Storage device including a non-volatile memory

A storage device includes a tamper-resistant module and a flash memory. In correspondence with a command, a CPU inside the tamper-resistant module judges the security of data received from the outside, then recording the data as follows: High-security and small-capacity data is recorded into a memory inside the tamper-resistant module. High-security and large-capacity data is encrypted, then being recorded into the flash memory. Low-security data is recorded as it is into the flash memory. This recording method permits large-capacity data to be stored while ensuring a security (i.e., a security level) corresponding thereto.

BACKGROUND OF THE INVENTION

The present invention relates to a storage device and an information appliance connected to the storage device. In particular, it relates to a method of controlling the data transfer between the information appliance and the storage device.

In recent years, the development of the network society based on the Internet and so on has been increasing the importance of a technology for protecting the copyright of the content such as music and an image circulated on the network. As the copyright-protecting technology, there has been proposed a memory IC card. The memory IC card mounts thereon a private-key storing circuit for storing a private key used for the encryption/decryption and a data storing circuit for saving the data, and also has a function of using a writing-in controlling circuit so as to write the private key into the private-key storing circuit and a function of authenticating the opposite appliance. This technology has been disclosed in, e.g., JP-A-2000-163547.

In JP-A-2000-163547, all the data are recorded in a storage medium on a packaged storage device such as the memory IC card. In order to prevent the stealing of the content or the like, the packaged storage device such as the memory IC card has a structure (i.e., a tamper-resistant module) that is configured so that analyzing the inside data from the outside is difficult. Generally speaking, however, the packaged storage device such as the memory IC card having the tamper-resistant module is expensive, and its memory's storage-capacity is small. Consequently, it was very difficult to store high-security data in large quantities into the packaged storage device such as the memory IC card.

Also, in JP-A-2000-163547, the packaged storage device such as the memory IC card has stored the high-security data and low-security data together into the tamper-resistant module. Namely, the device has done this without making a judgement on the differentiation of the high-security data and the low-security data just in response to a transfer instruction from a higher-order device. This has resulted in a state where data that need not be secured have also been all stored into the tamper-resistant module, thereby making it impossible to effectively utilize the storage area within the tamper-resistant module.

Also, in JP-A-2000-163547, a non-volatile memory (hereinafter, referred to as “an NV memory”) such as an EEPROM has been used as the data-saving storage area. Concerning the NV memory used in the prior art, however, its rewritable number is small and accordingly it was difficult to replace the content many times.

Moreover, in JP-A-2000-163547, the packaged storage device such as the memory IC card, as described above, is small in its storage-capacity. This condition, even when applications are executed on the memory IC card, has allowed only the execution of an application whose program uses just a small storage-capacity.

Meanwhile, in JP-A-10-334205, there has been disclosed a card where an IC chip and a flash memory are built-in. However, since the IC chip and the flash memory are independent of each other, it is impossible for the IC chip to write or read the data into or from the flash memory.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a storage device and a host terminal device that allow high-security data to be stored at a low-cost and in large quantities many times.

It is another object of the present invention to provide the storage device and the host terminal device that are capable of effectively utilizing a record area inside a controller.

It is still another object of the present invention to provide the storage device and the host terminal device that are capable of recording a variety of applications and of executing even a large-sized application.

In the present invention, private data is recorded in advance into a non-volatile memory inside the controller. Meanwhile, information that cannot be recorded into the non-volatile memory inside the controller is written into a non-volatile memory outside the controller after the information has been encrypted using a private key.

In the present invention, the controller judges the security (i.e., the security level or the like) of information transmitted from the outside. Moreover, the controller divides the data so that the high-security information will be recorded into the non-volatile memory inside the controller and the low-security information will be recorded into a flash memory.

In the present invention, there is mounted a work memory (e.g., a RAM) for executing an application inside the controller. In addition, the application is encrypted using the private key inside the controller, then being stored into an access-limited area in the non-volatile memory outside the controller.

Furthermore, as required, the application is read out from the non-volatile memory outside the controller so as to be decrypted and expanded onto the work memory, then being executed.

The present invention permits large-capacity data to be stored while ensuring a security (i.e., a security level) corresponding thereto.

