Data transfer system and data transfer method
View Patent ↗A transfer source gives a challenge key, own public key, an ID for identifying the target data, and an encryption key type to a transfer destination that is authenticated by a certificate. In accordance with the given key type, the transfer destination generates a first session key (and a second session key), encrypts the first session key and own public key (or second session key) with the transfer source's public key, encrypts the resulting encrypted data with the challenge key, and transmits the data encrypted with the challenge key to the transfer source. The transfer source encrypts the target data with the second session key (or the transfer destination's public key) that is derived from the received data, encrypts the resulting encrypted data with the first session key, and transmits the data encrypted with the first session key to the transfer destination. The transfer destination decrypts the received data with the first session key, and decrypts the resulting decrypted data with the second session key (or the own public key) to acquire the license.
1. A computer-implemented method for encrypting and transferring a license that comprises content data, key data for decrypting the content data, and decryption permission condition data for the content data, the computer-implemented method comprising:
causing a transfer destination comprising a recorder/player to,
transmit to a transfer source comprising a distribution server, a certificate including a public key of the transfer destination;
causing the transfer source to,
verify the validity of the received certificate,
generate a challenge key,
encrypt the challenge key with the public key,
transmit first data to the transfer destination, said first data being formed by joining a certificate including a public key of the transfer source to the resulting encrypted data, and
transmit second data to the transfer destination, said second data being formed by joining a license ID for identifying the license to key type data used for indicating the type of a license encryption key;
causing the transfer destination to,
decrypt said first data excluding the transfer source's public key with a secret key of the transfer destination to acquire the challenge key after acquiring the transfer source's public key from said first data,
generate a first session key and a second session key or only the first session key in accordance with the key type data,
generate joined data by joining the first session key to the transfer destination's own public key or joining the first session key to the second session key,
generate encrypted data by encrypting the joined data with said transfer source's own public key,
generate further encrypted data by encrypting the encrypted data with said challenge key, and
transmit the further encrypted data to the transfer source;
causing the transfer source,
generate decrypted data by decrypting the further encrypted data with said challenge key,
generate further decrypted data by decrypting the decrypted data with a secret key of the transfer source,
acquire the first session key and the second session key or the first session key and the transfer destination's public key from the further decrypted data,
generate an encrypted license by encrypting the license with the second session key or the transfer destination's public key,
generate a further encrypted license by encrypting the encrypted license with said first session key, and
transmit the further encrypted license to the transfer destination; and
causing the transfer destination to,
generate a decrypted license by decrypting the further encrypted license with said first session key,
acquire the license by generating a further decrypted license by decrypting the decrypted license with said second session key or the transfer source's own public key, and
store the further decrypted license, and
access the content data utilizing the further decrypted license.
2. The transfer method according to claim 1 , wherein, when said license is to be encrypted and transferred while the first session key common to the transfer source and the transfer destination is retained, the method comprises:
causing the transfer destination to,
generate a new session key,
generating encrypted session data by encrypting the new session key with said first session key, and
transmit the encrypted session data to the transfer source; and
causing the transfer source to,
acquire said new session key by decrypting the encrypted session data with said first session key,
generate the encrypted license with the acquired new session key,
generate the further encrypted license with said first session key.
3. A system comprising:
a transfer destination comprising a recorder/player, the transfer destination configured to,
transmit to a transfer source comprising a distribution server, a certificate including a public key of the transfer destination;
the transfer source configured to,
verify the validity of the received certificate,
generate a challenge key,
encrypt the challenge key with the public key,
transmit first data to the transfer destination, said first data being formed by joining a certificate including a public key of the transfer source to the resulting encrypted data, and
transmit second data to the transfer destination, said second data being formed by joining a license ID for identifying a license to key type data used for indicating the type of a license encryption key;
the transfer destination further configured to,
decrypt said first data excluding the transfer source's public key with a secret key of the transfer destination to acquire the challenge key after acquiring the transfer source's public key from said first data,
generate a first session key and a second session key or only the first session key in accordance with the key type data,
generate joined data by joining the first session key to the transfer destination's own public key or joining the first session key to the second session key,
generate encrypted data by encrypting the joined data with said transfer source's own public key,
generate further encrypted data by encrypting the encrypted data with said challenge key, and
transmit the further encrypted data to the transfer source;
the transfer source further configured to,
generate decrypted data by decrypting the further encrypted data with said challenge key,
generate further decrypted data by decrypting the decrypted data with a secret key of the transfer source,
acquire the first session key and the second session key or the first session key and the transfer destination's public key from the further decrypted data,
generate an encrypted license by encrypting the license with the second session key or the transfer destination's public key,
generate a further encrypted license by encrypting the encrypted license with said first session key, and
transmit the further encrypted license to the transfer destination; and
the transfer destination further configured to,
generate a decrypted license by decrypting the further encrypted license with said first session key,
acquire the license by generating a further decrypted license by decrypting the decrypted license with said second session key or the transfer source's own public key, and
store the further decrypted license; and
access the content data utilizing the further decrypted license.
4. The system of claim 3 wherein the content data, the public key of the transfer destination, the first data, the second data, the further encrypted data, and the further encrypted license are transferred between network nodes.
5. The system of claim 3 wherein the content data, the public key of the transfer destination, the first data, the second data, the further encrypted data, and the further encrypted license are transferred between recording media.
6. The system according to claim 3 , wherein, when the license is to be encrypted and transferred while the first session key common to the transfer source and the transfer destination is retained,
the transfer destination is further configured to,
generate a new session key,
generate encrypted session data by encrypting the new session key with said first session key, and
transmit the encrypted session data to the transfer source; and
the transfer source is configured to,
acquire said new session key by decrypting the encrypted session data with said first session key,
generate the encrypted license with the acquired new session key,
generate the further encrypted license with said first session key.
7. The system of claim 6 wherein the encrypted session data is transferred between network nodes.
8. The system of claim 6 wherein the encrypted session data is transferred between recording media.
9. The method of claim 1 wherein the content data, the public key of the transfer destination, the first data, the second data, the further encrypted data, and the further encrypted license are transferred between recording media.
10. The method of claim 1 wherein the content data, the public key of the transfer destination, the first data, the second data, the further encrypted data, and the further encrypted license are transferred between network nodes.
11. The method of claim 2 wherein the encrypted session data is transferred between network nodes.
12. The method of claim 2 wherein the encrypted session data is transferred between recording media.