JP2009181598A - Information processor for digital right management - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processor for digital right management which may improve management and operation of the digital right by simplifying to managing/operating an open key certification used for delivering a license for the digital contents. <P>SOLUTION: A license delivering server 204 delivers information for the open key certification and a secret key as facilitating information 207 to a client terminal 201 other than a client module 206. Only if the open key certification is faulty, then, the facilitating information 207 is retransmitted. The license delivery server 204, further, delivers the client terminal 201 an individual license by selecting one of access control lists and generating each of the individual licenses if a plurality of the access control lists exist, which describe various permitting conditions and correspond to a requested content and a requester. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technology for managing from registration to distribution of digital content such as an electronic confidential document and controlling operations such as browsing, storage, editing, and copying of the distributed content. Digital Rights Management (Digital Rights Management) , DRM) related to an information processing apparatus for safely managing digital contents.

DRM technology is known as a technology for dealing with the problem of copyright protection of digital contents on the Internet. The DRM technique is generally a technique for protecting digital contents and distributing and managing contents. However, the DRM technique used in this specification indicates the following.
The content is encrypted, and the license conditions for the content and the content decryption key are stored in the license.
-When using the content, the user downloads the encrypted content from the content server, downloads the license from the license distribution server, and then uses the content in accordance with the license conditions.

  For managing the electronic document using the DRM technology, the distribution control of the license and the mechanism for generating the individual license for each user are described in the “confidential content management method” (Japanese Patent Application No. 2003-095723) of the prior application. Has been.

  In addition, a technical paper (see Non-Patent Document 1) that discloses UDAC (Universal Distribution with Access Control), which is a DRM technique involved in the invention by the inventors of the present application, describes application examples of UDAC music content. Has been.

Tanaaki Anazawa, Koji Takemura, Takashi Tsunehiro, Takayuki Hasebe, Takuhisa Hatakeyama, “Open Super Distribution Platform Realizing Toughness of Content Protection”, [online], Information Processing Society of Japan Report EIP14-5, 2001 11 May, [Search February 4, 2004], Internet <URL: http://www.keitaide-music.org/pdf/EIP14-5.pdf>

However, the conventional content management method described above has the following problems.
(1) In a content management system using DRM, when distributing a license, a public key certificate based on a public key infrastructure (Public Key Infrastructure, PKI) is used for communication between a client and a server. In managing and operating the public key certificate, it is necessary to introduce a Certificate Authority (CA). A system that requires the maintenance of a high security strength needs to use a strict certificate authority and convert a client module into an attack-resistant module (TRM) for each customer security domain. However, at present, there are many requests that a simple certificate authority is used to operate DRM easily and inexpensively even if the security strength is somewhat reduced.

Further, the developer ships the client module as a TRM with the class public key certificate and the corresponding private key embedded in the client module in advance. In this form, when the class public key certificate is compromised, the developer must recreate the client module once more, and the user must reinstall the client module.
(2) The license distributed to each user is individually generated by the license distribution server with reference to an access control list (ACL). The license is set for each group or user. Specifically, permission conditions such as permitting group A to print content and prohibiting printing to group B are set. In such a situation, there are cases where a user belongs to one or more groups, and it is necessary to decide which license conditions should be distributed to the user.
(3) Control for passing a license downloaded to a client terminal to another limited client terminal is not realized.
(4) As shown in FIG. 46, the operation log 13 indicating what operation is performed on the content to be protected at the client terminal 11 is managed by the client terminal 11 and is managed at an appropriate timing. The data is transmitted to the server 12 and managed as log data 14. However, if the log is managed on the client side, tampering or the like can be easily performed. Further, if it is attempted to take measures such as tampering prevention, it will be costly and difficult to implement.
(5) The license distribution server can distribute only permission conditions for one content in response to one license request. Therefore, when using a plurality of contents, the client terminal must make a plurality of license requests to the license distribution server.
(6) When a license is acquired by a client terminal, there is no mechanism for notifying the license distribution server whether the terminal is authenticated by the content protection system based on DRM. Therefore, the license is distributed to an unauthenticated client terminal.
(7) When the client terminal receives a license that stores a plurality of license conditions for the same content, there is no method for selecting one license condition from the licenses, so the received license can be used. Can not.
(8) When editing content protected by DRM, data is stolen from the shared memory (clipboard) by operations such as cutting or copying data in the content.

  A first object of the present invention is to provide an information processing apparatus that does not require re-creation / reinstallation of a client module even when a public key certificate is compromised, and that can easily manage and operate the public key certificate. Is to provide.

  A second problem of the present invention is to provide an information processing apparatus that realizes improved content management by DRM.

  FIG. 1 is a principle diagram of the first and second information processing apparatuses of the present invention. The information processing apparatus in FIG. 1 includes a storage unit 101, a generation unit 102, and a transmission unit 103. The first and second information processing apparatuses correspond to, for example, a license distribution server 204 in FIG. 2 to be described later. It corresponds to a CPU (central processing unit) 4401 and a network connection device 4407, respectively.

  The first information processing apparatus distributes to the user terminal a terminal module 111 that is a program for acquiring license data for decrypting the encrypted digital content using a public key infrastructure. The storage means 101 stores the encryption key, and the generation means 102 encrypts the public key certificate necessary for encrypted communication based on the public key infrastructure and the private key information for the public key using the encryption key. The encryption information 112 is generated. The transmission unit 103 includes a decryption key for decrypting the encrypted information 112, and decrypts the encrypted information after being activated on the user terminal, and acquires a public key certificate and private key information. The encrypted information 112 is transmitted to the user terminal.

  The generation unit 102 extracts the encryption key from the storage unit 101 and encrypts the information of the public key certificate and the secret key using the encryption key to generate the encryption information 112. The transmission means 103 transmits the terminal module 111 and the generated encryption information 112 to the user terminal. When the terminal module 111 is activated on the user terminal, the terminal module 111 decrypts the encrypted information 112 using the decryption key, obtains the public key certificate and the private key information, and uses the information. The license data 113 is acquired by performing encrypted communication with the license distribution server.

  As described above, if the public key certificate and the private key information are distributed separately from the terminal module 111, even if the public key certificate is compromised on the user terminal, a new public key certificate and private key are obtained. It is only necessary to distribute the encrypted information including the key information again. Therefore, it is not necessary to recreate / reinstall the terminal module 111, and the cost for certificate update can be kept low.

  The terminal module 111 and the encryption information 112 correspond to, for example, the client module 206 and the activation information 207 in FIG. Further, the user terminal corresponds to, for example, the client terminal 201 in FIG. 2, the encryption key and the decryption key correspond to, for example, Ks and Km3 in FIG. 4, and the public key certificate and the private key include, for example, those shown in FIG. Corresponding to 4 Cci and Kci (i = 1, 2,..., N).

  The second information processing apparatus receives an access request for digital content from the user terminal, and distributes license data for accessing the digital content to the user terminal as a response. The storage unit 101 stores a plurality of access control lists that describe users who are permitted access, permitted access modes, and permission conditions in association with digital contents. The generation unit 102 obtains an access control list corresponding to the content identifier included in the access request and corresponding to the user identifier of the requester who transmitted the access request from the access control list. When there are a plurality of access control lists, one access control list is selected from the obtained plurality of access control lists, and individual license data based on the selected access control list is generated. The transmission means 103 transmits the individual license data to the user terminal.

