Download security system

A download security system (100) includes a server (102) and an information processing apparatus (10). The information processing apparatus (10) includes a flash memory (64) for storing data downloaded from the server (102) and a memory controller (62). A transition command for a transition to a writable mode to the flash memory (64) is transmitted from the server (102), and in response to the transition command, a memory controller (62) makes a transition to the writable mode. The data downloaded from the server (102) is written to the flash memory (64) by the memory controller (62) in the writable mode.

This application is the U.S. national phase of International Application No. PCT/JP2007/067560 filed 4 Sep. 2007, the entire contents of which is hereby incorporated by reference.

TECHNICAL FIELD

The technology presented herein relates to a download security system. More specifically, the present technology relates to a download security system of allowing only intended download data to be written in a predetermined memory area. Furthermore, the present technology relates to an information processing apparatus, a server, a memory controller and a security method which are utilized in a download security system.

PRIOR ART

One example of an art of downloading data from a server to an IC card of a portable terminal is disclosed in a Japanese Patent Laying-open No. 2002-281181 (patent document 1) laid-open on Sep. 27, 2002. More specifically, in the art of the patent document 1, the IC card has file structure so as to be protected by an access key for each file, and a readable-and-writable key by which an access is made to the IC card to read the content of the file and to rewrite the same is managed by only a host server. An addition and a change to the content written in the IC card can be performed only by a write instruction from the host server after an online connection is made with the host server through the portable terminal. That is, only at a time that the readable-and-writable key added to the instruction is sent, that it is checked on the side of the IC card, and that the check is correct, the file is made accessible.

However, in the art of the patent document 1, it is intended that by the write instruction added with the access key for the file, writing to the file by the IC card is merely controlled from the server, and furthermore, in the patent document 1, there is no idea of making a transition of modes of the IC card, so that unauthorized data may be written.

SUMMARY

Therefore, it is a primary feature of the example embodiments presented herein to provide a novel download security system, and an information processing apparatus, a server, a memory controller and a security method which are utilized therefor.

Another feature of the present embodiments is to provide a download security system capable of preventing unintended data from being written, and an information processing apparatus, a server, a memory controller and a security method which are utilized therefor.

The present embodiments employ the following features in order to solve the above-described problems. It should be noted that reference numerals and the supplements inside the parentheses show one example of a corresponding relationship with the embodiments described later for easy understanding of the present embodiment, and do not limit the present embodiment.

A first embodiment is a download security system including a server and an information processing apparatus for downloading data from the server. The information processing apparatus includes a storing means for storing the data downloaded from the server, and a controlling means for controlling writing to the storing means. The server includes a transition command transmitting means for transmitting to the information processing apparatus a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means, and a data transmitting means for transmitting the data to the information processing apparatus. The controlling means includes a writing means for writing the data transmitted by the data transmitting means to the storing means in the writable mode to which the transition is made in response to the first transition command.

In the first embodiment, a download security system (100) includes a server (102) and an information processing apparatus (10). To the information processing apparatus, a storing means (64) for storing the data downloaded from the server and a controlling means (62) for controlling writing to the storing means are provided. The server includes a transition command transmitting means (S33, S323) for transmitting to the information processing apparatus a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means. Furthermore, the server includes a data transmitting means (S67, S341), and transmits the data to be downloaded to the information processing apparatus. The controlling means makes a transition to the writable mode in response to the first transition command. Furthermore, the controlling means includes a writing means (S83, S267), and writes the data transmitted by the data transmitting means to the storing means in the writable mode.

According to the first embodiment, in response to the first transition command from the server, it is possible to cause the controlling means to make a transition to the writable mode, and then, in the writable mode, the data from the server can be written to the storing means. Accordingly, a transition of the mode is necessary for writing data, and therefore, it is possible to perform stepwise protection of data, and heighten a degree of security.

A second embodiment is a download security system, and the server further includes an encrypting means for encrypting the first transition command. The transition command transmitting means transmits the first transition command encrypted by the encrypting means, and the controlling means further includes a decrypting means for decrypting the encrypted first transition command.

In the second embodiment, the server further includes an encrypting means (S31) and encrypts the first transition command. The encrypted first transition command is transmitted by the transition command transmitting means. The controlling means further includes a decrypting means (S37, S227), and decrypts the encrypted first transition command.

According to the second embodiment, the first transition command can be encrypted and transmitted, capable of heightening the degree of security with respect to the mode transition.

A third embodiment is a download security system, and the first transition command includes an address designated for writing the data. The controlling means includes a write-enabling means for making only the designated address writable when a transition is made to the writable mode in response to the first transition command.

In the third embodiment, an address to which data is to be written can be designated by the first transition command. The controlling means further includes a write-enabling means (S45, S237), and makes only the designated address writable.

According to the third embodiment, by the first transition command, it is possible to make a transition to the writable mode and make only the address designated by the command writable.

A fourth embodiment is a download security system, and the write-enabling means makes a fixed range from the designated address writable.

In the fourth embodiment, by the first transition command, it is possible to make a transition to the writable mode and make a fixed range from the designated address writable.

A fifth embodiment is a download security system, and the controlling means decrypts the encrypted first transition command by the decrypting means in a secure mode being higher in a degree of security than usual to which a transition has been made direct before the writable mode.

In the fifth embodiment, a secure mode being higher in a degree of security than usual is provided directly before the writable mode, and in the secure mode, decryption of the encrypted first transition command is performed.

According to the fifth embodiment, the decryption of the first transition command can be performed in the secure mode, capable of heightening the degree of security.

A sixth invention is a download security system, the server stores a first key for encrypting the first transition command and a second key different from the first key for encrypting data. The encrypting means encrypts the first transition command by utilizing the first key, and the data transmitting means transmits the data encrypted by utilizing the second key. The storing means stores the first key and the second key. The decrypting means decrypts the encrypted first transition command by utilizing the first key. The writing means decrypts the data by utilizing the second key in the writable mode and writes the same to the storing means.

In the sixth embodiment, a first key for encrypting the first transition command and a second key different from the first key for encrypting the data to be downloaded are stored in the server and the storing means. That is, the server and the controlling means have a common key (first key) for the first transition command and a common key (second key) for the data to be downloaded. The first transition command which is encrypted with the first key and transmitted by the server is decrypted with the first key by the controlling means, and the controlling means makes a transition to the writable mode by the first transition command. Furthermore, the download data which is encrypted with second key and transmitted by the server is decrypted with the second key by the controlling means, and written to the storing means in the writable mode.

According to the sixth embodiment, it is possible to separately perform protection on the mode transition and the download data, capable of further heightening the degree of security.

A seventh embodiment is a download security system, and the server further stores a third key for message digest authentication of the data. The data transmitting means encrypts, by utilizing the second key, the data to which an authentication symbol generated by utilizing the third key is added, and transmits the encrypted data. The storing means further stores the third key. The controlling means decrypts the encrypted data by utilizing the second key in the writable mode. The writing means, when the decrypted data is authenticated by utilizing the third key, writes the data.

In the seventh embodiment, the third key for message digest authentication of the data to be downloaded is stored in the server and the storing means. The server encrypts the data to which the authentication symbol (MIC) generated by utilizing the third key is added with the second key and transmits the same. The controlling means decrypts the encrypted data with the second key in the writable mode. Then, when the decrypted data is authenticated by utilizing the third key, the data is written to the storing means.

According to the seventh embodiment, it is possible to perform the message digest authentication with respect to the data to be downloaded.

An eighth embodiment is a download security system, and the third key is a key obtained by a part of the second key being replaced.

In the eighth embodiment, the third key for message digest authentication is a key obtained by a part of the second key being replaced. Accordingly, if a common part is shared between the second key and the third key, the size of the area for storing the key can be reduced, resulting in reduction in cost.

A ninth embodiment is a download security system, and the storing means stores the encrypted first key and second key. The controlling means decrypts the encrypted first key and develops the same in a RAM when a transition to the secure mode is made, and decrypts the encrypted second key and develops the same in the RAM when a transition to the writable mode is made.

In the ninth embodiment, in the storing means, the first key and the second key are encrypted and stored. When a transition to the secure mode is made, the first key is decrypted and automatically developed in the RAM by the controlling means. When a transition to the writable mode is made, the second key is decrypted and automatically developed in the RAM by the controlling means.

According to the ninth embodiment, at a time of the mode transition, the first key or the second key corresponding to the mode can be decrypted and developed in the RAM.

A tenth embodiment is a download security system, and the controlling means develops the first key in response to a second transition command for making a transition to the secure mode, and develops the second key in response to the first transition command.

In the tenth embodiment, when a mode transition is made in response to the transition command by the controlling means, the first key or the second key is decrypted and developed.

According to the tenth embodiment, in response to the transition command, the first key or the second key to the mode can be decrypted and developed.

An eleventh embodiment is a download security system, and the information processing apparatus further includes a normal encrypting means for performing an encryption according to an algorithm of a relatively low processing load on the command with respect to the controlling means in a normal mode.

In the eleventh embodiment, it is possible to encrypt the command issued to the controlling means in the normal mode by the normal encrypting means according to an algorithm of a relatively low processing load.

A twelfth embodiment is a download security system, and the information processing apparatus further includes a writing command issuing means for issuing a writing command to instruct the controlling means to perform writing. The controlling means writes the data in the storing means in response to the writing command in the writable mode.

In the twelfth embodiment, the information processing apparatus further includes a writing command issuing means (S73, S143), and issues a writing command to the controlling means. The controlling means performs writing the data in response to the writing command in the writable mode.

According to the twelfth embodiment, according to the writing instruction from the information processing apparatus, the data downloaded from the server can be written to the storing means. The data transmission and the data writing are separately processed, capable of making it difficult to cause disappearance of the data.

A thirteenth embodiment is a download security system, and the storing means stores identification information of the storing means. The information processing apparatus includes an identification information transmitting means for transmitting the identification information stored in the storing means to the server. The server stores a plurality of first keys for encrypting the first transition command, each of which is brought into correspondence with a respective one of the plurality of identification information. The encrypting means encrypts the first transition command by utilizing the first key corresponding to the identification information of the storing means.

In the thirteenth embodiment, the storing means stores identification information of the storing means. The identification information is transmitted to the server by an identification information transmitting means (S5, S105). On the other hand, the server stores a plurality of first keys, each of which is brought into correspondence with a respective one of the plurality of identification information. That is, the first key for encrypting the first transition command is prepared for each storing means, and stored in the storing means and the server. The first transition command is encrypted by the encrypting means by utilizing the first key corresponding to the received identification information.

According to the thirteenth embodiment, it is possible to encrypt the first transition command by the first key for each storing means, and cause the controlling means to make a transition to the writable mode by the first transition command, capable of heightening the degree of security.

A fourteenth embodiment is a download security system, and the storing means stores identification information of an application program stored in the storing means. The information processing apparatus includes identification information transmitting means for transmitting the identification information stored in the storing means to the server. The server stores a plurality of first keys for encrypting the first transition command, each of which is brought into correspondence with a respective one of the plurality of identification information. The encrypting means encrypts the first transition command by utilizing the first key corresponding to the received identification information of the application program.

In the fourteenth embodiment, the storing means stores identification information of an application program stored in the storing means. The identification information is transmitted to the server by an identification information transmitting means (S105). On the other hand, the server stores a plurality of first keys, each of which is brought into correspondence with a respective one of the plurality of identification information. That is, the first key for encrypting the first transition command is prepared for each application (game), and stored in the storing means and the server. The first transition command is encrypted by the encrypting means by utilizing the first key corresponding to the received identification information.

According to the fourteenth embodiment, it is possible to encrypt the first transition command by the first key for each application, and cause the controlling means to make a transition to the writable mode by the first transition command, capable of heightening the degree of security.