DESCRIPTION OF THE EMBODIMENTS

FIG. 1is the configuration diagram of a storage device120to which the present invention has been applied.

The storage device120includes a tamper-resistant module121and a flash memory140. The tamper-resistant module121, which is an electronic circuit configured so that performing the physical analysis from the outside is difficult, is used in an electronic appliance such as an IC card which is required to exhibit a high-level security. Namely, the tamper-resistant characteristic of the tamper-resistant module121is higher than that of the flash memory140. An inside bus123is used for transmitting/receiving information among the respective circuits. A flash memory interface124is used for connecting the flash memory140to the tamper-resistant module121.

A host interface122is used for transmitting/receiving an access command110between the storage device120and an external appliance connected to the storage device120. A CPU128controls the respective circuits inside the storage device120. The CPU128uses an encryption processing circuit126in order to perform an encryption processing inside the storage device120. A RAM129is a work RAM (i.e., a work memory) used for recording data temporarily. A ROM130records programs and data that the CPU128permanently utilizes. An NV memory125is a small storage-capacity non-volatile memory whose writable number is small. The NV memory125records the type of information that is dangerous if analyzed from the outside. As the NV memory125, there exists, e.g., an EEPROM (i.e., an electrically rewritable ROM).

The NV memory125stores the following information and programs:

Secret information KM151includes information on a key or the like that is used in order to encrypt or decrypt data when the tamper-resistant module121reads or writes the data toward the flash memory140. A KM-compliant encryption processing program152is an application for performing the encryption processing by using the secret information KM151.

Secret information KO153includes information on a certificate, a key, or the like that is used by a server180of a service provider100and a mobile terminal103in order to establish an encrypted communications-path on a public line108described later. A KO-compliant encryption processing program154is an application for performing the encryption processing by using the secret information KO153.

Secret information KI155includes information on a storage device certificate, a key, or the like that is used by a delivery application181inside the server180of the service provider100and the storage device120in order to establish an encrypted inside-communications-path109described later. A KI-compliant encryption processing program156is an application for performing the encryption processing by using the secret information KI155.

Secret information KL157includes information on a certificate, a key, or the like that is needed when an application executed by the CPU128performs an encryption processing. A KL-compliant encryption processing program158is an application for performing the encryption processing by using the secret information KL157. Incidentally, there are some cases where, depending on an application, KL157is used for a specific purpose of its own, and there are other cases where KL157exist in plural number for each application.

The NV memory125includes a data area160. The data area160stores the personal information on a user of the storage device120, e.g., the telephone number, the schedule, the credit card information, the electronic cash, and the individual certification information.

Although it can be considered that the above-described important personal information (i.e., the key information and the like) is stored into the flash memory140, the personal information is stored into the NV memory125in the tamper-resistant module121that is configured so that the reading-out from the outside is difficult. This is because there exists a possibility that a person of malice may destroy the card so as to steal the personal information.

An application RAM127is used for decrypting and executing the cipher of an encrypted application144that the CPU128has read out from the flash memory140at the time of the application execution.

The flash memory140is an electrically batch-erasable/writable non-volatile memory. A flash memory chip, e.g., a large storage-capacity multi-value flash memory, can be considered as the memory140. The flash memory140includes a user-access-prohibited area142where a user access is prohibited or limited, and a user-access-permitted area141. Data stored into the user-access-prohibited area142is erased and written-in only by the CPU128inside the tamper-resistant module121. Information that will cause a trouble if manipulated by the user, e.g., the encrypted application144executed by the CPU128and important information143such as firmware of the storage device120, are saved into the user-access-prohibited area142. Incidentally, in some cases, an electronic signature is added to the data here so that the tampering is impossible from the outside. The user-access-permitted area141is an area that is freely accessible from an external device connected to the storage device120. Data that will present no problem if seen from the outside, e.g., a content402, the encrypted programs, and the others, are saved into the user-access-permitted area141. The firmware refers to hardware-converted software (i.e., program). Concretely, the firmware refers to BIOS, a driver, or the like.