  The generation unit 102 refers to the one corresponding to the content identifier of the access request among the plurality of access control lists stored in the storage unit 101, and extracts the access control list corresponding to the user identifier of the requester. When there are a plurality of obtained access control lists, one access control list is selected from them, and individual license data based on the selected access control list is generated. The transmission unit 103 transmits the generated individual license data to the user terminal as a response to the access request.

  According to such an information processing apparatus, even when the requester belongs to a plurality of groups and there are a plurality of permission conditions that apply to the requested content, the requester should be applied to the requester. License conditions can be automatically determined and licenses can be distributed.

  A third information processing apparatus according to the present invention includes a storage unit and a selection unit, transmits an access request for digital content to the license distribution device, and receives license data for accessing the digital content from the license distribution device as a response. . The storage unit includes a plurality of access control lists describing access forms and permission conditions permitted for the digital content and information specifying selection processing, and stores license data received from the license distribution apparatus. The selection means executes a selection process designated by the license data, and selects one access control list from those access control lists.

  The selection means refers to the license data received from the license distribution apparatus and stored in the storage means, executes designated selection processing, and selects one access control from a plurality of access control lists included in the license data. Select a list.

  According to such an information processing apparatus, even when a license storing a plurality of license conditions for the same content is received, one license condition is automatically selected and received by a predetermined selection process. A license can be used.

  The third information processing apparatus corresponds to, for example, the client terminal 201 in FIG. 2, and the storage unit and the selection unit correspond to, for example, the memory 4402 and the CPU 4401 in FIG. 44, respectively. Also, the license distribution apparatus corresponds to, for example, the license distribution server 204 in FIG. 2, and the information specifying the selection process corresponds to, for example, script_id in FIG.

  According to the present invention, in a content management system based on DRM using PKI, it is possible to manage and operate public key certificates in a simpler method than when a strict certificate authority is used. This facilitates the construction of a PKI and the development of a content management system using DRM.

In addition, content management by DRM is improved in the following points.
(1) A license to be distributed to users belonging to one or more groups can be automatically determined.
(2) Even when the user terminal receives a license storing a plurality of license conditions for the same content, the license can be used by automatically selecting one license condition.

It is a principle figure of the information processing apparatus of this invention. It is a block diagram of a content protection system. It is a figure which shows the unauthorized use of a license. It is a figure which shows a client activation function. It is a flowchart of an activation information generation procedure. It is a flowchart of an activation information generation process. It is a flowchart of an activation information setting process. FIG. 3 is a diagram (part 1) illustrating a data structure of a license. It is a figure (the 2) which shows the data structure of a license. It is a figure which shows Acl structure. It is FIG. (1) which shows an ACLEntry structure. FIG. 3 is a diagram (part 2) illustrating an ACLEntry structure. FIG. 3 is a diagram showing an ACLEntry structure (part 3); It is FIG. (1) which shows an Acp structure. It is a figure (the 2) which shows an Acp structure. FIG. 6 is a diagram (part 3) illustrating an Acp structure. It is a figure (the 1) which shows an Acm structure. It is a figure (the 2) which shows an Acm structure. It is a figure (the 3) which shows an Acm structure. It is a figure which shows the verification process using the hash value of a root public key. It is a figure which shows the 1st comparison result of an authentication system. It is a figure which shows a 1st priority table. It is a flowchart of an individual license selection process. It is a flowchart of an ACL entry selection process. It is a figure which shows the control by a permission subject domain list. It is a figure which shows offline control. It is a figure which shows an IC card authentication cooperation module. It is a figure which shows an IC card authentication sequence. It is a flowchart of an IC card authentication process. It is a figure which shows DecodeInformation structure. It is a figure which shows EntryKeyMap type. It is a figure which shows the format of encryption content. It is a figure which shows the format of Content Header. It is a figure which shows Content Information. It is a figure which shows Element Information. It is a figure which shows a recognition system condition list. It is a figure which shows a logical operation. It is a figure which shows the 2nd comparison result of an authentication system. It is a figure which shows the RightsScriptSpec structure. It is a figure which shows a 2nd priority table. It is a figure which shows a 3rd priority table. It is a flowchart of the ACL entry selection process by a client module. It is a figure which shows the period when a license is not distributed. It is a block diagram of information processing apparatus. It is a figure which shows a recording medium. It is a figure which shows the conventional log management.

The best mode for carrying out the present invention will be described below in detail with reference to the drawings.
In the content protection system of this embodiment, the DRM client module and the activation information are generated separately and distributed separately. The DRM client module is a program having a license acquisition function and an encrypted content decryption function. The activation information includes the class public key certificate to be used and the secret key information for the public key of the certificate, and is used to activate the DRM client module and enable its function.

  After the DRM client module is distributed, the user acquires the activation information, and the DRM client module automatically sets the class public key certificate and private key in the activation information in the DRM client module. . Thereafter, the DRM client module acquires a license from the license distribution server.

  FIG. 2 is a configuration diagram of such a content protection system. The content protection system of FIG. 2 includes a client terminal 201 and a content management system 202, and the content management system 202 includes a user management server 203, a license distribution server 204, and a content server 205. The client terminal 201, user management server 203, license distribution server 204, and content server 205 correspond to, for example, an information processing apparatus (computer) and can communicate with each other via a communication network.

  The client terminal 201 is a user terminal that uses the content, downloads the encrypted content from the content server 205, downloads the license from the license distribution server 204, and decrypts the encrypted content according to the license permission conditions.

  The content server 205 includes a database that stores encrypted content, and the user management server 203 includes a database that stores management information such as an authentication method for each user. The license distribution server 204 includes a database for storing licenses, and separately generates a client module 206 that is a DRM client module and activation information 207 and distributes them to the client terminal 201. The client module 206 includes a decryption module 208 and a licensor agent 209.

  The licensor agent 209 distributed to the client terminal 201 acquires activation information 207 distributed separately. Thereafter, the licensor agent 209 obtains a license from the license distribution server 204, and the decryption module 208 decrypts the encrypted content using the license.

  Here, when the licensor agent 209 accepts any activation information, a malicious user starts up a fake license distribution server and distributes appropriate activation information, so that the user There is a possibility that the license will be passed to the created decryption module and used.

  For example, as shown in FIG. 3, a case is assumed where a valid license distribution server 301 distributes the licensor agent 303 and the decryption module 304 to the client terminal. When a non-malicious user uses content, the licensor agent 303 acquires the license 313 after acquiring the activation information 311 from the license distribution server 301.

  However, when a malicious user prepares the fake decryption module 305 in the client terminal, starts up the fake license distribution server 302 and distributes the fake activation information 312, the licensor agent 303 displays the license distribution server 301. There is a possibility that the license 313 obtained from the above will be passed to the decryption module 305.