A fifteenth embodiment is a download security system, and the storing means includes a first area and a second area. The controlling means performs writing by the writing means on only the first area in the writable mode to which a transition is made in response to the first transition command, and performs writing different from the writing by the writing means on the second area.

In the fifteenth embodiment, the storing means includes a first area (204) and a second area (206). The controlling means performs writing by the writing means on only the first area. That is, the controlling means writes the download data to the first area in the writable mode to which a transition is made in response to the first transition command. On the other hand, the controlling means performs writing different from the writing to the first area on the second area.

According to the fifteenth embodiment, in the writable mode to which a transition is made in response to the first transition command, writing allowing protection of data can be performed only on a predetermined region out of the storing means, and another writing not allowing protection of data according to the mode transition can be performed on the rest of the area. Thus, it is possible to perform appropriate writing by using different writing areas for different writing uses.

A sixteenth embodiment is a download security system, and the storing means stores boundary data between the first area and the second area.

In the sixteenth embodiment, the storing means stores boundary data between the first area and the second area. The controlling means can grasp the first area and the second area to access the same by reference to the boundary data of the first area and the boundary data of the second area.

A seventeenth embodiment is a download security system, and the storing means and the controlling means are provided to a storage medium attachable to the information processing apparatus.

In the seventeenth embodiment, the storing means and the controlling means are provided to the storage medium (28) detachable to the information processing apparatus. Thus, it is possible to perform stepwise protection on the writing of the download data to the storing means provided to the storage medium.

An eighteenth embodiment is a memory controller, in download security system including a server and an information processing apparatus for downloading data from the server, of controlling writing to a storing means for storing the downloaded data. The memory controller comprises a changing means for making a transition to a mode of being writable to the storing means in response to a first transition command transmitted from the server to the information processing apparatus, and a writing means for writing the data transmitted from the server to the storing means in the writable mode.

In the eighteenth embodiment, a memory controller (62) is used in a download security system (100), and controls writing to a storing means (64) for storing data downloaded from a server (102). More specifically, the memory controller includes a changing means (S43, S235) for making a transition to a mode of being writable to the storing means in response to a first transition command transmitted from the server to the information processing apparatus (10). The transition to the writable mode makes it possible to write to the storing means. The memory controller further includes a writing means (S83, S267), and writes the data downloaded from the server to the storing means in the writable mode.

According to the eighteenth embodiment, it is possible to implement the download security system high in the degree of security as in the above-described first invention.

A nineteenth embodiment is a server utilized in a download security system including an information processing apparatus for downloading data, a storing means for storing the data, and a controlling means for controlling writing to the storing means. The server comprises a transition command transmitting means for transmitting to the information processing apparatus a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means, and a data transmitting means for transmitting the data to the information processing apparatus.

In the nineteenth embodiment, a server (102) is utilized in a download security system (100), and provides data to be downloaded to an information processing apparatus (10). The system further includes a storing means (64) for storing downloaded data, and a controlling means (62) for controlling writing to the storing means. The server includes a transition command transmitting means (S33, S323), and transmits to the information processing apparatus a first transition command to cause the controlling means to make a transition to a writable mode. The first transition command is applied from the information processing apparatus to the controlling means, and in response thereto, the controlling means shifts to the writable mode. Furthermore, the server further includes a data transmitting means (S67, S341), and transmits the data to the information processing apparatus. The data is applied from the information processing apparatus to the controlling means, and written to the storing means by the controlling means in the writable mode.

According to the nineteenth embodiment, it is possible to implement the download security system as in the above-described first embodiment.

A twentieth invention is an information processing apparatus utilized in a download security system including a server, a storing means for writing data downloaded from the server, and a controlling means for controlling writing to the storing means. The information processing apparatus comprises a transition command providing means for, when a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means is received from the server, providing the first transition command to the controlling means; a data providing means for providing the data to the controlling means when the data is received from the server; and a writing command issuing means for issuing a writing command of the data to the controlling means.

In the twentieth embodiment, an information processing apparatus (10) is utilized in a download security system (100), and downloads data from a server (102). The system includes a storing means (64) for writing the downloaded data, and a controlling means (62) for controlling the writing. The information processing apparatus includes a transition command providing means (S35, S125), and, when a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means is received from the server, provides the first transition command to the controlling means. In response to the first transition command, the controlling means makes a transition to the writable mode. The information processing apparatus further includes a data providing means (S69, S141) to provide the data to the controlling means when the data is received from the server. The information processing apparatus further includes a writing command issuing means (S73, S143), and issues a writing command of the data to the controlling means. In response to the writing command, the controlling means writes the received data to the storing means.

According to the twentieth embodiment, it is possible to implement the download security system as in the above-described first embodiment.

A twenty-first embodiment is a security method in a download security system including a server, an information processing apparatus for downloading data from the server, a storing means for storing the data, and a controlling means for controlling writing to the storing means. The security method includes a step of transmitting to the information processing apparatus a first transition command to cause the controlling means to make a transition to a mode of being writable to the storing means by the server; a step of making a transition to the writable mode in response to the first transition command by the controlling means; a step of transmitting the data to the information processing apparatus by the server; and a step of writing the data to the storing means in the writable mode by the controlling means.

In the twenty-first embodiment, the security method is a security method when in a download security system (100), data downloaded from a server (102) to an information processing apparatus (10) is written to a storing means (64) by a controlling means (62). In this method, the server transmits a first transition command to causes the controlling means to make a transition to a writable mode to the information processing apparatus (S33, S323). In response to the first transition command, the controlling means makes a transition to the writable mode (S43, S235). Furthermore, the server transmits data to be downloaded to the information processing apparatus (S67, S341). The controlling means writes the data provided from the information processing apparatus to the storing means in the writable mode (S83, S267).

According to the twenty-first embodiment, it is possible to implement the download security system as in the above-described first embodiment.

According to the present embodiment, in order to write the data to be downloaded to the storing means, in response to the transition command from the server, the controlling means makes a transition to the writable mode, capable of performing stepwise protection, and heightening the degree of security. Accordingly, it is possible to provide safety with respect to unauthorized writing, and prevent unintended data from being written.

The above described features, aspects and advantages of the present embodiment will become more apparent from the following detailed description of the present embodiment when taken in conjunction with the accompanying drawings.

BEST MODE

Referring toFIG. 1, a security system (hereinafter referred to as “system”)100of an embodiment includes an information processing apparatus10and a server102. The information processing apparatus10downloads data from the server102to store the data in a predetermined memory area. The system100of this embodiment is a download security system, and is for preventing the predetermined memory area for writing downloaded data from being utilized by an unauthorized download. Furthermore, the information processing apparatus10also functions as a security system for a backup data writing area, and is for preventing a predetermined memory area for writing the backup data from being used illegally. Here, the system100may function as a security system for a backup data writing area.

It should be noted that the information processing apparatus10is implemented in a form of a portable game apparatus in this embodiment, but in another embodiment, this may be a computer in another form, such as a mobile information terminal, a cellular phone, a personal computer, a console game apparatus, or the like. Additionally, the server102is a computer, and has a CPU, a RAM, a ROM, an HDD, a communication device, and the like although illustration is omitted.

The information processing apparatus, that is, the game apparatus10can connect to the server102via an access point104and a network106. The network106is a wide area network (WAN), the Internet or the like, or may be a local area network (LAN). When downloading data from the server102, the game apparatus10connects to the access point104by wireless (or wired), and communicates with the server102on the network106via the access point104. Here, the game apparatus10fetches IP addresses of the access point104and the server102according to an input or a list selection by the user, or the like.

Referring toFIG. 2, the game apparatus10includes a first liquid crystal display (LCD)12and a second LCD14. The LCD12and the LCD14are set on a housing16so as to be arranged in predetermined positions. In this embodiment, the housing16comprises an upper housing16aand a lower housing16b, and the LCD12is provided on the upper housing16awhile the LCD14is provided on the lower housing16b. Accordingly, the LCD12and the LCD14are closely arranged so as to be longitudinally (vertically) parallel with each other.

In addition, although an LCD is utilized as a display in this embodiment, an EL (Electronic Luminescence) display, a plasmatic display, etc. may be used in place of the LCD.

As can be understood fromFIG. 2, the upper housing16ahas a plane shape little larger than a plane shape of the LCD12, and has an opening formed so as to expose a display surface of the LCD12from one main surface thereof. On the other hand, the lower housing16hhas a plane shape and a size approximately the same as those of the upper housing16a, and has an opening formed so as to expose a display surface of the LCD14at approximately the center of the horizontal direction. Also, a power switch18is provided at the right side surface of the lower housing16b.

Furthermore, the upper housing16ais provided with sound release holes20aand20bfor speakers36aand36b(seeFIG. 3) on both sides of the LCD12.

The upper housing16aand the lower housing16bare rotatably connected at a lower side (lower edge) of the upper housing16aand a part of an upper side (upper edge) of the lower housing16b. Accordingly, in a case that a game is not played, for example, if the upper housing16ais rotatably folded such that the display surface of the LCD12and the display surface of the LCD14are face to face with each other, it is possible to prevent the display surface of the LCD12and the display surface of the LCD14from being damaged, such as a flaw, etc. It should be noted that the upper housing16aand the lower housing16bare not necessarily rotatably connected with each other, and may alternatively be provided integrally (fixedly) to form the housing16.

Then, a microphone hole20cfor a microphone (not illustrated) is formed at the center of the connected portion between the upper housing16aand the lower housing16b. This makes it possible to perform game processing on the basis of a sound signal by a sound, a voice or a breath which are taken from the microphone.

Furthermore, the lower housing16bis provided with an operating switch22(22a,22b,22c,22d,22e,22L and22R). The operating switch22includes the direction instructing switch (cross switch)22a, the start switch22b, the select switch22c, the action switch (A button)22d, the action switch (B button)22e, the action switch (X button)22f, the action switch (Y button)22g, the action switch (L button)22L and the action switch (R button)22R.

The switch22ais arranged at the left of the LCD14on the one surface of the lower housing16b. The other switches22b-22gare arranged at the right of the LCD14on the one surface of the lower housing16b. In addition, the operating switches22L and22R are arranged at the right and left corners on the upper side surface of the lower housing16b. Here, the action switches22L and22R are provided on a back surface of the lower housing16b, and shown by dotted line because they are hidden under the connected portion in a front view as shown inFIG. 2.

The direction instructing switch22afunctions as a digital joystick, and is utilized for instructing a traveling direction (moving direction) of a player object (or player character) to be operated by a user or a player and instructing a traveling direction of a cursor, and so forth by operating any one of four depression portions. Also, a specific role can be assigned to each of the four depression portions, and by operating any one of the four depression portions, it is possible to instruct (designate) the assigned role.

The start switch22bis formed by a push button, and is utilized for starting (restarting), temporarily stopping (pausing) a game, and so forth. The select switch22cis formed by the push button, and utilized for a game mode selection, etc.

The action switch22d, that is, the A button is formed by the push button, and allows the player object to perform an arbitrary action except for instructing the direction, such as hitting (punching), throwing, holding (obtaining), riding, jumping, etc. For example, in an action game, it is possible to apply an instruction of jumping, punching, moving arms, etc. In a role-playing game (RPG) and a simulation RPG, it is possible to apply an instruction of obtaining an item, selecting and determining arms or command, etc. The action switch22e, that is, the B button is formed by the push button, and is utilized for making a transition to a game mode selected by the select switch22c, canceling an action determined by the A button22d, and so forth.

