuses; and

a second counting unit operable to increment the count of the total number of apparatuses having permission to receive the encrypted content by the first value when (i) a sum of the first value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the another apparatus is already stored in said storage unit,

said second counting unit being operable to increment the count of the total number of apparatuses having permission to receive the encrypted content to receive the encrypted content by the second value when (i) a sum of the second value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the another apparatus is not already stored in said storage unit.

3. An information processing apparatus according to claim 1, wherein the authentication information is first authentication information, and said authentication unit is operable to transmit a request for second authentication information to the another apparatus when the first authentication information is valid, to receive the second authentication information from the another apparatus, and to determine whether the second authentication information is valid;

said transmitting unit being operable to transmit the key associated with decryption of the encrypted content to the another apparatus when the second authentication information is valid and the count of the total number of apparatuses having permission to receive the encrypted content is less than the maximum value.

4. An information processing apparatus according to claim 1, wherein the information processing apparatus is a personal computer.

5. An information processing apparatus according to claim 1, wherein the information processing apparatus is a general-purpose personal computer that executes various types of functions by installing various programs.

6. A method for carrying out secure transmission of content to an apparatus over a network, said method comprising:

using a processor to carry the following steps;

encrypting the content;

receiving authentication information from the apparatus when the apparatus requests permission to receive the encrypted content;

determining whether the authentication information is valid;

obtaining identification information of the apparatus from the authentication information when the authentication information is valid;

determining whether the identification information of the apparatus is already stored;

transmitting a key to the apparatus when the authentication information of the apparatus is valid, the key being associated with decryption of the encrypted content;

incrementing by one a count of a total number of apparatuses having permission to receive the encrypted content when (i) the identification information of the apparatus is not already stored and (ii) the count of the total number of apparatuses having permission to receive the encrypted content is less than a maximum value;

storing the identification information of the apparatus when the identification information of the apparatus is not already stored; and

deleting the stored identification information and resetting the count of the total number of apparatuses having permission to receive the encrypted content when the key associated with decryption of the encrypted content is changed.

7. A method according to claim 6, wherein the apparatus is operable to transmit the encrypted content to a plurality of further apparatuses over the network, and said method further comprises:

obtaining a first value and a second value from the apparatus when the authentication information is valid, the first value being a number of further apparatuses in the plurality of further apparatuses that are newly requesting permission to receive the encrypted content, and the second value being a total number of further apparatuses in the plurality of further apparatuses;

incrementing the count of the total number of apparatuses having permission to receive the encrypted content by the first value when (i) a sum of the first value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the apparatus is already stored; and

incrementing the count of the total number of apparatuses having permission to receive the encrypted content by the second value when (i) a sum of the second value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the apparatus is not already stored.

8. A non-transitory computer-readable storage medium having recorded thereon computer program instructions for executing a method for carrying out secure transmission of content to an apparatus over a network, said method comprising:

encrypting the content;

receiving authentication information from the apparatus when the apparatus requests permission to receive the encrypted content;

determining whether the authentication information is valid;

obtaining identification information of the apparatus from the authentication information when the authentication information is valid;

determining whether the identification information of the apparatus is already stored;

transmitting a key to the apparatus when the authentication information of the apparatus is valid, the key being associated with decryption of the encrypted content;

incrementing by one a count of a total number of apparatuses having permission to receive the encrypted content when (i) the identification information of the apparatus is not already stored and (ii) the count of the total number of apparatuses having permission to receive the encrypted content is less than a maximum value;

storing the identification information of the apparatus when the identification information of the apparatus is not already stored; and

deleting the stored identification information and resetting the count of the total number of apparatuses having permission to receive the encrypted content when the key associated with decryption of the encrypted content is changed.

9. A computer-readable medium according to claim 8, wherein the apparatus is operable to transmit the encrypted content to a plurality of further apparatuses over the network, and said method further comprises:

obtaining a first value and a second value from the apparatus when the authentication information is valid, the first value being a number of further apparatuses in the plurality of further apparatuses that are newly requesting permission to receive the encrypted content, and the second value being a total number of further apparatuses in the plurality of further apparatuses;

incrementing the count of the total number of apparatuses having permission to receive the encrypted content by the first value when (i) a sum of the first value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the apparatus is already stored; and

incrementing the count of the total number of apparatuses having permission to receive the encrypted content by the second value when (i) a sum of the second value and the count of the total number of apparatuses having permission to receive the encrypted content is at most equal to the maximum value and (ii) the identification information of the apparatus is not already stored.