Therefore, in the present embodiment, a “client activation function” for safely and automatically realizing certificate issuance / embedding is assumed as follows.
(1) The following processing is automatically performed when the license distribution server is installed.
Generate a set of CA private keys and public key certificates and maintain them in the CA module.
・ Register the CA public key certificate on the license distribution server.
(2) The following processing is automatically executed by the “client activation command (function)”.
Generate a set of client module private key and public key.
・ Enter the public key into the CA module and issue a public key certificate.
Embed the private key, public key certificate, and CA public key certificate in the specified client module.
-Save the correspondence table of client name and certificate list for management.
(3) The following processing is automatically executed by the “certificate revocation command (function)”.
-Specify the certificate to be revoked.
A CRL is generated by adding a specified certificate to a conventional CRL (Certificate Revocation List) (list of revoked certificates) at a certificate authority.
Set the generated CRL in the license distribution server.
(4) A universal public key certificate (Universal Certificate) is maintained in the client activation function so that interoperability among DRMs around the world is possible.

  More specifically, a function to activate the certificate authority and the client is implemented in the license distribution server management / operation system. TRM of the client module is performed only when the client module is provided and when the version is upgraded, not every time the certificate is issued. The client module activation key is automatically issued by the activation key automatic issuing function on the management / operation system.

  FIG. 4 shows a configuration for realizing such a client activation function. Here, it is assumed that the license distribution server management / operation system is provided in the license distribution server 204. The license distribution server 204 includes a client activation module 402, a certificate authority module 403, and a storage device 404, and the client terminal 201 includes a storage device 405.

The key and certificate notation used in FIG. 4 is as follows.
{X} K: Indicates that the information X is encrypted so that it can be decrypted with the key K.
Km2: Contract key. A key required to securely provide confidential information to each customer (content registrant, content user, etc.). Either public key or symmetric key cryptography is acceptable. The customer sets the license distribution server 204.
Cr1: Public key certificate of the certificate authority. Self-signed.
Kci (i = 1, 2,..., N): DRM class secret key.
Cci (i = 1, 2,..., N): Class public key certificate corresponding to Kci.
Ks: A session key that is changed every time the client module activation key is transmitted. Symmetric key cryptography key.
Km3: Client master key. A symmetric key cryptography secret key embedded in the client module by the manufacturer. One client module can have multiple types of Km3.

  The contract key Km2 is shared between the customer and the license distribution server management / operation system. Km2 is generated by the activation key generation tool 401 and distributed, and then updated at regular intervals. The client master key Km3 is shared between the customer and the client module. The client module activation key {Ks} Km3 || {Ks} Km2 is generated by the activation key generation tool 401, and issued when the client module 206 is provided and upgraded. The client activation module 402 generates activation information 207 using the contract key and the client module activation key.

  FIG. 5 is a flowchart of the activation information generation procedure by the operator of the license distribution server 204. The management / operation system first performs initialization processing (step 501) and determines the result (step 502). In the initialization process, the certificate authority root (root certificate authority) public key certificate is acquired.

  If the result is OK, as shown in FIG. 4A, contract key acquisition processing is performed (step 503), and the result is determined (step 504). As a result, the contract key Km2 is securely set in the client activation module 402.

  If the result is OK, the client module activation key acquisition process is performed (step 505), and the result is determined (step 506). In this process, as shown in FIG. 4C, the activation key generation tool 401 is requested to issue a client module activation key, and from the activation key generation tool 401, as shown in FIG. The issued client module activation key {Ks} Km3 || {Ks} Km2 is received. The client module activation key may be obtained by exchanging electronic mail.

  If the result is OK, an activation information generation process is performed (step 507), and the result is determined (step 508). If the result is NG in steps 502, 504, 506, and 508, error processing is performed (step 509).

  FIG. 6 is a flowchart of the activation information generation process performed by the client activation module 402 in step 507 of FIG. The client activation module 402 first performs a client module activation key acquisition process (step 601) and determines the result (step 602).

  If the result is OK, the client module activation key is decrypted with the contract key Km2 to obtain the session key Ks (step 603), and the result is judged (step 604).

  If the result is OK, the DRM class private key Kci and the class public key certificate Cci are acquired (step 605), and the result is determined (step 606). At this time, the certificate authority module 403 issues a class public key certificate Cci as shown in FIG.

  If the result is OK, the DRM class private key Kci and the class public key certificate Cci are encrypted with the session key Ks as shown in FIG. 4 (f) (step 607), and the result is determined ( Step 608). At this time, as shown in FIG. 4B, the public key certificate Cr1 generated by the certificate authority is also encrypted together with Kci and Cci.

  If the result is OK, then as shown in FIG. 4G, the encrypted information and {Ks} Km3 which is a part of the client module activation key are combined to activate the activation information 207. Is generated (step 609), and the result is determined (step 610). If the result is NG in steps 602, 604, 606, 608 and 610, error processing is performed (step 611).

  The generated activation information 207 is embedded in the activated client module 411 in the storage device 404 together with the client module 206 converted to TRM as shown in (h) of FIG. 4, and as shown in (i). Distributed within the domain. Thus, the activated client module 411 is temporarily stored in the storage device 405 of the distribution destination client terminal 201.

  FIG. 7 is a flowchart of activation information setting processing by the client module 206 in the client terminal 201. As illustrated in (j) of FIG. 4, when the client module 206 is activated on the client terminal 201, the client module 206 first acquires the activation information 207 (step 701) and determines the result (step 702).

  If the result is OK, then as shown in FIG. 4 (k), the activation information is decrypted with the client master key Km3 to obtain Kci and Cci (step 703), and the result is judged (step 703). 704). In this process, first, {Ks} Km3 is decoded with Km3 to extract Ks, and then the remaining activation information is decoded with Ks to extract Kci, Cci, and Cr1.

If the result is NG in steps 702 and 704, error processing is performed (step 705).
Thereafter, the client module 206 communicates with the license distribution server 204 using the acquired DRM class private key and certificate, and acquires a license.

  According to such a mechanism, even when the class public key certificate of the client terminal 201 is compromised, it is not necessary to recreate / reinstall the client module 206, and only the activation information 207 needs to be replaced. Therefore, the cost for certificate renewal can be kept low.

  In the configuration of FIG. 4, the PKI is constructed using the certificate authority module 403 in the license distribution server 204, but an external certificate authority 406 can be used instead. In addition to the DRM class private key Kci and the class public key certificate Cci, a set of the private key Kcu and the universal public key certificate Ccu may be added to the activation information 207.

Next, the mechanism of the content protection system will be described in more detail while showing examples of licenses used in the present embodiment.
8 and 9 show a license data structure (LicenseInfo structure), and FIG. 10 shows an Acl structure which is data in the acl (access control list) field of FIG. 11, 12, and 13 show the ACLEntry structure that is data of the acl_entry field of FIG. 10, and FIGS. 14, 15, and 16 show the Acp structure that is data of the acp (decoder access condition) field of FIG. 17, 18, and 19 illustrate an Acm structure that is data in the acm (media access condition) field of FIG. 11.

  The following countermeasures are taken against the problem that the license is transferred to the decryption module created by the malicious user and can be used. As shown in FIG. 9, a field called rpk_hash_list is provided in the license, and a list of hash values of the root public key used for certificate check when the license is issued is stored. Further, the decryption module 208, the licensor agent 209, and the license distribution server 204 hold the root public key certificate, respectively.

  As illustrated in FIG. 20, the licensor agent 209 of the client terminal 201 transmits a license acquisition request to the license distribution server 204. At this time, the licensor agent 209 transmits the hash value rpk_hash_value of the root public key of the certificate to the license distribution server 204, and the license distribution server 204 verifies the received hash value.