The large variety types of application programs that the CPU128uses are in advance encrypted and stored into the flash memory140. The encrypted application program144, before being used, is supplied to the tamper-resistant module121. At that time, the CPU128decrypts the application program with the use of KM151and the KM-compliant encryption processing program152, then loading the decrypted program onto an application RAM127. When the loading is completed, the application program becomes executable. Meanwhile, the content402such as a voice and an image are stored into the flash memory140. At this time, the CPU128automatically analyzes storing destinations of the data in accordance with the access command110. The details of the analyzing method will be explained later.

FIG. 2is a configuration diagram of a system that utilizes the embodiment of the storage device120to which the present invention has been applied.

The mobile terminal103, which is connected to the storage device120, has a function of performing communications with the service provider100with the utilization of the storage device120. The mobile terminal103includes a display screen104, a speaker105, a microphone106, and a CCD camera107.

The service provider100has the server180for performing content delivery or the like toward the storage device120. The server180includes the delivery application181and a content182to be delivered.

Between the service provider100and the mobile terminal103, in order to prevent the leakage of the data, it is possible to establish the encrypted communications-path on the public line108. Moreover, the storage device120connected to the mobile terminal103can further establish the encrypted inside-communications-path109inside the encrypted communications-path established with the service provider100. Although, in the drawing, the inside-communications-path109is illustrated on the mobile terminal103alone, actually, the path109is installed on the public line108as well. The details will be explained later.

In the present system employing the service provider100, the mobile terminal103, and the storage device120, when the service provider100and the storage device120transmit/receive the data therebetween, the data are encrypted twofold between the service provider100and the mobile terminal103, i.e., on the public line108, whereas the data are encrypted one fold between the mobile terminal103and the storage device120. In some cases, depending on an encryption processing method utilized by the mobile terminal103or the like, the data are encrypted (N+M)-fold between the service provider100and the mobile terminal103, whereas the data are encrypted M-fold between the mobile terminal103and the storage device120. Additionally, the appliance to which the storage device120is to be connected is not limited to the mobile terminal103, and the public line108may be either a wired line or a wireless line. An optical cable or the like can be considered as the wired line.

FIG. 3is a configuration diagram of the mobile terminal103.

A CPU201controls the respective circuits in the mobile terminal103. A RAM202temporarily stores data that the CPU201utilizes. A ROM203records non-rewritable data that the CPU201permanently utilizes. A mobile terminal controlling circuit204performs a processing such as the transmission/reception of information between the mobile terminal103and the external appliance. An input/output interface205performs processings such as a key inputting by the user of the mobile terminal103and a screen displaying. A storage device interface207performs the transmission/reception of the information between the mobile terminal103and the storage device120. A decoder circuit206decodes the information read out from the storage device120back to a voice, an image, and the like. A bus208is used for the transmission/reception of the information among the circuits.

FIG. 4is a diagram for illustrating the configuration of the decoder circuit206.

The decoder circuit206decodes the data read out from the storage device120, then reproducing the decoded data. Accordingly, it is required to prevent the decoded data from being accessed from the outside. On account of this, the decoder circuit206is configured as the tamper-resistant module. A controlling circuit301controls the respective circuits in the decoder circuit206. A RAM302temporarily records the decoded information or the like. A ROM303records low-security information that is permanently utilized, such as programs of the controlling circuit. A non-volatile memory306records high-security information, such as a certificate of the decoder circuit206and a key needed to decrypt the encrypted data fetched from the storage device120. An interface307is an interface used for establishing the connection with the external circuits. A bus308is used for the transmission/reception of the information among the respective circuits.

FIG. 5is a diagram for illustrating one example of the communications scheme in a system that employs the storage device120to which the present invention has been applied.

The transmission/reception of the information between the storage device120and the mobile terminal103is performed by the access command110. The access command110is defined as a hierarchical access command (hereinafter, referred to as “a hierarchical command”)405. A physical access command408is a basic command on an input/output of data or the like with the storage device120. A logical access command409is transmitted/received as the data for the physical access command408. The storage device120and the mobile terminal103analyze the physical access command408and fetch the logical access command409from the data area, then executing the logical access command. The employment of the command configuration like this allows the commands to be easily extended without modifying the basic command between the mobile terminal103and the storage device120.