The action switch22f, that is, the X button and the action switch22g, that is, the Y button are formed by the push buttons, and are utilized for a subsidiary operation when the game cannot be advanced only with the A button22dand the B button22e. It should be noted that the X button22fand the Y button22gcan be used for the operations similar to the A button22dand B button22e. Of course, the X button22fand the Y button22gare not necessarily utilized in the game play.

The action switch (left depression button)22L and the action switch (right depression button)22R are formed by the push buttons, and the left depression button (L button)22L and the right depression button (R button)22R can be used for the operation the same as the A button22dand the B button22e, and also function as a subsidiary of the A button22dand the B button22e. In addition, the L button22L and the R button22R can change the roles assigned to the direction switch22a, the A button22d, the B button22e, the X button22f, and the Y button22gto other roles.

Also, on a top surface of the LCD14, a touch panel24is provided. As the touch panel24, any kinds of a resistance film system, an optical system (infrared rays system) and an electrostatic capacitive coupling system, for example, can be utilized. In response to an operation (touch input) by depressing, stroking, touching, and so forth with a stick26, a pen (stylus pen), or a finger (hereinafter, referred to as “stick26, etc.”) on a top surface of the touch panel24, the touch panel24detects coordinates of an operated position by the stick26, etc. to output coordinates data corresponding to the detected coordinates.

It should be noted that in this embodiment, a resolution of the display surface of the LCD14(the same is true for the LCD12) is 256 dots×192 dots. A detection accuracy of the touch panel24is also rendered 256 dots×192 dots in correspondence to the resolution of the display surface. However, the detection accuracy of the touch panel24may be lower than the resolution of the display surface, or higher than it.

Different game screens may be displayed on the LCD12and the LCD14. For example, in a racing game, a screen viewed from a driving seat is displayed on the one LCD, and a screen of entire race (course) may be displayed on the other LCD. Furthermore, in the RPG, a map, characters such as a player object, etc. are displayed on the one LCD, and items belonging to the player object may be displayed on the other LCD. Additionally, a game screen including a player object and a non-player object, etc. may be displayed on the one LCD, and a game screen including information relating to the player object and the non-player object or an operation screen for operating the player object can be displayed on the other LCD. Furthermore, by utilizing the two LCD12and LCD14as one screen, it is possible to display a large monster (enemy object) to be defeated by the player object.

Accordingly, the player is able to point (operate) an image such as a player object, an enemy object, an item object, an operating object, etc. to be displayed on the screen of the LCD14and select (input) commands by operating the touch panel24with the use of the stick26, etc. Also, it is possible to change the direction of a virtual camera (viewpoint) (direction of the line of sight) provided in the virtual game space (three-dimensional game space), and instruct a scrolling (gradual moving display) direction of the game screen (map).

Additionally, depending on the kind of the game, other input instructions can be made with the use of the touch panel24. For example, it is possible to input by hand texts, numbers, symbols, etc. on the LCD14of the touch panel24.

Thus, the game apparatus10has the LCD12and the LCD14as a display portion of two screens, and by providing the touch panel24on an upper surface of any one of them (LCD14in this embodiment), the game apparatus10has the two screens (12,14) and two kinds of the operating portions (22,24).

Although the first LCD12and the second LCD14are vertically arranged, the arrangement of the two LCDs may be changed as necessary. In another embodiment, the first LCD12and the second LCD14may horizontally be arranged.

Furthermore, in this embodiment, two LCDs are provided, but the number of LCDs as a display means can be changed as necessary. In another embodiment, a vertically-long LCD is provided, and by vertically dividing the display areas into two, two game screens may be displayed on the respective display areas, or a horizontally-long LCD is provided, and by horizontally dividing the display area side by side, two game screens may be displayed on the respective display areas.

In addition, the stick26can be housed in the housing portion (not shown) provided on the lower housing16b, for example, and taken out as necessary. It should be noted that if the stick26is not provided, the housing portion also need not to be provided.

Moreover, the game apparatus10includes a memory card (or cartridge)28. The memory card28is a storage medium detachable to the game apparatus10, and inserted into a loading slot30(shown by dotted lines inFIG. 2) provided on an upper edge surface of the lower housing16b. A connector32(seeFIG. 3) for connecting to a connector60provided at an end portion of the memory card28in the loading direction is provided at a depth portion of the loading slot30, and when the memory card28is loaded into the loading slot30, the connectors are connected with each other, and therefore, the memory card28is accessible by a CPU34(seeFIG. 3) of the game apparatus10.

Furthermore, although omitted inFIG. 1, a battery accommodating box is provided on a rear surface of the lower housing16b, a volume switch, an earphone jack, etc. are provided on the lower edge surface (bottom surface) of the lower housing16b, and an external expansion connector is provided on the upper edge surface (top surface), for example.

FIG. 3is a block diagram showing an electrical configuration of the game apparatus10. Referring toFIG. 3, the game apparatus10includes an electronic circuit board38, and on the electronic circuit board38, circuit components, such as a CPU34, etc. are mounted. The CPU34is connected to the above-described connector32via a bus40, and is connected with a RAM42, a first graphics processing unit (GPU)44, a second GPU46, an input-output interface circuit (hereinafter, referred to as “I/F circuit”)48, an LCD controller50, and a wireless communication portion58.

The connector32is detachably connected with the memory card28as described above. The memory card28includes a memory controller62and a flash memory64, and the memory controller62is connected to the flash memory64and the connector60via a bus. Accordingly, as described above, the CPU34can access the flash memory64via the memory controller62.

The memory controller62is a controlling apparatus for controlling writing and reading to and from the flash memory64. The memory controller66has a RAM66as an internal memory.

The flash memory64stores in advance a game program for a game to be executed in the game apparatus10, image data (images of characters and objects, background images, item images, icon (button) images, message images, etc.) and data of sound (music) (sound data), etc. necessary for the game. Furthermore, as described later, in the flash memory64, an area for saving downloaded data and an area for storing backup data, such as proceeding data of the game and result data of the game are provided. Furthermore, in this embodiment, a NAND-type flash memory is applied as a flash memory64. In another embodiment, another nonvolatile memory may be applied.

The RAM42of the game apparatus10is utilized as a buffer memory or a working memory. That is, the CPU34loads the game program, the image data, the sound data, etc. stored in the memory card28into the RAM42, and executes the loaded game program. Furthermore, the CPU34executes a game processing while storing data (game data, flag data, etc.) temporarily generated or obtained in correspondence with a progress of the game in the RAM42.

It should be noted that the game program, the image data, the sound data, etc. are read from the memory card28entirely at a time, or partially and sequentially so as to be stored into the RAM42.

Here, in the game apparatus10, an application other than the game may be executed, and in such a case, necessary data for the program and the image data, etc. as to the application may be stored in the flash memory64of the memory card28. Furthermore, sound (music) data may be stored as required.

Each of the GPU44and the GPU46forms a part of a rendering means, is constructed by, for example, a single chip ASIC, and receives a graphics command (drawing instruction) from the CPU34to generate image data according to the graphics command. It should be noted that the CPU34applies an image generation program (included in the game program) required to generate the image data to both of the GPU44and GPU46in addition to the graphics command.

Furthermore, the GPU44is connected with a first video RAM (hereinafter referred to as “VRAM”)52, and the GPU46is connected with a second VRAM54. The GPU44and the GPU46respectively access the first VRAM52and the second VRAM54to obtain necessary data (image data: polygon data, texture data, etc.) to execute a graphics command.

In addition, the CPU34writes image data necessary for drawing to the first VRAM52and the second VRAM54via the GPU44and the GPU46. The GPU44accesses the VRAM52to produce image data necessary for drawing and stores the same in a rendering buffer of the VRAM52. The GPU46accesses the VRAM54to produce image data for drawing and stores the same in the rendering buffer of the VRAM54. As a rendering buffer, a frame buffer, a line buffer, etc. may be adopted.

The VRAM52and the VRAM54are connected to the LCD controller50. The LCD controller50includes a register56, and the register56consists of one bit, for example, and stores a value of “0” or “1” (data value) according to an instruction of the CPU34. The LCD controller50outputs the image data produced by the GPU44to the LCD12, and outputs the image data produced by the GPU46to the LCD14in a case that the data value of the register56is “0”. Additionally, the LCD controller50outputs the image data produced by the GPU44to the LCD14, and outputs the image data produced by the GPU46to the LCD12in a case that the data value of the register56is “1”.

Furthermore, the LCD controller50can directly read the image data from the VRAM52and the VRAM54, or read the image data from the VRAM52and the VRAM54via the GPU44and the GPU46.

In addition, the VRAM52and the VRAM54may be provided in the RAM42, or a rendering buffer and a Z buffer therefor may be provided in the RAM42.

The I/F circuit48is connected with the operating switch22, the touch panel24and the speakers36a,36b. Here, the operating switch22is the above-described switches22a,22b,22c,22d,22e,22f,22g,22L and22R, and in response to an operation of the operating switch22, a corresponding operation signal (operation data) is input to the CPU34via the I/F circuit48. Furthermore, coordinates data output from the touch panel24is input to the CPU34via the I/F circuit48. In addition, the CPU34reads from the RAM42the sound data necessary for the game, such as a game music (BGM), a sound effect or voices of a game character (onomatopoeic sound), etc., and outputs it from the speakers36a,36bvia the I/F circuit48.

The wireless communication portion58is a communication means for transmitting and receiving data with another game apparatus10or communication equipment by radio waves. Here, the weak radio wave transmitted and received by the game apparatus10is set in intensity to such a degree as not to be restricted by the Radio Law. When the CPU34applies data such as game data, a command, etc. to the wireless communication portion58, the wireless communication portion58modulates communication data to be transmitted to the opponent into a wireless signal and transmits it from an antenna. Furthermore, the wireless communication portion58receives a wireless signal from the opponent by the antenna to demodulate it to data, and applies the data to the CPU34. By utilizing the wireless communication portion58, the game apparatus10can receive and transmit data with other game apparatuses10to thereby execute a communication game. The game apparatus10can connect to the access point104and the network106via the wireless communication portion58, and thus can download a program and data from a server102on the network106, and communicate with another game apparatus10via the network106.

In the system10, a predetermined area for writing the data downloaded from the server102is provided to the flash memory64of the memory card28. Furthermore, a predetermined area for writing backup data to be generated during execution of a game (application) is provided to the flash memory64. One example of the memory map of the flash memory64is shown inFIG. 4. The flash memory64is provided with an information area200, a game area202, a download area204, a backup area206, etc. Here,FIG. 4shows a part of the memory map, and can be provided with other areas.

The download area204is an area for writing data downloaded from the server102, and the backup area206is an area for writing backup data. Here, in the information area200, as shown inFIG. 8described later, header information of the flash memory64and predetermined data are stored in advance. Furthermore, in the game area202, a game program and data are stored in advance. The game program includes a game processing program, a download processing program, a backup processing program, etc.

An operation of the memory controller62is controlled depending on a mode such that the writing area provided to the flash memory64is protected stepwise. For each mode, an executable operation by the memory controller62is restricted, and there is a need of switching the mode to execute a necessary operation. An outline of a mode transition of the memory controller62is shown inFIG. 5. The memory controller62has a game mode, a DL (Download) secure mode, a download mode, a backup mode, etc. The memory controller62is configured to make a mode transition in response to various transition commands applied externally (the CPU34being a host, or the server102on the network106). Additionally, the CPU34issues the transition command by executing the application program (a program stored in the game apparatus10may be appropriate) stored in the memory card28.