  The license distribution server 204 compares the received hash value with the hash value stored in the rpk_hash_list of the license, and distributes the license if the corresponding value exists in the list. However, if the corresponding value does not exist in the list, the license is not distributed.

  Similarly, in the client terminal 201, processing using rpk_hash_list is performed between the decryption module 208 and the licensor agent 209. The decryption module 208 transfers the public key hash value rpk_hash_value to the licensor agent 209, and the licensor agent 209 verifies the hash value. If the corresponding value exists in the license list, the license is transferred to the decryption module 208. If the corresponding value does not exist in the list, the license is not transferred.

By performing such verification processing, it is possible to prevent a license from being passed to a decryption module created by a malicious user.
Next, processing for automatically determining a license to be distributed to users belonging to one or more groups will be described.

  The license distribution server 204 stores, in a database, an access control list (ACL) that describes a user or a user group permitted to access the content and an access mode and a permission condition permitted for each corresponding to the content or the content set. Register with. Each time an access request is generated on the client terminal 201, request information is sent from the client terminal 201 to the license distribution server 204, and the license distribution server 204 distributes the license as a response.

At this time, the license distribution server 204 generates an individual license from the ACL corresponding to the content after determining whether or not access by the user or the user group is possible. Specifically, permission conditions for the requester are generated from the ACL entry of the group to which the requester belongs and the ACL entry for the requester, and an individual license is generated. The procedure for generating an individual license is as follows.
1. Acquisition of ACL entry The ACLEntry structure (FIG. 11) of each ACL entry registered in the database includes a user ID and a group ID. Therefore, an ACL entry having a user ID and a group ID obtained by a checkPrincipal method of a class that implements a predetermined API (Application Program Interface) is obtained from a plurality of ACL entries corresponding to the requested content identifier (content_id). To do. The checkPrincipal method is a method for acquiring the user information and group information of the user from the user management server 203 based on the user authentication information of the user.
2. Determination of Validity of ACL Entry When an acquired ACL entry satisfies any of the following conditions (1) to (7), the ACL entry is invalidated. If all the acquired ACL entries are invalid, the request is rejected and the process is terminated. However, if the condition (2) is satisfied, the request is immediately rejected and the process is terminated.
(1) The license retention time limit (kept_limit) and the license start date / time (start_time) (FIG. 19) included in the Acm structure are invalid.
(2) The priority rejection flag (deny flag) (bit 7 in FIG. 18) included in the Acm structure is on.
(3) The number of rights included in the Acm structure (FIG. 19) is 0 (rights_count == 0)
(4) The number of permitted content operations included in the Acm structure (FIG. 17) is 0 (operation_count == 0)
(5) The certificate subject at the time of Open does not correspond to the permitted subject domain list (subject_list) (FIG. 19) included in the Acm structure.
(6) The operation requested by Get_License does not match the operation of the ACLEntry structure (FIG. 11). Get_License corresponds to a license acquisition request transmitted from the client terminal 201 to the license distribution server 204.
(7) An authentication method in which the bit of the authentication method condition list (authentication_list) obtained by the checkPrincipal method is 0 and the bit of the authentication_list (FIG. 12) of the ACL entry corresponding to the bit is 1 , Bit0 to bit7.

For example, in the example of FIG. 21, since the condition obtained by checkPrincipal does not satisfy the authentication_list set in the ACL entry in bit 1, this ACL entry cannot be used for individual condition setting.
3. Discrimination of license usage form (online / offline) (1) When a sequential license designation flag (dynamic_license flag) of Get_License is on, a dynamic_license flag (bit 4 in FIG. 18) from the ACL entries remaining up to the above processing 2 Leave only the ones that are on. If the dynamic_license flag of all the ACL entries remaining until the processing of 2 is off, the request is rejected. In this case, the reject code is 8111h, indicating that there is no valid ACL entry.

The sequential license (online license) is a type of license that is used immediately after issuance, and is discarded by the client terminal 201 after use. On the other hand, the offline license is a type of license that is temporarily stored in the client terminal 201 and can be used without being connected to the license distribution server 204 thereafter.
(2) When the dynamic_license flag of acm of Get_License is off or acm is not specified Only the ACL entries that have the dynamic_license flag off from the ACL entries remaining up to the processing of 2 are left. If the dynamic_license flag of all ACL entries remaining up to process 2 of 2 is on, the request is rejected. In this case, the reject code is also 8111h.
4). Selection of ACL entry and distribution of individual license (1) When acm and acp are not specified in Get_License Select an ACL entry according to the priority table of FIG. When a plurality of ACL entries are selected according to a certain priority order selection rule, an ACL entry is selected according to the next priority order selection rule.

  Actually, since the partial copy prohibition flag is not turned on in the partial copy license that permits partial copy of the content, the selection rule of priority 4 is not used when selecting the partial copy license. In addition, since the storage prohibition flag is never turned on in the storage license that permits the storage of the content, the selection rule of priority 5 is not used when selecting the storage license. Furthermore, since the print prohibition flag is not turned on in a print license that permits printing of content, the selection rule of priority 6 is not used when selecting a print license.

When a plurality of ACL entries remain by the above selection process, the ACL entries are selected in the order registered in the database.
(2) When acm and acp are specified in Get_License Select an ACL entry satisfying acm and acp specified in Get_License from the remaining ACL entries, store it in an individual license, and distribute it.
(2-1) When there are a plurality of ACL entries satisfying acm and acp Select an ACL entry according to the priority table of FIG. If a plurality of ACL entries still remain, the ACL entries are selected in the order registered in the database.
(2-2) When there is no ACL entry satisfying acm and acp, the request is rejected and the process is terminated. The reject code is 8111h.

After finally selecting one ACL entry according to the above procedure, a license having the ACL entry is distributed. At this time, the license move_count is set to 00h, and the rights_count is set to 01h for distribution. However, when an ACL entry whose dynamic_license flag is on is selected, sequential licenses (operation_count 01h, move_count 00h, and rights_count 01h) are distributed.
5. Server-side database subtraction process The license distribution server 204 subtracts 1 from rights_count of the ACL entry selected in the above-described process 4.

  FIG. 23 is a flowchart of such individual license selection processing. The license distribution server 204 first acquires the group ID list of the group to which the requester belongs from the user management server 203 by the above process 1 (step 2301), and determines the result (step 2302). If there are two or more affiliation groups, then the ACL entry is selected by the above processes 2 and 3 (step 2303), and the result is judged (step 2304).

  If a plurality of ACL entries remain, only one ACL entry is selected and the license is distributed (step 2305). Then, 1 is subtracted from the number of rights in the database by the above process 5 (step 2306).

  If there is one member group in step 2302 and if only one ACL entry remains in step 2304, the license is immediately distributed (step 2305), and the processing in step 2306 is performed. Further, if the group to which the group belongs is 0 in step 2302, the requester is notified of the request cancellation (step 2308).

  FIG. 24 is a flowchart of the ACL entry selection process in step 2303 of FIG. The license distribution server 204 first determines the validity of the ACL entry by the above process 2 (step 2401) and determines the result (step 2402).

  If the ACL entry is valid, it is then determined whether or not the ACL entry satisfies the request condition by the above processing 3 (steps 2403 and 2404). If there is an ACL entry satisfying the request condition, it returns to the processing of FIG. 23 as a selection result. If there is no ACL entry satisfying the request condition, the requester is notified of the request discard (step 2405).