A license401is information including a key for decrypting an encrypted content402. The encrypted content402is a content encrypted by the license401. The arrow attached to a license delivery404indicates the case where the license401is delivered from the service provider100to the tamper-resistant module121inside the storage device120via a network403and the mobile terminal103. The arrow attached to a content delivery407indicates the case where the content402is delivered from the service provider100to the storage device120. Between the service provider100and the mobile terminal103, the license401and the content402are delivered using a hierarchical command406. Between the mobile terminal103and the storage device120, the license401is delivered using the hierarchical command405, then being stored into the tamper-resistant module121. Between the mobile terminal103and the storage device120, using only the physical access command408, the content402is delivered into the flash memory140inside the storage device120.

FIGS. 19A to 19Dare diagrams for illustrating configuration examples of the physical access command408and the logical access command409.

The physical access command408includes the command code1801, the length1802, and the data area1803. The command code1801includes the command type1810, the attribute1811, and the security level1812. The command type1810and the attribute1811store information maintained in correspondence relationships shown by a table inFIG. 19C. The attribute1811refers to tags or the like indicating whether the data are, e.g., the personal information, the key information, and the like, or the other general information. Hereinafter, the data representing the attribute like this are referred to as “attribute data”. The security level1812stores information indicating the level of the security of data transmitted by a command. In the present embodiment, the security level is classified into three stages. A device that issues the access command110, in correspondence with the property of the data to be transmitted, adds the security level onto the access command110at the time of the issuing.

The length1802stores information indicating the length of the data area1803. In addition to the usual data, the data area1803stores the logical access command409as well.

The logical access command409includes the command code1804, the length1805, and the data1806. The command code1804is the same as the command code1801of the physical access command408. The length1805stores information indicating the length of data to be stored into the data1806. The data1806stores the real data.

The hierarchical command406and a physical access command410and a logical access command411which constitute the hierarchical command406are basically of the same configuration as that of the hierarchical command405. The hierarchical command406is used when the mobile terminal103and the server180transmit/receive the information via the network403. Incidentally, it does not matter at all if the hierarchical command405and the hierarchical command406differ from each other in their concrete command codes or the like.

FIG. 20is a flow diagram for explaining a dividing processing of the hierarchical command, where the hierarchical command is received and divided by the storage device120.

The storage device120receives the physical access command408(1901). The CPU128in the storage device120checks the command code1801of the physical access command408(1902). If the logical access command409exists therein, the CPU128executes the analysis of the logical access command (1904). The CPU128processes the logical access command409(1905). If the logical access command409is not included in the physical access command408, the CPU128executes the processing of the physical access command (1903). When the command processing has been terminated, the CPU128performs a data selection processing so as to differentiate high-security data from low-security data, then recording the respective data into areas that are appropriate thereto each (1906).

FIG. 21is a flow diagram for explaining the data selection processing1906that the CPU128executes.

The CPU128checks whether or not the command type1810of the physical access command408or the logical access command409transmitted from the mobile terminal103is of a WRITE command (2002). If the command type is of a command other than the WRITE command, the CPU terminates the processing (2009). If the command type1810is of the WRITE command, the CPU128checks the data within the data area, thereby checking whether or not there exists the attribute data in the attribute1811(2003). If there exists no attribute data in the attribute1811, the CPU128checks the security level1812in the command code (2004). If the security level is equal to 1, the CPU128checks the free available capacity of the NV memory125(2005), and if there exists enough free capacity, the CPU stores the data into the NV memory125(2006). If there exists no enough free capacity, the CPU128encrypts the data (2007), then writing the encrypted data into the flash memory140(2008). If the security level is equal to 2, the CPU128encrypts the data (2007), then writing the encrypted data into the flash memory140(2008). If the security level is equal to 3, the CPU128writes the data into the flash memory140(2008). If, at the step2003, the CPU128has judged that there exists the attribute data in the attribute1811, the CPU128judges the content of the attribute data (2010). If, based on the attribute data, the data transmitted by the access command is judged to be small-capacity private data, the CPU128checks the free capacity of the NV memory125(2011). Then, if there exists enough free capacity, the CPU stores the data into the NV memory125(2012). If there exists no enough free capacity, the CPU128encrypts the data (2013), then writing the encrypted data into the flash memory140(2014). If the data is judged to be large-capacity private data, the CPU128encrypts the data (2013), then storing the encrypted data into the flash memory140(2014). If there is no need of the encryption, the CPU128writes the data as it is into the flash memory140(2014).