The game mode is a normal mode. When the power of the game apparatus10is turned on, for example, an electric power is supplied from the game apparatus10to the memory controller62so as to activate it. When being activated, the memory controller62is placed in the game mode, and is basically in the game mode during execution of the game (more specifically, when no data is required to be written to the flash memory) as well. During execution of the game, a program and data have to be read from the flash memory64as necessary, and in this game mode, it is desirable that reading from the flash memory64is performed at high speeds. Thus, in the game mode, the command to be applied to the memory controller62may not be encrypted, but even if the command is encrypted, the command may be protected to such a degree to be encrypted by an algorism of low processing load. Additionally, in the game mode, even if the host (CPU34) issues a data writing command to the flash memory64, the memory controller62does not accept the command, and thus it is impossible to write the data into the flash memory64.

The flash memory64is provided with a download area204for writing downloaded data in order to download data from the server102according to a selection by the player or according to a program during execution of the game. In a case of downloading, the degree of security has to be heightened for protecting the flash memory64from an unauthorized computer access. Thereupon, the memory controller62makes a transition from the game mode in which an access to the flash memory64is easy to a mode of a high degree of security.

Furthermore, a transition is not directly made from the game mode to the download mode in which download data can be written, but another mode, that is, a DL secure mode in this embodiment is interposed so as to perform protection at two levels when downloading.

More specifically, when a gCHG_DL_MODE command is applied to the memory controller62in the game mode, the memory controller62makes a transition from the game mode to the DL secure mode. Here, the gCHG_DL_MODE command is a transition command for making a transition from the game mode to the DL secure mode, and is issued by the CPU34of the game apparatus10.

The DL secure mode is a mode provided for heightening the degree of security at a time of downloading. In the DL secure mode, a command to be applied to the memory controller62is encrypted. More specifically, an encrypted dsCHG_MODE command is applied to the memory controller62. Here, the dsCHG_MODE command is a transition command for making a transition from the DL secure mode to the download mode. The transition command to the download mode is not issued from the CPU34of the game apparatus10, but transmitted from the server102after it being encrypted in the server102. It should be noted that the CPU34of the game apparatus10cannot generate the dsCHG_MODE command. This is because the dsCHG_MODE command is to be applied to the memory controller62in the encrypted state, and the CPU34of the game apparatus10does not have key data for the encryption. The memory controller62decrypts the command received in the DL secure mode, and makes a transition to the download mode when the command is the dsCHG_MODE command. For encryption of the transition command, the server102and the memory card28store a common key.

Thus, it is possible to perform protection with respect to a transition from the DL secure mode to the download mode. Furthermore, a transition command to the DL secure mode is issued from the CPU34being the host while a transition command to the download mode is issued from the server102. That is, the transition to the download mode is enabled by cooperation between the CPU34and the server102, so that it is possible to further heighten the degree of security.

In the download mode, data downloaded from the server is written to the download area204. The data to be downloaded is encrypted in the server and transmitted while the received data is decrypted by the memory controller62. Thus, it is possible to protect the data to be downloaded. Furthermore, the encryption key in the DL secure mode and the encryption key in the download mode are differentiated from each other, resulting in the two levels of security. Thus, it is possible to separately protect the transition command and the data.

The download data is encrypted in the server as described above, and when receiving the encrypted data, the CPU34transfers it to the memory controller62. For writing the data, the CPU34issues a writing command (dWR_PAGE command). In response to the writing command, the memory controller62executes processing for writing the data, such as decryption of data, etc. If it is authenticated that the received data is authorized data, the memory controller62writes this data to the download area204. The writing to the download area204is made possible only in the download mode. The memory controller62is configured to accept the writing command issued by the CPU34only in the download mode, and thus, in another mode, writing to the download area204is made impossible.

After completion of writing the predetermined data, in response to a dlCHG_MODE command, the memory controller62makes a transition to the game mode. Here, the dlCHG_MODE command is a transition command for making a transition from the download mode to the game mode, and issued from the CPU34.

In the mode transition as to the downloading, accessibility to the flash memory64is changed.FIG. 6shows the changes of the memory map of the flash memory64when a transition to the download mode is made. First, in the game mode, the game area202and the download area204are set to be readable only. Then, when a transition is made to the DL secure mode in response to the gCHG_DL_MODE command, all the areas are set to unreadable and unwritable states. The processing of the encrypted dsCHG_MODE command is performed in a state that all the areas of the flash memory64are made inaccessible. Then, when a transition is made to the download mode in response to the dsCHG_MODE command, the download area202is made accessible. Moreover, in this embodiment, only the block designated by the dsCHG_MODE command out of the download area202is made accessible. Thus, depending on the transition of the mode, readable and writable states are changed with respect to each area of the flash memory64, that is, the memory map is changed for each mode, capable of heightening the degree of security.

On the other hand, during execution of the game, the CPU34generates backup data of the game. The backup area206for writing the backup data is provided to the flash memory64. The writing to the backup area206itself is to be locally performed in nature, but program data illegally acquired from the network106, for example, may be written to the backup area206. In order to prevent the backup area206from being illegally used, the degree of security of the backup area206is heightened.

As shown inFIG. 5, in order to perform writing to or reading from the backup area206, the memory controller62makes a transition from the game mode to the backup mode in response to a gCHG_BK_MODE command. Here, the gCHG_BK_MODE command is a transition command for making a transition from the game mode to the backup mode, and is issued to the memory controller62by the CPU34being the host. Additionally, in response to a bCHG_MODE command, the memory controller62makes a transition to the game mode. Here, the bCHG_MODE command is a transition command for making a transition from the backup mode to the game mode, and is issued to the memory controller62by the CPU34being the host.

In the backup mode, when data is to be written, data to be written is transformed into a predetermined format by the CPU34, and the data in the predetermined format is written to the backup area206by the memory controller62. On the other hand, when data is to be read, it is determined whether or not the read data is in the predetermined format by the memory controller62. If it is determined that the data is in the predetermined format, the data is output to the CPU34.

However, if it is determined that the data is not in the predetermined format, the data is regarded as data being illegally written to the backup area, and the memory controller62makes a transition to an illegal mode. When the transition to the illegal mode is made, the data is not output, thus capable of preventing the backup area from being illegally used.

Additionally, in this embodiment, when it is determined that the written data is not in the predetermined format, the memory controller62outputs no data, but in another embodiment, the memory controller62outputs predetermined data indicating that this is unauthorized data to the CPU34to thereby allow the CPU34to perceive the illegally written data. In this case as well, the written data is not normally output, so that it is possible to protect the backup area206from the unauthorized use.

In the mode transition as to the backup as well, accessibility to the flash memory64is changed.FIG. 7shows the changes of the memory map of the flash memory64when a transition is made to the backup mode. In the game mode, the game area202is set to a state of being readable only, and the backup area206is set to unreadable and unwritable states. Then, when a transition to the backup mode is made in response to the gCHG_BK_MODE command, only the backup area206is set to the accessible state. Moreover, in this embodiment, only the block designated by the gCHG_BK_MODE command out of the backup area206is made accessible. Thus, as in the downloading case, in response to the transition of the mode, readable and writable states are changed with respect to each area of the flash memory64, that is, the memory map is changed for each mode, capable of heighten the degree of security.

It should be noted that in this embodiment, writing to the backup area206is made possible only after the transition to the backup mode. This is because of preventing the data written once at the factory, for example, from being erroneously overwritten. However, as a modified example, the backup area206out of the flash memory64may be writable even in the game mode.

FIG. 8shows one example of a memory map of the information area200of the flash memory64. Additionally,FIG. 8is a part of the information area200and also stores other necessary data, such as a start address of the game area202, etc.

In a memory area210, a start address of the download area204is stored in advance, and in a memory area212, a start address of the backup area206is stored in advance. A size or an end address of the download area204and the backup area206may be stored for the rest. As header information, data capable of discriminating each of the download area204and the backup area206and other areas, that is, boundary data of each area may be stored. The memory controller62can grasp and access each area by referring to the boundary data of each area.

In a memory area214, an encrypted key1is stored in advance. The key1is a key for DL secure mode (encryption key), that is, a key to be used in the DL secure mode. By the key1, the dsCHG_MODE command encrypted in the server102is decrypted.

Additionally, the flash memory64stores encrypted keys, so that it is possible to make the content of the key unreadable even if the flash memory64is taken out from the memory card28, and the data is illegally read.

In a memory area216, an encrypted key2is stored in advance. The key2is a key for the download mode (encryption key), that is, a key to be utilized in the download mode. By the key2, the data to be downloaded which is encrypted in the server102is decrypted.

In a memory area218, an encrypted key3is stored in advance. The key3is a key for message digest authentication (encryption key) of the data to be downloaded, that is, a key for calculating a message integrity code (MIC) as an authentication symbol of the data to be downloaded. It should be noted that in this embodiment, a configuration in which a part of the key3is the same as a part of the key2is adopted. That is, the key3is a key obtained by replacing a part of the key2(part except for the common part). Then, in the memory area218, only the above-described rest part of the key3(part except for the part common to the key2) is encrypted and stored. When the complete key3is required for the MIC calculation, the key3of the memory area218and the common part of the key2are utilized.

In a memory area220, a unique ID indicating identification information of the memory card28(flash memory64) is stored. Furthermore, in a memory area222, a game ID indicating identification information of the game or the application of the memory card28is stored. The game ID may be a title and a kind of the game.

Additionally, in this embodiment, in the flash memory64, a key being specific to the memory card28is stored. That is, keys1,2and3corresponding to the unique ID are stored. In another embodiment, a key being specific to the game title, that is, keys1,2and3corresponding to the game ID may be stored.

FIG. 9shows one example of a memory map of the internal RAM66of the memory controller62. Here,FIG. 9shows a part of the memory map of the internal RAM66.

In a memory area300, a current mode is stored. By this mode data, the memory controller62can grasp the current mode. When receiving a command, the memory controller62may determine, before execution of the command, whether or not the command is a command defined as being issued in the current mode. Thus, it is possible to determine a normally issued command.

A memory area302is a key memory area. Keys corresponding to the current mode are stored. As described above, in this embodiment, each key is encrypted and stored in the information area200of the flash memory64. The memory controller62reads the key in the work area of the internal RAM66to decrypt the same, and stores the decrypted key in the memory area302. Furthermore, when a transition is made in response to each transition command, each key may be developed in the memory area302.

More specifically, as shown inFIG. 10, in the DL secure mode, in the key memory area302, a decrypted key1and a decrypted key3(strictly, a part of the key3in this embodiment) are stored. Here, the key1is a key for the DL secure mode, but in this embodiment, in the game mode as well, predetermined data (the random number and the unique ID or the game ID) may be encrypted by utilizing the key1, so that the key1has already been stored in the memory area302from the game mode. Furthermore, the key3is made resident until the power is turned off. The part of the key3is smaller than the part shared with the key2, so that this is developed in advance. Additionally, when a transition from the game mode to the DL secure mode is made, the key1is read again from the flash memory64so as to be decrypted and then developed in the memory area302. This is a re-development by way of caution in view of the fact that the data on the internal RAM66may be rewritten due to any accident.

When a transition to the download mode is made, the key1is replaced with the key2. That is, the key1is erased from the memory area302, and the key2is read in the work area from the flash memory64so as to be decrypted, and the decrypted key is stored in the memory area302. Furthermore, the key3is stored as it is. As described above, the key2is used for encrypting the data to be downloaded in the download mode while the key3is used for calculating the MIC of the data to be downloaded. As in this embodiment, one part is shared between the key2and the key3, so that the size of the area to be ensured for the key memory area302is reduced, resulting in reduction in the capacity of the internal RAM66and the cost.

Alternatively, in another embodiment, the complete key3may be stored in advance, and the key3is developed in the key memory area302.