10. An information processing apparatus for carrying out secure receiving of content from a first apparatus over a first network connection and for carrying out secure transmission of the content to a second apparatus over a second network connection, said information processing apparatus comprising:

a first transmitting unit operable to transmit to the first apparatus a request for permission to receive the content;

a first authentication unit operable to perform a first authentication procedure with the first apparatus;

a receiver operable to receive a first key from the first apparatus when the first authentication procedure is successful;

a decryption unit operable to use the first key to generate a decryption key used to decrypt encrypted content received from the first apparatus;

a reencryption unit operable to reencrypt the decrypted content;

a second authentication unit operable to receive authentication information from the second apparatus when the second apparatus requests permission to receive the content and to determine whether the authentication information is valid;

a first obtaining unit operable to obtain identification information of the second apparatus from the authentication information when the authentication information is valid and to determine whether the identification information of the second apparatus is already stored in a storage unit, the storage unit being operable to store the identification information of the second apparatus when the identification information of the second apparatus is not already stored in said storage unit;

a second transmitting unit operable to transmit a second key to the second apparatus when the authentication information of the second apparatus is valid, the second key being associated with decryption of the reencrypted content;

a first counting unit operable to increment by one a count of a number of apparatuses having permission to receive the reencrypted content when (i) the identification information of the second apparatus is not already stored in said storage unit and (i) the count of the total number of apparatuses having permission to receive the reencrypted content is less than a maximum value; and

an information updating unit operable to delete the stored identification information of the second apparatus and to reset the count of the number of apparatuses having permission to receive the reencrypted content when the second key is changed.

11. An information processing apparatus according to claim 10, wherein the authentication information is first authentication, and said second authentication unit is operable to transmit a request for second authentication information to the second apparatus when the first authentication information is valid, to receive the second authentication information from the second apparatus, and to determine whether the second authentication information is valid;

said second transmitting unit being operable to transmit the second key to the second apparatus when the second authentication information is valid and the count of the total number of apparatuses having permission to receive the reencrypted content is less than the maximum value.

12. An information processing apparatus according to claim 10, further comprising:

a third transmitting unit operable to transmit, to the first apparatus, the count of the number of apparatuses having permission to receive the reencrypted content.

13. An information processing apparatus according to claim 10, wherein the information processing apparatus is a personal computer.

14. An information processing apparatus according to claim 10, wherein the information processing apparatus is a general-purpose personal computer that executes various types of functions by installing various programs.

15. A method for carrying out secure receiving of content from a first apparatus over a first network connection and for carrying out secure transmission of the content to a second apparatus over a second network connection, said method comprising:

using a processor to carry the following steps;

transmitting to the first apparatus a request for permission to receive the content;

performing a first authentication procedure with the first apparatus;

receiving a first key from the first apparatus when the first authentication procedure is successful;

generating a decryption key from the first key;

decrypting, using the generated decryption key, encrypted content received from the first apparatus;

reencrypting the decrypted content;

receiving authentication information from the second apparatus when the second apparatus requests permission to receive the content;

determining whether the authentication information is valid;

obtaining identification information of the second apparatus from the authentication information when the authentication information is valid;

determining whether the identification information of the second apparatus is already stored;

transmitting a second key to the second apparatus when the authentication information of the second apparatus is valid, the second key being associated with decryption of the reencrypted content;

incrementing by one a count of a number of apparatuses having permission to receive the reencrypted content when (i) the identification information of the second apparatus is not already stored in said storage unit and (ii) the count of the total number of apparatuses having permission to receive the reencrypted content is less than a maximum value;

storing the identification information of the second apparatus when the identification information of the second apparatus is not already stored; and

deleting the stored identification information of the second apparatus and resetting the count of the number of apparatuses having permission to receive the reencrypted content when the second key is changed.

16. A non-transitory computer-readable storage medium having recorded thereon computer program instructions for executing a method for carrying out secure receiving of content from a first apparatus over a first network connection and for carrying out secure transmission of the content to a second apparatus over a second network connection, said method comprising:

transmitting to the first apparatus a request for permission to receive the content;

performing a first authentication procedure with the first apparatus;

receiving a first key from the first apparatus when the first authentication procedure is successful;

generating a decryption key from the first key;

decrypting, using the generated decryption key, encrypted content received from the first apparatus;

reencrypting the decrypted content;

receiving authentication information from the second apparatus when the second apparatus requests permission to receive the content;

determining whether the authentication information is valid;

obtaining identification information of the second apparatus from the authentication information when the authentication information is valid;

determining whether the identification information of the second apparatus is already stored;

transmitting a second key to the second apparatus when the authentication information of the second apparatus is valid, the second key being associated with decryption of the reencrypted content;

incrementing by one a count of a number of apparatuses having permission to receive the reencrypted content when (i) the identification information of the second apparatus is not already stored in said storage unit and (ii) the count of the total number of apparatuses having permission to receive the reencrypted content is less than a maximum value;

storing the identification information of the second apparatus when the identification information of the second apparatus is not already stored; and

deleting the stored identification information of the second apparatus and resetting the count of the number of apparatuses having permission to receive the reencrypted content when the second key is changed.