FIG. 6is a flow diagram for explaining an encrypted communications-path establishing processing510and an encrypted inside-communications-path establishing processing520on the public line108. Being summarized as one processing, these steps are referred to as “an encrypted communications-path establishing processing500”.

The explanation will be given below concerning the encrypted communications-path establishing processing510on the public line108. The mobile terminal103fetches the secret information KO153from the storage device120(502). The mobile terminal103encrypts the secret information KO153, then transmitting the encrypted secret information to the service provider100(503). The server180of the service provider100, which has received the encrypted secret information KO153, decrypts and fetches the secret information KO153(504). In the communications thereinafter, the server180and the mobile terminal103encrypt information by using the secret information KO153, then transmitting/receiving the encrypted information therebetween (505). This allows the encrypted communications-path to be established (506).

The explanation will be given below regarding the encrypted inside-communications-path establishing processing520. The storage device120encrypts the secret information KI155, then transmitting the encrypted secret information KI155to the service provider100by using the encrypted communications-path that has been established between the mobile terminal103and the service provider100(509). The server180of the service provider100, which has received the encrypted secret information KI155, decrypts and fetches the secret information KI155(510). Thereinafter, the server180and the storage device120encrypt information by using the secret information KI155, then transmitting/receiving the encrypted information therebetween (511). This allows the encrypted inside-communications-path to be established (512).

FIG. 7is a diagram for explaining the basic flow of a copyright protection among the mobile terminal103, the storage device120, and the server180. This drawing illustrates the case where the content402whose copyright wishes to be protected is transmitted from the server180to the storage device120. The notation of the respective transmitting steps follows a table notation definition2101illustrated inFIG. 22. Incidentally, inFIG. 7, the server180generates KS1, using a random number or the like. The encryption processing circuit126in the storage device120generates KS2, using a random number or the like.

If the user operates the mobile terminal103to instruct the storage device120to perform the content acquisition, the storage device120, via the mobile terminal103, issues a content request601to the server180that holds the content402. In accompaniment with this content request, the storage device120transmits, to the server180, a CONTENT ID corresponding to the content402to be acquired and a certificate C (KA, KPMC | | IMC) for certifying that the storage device120is an authentic appliance (601). Having received the CONTENT ID and the certificate C, the server180checks the certificate. If the certificate is an authorized one, the server transmits a session key E (KPMC, KS1) to the storage device120(602). Having received the session key KS1, the storage device120transmits, to the server180, various information including a session key KS2as E (KS1, KPM1| | KS2| | CRLUPDATE) (603). Having received the various information, the server180transmits, to the storage device120, various information including the license401as E (KS2, CRL | | E (KPM1, TRANSACTION ID | | ACM KC | | ACP) (604). Subsequently, the server180transmits, to the storage device120, the content402as E (KC, CONTENT) (605). The transmission/reception of information that will be explained hereinafter is performed using the scheme described here.

FIG. 8illustrates the hierarchical configurations of the respective software programs of the storage device120, the mobile terminal103, and the server180. In the following description, the description of the service provider100will be omitted. In the storage device120, applications701are configured on an encryption calculating unit702. The applications701perform the encryption processing or the like, using the encryption calculating unit702. The software is configured in the tamper-resistant module121. As the applications701, there are mounted the applications701that meet the services offered by the storage device120, i.e., the services ranging from the data processings inside the storage device120to the encrypted communications. The encryption calculating unit702performs calculation processings about the ciphers. The encryption calculating unit702is utilized not only by the applications701but also by an encrypted-communications processing unit704in the mobile terminal103.