Returning toFIG. 9, a memory area304stores a random number. The random number is a pseudo random number, and generated when predetermined processing is executed in the memory controller62. Furthermore, in the memory area306, a flag indicating a write protection is stored. When the write protection is turned on, writing by the flash memory64to the download area204is inhibited.

FIG. 11shows one example of data to be stored in the database of the server102. Here, the database is stored in an HDD, a ROM, or the like of the server102.

In the database, the data to be downloaded is stored. The data to be downloaded is data to be stored in the download area204of the memory card28. For example, a file for downloading may be prepared for each game title, that is, in correspondence with the game ID.

Furthermore, key data is stored in the database. In this embodiment, as described above, a specific key is prepared for each memory card28, so that a key1, a key2and a key3are stored by being brought into correspondence with the unique ID. It should be noted that similar to the memory card28, with respect to the key3, a part may be shared with the key2, and therefore, the rest part is stored, or the complete key3may be stored.

Additionally, in another embodiment, keys for each game title may be prepared, that is, the keys1,2and3may be stored by being brought into correspondence with the game ID.

FIG. 12shows one example of a memory map of the RAM of the server102. Here, the memory map shows a part, and other necessary program and data are also stored.

A memory area400is a program memory area, and stores a program for executing the download processing of the server102. The program is read from the ROM, the HDD, or the like.

A memory area402is a data memory area, and stores data read from the ROM, the HDD, or the like, data generated by the CPU, data received from the game apparatus10, etc.

In a memory area404, a unique ID received first is stored, and in a memory area406, a game ID is stored. More specifically, when download processing is started, the unique ID and the game ID are first transmitted from the game apparatus10, and the unique ID and the game ID are respectively stored in the memory areas404and406.

In a memory area408, the keys read from the database are stored. In this embodiment, the keys1,2and3corresponding to the unique ID are stored.

In a memory area410, a random number and a unique ID are stored. More specifically, data of the random number and the unique ID which are encrypted with the key1are transmitted from the game apparatus10after the first unique ID, and the random number and the unique ID obtained by decrypting the reception data with the key1are stored in the memory area410.

In a memory area412, a block address is stored. More specifically, following the above-described random number and unique ID, a block address where writing is made is transmitted from the game apparatus10, and the block address is stored in the memory area412. In this embodiment, the server102transmits a transition command which designates the block address to the memory controller62via the game apparatus10to designate the block address where a file to be downloaded is written.

In a memory area414, a write file is stored. More specifically, the file for the data to be downloaded read from the database is stored. If the download data is prepared for each game title, the data corresponding to the game ID is stored. Alternatively, the data corresponding to the unique ID, that is, the data for each memory card28may be read, and predetermined data may be read irrespective of the game ID and the unique ID. From the write file, a predetermined amount of data is sequentially fetched and transmitted to the game apparatus10.

FIG. 13shows one example of a memory map of the RAM42of the game apparatus10in the download processing. Additionally,FIG. 13shows a part of the memory map, and other necessary data is stored.

A memory area500is a program memory area, in which a program for executing the processing by the game apparatus10is read from the memory card28and stored. The program includes game processing program, download processing program, etc.

A memory area502is a data memory area, in which data fetched from the memory card28, data generated by the CPU34, data received from the server102, etc. are stored.

In a memory area504, a game ID is stored. The game ID is read from the memory area222of the information area200of the flash memory64by the memory controller62so as to be output, and applied to the CPU34via the connector60, the connector32, etc when the power is turned on. The game ID, when the unique ID is transmitted to the server102at first, is transmitted together therewith.

In a memory area506, a block address where the downloaded data is to be written is stored. In the game apparatus10, a space area of the download area204is ensured, and a block address to be written is decided from the space area. The block address is transmitted to the server102.

In a memory area508, a file data amount to be downloaded from the server102is stored. The file data amount of the file to be downloaded is transmitted from the server102, so that the received file data amount is stored in the memory area508. By the file data amount, the CPU34can determine whether or not all data of the write file have been written.

FIG. 14shows one example of a memory map of the RAM42of the game apparatus10at a time of the backup processing. Here,FIG. 14also shows a part of the memory map similar toFIG. 13.

The memory area500is a program memory area, and stores the game processing program, the backup processing program, etc. which are read from the memory card28.

In the memory area504of the data memory area502, similar to the download processing inFIG. 13, the game ID read from the memory card28is stored.

In a memory area510, data to be written is stored. That is, the backup data generated during execution of the game (application) by the CPU34is stored.

In a memory area512, data with parity is stored. The data to be written is transformed in a predetermined format by the CPU34and then written to the backup area206. In this embodiment, a parity bit is added to the backup data. The data with parity is written to the backup area206.

FIG. 15shows one example of the data with parity.FIG. 15is structural example of page data (512 bytes) of the backup area206, and in this embodiment, the data structure of each byte is “7-bit data”+“parity (1 bit) of the 7-bit data”. That is, with respect to the data to be written, the parity bit of one bit is added to every 7 bits to thereby generate the data with parity. For example, in a bit string of bits0-6, if there is an even number of “1”, “1” is written to the bit7while if there is an odd number of “1” in the bite string, “0” is written to the bit7.

In a memory area514, a block address to be written is stored. The CPU34of the game apparatus10ensures a space area of the backup area206, decides a block address where the data with parity is to be written, and stores the block address in the memory area514. The block address to be written is designated in the transition command for making a transition to the backup mode.

In a memory area516, a block address to be read is stored. The CPU34confirms a storing position of the data to be read of the backup area206, decides the block address to be read, and stores the block address in the memory area516. The block address to be read is designated in the transition command for making a transition to the backup mode.

In a memory area518, the data read from the backup area206of the memory card28is stored. Whether the data to be read from the backup area206is data with parity or not is checked by the memory controller62when being read. If the data is read from the backup area206, the data is data authorizedly written to the backup area206, so that the CPU34can remove the parity from the read data to transform it to the original data, and can use the data. On the other hand, if it is determined that the data of the backup area206is data unauthorizedly written data as a result of the parity check, the memory controller62makes a transition to the illegal mode so as to output no data. Thus, the reading processing of the backup data has not been finished, so that a normal operation cannot be performed.

The entire operation of the system10during the download processing is briefly explained with reference toFIG. 16toFIG. 19. It should be noted that an operation of each of the game apparatus10, the memory controller62and the server102at a time of the download processing is explained by utilizing an individual flowchart.

The download processing is started when the memory controller62of the memory card28is in the game mode. Referring toFIG. 16, when the download processing is started, the CPU34of the game apparatus10issues a gRD_UID command to the memory card28in a step S1. The gRD_UID command is a command for reading a unique ID from the memory card28. In response thereto, the memory controller62reads a unique ID from the flash memory64and outputs the same to the game apparatus10in a step S3. The CPU34transfers the received unique ID to the server102in a step S5, and the CPU of the server102stores the received unique ID in the RAM. Thus, the unique ID of the memory card28is transmitted to the server102. The unique ID is compared with a unique ID which is received later for authenticating the memory card28.

Succeedingly, the CPU34of the game apparatus10issues a gRD_IF command to the memory card28in a step S9. The gRD_IF command is a command for reading the random number and the unique ID in the memory card28. In response thereto, the memory controller62outputs the generated random number and the unique ID read from the flash memory64to the game apparatus10in a step S11. Here, the random number and the unique ID are encrypted by the key1developed in the internal RAM66. The CPU34transfers the received data to the server102in a step S13. The CPU of the server102decrypts the received data with a key1in a step S15. The key1to be used is the key1corresponding to the unique ID. Then, the CPU of the server102determines whether or not the unique ID decrypted in the step S15and the unique ID received first in the step S7match with each other in a step S17. If “NO” in the step S17, that is, if the unique ID is different from the unique ID first received, since the memory card28cannot be acknowledged as an authorized card, the CPU of the server102ends the download writing processing in a step S19.

On the other hand, if “YES” in the step S17, that is, if it is determined that the memory card28is the authorized card by the server102, the CPU34of the game apparatus10designates a block address for writing data to be downloaded in the download area204in a step S21. Furthermore, the CPU34issues a gCHG_DL_MODE command to the memory card28in a step S23. The gCHG_DL_MODE command is a transition command for making a transition from the game mode to the DL secure mode. In response thereto, the memory controller62makes a transition to the DL secure mode in a step S25.

Furthermore, in a step S27, the CPU34of the game apparatus10transmits the block address decided in the step S21to the server102. In response thereto, the CPU of the server102generates a dsCHG_MODE command in a step S29. The dsCHG_MODE command is a transition command for making a transition from the DL secure mode to the download mode. The transition command is generated by utilizing the random number and the unique ID acquired in the step S15and the block address received in the step S29. Here, the random number and the unique ID are utilized for authentication in the memory controller62, and by the block address, the block address where the download data is to be written is designated.

Succeedingly, in a step S31inFIG. 17, the CPU of the server102encrypts the generated dsCHG_MODE command with the key1. Then, in a step S33, the CPU of the server102transmits the encrypted dsCHG_MODE command to the game apparatus10. The CPU34of the game apparatus10transfers the received data to the memory card28in a step S35. The memory controller62receives the data, and decrypts the received data with the key1in a step S37. Thus, from the dsCHG_MODE command, the random number and the unique ID can be acquired, and the designated block address can also be acquired.

The memory controller62determines whether or not the unique ID and the random number which are acquired from the command match with the random number and the unique in the memory card28in a step S39. If “NO” in the step S39, that is, if the received command is not the authorized command, the memory controller62makes a transition to the illegal mode in a step S41. This hinders the download processing from advancing to thereby prevent the unauthorized download from being performed.

Alternatively, if “YES” in the step S39, that is, if the received command is the authorized command, the memory controller62makes a transition to the download mode in a step S43, and makes only the designated block accessible in a step S45. This makes it possible to perform writing to the block designated by the transition command to the download mode. Furthermore, at this time, the key2for download mode is decrypted and developed in the internal RAM66.

Furthermore, in a step S47, the CPU34of the game apparatus10issues a dlRD_IF command to the memory card28. The dlRD_IF command is a command for reading the random number and the unique ID. In response to the command, the memory controller62encrypts the random number and the unique ID with the key2, and outputs the same to the game apparatus10in a step S49. The CPU34of the game apparatus10receives the data and transfers the received data to the server102in a step S51. In response thereto, the CPU of the server102receives the data, and decrypts the data by using the key2in a step S53. Thus, the server102acquires the random number and the unique ID from the memory card28. The random number and the unique ID are used later as initial values when an MIC of the data to be downloaded is calculated, and are also used as initial values for encryption of the data to be transmitted from server102.

In addition, in a step S55inFIG. 18, the CPU34of the game apparatus10issues a dlPRT_OFF command to the memory card28. The dlPRT_OFF command is a command for canceling the write protection. In response to the command, the memory controller62turns the write protection off, making it possible to execute writing to the designated block of the download area204.

Succeedingly, in a step S59, the CPU of the server102prepares data to be downloaded, that is, a write file. Then, in a step S61, the CPU of the server102fetches data of a predetermined size (2 kbytes in this embodiment) from the write file. The transmission of the write file from the server102to the game apparatus10(to the memory card28) is performed by the predetermined size.

Then, in a step S63, the CPU of the server102calculates an MIC of a predetermined size (8 bytes in this embodiment) from the data of 2 kbytes by using the key3. As an initial value for the calculation of the MIC, the random number and the unique ID which are acquired in the step S53are used. In addition, the CPU of the server102generates data obtained by adding the MIC of 8 bytes to the data of 2 kbytes, and encrypts the generated data with the key2in a step S65. Here, as an initial value for the encryption, the random number and the unique ID which are acquired in the step S53are used. Then, in a step S67, the CPU of the server102transmits the encrypted data to the game apparatus10.