According to such an individual license selection process, a license to be distributed to users belonging to one or more groups can be automatically determined.
Next, there will be described control for determining whether or not access is permitted when a license is downloaded to a client terminal, and control for safely delivering the downloaded license to another client terminal. In this control, the permitted / rejected domains are limited using the subject list of the public key certificate (X.509 certificate).

  The subject of the public key certificate is a name for identifying the certificate subject. It is expressed in a 500 name system. For example, a person named hana who belongs to the network division of TRUST Corporation is represented as follows.

{Country = JP, Organization = TRUST Corp. , OrganizationUnit = Network, CommonName = hana}

The format for representing one entry in this way is X. It is defined by the 500 directory system and is called DN (Distinguished Name). A part of DN is called RDN (Relative Distinguished Name). RDN is an X.R. 501 is a relative identification name defined in 501; This is an absolute identification name defined in 501. The HDN RDN is, for example:

{Country = JP, Organization = TRUST Corp. },
{Organization = TRUST Corp. },
{CommonName = hana}

Here, the range in which the license is distributed and moved is controlled by the DN of the public key certificate (media class public key certificate) held by the client terminal. For this purpose, as one of the license permission conditions, a list of DNs and RDNs to be permitted is set in the permitted subject domain list (subject_list) (FIG. 19) of the ACL entry.

  Then, RDNs included in the DN of the public key certificate are extracted in order from the top and compared with each entry (RDN) in the permitted subject domain list. If the upper RDN of the subject of the public key certificate matches one entry in the list, access is granted. As a result, it is possible to perform control such that the license is distributed only to the client terminal that matches the RDN in the permitted subject domain list.

  For example, as shown in FIG. 25, there are TRUST Corporation 2501 and IT Corporation 2502, and TRUST Corporation 2501 has a network business unit 2511 and a software business unit 2512. At this time, if you want to share certain protection information between the network division 2511 of TRUST Corporation 2501 and IT Corporation 2502, set the following information in the license subject domain list to distribute the license to other organizations You can avoid it. However, the RDN is specified in order from the most significant RDN.

{Country = JP, Organization = TRUST Corp. , Organization Unit = Network},
{Country = JP, Organization = IT Inc. }

In accordance with the license subject domain list, the license distribution server 204 distributes the license to the network business unit 2511 and the IT business unit 2502 of the TRUST Corporation 2501, and does not distribute the license to the software business unit 2512 of the TRUST Corporation 2501.

  Since the license subject domain list is stored and distributed in the license as one of the license conditions, the licensor agent of the client terminal that receives the license interprets the list and copies the license within the range indicated in the list. Can move.

  Therefore, as shown in FIG. 26, after the license is distributed to IT Corporation 2502, the licensor agent of IT Corporation 2502 copies the license to the network business unit 2511 of TRUST Corporation 2501 in accordance with the above-mentioned permitted subject domain list. ,Moving. However, the license is not copied or moved to the software business unit 2512 of TRUST Corporation 2501.

  Next, a method for securely copying and moving a distributed license to another client terminal using an IC (Integrated Circuit) card will be described. In this method, DN is inserted into the license and distributed to the client terminal, and the client module checks whether the DN of the IC card matches the DN of the IC card.

  In this case, an IC card authentication cooperation module 2701 is provided in the client module 206 as shown in FIG. The IC card authentication cooperation module 2701 is a module that authenticates the user to the client module 206 using the IC card 2702. The IC card 2702 stores an IC card user certificate, and the IC card 2702 is inserted into the slot of the client terminal 201. The client module 206 copies and moves the license only to the authenticated IC card 2702.

  FIG. 28 shows an IC card authentication sequence by the IC card authentication cooperation module 2701. In this sequence, authentication is performed by generating a random number each time, signing it, and performing signature verification.

  The IC card authentication cooperation module 2701 inquires of the IC card 2702 about the state when using the license, and checks whether the IC card 2702 is connected to the client terminal 201. When the IC card is removed, the user is requested to insert the IC card and input a PIN (Personal Identification Number) code. In response to this, the user inserts the IC card 2702 into the client terminal 201 and inputs the PIN code (step 2801).

  Next, the IC card authentication cooperation module 2701 generates a random number and transmits the random number to the IC card 2702 using a secure session that is a function of the IC card 2702 (procedure 2802).

  The IC card 2702 digitally signs the received random number using the encryption key for the certificate held (step 2803). Then, the digital signature and certificate are transmitted to the IC card authentication cooperation module 2701 through a secure session.

  The IC card authentication cooperation module 2701 verifies the validity of the certificate of the IC card 2702 (procedure 2804), and determines whether or not the DN of the certificate is the same as the account currently logged in to the client terminal 201 (certificate). Whether or not the DN of the distributed license matches (step 2805), and the digital signature received from the IC card 2702 is verified using the certificate (step 2806).

  For the DN check, data for mapping the certificate DN of the IC card 2702 and the account of the client terminal 201 is required, but the IC card authentication cooperation module 2701 holds such data. .

  When the IC card 2702 is still connected to the client terminal 201, it is not necessary for the user to input a PIN code, and the IC card 2702 is authenticated according to the sequence after the procedure 2802.

  FIG. 29 is a flowchart of such an IC card authentication process. The IC card authentication cooperation module 2701 first generates a random number (step 2901) and transmits it to the IC card 2702 (step 2902). Next, the digital signature and certificate are received from the IC card 2702 (step 2903), the validity of the certificate is verified (step 2904), and the result is determined (step 2905).

  If the result is OK, a certificate DN check is performed (step 2906), and the result is determined (step 2907). If the result is OK, then the digital signature is verified (step 2908) and the result is determined (step 2909). If the result is NG in steps 2905, 2907, and 2909, error processing is performed (steps 2910, 2011, and 2912).

In this example, the license is copied and moved using an IC card, but any other computer-readable portable recording medium can be used.
Next, in order to deal with the problem of log falsification on the client terminal, the license distribution server logs each operation such as content display, printing, storage, partial copy, transfer, and mail attachment on the client terminal. The method of taking is described.

  In this method, a field (FIG. 11) representing an operation type of content called operation is provided in the license. The user requests a license of a desired operation type from the license distribution server depending on which operation is desired. Then, the license distribution server specifies an operation on the content of the client terminal by storing log data indicating which type of operation the license is distributed to the client terminal.

According to such log management, since log data is created and managed on the server side, the possibility of tampering by the user is very low.
Next, a description will be given of a method for acquiring licenses for the contents at a time when the client terminal uses a plurality of encrypted contents. In this method, permission conditions / decryption keys corresponding to a plurality of contents are stored in a license, and the contents are controlled. Further, by providing a field (FIG. 10) that can store a plurality of ACL entry fields representing permission conditions for one content in the license, a plurality of permission conditions can be distributed at one time.

  FIG. 30 shows a DecodeInformation structure (FIG. 9) which is data of content decryption information (decode_information) in the license, and FIG. 31 shows an encrypted content element-decryption key correspondence list (element-key-) in the DecodeInformation structure. ElementKeyMap type, which is map) data.

