Secure device having key management function and information processing apparatus

• US 7,978,857 B2
• Filed: 08/15/2007
• Issued: 07/12/2011
• Est. Priority Date: 09/26/2006
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Hasegawa, Eiji, Nishiguchi, Naoki
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US11/893,168
• Publication Number:
  US 20080075290A1
• Time in Patent Office: 1,427 Days
• Field of Search: 380/277
• US Class Current: 380/277
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A secure device has an input unit for dividing content into a plurality of blocks and inputting the plurality of blocks, a key generating unit for sequentially generating keys for encrypting one or plural blocks,

• • a content encrypting unit for encrypting the one or plural blocks by using the generated key, a key information generating unit for generating key information for restoring the generated key used for the encrypting by the generated key, and a storage control unit for outputting contents of each of the blocks encrypted by the content encrypting unit and the key information generated by the key information generating unit to an external storage.

The key sequentially generated by the key generating unit is newly generated when a predetermined condition is satisfied, and varies by every one or plural blocks.

Claims

1. An integrated circuit comprising:

an input unit for dividing content into a plurality of blocks and inputting the plurality of blocks;

a key generating unit for sequentially generating keys for encrypting one or plural blocks;

a content encrypting unit for encrypting the one or plural blocks by using the generated key;

a key information generating unit for generating key information for restoring the generated key used for the encrypting by the generated key, wherein the key information includes the generated keys encrypted with a master key peculiar to the integrated circuit;

a storage control unit for outputting contents of each of the blocks encrypted by the content encrypting unit and the key information generated by the key information generating unit to an external storage;

a restoration control unit for receiving key information stored in the external storage;

a key information restoring unit for restoring the generated keys used for the encrypting from the received key information;

an output unit for outputting the restored generated keys to an information processing mechanism for decrypting the contents in each block stored in the external storage; and

a key information restoration managing unit for managing a restoration state of the generated keys restored by the key information restoring unit and for determining whether an already restored generated key can be updated or not and whether a generated key to be newly restored can be restored or not on the basis of the restoration state of the generated key already restored,

wherein the key sequentially generated by the key generating unit is newly generated when a predetermined condition is satisfied, and varies by every one or plural blocks, and

wherein when the key information restoration managing unit determines that restoration is not permitted, the key information restoring unit does not restore the generated key which is not permitted to be restored.

2. The integrated circuit according to claim 1, wherein the key information includes the generated key and range information specifying the block of contents to which the generated key is applied for encrypting.

3. The integrated circuit according to claim 1, further comprising a key information storing unit for storing a key generated by the key generating unit,

wherein the key information includes a key index that specifies the generated key stored in the key information storing unit.

4. The integrated circuit according to claim 3, wherein the key information further includes range information that specifies a block of contents to which the generated key specified by the key index is applied.

5. The integrated circuit according to claim 1, wherein the key generating unit generates a key initial value and, from the key initial value, generates a key on the basis of a predetermined rule, and the key information includes the key initial value.

6. The integrated circuit according to claim 1, wherein when the key information restoration managing unit does not receive an update request from the information processing mechanism and when the number of generated keys that are currently used is equal to the predetermined maximum number of the generated keys, the key information restoration managing unit does not permit the new restoration request of the key, and

wherein when the key information restoration managing unit receives a plurality of restoration requests during a predetermined time, the key information restoration managing unit receives only one restoration request and permits to restore only one generated key.

7. An information processing apparatus having a key management function and comprising:

an integrated circuit configured to generate and restore keys for encrypting content and to encrypt the content by using the generated key;

a memory configured to store the encrypted content and key information having data by which the generated key used for encrypting the content can be restored; and

a processor configured to reproduce the contents stored in the memory;

wherein the integrated circuit;

divides the content into a plurality of blocks and inputs the plurality of blocks;

sequentially generates keys for encrypting one or plural blocks when a predetermined condition is satisfied;

encrypts the one or plural blocks by using the generated key;

generates key information for restoring the generated key used for the encrypting, wherein the key information includes the generated keys encrypted with a master key peculiar to the integrated circuit;

outputs the content of each of the blocks encrypted by the content encrypting unit and the generated key information to the memory;

receives key information for restoring the generated key used for the encrypting from the processor;

restores the generated keys used for the encrypting from the received key information;

outputs the restored generated key to the processor; and

manages a restoration state of the keys restored and determines whether an already restored generated key can be updated or not and whether a generated key to be newly restored can be restored or not on the basis of the restoration state of the generated key already restored, and

the information processor comprises;

an information obtaining unit for obtaining the content in the block to be reproduced and key information from the memory;

a key obtaining unit for supplying the obtained key information to the integrated circuit and for obtaining a generated key corresponding to the key information from the integrated circuit; and

a content restoring unit for reproducing content by sequentially restoring contents in the blocks obtained from the memory by using the generated key obtained from the memory.