In response thereto, in a step S69, the CPU34of the game apparatus10transmits a page address to be written together with the received data to the memory card28. In response thereto, in a step S71, the memory controller62receives the data.

Succeedingly, in a step S73, the CPU34of the game apparatus10issues a dWR_PAGE command to the memory card28. The dWR_PAGE command is a command for writing the data transmitted to the memory card28to the download area204. In response to the command, the memory controller62decrypts the received data received in the step S71with the key2in a step S75. Thus, the data obtained by adding the MIC of 8 bytes to the data of 2 kbytes can be acquired.

In addition, in a step S77, the memory controller62calculates an MIC of 8 bytes with respect to the acquired data of 2 kbytes with the key3. When the MIC is calculated, the random number and the unique ID which are transmitted in the step S49are utilized as initial values.

Then, in a step S79, the memory controller62determines whether or not the calculated MIC and the MIC acquired through the decryption match with each other. If “NO” in the step S79, that is, if the authorized download data is not received, the memory controller62does not perform writing in a step S81. Thus, unauthorized data is not written to the download area204.

On the other hand, if “YES” in the step S79, that is, if the authorized data is received, the memory controller62writes the received data of 2 Bytes to the designated block of the download area204in a step S83.

Succeedingly, the CPU34of the game apparatus10determines whether or not writing of the file is completed or writing by one block is completed in a step S85. In the download mode of this embodiment, within a fixed range (one block in this embodiment) from the designated block address, it is possible to write data without the transition command from the server102. Accordingly, until the writing by one block is completed, or until data less than one block of the writing file is completed, operations of transmitting the encrypted data by the CPU of the server102, and decrypting the data and writing the same by the memory controller62are repeatedly performed. That is, if “NO” in the step S85, the process returns to the step S61inFIG. 18. Thus, making the use of the transition command from the server102unnecessary as to the writing within the fixed range offers advantages of capable of reducing the load of the server102, and shortening the processing on the side of the game apparatus10as well.

On the other hand, in a case that file writing by one block or more has to be performed, after ending the download mode once, the process makes a transition to the game mode. The transition command is transmitted from the server102again to change the mode of the memory controller62to the download mode, and then, downloading the data is performed.

That is, if “YES” in the step S85, the CPU34of the game apparatus10issues a dlCHG_MODE command to the memory card28in a step S87. The dlCHG_MODE command is a transition command for making a transition from the download mode to the game mode. In response thereto, the memory controller62makes a transition to the game mode in a step S89.

In addition, the CPU34of the game apparatus10determines whether or not the writing of the file is completed in a step S91. If “NO” in the step S91, that is, if there is unwritten data in the write file, the process returns to the step S9inFIG. 16to repeat the processing from the game mode. On the other hand, if “YES” in the step S91, that is, if all data of the write file is written, the download processing is ended.

Succeedingly, an operation of each of the game apparatus10, the memory controller62and the server102in the download processing is explained.

FIG. 20toFIG. 22show one example of an operation of the game apparatus10in the download processing. When starting the download processing, in a step S101shown inFIG. 20, the CPU34issues a gRD_UID command to the memory card28. The gRD_UID command is a command for reading a unique ID. Furthermore, the gRD_UID command is issued when the memory controller62is in the game mode, so that this may be encrypted by an algorithm of a relatively low processing load (scramble, for example) and output to the memory card28.

When a command and data are transmitted from the game apparatus10to the memory card28, the CPU34applies the command and the data to the connector32, and then, the command and the data are applied to the memory controller62via the connector60.

Next in a step S103, the CPU34determines whether or not the unique ID is received from the memory card28. In response to the gRD_UID command, the memory controller62returns the unique ID, and thus, reception of the data from the memory controller62via the connector32is waited.

If “YES” in the step S103, that is, if the unique ID from the memory controller62is received, the CPU34transmits the unique ID and the game ID to the server102in a step S105. More specifically, the received unique ID is stored in the data memory area502of the RAM42and the game ID stored in the memory area504is read, whereby the data including the unique ID and the game ID is transmitted.

It should be noted that when the data is transmitted from the game apparatus10to the server10, the CPU34applies the data to the wireless communication portion58, and then, the data is applied from the wireless communication portion58to the server102via the access point104and the network106.

Succeedingly, the CPU34issues a gRD_IF command to the memory card28in a step S107. Here, the gRD_IF command is a command for reading the random number and the unique ID. The gRD_IF command may also be encrypted by an algorism of a relatively low processing load like scramble and may be transmitted. Then, in a step S109, the CPU34determines whether or not the data (encrypted random number and unique ID) is received from the memory card28. In response to the gRD_IF command, the memory controller62returns the aforementioned data, and thus reception of the data is waited.

If “YES” in the step S109, that is, if the data from the memory controller62is received, the CPU34transmits the received data (encrypted random number and unique ID) to the server102in a step S111.

Succeedingly, in steps S113and S115, it is determined whether or not the result as to whether or not the memory card28is an authorized card is received from the server102via the wireless communication portion58. The server102returns the result of the authentication of the memory card28in response to the data transmission in the step S111, and thus reception of the data from the server102is waited. More specifically, in the step S113, the CPU34determines whether or not the fact that the memory card28is an authorized card is received from the server102. If “NO” in the step S113, the CPU34determines whether or not the fact that the memory card28is not an authorized card is received in the step S115. If “NO” in the step S115, the process returns to the step S113.

If “YES” in the step S115, that is, if it is regarded that an unauthorized memory card28is attached, the download processing is ended. Thus, it is possible to avoid downloading to the unauthorized memory card28.

On the other hand, if “YES” in the step S113, that is, if it is assumed that the authorized memory card28is attached, the CPU34ensures a space area of the download area204and decides the block address to be written in a step S117. Information about which area out of the memory area of the flash memory64is used, or which area is a space area is stored in the information area200as header information, for example. Thus, the CPU34generates management data of the flash memory64on the basis of the header information, ensures the space area on the basis of the management data, and decides the block address to be written. The decided block address is stored in the memory area506. After completion of the step S117, the process proceeds to a step S119inFIG. 21.

In the step S119inFIG. 21, the CPU34issues a gCHG_DL_MODE command to the memory card28. The gCHG_DL_MODE command is a transition command for making a transition to the DL secure mode. Here, the gCHG_DL_MODE command may be encrypted according to an algorithm of a relatively low processing load such as a scramble so as to be transmitted. Succeedingly, in a step S121, the CPU34transmits the block address decided in the step S117to the server102.

Then, in a step S123, the CPU34determines whether or not the data (encrypted dsCHG_MODE command) is received from the server102. In response to the transmission in the step S121, the server102returns the data, and thus, reception of the data is waited.

If “YES” in the step S123, that is, if receiving the aforementioned data, the CPU34transmits the received data (encrypted dsCHG_MODE command) to the memory card28in a step S125. Thus, the memory controller62makes a transition to the download mode.

In addition, in a step S127, the CPU34issues a dlRD_IF command to the memory card28. The dlRD_IF command is a command for reading the random number and the unique ID. Then, in a step S129, the CPU34determines whether or not the data (encrypted random number and unique ID) is received from the memory card28. In response to the dlRDIFcommand, the memory controller62returns the encrypted random number and unique ID, and reception of the data is waited.

If “YES” in the step S129, that is, if the aforementioned data is received, the CPU34transmits the received data (encrypted random number and unique ID) to the server102in a step S131.

Succeedingly, in a step S133, the CPU34issues a dlPRT_OFF command to the memory card28. The dlPRT_OFF command is a command for canceling the write protection. After completion of the step S133, the processing proceeds to a step S135inFIG. 22.

In the step S135shown inFIG. 22, the CPU34determines whether or not data about the amount of file data is received from the server102. In response to the data transmission in the step S131, the server102prepares data to be downloaded (write file), and transmits the amount of file data first, and thus, reception of the amount of file data is waited in the step S135. If “YES” in the step S135, the CPU34stores the received amount of file data in the memory area508in a step S137.

Succeedingly, in a step S139, the CPU34determines whether or not data (encrypted data of 2 kbytes+8 bytes) is received from the server102. Here, after transmitting the amount of file data, the server102transmits the data from the write file by a predetermined size. More specifically, the server102encrypts the data obtained by adding the MIC of 8 bytes to the data of 2 kbytes and transmits the same, and thus, reception of the data is waited in the step S139.

If “YES” in the step S139, that is, if the aforementioned data is received, the CPU34transmits a page address to be written with the received data to the memory card28in a step S141. Here, the data is transmitted by a predetermined size from the server102, and thus the CPU34can decide a page address where the data is to be written on the basis of the management data of the flash memory64, the block address, etc. every time that the data is received. In a succeeding step S143, the CPU34issues a dWR_PAGE command to the memory card28. The dWR_PAGE command is a command for instructing the memory card28to write the transmitted data in the step S141to the designated page address.

Then, in a step S145, the CPU34determines whether or not the writing of the file is completed, or the writing by one block is completed. As described above, the data is transmitted by a predetermined size from the server102, and thus, the CPU34can calculate the amount of written data (amount of data transmitted to the memory card28). Accordingly, the CPU34can determine whether or not the amount of written data reaches the amount of file data or one block. If “NO” in the step S145, the processing returns to the step S139, and until the writing of the file data is completed, or until the writing by one block is completed, the writing the data is repeated.

On the other hand, if “YES” in the step S145, the CPU34issues a dlCHG_MODE command to the memory card28in a step S147. The dlCHO_MODE command is a transition command for making a transition from the download mode to the game mode. Then, in a step S149, the CPU34determines whether or not writing of the file data is completed. If “NO” in the step S149, that is, if writing by one block is completed, but writing of all the write file has not been completed, the process returns to the step S107inFIG. 20, and the processing from the step S107in the game mode is performed again for writing the rest of the data. On the other hand, if “YES” in the step S149, the download processing is ended.

FIG. 23toFIG. 26show one example of an operation of the memory controller62in the download processing. Additionally, as described above, the download processing is started in the game mode, and thus, the processing from when the power is turned on to when the memory controller62is placed in the game mode is described as steps S201to S205inFIG. 23.

When starting the process, the memory controller62sets the mode to the game mode in the step S201shown inFIG. 23. In a mode memory area300of the internal RAM66, data indicating the game mode is stored.

Next, in the step S203, the memory controller62makes the download area204and the game area202readable only. For example, the memory controller62generates data indicating accessibility to each area of the flash memory64in the internal RAM66. Then, in the data, data indicating that only reading is possible with respect to the download area204and the game area202is set.

Succeedingly, in the step S205, the memory controller62reads the key1and the key3from the information area200of the flash memory64to the work area of the internal RAM66and decrypts the same, and develops the key1and the key3in the key memory area302.

The processing after a step S207onward corresponds to the download processing by the memory controller62. The memory controller62determines whether or not the gRD_UID command is received via the connector60in the step S207. If “YES” in the step S207, that is, if the command for reading the unique ID is received, the memory controller62reads the unique ID from the memory area220of the information area200, and outputs the unique ID to the connector60in a step S209. Here, if the gRD_UID command is encrypted through scrambling, etc. and then transmitted, after the received data is decrypted, it is determined whether or not the data is the gRD_UID command. Furthermore, the data output to the connector60by the memory controller62is applied to the CPU34via the connector32, etc.

If the step S209is ended, or if “NO” in the step S207, the memory controller62determines whether or not the gRD_IF command is received in a step S211. Here, if the gRD_IF command is encrypted through scrambling, after the received data is decrypted, it is determined whether or not the data is the gRD_IF command. If “NO” in the step S211, the process returns to the step S207.