  The encrypted content is generally distributed in a format as shown in FIG. 32, and can store N different elements (contents). 33 shows the format of the header (Content Header) of FIG. 32, FIG. 34 shows the content information (Content Information) of FIG. 33, and FIG. 35 shows each element information (Element Information) of FIG. ). By using the DecodeInformation structure of FIG. 30, the decryption keys corresponding to the plurality of elements (contents) of FIG. 32 can be stored in the license.

  The ACLEntry structure, which is data of an ACL entry, includes a field of a licensed content element number list (element_list) (FIG. 13), and stores element numbers of elements that can be used in the license conditions of the ACL entry. Therefore, by using the Acl structure of FIG. 10, permission conditions corresponding to a plurality of elements can be stored in the license.

  Next, a field for describing the authentication method is provided in the ACL entry of the license, and the access is performed by comparing the authentication method in which the user has been authenticated in the past with the authentication method described in the field. A method for controlling the above will be described. In this method, logical operations of two authentication methods to be compared are performed, and the calculation result is used as an access condition.

  The license distribution server 204 inquires of the user management server 203 what authentication method the user has been authenticated for, and acquires the authentication method condition. Then, the acquired condition is compared with the authentication method condition list (authentication_list) (FIG. 12) stored in the license requested by the client terminal, and whether or not the license can be distributed is determined. The authentication_list is set with an authentication method necessary for license registration.

  Specifically, the authentication_list in the license is data of a bit string in which each bit is mapped to each authentication method, and is composed of 8 bits as shown in FIG. The bit corresponding to the required authentication scheme is set on (logic 1).

  When the license distribution server 204 maps the authentication method information acquired from the user management server 203 to the data in the format of FIG. 36, if the user has successfully completed the authentication by each authentication method, the corresponding bit Turn on. For example, if the user has already been authenticated by the ID / password method and the signature method, a value of 00100001 is generated.

  The license distribution server 204 does not distribute the license only when there is an authentication method in which the bit of the generated data is 0 and the bit of the authentication_list corresponding to the bit is 1.

  This control is explained by propositional logic. The bit of the authentication_list is set to A, the bit of the mapped data is set to B, and as a result of performing logical operation A⇒B as shown in FIG. If there is a 0 bit, processing for rejecting license distribution is performed.

  In the example of FIG. 38, in bit 1, the condition acquired from the user management server 203 does not satisfy the authentication_list in the license, so the license is not distributed to the client terminal 201. According to such control, it is possible to prevent license distribution to client terminals that are not authenticated by the content protection system using DRM.

  Next, when the client terminal receives a license storing a plurality of license conditions for the same content, the license is used by selecting one license condition from among the licenses according to the intention of the registrant. How to do will be described.

  The license has a field called license_script_spec (FIG. 8), and the ACLEntry structure has a field called rights_script (FIG. 11). The data of these fields includes the RightsScriptSpec structure shown in FIG. The permission condition selection process is associated with the identifier (script_id) described in the RightsScriptSpec structure.

  As an example of the permission condition selection process, there is an ACL entry selection process based on the above-described priority order table of FIG. In addition, as shown in FIG. 40, script_id can be assigned to a priority table in which the priority order of permission conditions is changed. Furthermore, as shown in FIG. 41, script_id can also be assigned to a priority table whose selection rule has been changed. Thus, the RightsScriptSpec structure specifies a process of selecting one of a plurality of ACL entries.

  Further, the selection rules described in this priority order table may be disclosed on the Web or the like so that anyone using the license distribution system can view them. Thereby, the registrant can grasp how the permission condition is selected.

  FIG. 42 is a flowchart of processing in which the client module 206 selects an ACL entry by using the RightsScriptSpec structure of the received license. The client module 206 first checks whether or not there are a plurality of ACL entries in the license (step 4201). If there is only one ACL entry, that ACL entry is selected.

  If there are a plurality of ACL entries, the rights_script structure of the rights_script of each ACL entry is checked (step 4202), and it is determined whether or not they are the same (step 4203).

  If the RightsScriptSpec structure is the same, one ACL entry is selected by the permission condition selection process corresponding to the script_id (step 4204). If there are different ones in the RightsScriptSpec structure, one ACL entry is selected by the permission condition selection process corresponding to the script_id of the RightsScriptSpec structure of license_script_spec (step 4205).

  Next, a countermeasure for the problem of data being stolen during content editing will be described. When the user edits the content, when a part of the content is copied and put on the clipboard, the client module 206 encrypts the data of the copy portion and puts it on the clipboard. Then, only when the authorized person performs a paste operation, a process of decrypting and pasting that portion is performed. This forcibly realizes control for limiting the editing operation (copy / paste) to the protected document only to authorized persons.

The license according to the present embodiment further includes information for realizing the following control.
(1) Preferential rejection control for users and groups is performed only for the rejection period and the rejection domain.

  Control the issuance period from the license issuance date and time until the license retention period, and issue the license no matter what kind of permission is granted to the issuing user and the group to which the user belongs within the license issuance period Priority is rejected.

  As shown in FIG. 19, fields of kept_period, kept_limit, and start_time are provided in the license. The kept_period stores the license holding period, the kept_limit stores the license holding deadline, and the start_time stores the date and time (license starting date and time) for starting the license distribution. The license distribution server 204 controls whether or not the content can be used by the access control target user for a predetermined period by linking these pieces of information with the deny flag shown in FIG.

In the ACL entry for a certain user, when start_time and kept_limit are set and the deny flag is set to ON, as shown in FIG. 43, the license is not distributed to the user during the period from start_time to kept_limit.
(2) When the offline license is used for the first time, the user sets a password so that the content registrant can specify the period during which the password can be entered.

  When using an offline license using password authentication, a field called password_min_len (FIG. 12) that stores the minimum length of the password used when using offline, and a password after the license arrives at the client terminal. A field called pw_input_period (FIG. 13) is provided for storing the time until input to the client terminal.

The user inputs a password longer than the length set in password_min_len within the time set in pw_input_period, and the client module 206 stores and sets the password. Thereafter, when using the license offline, the user uses the set password.
(3) Coordination method of DRM technology and superimposed display / printing In the current DRM protection method, for example, while a malicious user is displaying a protected document, the display screen is shot with a digital camera and shot. It is conceivable to pass the data to a third party. It is also conceivable to obtain a license with printing authority, copy the printed protected document with a copy machine, and give it to a third party.

  Therefore, superimposition information such as the license issuance date and time, the attribute information of the license issuing entity and the group to which the issuing entity belongs, and the like are stored in the license. The client module 206 that has acquired the license storing the superimposition information forcibly displays or prints the superimposition information when displaying or printing the content. As a result, information indicating who or when the content was displayed or printed is added to the content itself, making it easy to specify the content distribution route.

  Incidentally, the client terminal 201, the user management server 203, the license distribution server 204, and the content server 205 in FIG. 2 are configured using, for example, an information processing apparatus (computer) as shown in FIG. 44 includes a CPU (central processing unit) 4401, a memory 4402, an input device 4403, an output device 4404, an external storage device 4405, a medium drive device 4406, and a network connection device 4407, which are connected to each other via a bus 4408. It is connected.

  The memory 4402 includes, for example, a read only memory (ROM), a random access memory (RAM), and the like, and stores programs and data used for processing. The CPU 4401 performs necessary processing by executing a program using the memory 4402.

  The storage devices 404 and 405 in FIG. 4 correspond to the memory 4402 or the external storage device 4405. The client module 206, the decryption module 208, the licensor agent 209 in FIG. 2, the activation key generation tool 401 in FIG. 4, the client activation module 402, the certificate authority module 403, and the IC card authentication cooperation module 2701 in FIG. Corresponds to the program or its function stored in.

  The input device 4403 is, for example, a keyboard, a pointing device, a touch panel, or the like, and is used for inputting instructions and information from operators such as content registrants, managers, and users. The output device 4404 is, for example, a display, a printer, a speaker, or the like, and is used for outputting an inquiry to an operator or a processing result.

  The external storage device 4405 is, for example, a magnetic disk device, an optical disk device, a magneto-optical disk device, a tape device, or the like. The information processing apparatus stores the program and data in the external storage device 4405, and loads them into the memory 4402 and uses them as necessary. The external storage device 4405 is also used as a database for the user management server 203, the license distribution server 204, and the content server 205.

  The medium driving device 4406 drives a portable recording medium 4409 and accesses the recorded contents. The portable recording medium 4409 is an arbitrary computer-readable recording medium such as a memory card, a flexible disk, a CD-ROM (compact disk read only memory), an optical disk, and a magneto-optical disk. The operator stores the program and data in the portable recording medium 4409 and loads them into the memory 4402 for use as necessary.

  The network connection device 4407 is connected to an arbitrary communication network such as a LAN (local area network) or the Internet, and performs data conversion accompanying communication. The information processing apparatus receives the program and data from an external apparatus via the network connection apparatus 4407 as necessary, and loads them into the memory 4402 for use.

FIG. 45 shows a computer-readable recording medium that can supply a program and data to the information processing apparatus of FIG. Programs and data stored in the portable recording medium 4409 and the database 4511 of the server 4501 are loaded into the memory 4402 of the information processing apparatus 4502. The server 4501 generates a carrier signal for carrying the program and data, and transmits the carrier signal to the information processing device 4502 via an arbitrary transmission medium on the network. The CPU 4401 executes the program using the data and performs necessary processing.
(Appendix 1)
An information processing apparatus that distributes a terminal module, which is a program for acquiring license data for decrypting encrypted digital content using a public key infrastructure, to a user terminal,
Storage means for storing the encryption key;
Generating means for generating encrypted information by encrypting a public key certificate necessary for encrypted communication based on the public key infrastructure and secret key information for the public key of the public key certificate using the encryption key When,
A terminal module that includes a decryption key for decrypting the encrypted information, decrypts the encrypted information after being activated on the user terminal, and obtains the public key certificate and private key information; and An information processing apparatus comprising: a transmission unit configured to transmit activation information to the user terminal.
(Appendix 2)
An information processing apparatus that receives an access request for digital content from a user terminal and distributes license data for accessing the digital content to the user terminal as a response,
Storage means for storing a plurality of access control lists describing users who are allowed access, allowed access forms, and permission conditions in association with digital content;
Obtaining an access control list corresponding to the content identifier included in the access request and corresponding to the user identifier of the requester who transmitted the access request from the plurality of access control lists, and obtained access Generating means for selecting one access control list from the obtained plurality of access control lists and generating individual license data based on the selected access control list when there are a plurality of control lists;
An information processing apparatus comprising: transmission means for transmitting the individual license data to the user terminal.
(Appendix 3)
An information processing apparatus that transmits an access request for digital content to a license distribution apparatus and receives license data for accessing the digital content from the license distribution apparatus as a response,
Storage means for storing the license data received from the license distribution device, including a plurality of access control lists describing access forms and permission conditions permitted for the digital content, and information specifying selection processing;
An information processing apparatus comprising: selection means for executing a selection process specified by the license data and selecting one access control list from the plurality of access control lists.
(Appendix 4)
A program for a computer that distributes a terminal module, which is a program for obtaining license data for decrypting encrypted digital content using a public key infrastructure, to a user terminal,
The encryption information is obtained by encrypting the public key certificate necessary for encrypted communication based on the public key infrastructure and the secret key information for the public key of the public key certificate using the encryption key stored in the storage means. Produces
A terminal module that includes a decryption key for decrypting the encrypted information, decrypts the encrypted information after being activated on the user terminal, and obtains the public key certificate and private key information; and A program for causing a computer to execute a process of transmitting information to a user terminal.
(Appendix 5)
A program for a computer that acquires license data for decrypting encrypted digital content from a license distribution device using a public key infrastructure,
The encryption information stored in the storage means is decrypted using the decryption key included in the program, and the public key certificate necessary for encrypted communication based on the public key infrastructure and the public key of the public key certificate Obtain private key information,
A program that causes the computer to execute a process of acquiring the license data from the license distribution device by performing encrypted communication using the information of the public key certificate and the private key.
(Appendix 6)
A program for a computer that receives an access request for digital content from a user terminal and distributes license data for accessing the digital content to the user terminal as a response,
Content included in the access request from among a plurality of access control lists stored in the storage means describing the users permitted to access, the permitted access forms, and the permission conditions in association with the digital content. Obtaining an access control list corresponding to the identifier and corresponding to the user identifier of the requester who transmitted the access request;
When there are a plurality of obtained access control lists, one access control list is selected from the obtained plurality of access control lists,
A program for causing the computer to execute a process of generating individual license data based on a selected access control list.
(Appendix 7)
A relative identification name representing a part of the identification name of the public key certificate, the relative identification name described in the permitted domain subject list of the selected access control list, and the public key certificate held by the user terminal A process of distributing the individual license data to the user terminal when the relative identifier matches a part of the identifier of the public key certificate held by the user terminal. The program according to appendix 6, wherein the program is further executed.
(Appendix 8)
The program further causes the computer to execute a process of describing an identification name of a public key certificate in the individual license data and distributing the public key certificate to the user terminal. The user terminal is described in the individual license data. The program according to appendix 6, wherein the individual license data is stored in the portable recording medium when the identification name matches the identification name of the public key certificate stored in the portable recording medium.
(Appendix 9)
When the individual license data is distributed to the user terminal, the computer is further caused to execute processing for storing log data indicating a content operation type permitted for the user terminal by the individual license data. The program according to appendix 6, which is characterized.
(Appendix 10)
The program according to claim 6, wherein the individual license data includes a plurality of permission conditions and a plurality of decryption keys for accessing each of the plurality of digital contents.
(Appendix 11)
The user authentication method described in the individual license data is compared with the authentication method that has already authenticated the requester, and the authentication method described in the individual license data does not correspond to the authenticated authentication method. The program according to claim 6, further causing the computer to further execute a process of not distributing the individual license data to the user terminal.
(Appendix 12)
A program for a computer that transmits an access request for digital content to a license distribution device and receives license data for accessing the digital content from the license distribution device as a response,
License data received from the license distribution apparatus and stored in storage means, including a plurality of access control lists describing access forms and permission conditions permitted for the digital content, and information specifying selection processing Browse
A program for executing a selection process specified by the license data and causing the computer to execute a process of selecting one access control list from the plurality of access control lists.
(Appendix 13)
When a user accesses the digital content using the license data, copies a part of the digital content and puts it on the clipboard, the encrypted data is put on the clipboard, and the authorized person performs a paste operation. 13. The program according to appendix 12, wherein the computer is further caused to execute a process of decrypting and pasting the data of the copy portion when performing the above.
(Appendix 14)
A recording medium recording a program for a computer for distributing a terminal module, which is a program for acquiring license data for decrypting encrypted digital content using a public key infrastructure, to a user terminal,
The program is
The encryption information is obtained by encrypting the public key certificate necessary for encrypted communication based on the public key infrastructure and the secret key information for the public key of the public key certificate using the encryption key stored in the storage means. Produces
A terminal module that includes a decryption key for decrypting the encrypted information, decrypts the encrypted information after being activated on the user terminal, and obtains the public key certificate and private key information; and A computer-readable recording medium that causes the computer to execute a process of transmitting information to the user terminal.
(Appendix 15)
A recording medium recording a program for a computer that acquires license data for decrypting encrypted digital content from a license distribution device using a public key infrastructure,
The program is
The encryption information stored in the storage means is decrypted using the decryption key included in the program, and the public key certificate necessary for encrypted communication based on the public key infrastructure and the public key of the public key certificate Obtain private key information,
A computer-readable recording medium characterized by causing the computer to execute a process of acquiring the license data from the license distribution device by performing encrypted communication using the public key certificate and private key information .
(Appendix 16)
A recording medium recording a program for a computer that receives an access request for digital content from a user terminal and distributes license data for accessing the digital content to the user terminal as a response,
The program is
Content included in the access request from among a plurality of access control lists stored in the storage means describing the users permitted to access, the permitted access forms, and the permission conditions in association with the digital content. Obtaining an access control list corresponding to the identifier and corresponding to the user identifier of the requester who transmitted the access request;
When there are a plurality of obtained access control lists, one access control list is selected from the obtained plurality of access control lists,
A computer-readable recording medium that causes the computer to execute a process of generating individual license data based on a selected access control list.
(Appendix 17)
A recording medium that records a program for a computer that transmits an access request for digital content to a license distribution device and receives license data for accessing the digital content from the license distribution device as a response,
The program is
License data received from the license distribution apparatus and stored in storage means, including a plurality of access control lists describing access forms and permission conditions permitted for the digital content, and information specifying selection processing Browse
A computer-readable recording medium, wherein a selection process specified by the license data is executed to cause the computer to execute a process of selecting one access control list from the plurality of access control lists.
(Appendix 18)
An information processing method for distributing a terminal module, which is a program for acquiring license data for decrypting encrypted digital content using a public key infrastructure, to a user terminal,
The generation unit encrypts the public key certificate necessary for encrypted communication based on the public key infrastructure and the private key information for the public key of the public key certificate using the encryption key stored in the storage unit. , Generate encryption information,
A terminal module that includes a decryption key for decrypting the encrypted information, and that decrypts the encrypted information after being activated on the user terminal to obtain the public key certificate and private key information And the encrypted information is transmitted to the user terminal.
(Appendix 19)
An information processing method for receiving an access request for digital content from a user terminal and delivering license data for accessing the digital content to the user terminal as a response,
The generation means associates the access request with the access request from among a plurality of access control lists stored in the storage means describing the users permitted to access, the permitted access forms, and the permission conditions in association with the digital content. And an access control list corresponding to the user identifier of the requester who transmitted the access request
When there are a plurality of obtained access control lists, the generating means selects one access control list from the obtained plurality of access control lists,
An information processing method, wherein the generation unit generates individual license data based on a selected access control list.