On the other hand, if “YES” in the step S211, that is, if the command for reading the random number and the unique ID is received, the memory controller62encrypts the random number and the unique ID with the key1in a step S213. Here, the memory controller62generates the random number to the memory area304, and the memory controller62further reads the unique ID from the memory area220of the information area200to the work area. Here, the key1to be utilized in the encryption has already been developed in the memory area302. In a succeeding step S215, the memory controller62outputs the encrypted random number and unique ID.

Succeedingly, in a step S217, the memory controller62determines whether or not the gCHG_DL_MODE command is received. The gCHG_DL_MODE command is issued from the CPU34in a case that it is determined that the memory card28is an authorized card in the server102, and thus, in the step S217, reception of the command is waited. Furthermore, if the gCHG_DL_MODE command is encrypted through scrambling, etc., after the received data is decrypted, it is determined whether or not the data is the gCHG_DL_MODE command.

If “YES” in the step S217, that is, if the transition command to the DL secure mode is received, the memory controller62makes a transition from the game mode to the DL secure mode in a step S219. In the mode memory area300, data indicating the DL secure mode is stored.

Succeedingly, in a step S221shown inFIG. 24, the memory controller62reads the key1from the memory area214of the information area200and decrypts the same, and develops the decrypted one in the memory area302of the internal RAM66. Here, in the key memory area302, the key1has already been developed, but in order to prevent the data from being replaced in an accident, the key1is developed again in the processing in the step S221.

Furthermore, in a step S224, the memory controller62makes all the areas of the flash memory64inaccessible. For example, the memory controller62sets data indicating that access is made impossible with respect to all the areas in the data indicating accessibility to each area of the flash memory64.

Then, in a step S225, the memory controller62determines whether or not the data (encrypted dsCHG_MODE command) is received. After a transition to the DL secure mode is made, the encrypted dsCHG_MODE command is transmitted from the server102, and thus, in the step S225, reception of the data is waited.

If “YES” in the step S225, that is, if the data (encrypted dsCHG_MODE command) is received, the memory controller62decrypts the received data with the key1in a step S227. The dsCHG_MODE command is encrypted by the key1corresponding to the unique ID of the memory card28in the server102, and thus is decrypted by using the key1of the memory area302.

Succeedingly, in a step S229, the memory controller62acquires the block address, the unique ID and the random number from the dsCHG_MODE command. In the dsCHG_MODE command, the block address where the downloaded data is to be written is designated, and the random number and the unique ID which are previously output in the step S215are embedded.

Then, in a step S231, the memory controller62determines whether or not the acquired unique ID and random number match with the unique ID and the random number within the memory card28, that is, the unique ID stored in the internal RAM66and the random number stored in the memory area304.

If “NO” in the step S231, that is, if the transition command to the download mode is not the authorized command, the memory controller62makes a transition to the illegal mode in a step S233. In the mode memory area300, data indicating the illegal mode is stored. When a transition to the illegal mode is made, the memory controller62does not perform the download processing, capable of preventing unauthorized writing from being performed.

On the other hand, if “YES” in the step S231, that is, if the transition command to the download mode is the authorized command, the memory controller62makes a transition from the DL secure mode to the download mode in a step S235. In the mode memory area300, data indicating the download mode is stored.

Furthermore, in a step S237, the memory controller62makes only the block designated by the dsCHG_MODE command accessible. For example, the memory controller62changes the memory map of the download area to the designated block only and sets the data indicating that access is made possible with respect to only the download area to the data indicating accessibility to each area of the flash memory64.

In addition, in a step S239, the memory controller62reads the key2from the memory area216of the information area200and decrypts the same, and develops the decrypted one in the memory area302of the internal RAM66in place of the key1. Here, before the key2is developed, the key1is erased from the key memory area302.

Succeedingly, in a step S241inFIG. 25, the memory controller62determines whether or not the dlRD_IF command is received. The dlRD_IF command is issued by the CPU34after the encrypted dsCHG_MODE command is transferred, and thus, reception of the dlRD_IF command is waited in the step S241.

If “YES” in the step S241, that is, if the command for reading the random number and the unique ID is received, the memory controller62encrypts the random number and the unique ID with the key2in a step S243. Specifically, the memory controller62issues the random number to the memory area304, and reads the unique ID from the memory area220of information area200. Then, the random number and the unique ID are encrypted with the key2developed in the memory area302. In a step S245, the memory controller62outputs the encrypted random number and unique ID.

Succeedingly, in a step S247, the memory controller62determines whether or not the dlPRT_OFF command is received. The CPU34transfers the encrypted random number and unique ID which are output in the step S245to the server102, and issues the dlPRT_OFF command, and thus, reception of the command is waited in a step S247.

If “YES” in the step S247, that is, if the command for cancelling the write protection is received, the memory controller62turns off the write protection with respect to the download area204of the flash memory64in a step S249. More specifically, the memory controller62turns off the flag indicating the write protection stored in the memory area306of the internal RAM66.

Succeedingly, in a step S251, the memory controller62determines whether or not the data (encrypted 2 kbyte+8 byte data) is received. The data is download data transmitted from the server102. Furthermore, in the reception data, a page address to be written is added by the CPU34of the game apparatus10.

If “YES” in the step S251, the memory controller62stores the received data and the page address in the work area of the internal RAM66in a step S253. On the other hand, if “NO” in the step S251, the process proceeds to a step S269shown inFIG. 26.

Succeedingly, in a step S255, the memory controller62determines whether or not the dWR_PAGE command is received. As the dWR_PAGE command is issued by the CPU34of the game apparatus10after transfer of the download data, receiving the dWR_PAGE command is waited in the step S255.

If “YES” in the step S255, that is, if the writing command is received, the process proceeds to a step S257shown inFIG. 26. In the step S257, the memory controller62determines whether or not the write protection of the memory area306is turned off.

If “YES” in the step S257, that is, if the downloaded data is allowed to be written, the memory controller62decrypts the received data (encrypted 2 kbyte+8 byte data) with the key2in a step S259. Here, the received data is encrypted by the key2corresponding to the unique ID of the memory card28in the server102. By the decryption, it is possible to acquire the data of 2 kbytes to be downloaded and the MIC of 8 bytes.

Succeedingly, in a step S261, the memory controller62calculates the MIC of 8 bytes with respect to the decrypted data of 2 kbytes with the key3. Here, when the MIC is calculated, the unique ID and the random number which are stored in the internal RAM66are used as initial values. Furthermore, the key3for calculation is constructed by the part of the key2(common part) stored in the memory area302and the key3.

Then, in a step S263, the memory controller62determines whether or not the calculated MIC matches with the decrypted MIC. If “NO” in the step S263, that is, if the downloaded data is identified as unauthorized data, the process proceeds to a step S265. In the step S265, the memory controller62does not execute writing. Thus, it is possible to prevent the unauthorized data from being written to the download area204. After completion of the step S265, the download processing is ended.

On the other hand, if “YES” in the step S263, that is, if the downloaded data is authorized data, the memory controller62writes the decrypted data of 2 kbytes in the designated page in a step S267.

Succeedingly, in a step S269, the memory controller62determines whether or not the dlCHG_MODE command is received. The dlCHG_MODE command is issued by the CPU34when writing of the file is completed or writing by one block is completed. If “NO” in the step S269, the process returns to the step S251inFIG. 25. Accordingly, until the writing of the file is completed, or until the writing by one block is completed, writing the downloaded data of the predetermined size (2 kbytes) to the download area204is repeated.

On the other hand, if “YES” in the step S269, that is, if a transition command to the game mode is received, the memory controller62makes a transition from the download mode to the game mode in a step S271. In the mode memory area300, data indicating the game mode is stored. Furthermore, in a step S273, the memory controller62makes the download area204and the game area202readable only similar to the step S203. Here, the memory map of the download area is changed to the designated block, and thus, the download area204is returned to the original condition on the basis of the boundary data (start address) of each area defined in the information area200, and the data indicating that access is made possible with respect to only the download area is set.

In addition, in a step S275, the memory controller62decrypts the key1read from the memory area214of the information area200and develops the same in the key memory area302of the internal RAM66in place of the key2. When the step S275is ended, the process returns to the step S207. In a case that writing of the file to be downloaded is not completed, the download processing is executed from the game mode again to perform writing of the rest of the data.

FIG. 27toFIG. 29show one example of an operation of the server102in the download processing. When starting the download processing, the CPU of the server102determines whether or not the unique ID and the game ID are received in a step S301. In the download processing, the unique ID of the memory card28and the game ID are first transmitted from the game apparatus10via the network106, and thus, reception of them are waited in the step S301.

If “YES” in the step S301, the CPU of the server102stores the received unique ID and game ID in the memory area404and the memory area406of the RAM, respectively, in a step S303.

Succeedingly, in a step S305, the CPU of the server102determines whether or not data (encrypted random number and unique ID) is received. The aforementioned data is transmitted from the game apparatus10for authenticating the memory card28after first transmission of the unique ID, and thus, reception is waited in the step S305.

If “YES” in the step S305, the CPU of the server102decrypts the received data (encrypted random number and unique ID) with the key1corresponding to the unique ID in a step S307. More specifically, since the received data is encrypted with the key1by the memory controller62of the memory card28, the CPU reads the keys1,2and3corresponding to the first received unique ID of the memory area404, and stores them in the memory area408. Then, the received data is decrypted with the key1. Thus, it is possible to acquire the random number and the unique ID, and store the acquired random number and unique ID in the memory area410.

Then, in a step S309, the CPU of the server102determines whether or not the decrypted unique ID stored in the memory area410matches with the first unique ID stored in the memory area404.

If “YES” in the step S309, that is, if the memory card28is identified as an authorized card, the CPU of the server102transmits the data indicating that the memory card28is the authorized card to the game apparatus10via the network106in a step S311. After completion of the step S311, the process proceeds to a step S315inFIG. 28.

On the other hand, If “NO” in the step S309, that is, if the memory card28is not identified as an authorized card, the CPU of the server102transmits the data indicating that the memory card28is not the authorized card to the game apparatus10in a step S313. Then, the download processing is ended.

In the step S315shown inFIG. 28, the CPU of the server102determines whether or not the block address is received. In response to the transmission in the step S311, the block address is transmitted from the game apparatus10, and thus, the reception is waited in the step S315.

If “YES” in the step S315, the CPU of the server102stores the received block address in the memory area412in a step S317. Succeedingly, in a step S319, the CPU of the server102generates a dsCHG_MODE command by using the block address, the unique ID, and the random number. The dsCHG_MODE command is a transition command form making a transition to the download mode. In the dsCHG_MODE command, the block address is designated, and in the download mode, writing to the designated block address is made possible. Furthermore, in the dsCHG_MODE command, the random number and the unique ID of the memory area410are included.

Furthermore, in a step S321, the CPU of the server102encrypts the generated dsCHG_MODE command with the key1corresponding to the unique ID. Then, in a step S323, the CPU of the server102transmits the encrypted dsCHG_MODE command to the game apparatus10.

Succeedingly, in a step S325, the CPU of the server102determines whether or not the data (encrypted random number and unique ID) is received from the game apparatus10. When making a transition to the download mode, the memory controller62encrypts the random number and the unique ID with the key2and transmits the same to the server102, and thus, the reception is waited in the step S325.

If “YES” in the step S325, that is, if the aforementioned data (encrypted random number and unique ID) is received, the CPU of the server102decrypts the received data (encrypted random number and unique ID) with the key2corresponding to the unique ID in a step S327. Thus, the random number and unique ID which are thus acquired are stored in the memory area410. After completion of the step S327, the process proceeds to a step S329inFIG. 29.

In the step S329shown inFIG. 29, the CPU of the server102prepares a write file. More specifically, predetermined data is read from the data to be downloaded stored in the database, and stored in the memory area414of the RAM. The write file may be a file corresponding to the unique ID, a file corresponding to the game ID, or a predetermined file independent of the unique ID and the game ID, for example. In a step S331, the CPU of the server102transmits the file data amount of the write file to the game apparatus10.

Succeedingly, in a step S333, the CPU of the server102fetches data of a predetermined size (2 kbytes in this embodiment) from the write file. The data of the write file is transmitted separately by the predetermined size.

In a step S335, the CPU of the server102calculates the MIC of 8 bytes with respect to the data of 2 kbytes with the key3corresponding to the unique ID. Here, as initial values for calculation of the MIC, the random number and the unique ID in the memory area410are used. In a succeeding step S337, the CPU of the server102adds the MIC of 8 bytes to the data of 2 kbytes. Then, in a step S339, the CPU of the server102encrypts the data of 2 kbytes+8 bytes with the key2corresponding to the unique ID. Here, as initial values for encryption, the unique ID and the random number of the memory area410are used. In a step S341, the CPU of the server102transmits the encrypted data of 2 kbytes+8 bytes to the game apparatus10.

In a succeeding step S343, the CPU of the server102determines whether or not the file transmission is completed, or the transmission by one block is completed. Whether or not the file transmission is completed can be determined on the basis of the data amount of the write file and the cumulative amount of the data transmission. If “NO” in the step S343, that is, if the transmission by one block is not completed, or if the file transmission is not completed, the process returns to the step S333to repeat the processing for transmitting the data of the predetermined size.

On the other hand, if “YES” in the step S343, the CPU of the server102determines whether or not the file transmission is completed in a step S345. If “NO” in the step S345, that is, if the data transmission in blocks is completed, but the transmission of all data of the write file is not completed, the process returns to the step S305inFIG. 27. By repeating the processing from the download processing when the memory controller62in the game mode, writing of the data in the file to a next block is performed. On the other hand, if “YES” in the step S345, the writing of the data in the file is completed, so that the download processing is ended.

An operation of the backup processing by the game apparatus10as a security system with respect to the backup area is explained with reference to the flowcharts shown inFIG. 30toFIG. 33.

FIG. 30shows one example of an operation of the game apparatus10in the backup writing processing. When writing to the backup area206is started, the CPU34prepares the data to be written in the RAM42in a step S401. The data to be written is backup data generated by the CPU34in the game processing, and stored in the memory area510.

Next, in a step S403, the CPU34adds parity to the data to be written. As shown inFIG. 15, in this embodiment, data with parity is generated in a format in which each byte data is constructed of “data of seven bits”+a “parity bit (one bit)”. That is, the first seven bits in each byte is the generated backup data, and the parity of the first 7 bits is added to the last bit. The generated data with parity is stored in the memory area512.

Succeedingly, in a step S405, the CPU34confirms a space area of the backup area206, and decides a block address to be written. Here, information about which area is used or about which area is a space area out of the memory area of the flash memory64is stored in the information area200as header information, for example, and thus, the CPU34generates management data of the flash memory64on the basis of the header information, ensures the space area in the backup area206based on the management data, and decides a block address to be written. The decided block address is stored in the memory area514.

Then, in a step S407, the CPU34issues a gCHG_BK_MODE command to the memory card28. The gCHG_BK_MODE command is a transition command for making a transition to the backup mode. In the transition command, the block address to be written is designated. Here, the memory controller62makes a transition to the backup mode in response to the transition command, and makes only the designated block readable out of the backup area206.

In a succeeding step S409, the CPU34issues to the memory card28a write command for writing the data with parity. The write command includes the data with parity to be written. Similar to the above-described writing to the download area204, data of a predetermined size is added to the write command such that the data is written by the predetermined size. In response to the write command, the memory controller62writes the data to the designated block of the backup area206.

Then, in a step S411, the CPU34determines whether or not writing of all the prepared data is completed, or writing of the data by one block is completed. Here, whether or not writing of the prepared data (data with parity) is completed can be determined on the basis of the data amount of data with parity stored in the memory area512and the cumulative amount of data by the write command. If “NO” in the step S411, the process returns to the step S409to repeat the writing by the write command.

On the other hand, if “YES” in the step S411, the CPU34issues a bCHG_MODE command to the memory card28in a step S413. The bCHG_MODE command is a transition command for making a transition from the backup mode to the game mode. Here, in response to the transition command, the memory controller62makes a transition to the game mode.

Then, in a step S415, the CPU34determines whether or not writing of all prepared data (data with parity) is completed. If “NO” in the step S45, that is, if writing data by one block is completed, but there is data with parity on which writing is not performed, the process returns to the step S405to execute processing for writing as to the next block. On the other hand, if “YES” in the step S415, the backup writing processing is ended.

FIG. 31shows one example of an operation of the game apparatus10in the backup reading processing. When reading processing from the backup area206is started, the CPU34confirms a storing location of the backup data to be read in a step S501. Here, the backup data to be read is selected according to an operation by the user or a program, etc. The information in relation to a storing place of each backup data is included in the header information of the flash memory64, for example.

Next, in a step S503, the CPU34decides a block address to be read. The block address to be read is decided from the storing location of the backup data to be read, and stored in the memory area516.

Succeedingly, in a step S505, the CPU34issues a gCHG_BK_MODE command to the memory card28. The gCHG_BK_MODE command is a transition command for making a transition to the backup mode. In the transition command, the block address to be read which is decided in the step S503is designated. In response to the transition command, the memory controller62makes a transition to the backup mode in which only the designated block is made accessible.

In a step S507, the CPU34designates a page address to be read and issues a read command to the memory card28. The read command is a command for instructing the memory card28to read the data. For example, it is possible to instruct the memory card28to read the data on the designated page. Here, in response to the read command, the memory controller62reads the data on the designated page from the backup area206. Then, if the read data is the authorized data, the data is output to the CPU34.

In a step S509, the CPU34determines whether or not the data is received from the memory card28. As described above, if the read data is the authorized one, the data is output, and thus, in the step S509, the reception is waited. Here, in a case that the read data by the memory controller62is the unauthorized one, a transition to the illegal mode is made to thereby output no data, and the backup reading processing is not operated normally.

If “YES” in the step S509, the CPU34stores the received data, that is, the read data in the memory area518of the RAM42in a step S511. Then, in a step S513, the CPU34determines whether all data to be read is read, or reading by one block is completed. Here, whether or not all data to be read is read can be determined on the basis of a data amount of the data to be read and a cumulative amount of the read data by the read command. If “NO” in the step S513, the process returns to the step S507to repeat the reading processing by the read command.

On the other hand, if “YES” in the step S513, the CPU34issues a bCHG_MODE command to the memory card28in a step S515. The bCHG_MODE command is a transition command for making a transition to the game mode. In response to the transition command, the memory controller62makes a transition to the game mode.

Then, in a step S517, the CPU34determines whether or not all data to be read is read. If “NO” in the step S517, that is, if reading by one block is completed, but there is data to be read, the process returns to the step S503to execute processing to read a next block. On the other hand, if “YES” in the step S517, the backup reading processing is ended.

FIG. 32andFIG. 33show one example of an operation of the memory controller62in the backup processing. In a step S601inFIG. 32, the memory controller62determines whether or not a gCHG_BK_MODE command is received. The gCHG_BK_MODE command is a transition command to the backup mode. If “NO” in the step S601, the backup processing is ended.

On the other hand, if “YES” in the step S601, the memory controller62makes a transition from the game mode to the backup mode in a step S603. In the mode memory area300of the internal RAM66, data indicating the backup mode is stored. In a succeeding step S605, the memory controller62makes only the block designated by the gCHG_BK_MODE command out of the backup area206accessible. For example, the memory controller62stores the data indicating accessibility to each area of the flash memory64in the internal RAM66, changes in the data the memory map of the download area to the designated block only, and sets the data indicating that access is made possible with respect to only the backup area.

Then, the memory controller62executes processing corresponding to the command received in the backup mode. That is, in a step S607, the memory controller62determines whether or not the write command is received. If “YES” in the step S607, the memory controller62writes the received data together with the write command in the block of the backup area206designated by the transition command in a step S609.

If the step S609is ended, or if “NO” in the step S607, the memory controller62determines whether or not the bCHG_MODE command is received in a step S611. If “YES” in the step S611, that is, if the transition command to the game mode is received, the memory controller62makes a transition from the backup mode to the game mode in a step S613. In the mode memory area300, data indicating the game mode is stored. Succeedingly, in a step S615, the memory controller62makes the backup area206inaccessible. For example, in the data indicating accessibility to each area of the flash memory64, data indicating that the memory map of the backup area is returned to the original, and an access to the backup area206is made impossible is set. After completion of the step S615, the backup processing is ended.

On the other hand, if “NO” in the step S611, in a step S617inFIG. 33, the memory controller62determines whether or not the read command is received. If “YES” in the step S617, the memory controller62determines whether or not the page designated by the read command is in the accessible block in a step S619. The accessible block is a block within the backup area206designated by the transition command to the backup mode. By the determination, it is possible to perform a parity check with respect to only the data on which a reading designation is properly performed, capable of eliminating an unauthorized reading command.

If “YES” in the step S619, the memory controller62checks the parity in the page designated by the read command in a step S621. More specifically, the memory controller62reads the designated page data in the work area of the internal RAM66, calculates parity of the first 7 bits of each byte, and compares the calculation result with the last bit of each byte.

Then, in a step S623, the memory controller62determines whether or not the result of the parity check is correct. If “YES” in the step S623, that is, if the calculated parity bit and the last bit are equal to each other with respect to all the bytes, the memory controller62outputs the data in the designated page to the CPU34in a step S625.

On the other hand, if “NO” in the step S623, that is, if any byte for which the calculated parity bit and the last bit are not equal to each other is detected, the data to be read is identified as unauthorized data, and the memory controller62makes a transition to the illegal mode in a step S627. In the mode memory area300, data indicating the illegal mode is stored. When a transition to the illegal mode is made, the memory controller62does not output the read data. Accordingly, it is possible to prevent the unauthorized data from being read and utilized.

Additionally, if “NO” in the step S617, if “NO” in the step S619, or if the step S625is ended, the process returns to the step S607inFIG. 32.

In the above-described embodiment, the download area204is provided to the flash memory64of the memory card28detachable to the game apparatus10, but in another embodiment, the flash memory64is contained in the housing16of the game apparatus10, and within the flash memory64, the download area204may be provided. In this case, the memory controller62is also contained in the housing16. Furthermore, the backup area206may be also provided in the flash memory64inside the housing16of the game apparatus10. Here, in a case that the flash memory64is contained in the housing16of the game apparatus10, the unique ID may be identification information of the game apparatus10.

In each of the above-described embodiments, for making encryption for each memory card28, the keys1,2and3corresponding to the unique ID of the memory card28are prepared, and stored in the flash memory64and the server12in advance. However, in another embodiment, encryption may be made for each game title (game program) or each kind of the application (application program), and in such a case, keys1,2and3corresponding to the game ID (application ID) are prepared and stored in the flash memory64and the server12in advance. Then, at a time of encryption or decryption, keys corresponding to the game ID are used.

Furthermore, in each of the above-described embodiment, two writing areas, such as the download area204and the backup area206are provided to the flash memory64, and one of the download area204is protected stepwise by the mode transition and the encryption of the write data, and the other of the backup area206is protected by the format of the write data. However, in another embodiment, any one of the writing area only may be provided in the flash memory64.

Although the present embodiment has been described and illustrated in detail, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, the spirit and scope of the present embodiment being limited only by the terms of the appended claims.