DESCRIPTION OF SYMBOLS 11,201 Client terminal 12 Log management server 13 Operation log 14 Log data 101 Storage means 102 Generation means 103 Transmission means 111 Terminal module 112 Encrypted information 113 License data 202 Content management system 203 User management server 204, 301, 302 License distribution Server 205 Content server 206 Client module 207, 311, 312 Activation information 208, 304, 305 Decryption module 209, 303 Licensor agent 313 License 401 Activation key generation tool 402 Client activation module 403 Certificate authority module 404, 405 Storage device 406 External Certificate Authority 411 Activation Client Module 2501 TRUST Corporation 2502 IT Stock Company 2511 network Division 2512 Software Division 2701 IC card authentication linkage module 2702 IC card 4401 CPU
4402 Memory 4403 Input device 4404 Output device 4405 External storage device 4406 Medium drive device 4407 Network connection device 4408 Bus 4409 Portable recording medium 4501 Server 4502 Information processing device 4511 Database

Claims (6)

An information processing apparatus that receives an access request for digital content from a user terminal and distributes license data for accessing the digital content to the user terminal as a response,
Storage means for storing a plurality of access control lists describing users who are allowed access, allowed access forms, and permission conditions in association with digital content;
Obtaining an access control list corresponding to the content identifier included in the access request and corresponding to the user identifier of the requester who transmitted the access request from the plurality of access control lists, and obtained access Generating means for selecting one access control list from the obtained plurality of access control lists and generating individual license data based on the selected access control list when there are a plurality of control lists;
An information processing apparatus comprising: transmission means for transmitting the individual license data to the user terminal. An information processing apparatus that transmits an access request for digital content to a license distribution apparatus and receives license data for accessing the digital content from the license distribution apparatus as a response,
Storage means for storing the license data received from the license distribution device, including a plurality of access control lists describing access forms and permission conditions permitted for the digital content, and information specifying selection processing;
An information processing apparatus comprising: selection means for executing a selection process specified by the license data and selecting one access control list from the plurality of access control lists. A program for a computer that receives an access request for digital content from a user terminal and distributes license data for accessing the digital content to the user terminal as a response,
Content included in the access request from among a plurality of access control lists stored in the storage means describing the users permitted to access, the permitted access forms, and the permission conditions in association with the digital content. Obtaining an access control list corresponding to the identifier and corresponding to the user identifier of the requester who transmitted the access request;
When there are a plurality of obtained access control lists, one access control list is selected from the obtained plurality of access control lists,
A program for causing the computer to execute a process of generating individual license data based on a selected access control list.   A relative identification name representing a part of the identification name of the public key certificate, the relative identification name described in the permitted domain subject list of the selected access control list, and the public key certificate held by the user terminal A process of distributing the individual license data to the user terminal when the relative identification name matches a part of the identification name of the public key certificate held by the user terminal. 4. The program according to claim 3, wherein the program is further executed. A program for a computer that transmits an access request for digital content to a license distribution device and receives license data for accessing the digital content from the license distribution device as a response,
License data received from the license distribution apparatus and stored in storage means, including a plurality of access control lists describing access forms and permission conditions permitted for the digital content, and information specifying selection processing Browse
A program for executing a selection process specified by the license data and causing the computer to execute a process of selecting one access control list from the plurality of access control lists. An information processing method for receiving an access request for digital content from a user terminal and delivering license data for accessing the digital content to the user terminal as a response,
The generation means associates the access request with the access request from among a plurality of access control lists stored in the storage means describing the users permitted to access, the permitted access forms, and the permission conditions in association with the digital content. And an access control list corresponding to the user identifier of the requester who transmitted the access request
When there are a plurality of obtained access control lists, the generating means selects one access control list from the obtained plurality of access control lists,
An information processing method, wherein the generation unit generates individual license data based on a selected access control list.

Images