In the mobile terminal103, the encrypted-communications processing unit704is configured on a basic communications processing unit705and further, mobile terminal applications703are configured on the processing unit704. The basic communications processing unit705performs basic processings concerning the communications by the mobile terminal103, e.g., the communications-path encoding, the modification of the communications rate, and the data transmission/reception. The encrypted-communications processing unit704performs the encryption processings of the transmitted/received data, using an encrypting scheme determined beforehand between the processing unit704and the server180. The preparation for the data needed for the encrypted communications and the processings such as the encrypting calculations are performed using the encryption calculating unit702in the storage device120. The mobile terminal applications703are various types of applications that the user utilizes with the mobile terminal103, e.g., the menu display and the electronic mail function. In the server180, the software includes a basic communications processing unit706, an encrypted-communications processing unit707, and server applications708. The basic communications processing unit706and the encrypted-communications processing unit707basically perform the same operations as those of the encrypted-communications processing unit704and the basic communications processing unit705in the mobile terminal103. The encrypted-communications processing unit707, however, may not utilize the storage device120when performing the processings about the encryption. The server applications708are applications needed in order to function as the server, e.g., the management of the content402to be delivered to the mobile terminal103and the management of the user.

The explanation will be given below concerning the case where the storage device120acquires the content402from the server180via the mobile terminal103. As illustrated inFIG. 9, the encrypted-communications processing unit704in the mobile terminal103and the encrypted-communications processing unit707in the server180configure an encrypted communications-path801(this is equivalent to the encrypted inside-communications-path109) via the basic communications processing units705,706. The encrypted-communications processing unit704utilizes the encryption calculating unit702inside the storage device120so as to perform the calculations about the encryption. At the same time, the processing unit704transmits the information on the user to the server180, thereby recording temporary key information or the like that is used for the encryption/decryption in the encrypted communications-path801.

When an encrypted communications-path901is configured, as illustrated inFIG. 10, the respective applications of the storage device120, the mobile terminal103, and the server180are started up. The applications701in the storage device120acquire, via the mobile terminal103and the encrypted communications-path901, the license401corresponding to the content402wished to be acquired from the server applications708, then storing the license401into the tamper-resistant module121in the storage device120.

When the acquisition of the license has been terminated, as illustrated inFIG. 11, the applications701in the storage device120acquire the encrypted content402from the server applications708via the mobile terminal103and the encrypted communications-path1001, then storing the encrypted content into the flash memory140inside the storage device120. Additionally, since the content402has been already encrypted, at this step, it is well enough to simply store, into the storage device120, the data received from the server180. Consequently, the processing is performed using only the physical access command408. Using the logical access command409is also allowable.

FIG. 12is a flow diagram for explaining the processing steps of the communications inFIGS. 8 to 11.

An application starting-up processing is executed (1100). The mobile terminal103selects, from inside the storage device120, an application for performing a processing needed for communications to be performed by the mobile terminal103(1101). The CPU128checks whether or not the application, which is selected by the mobile terminal103and stored into the flash memory140, has been encrypted (1103). In the case of having been encrypted, the CPU128decrypts the application with the use of the secret information KM151, then storing the application into the application RAM127(1104). In the case of having been not encrypted, the CPU128reads out the application as it is from the flash memory140, then storing the application into the application RAM127in a state where the application is executable (1105). Then, the CPU128executes the application (1106).

When the application is started up, the mobile terminal103and the storage device120execute the encrypted communications-path establishing processing500, thereby establishing the communications-path with the server180.

A transmission/reception processing1120is executed between the storage device120and the server180. At this time, taking advantage of the secret information KI155used in the encrypted inside-communications-path establishing processing520of the encrypted communications-path establishing processing500, the server180and the storage device120encrypt the data of each other, thus performing the transmission/reception via the mobile terminal103(1107to1118). The mobile terminal103is incapable of seeing the data that the storage device120is transmitting/receiving. Instead, the mobile terminal103is capable of differentiating only the data whose transmission termination has been indicated by the storage device120. Accordingly, if the applicable data is transmitted from the storage device120, the mobile terminal103terminates the transmission/reception processing1120.

In order to terminate the transmission/reception processing1120, the mobile terminal103executes a termination processing1130. Concretely, the mobile terminal103transmits a processing-termination notice to the storage device120and the server180(1132,1135). This causes the server180to discard the communications-path (1133), and causes the storage device120to terminate the application (1136).

FIG. 13is a diagram for illustrating the exchanges of concrete commands in the case where the license401is downloaded from the server180into the storage device120via the mobile terminal103. The explanation will be given below in a manner of corresponding toFIG. 12.

In the application starting-up processing1100, the following commands are exchanged:

OPEN_CHANNEL1201is a command that the mobile terminal103issues to the storage device120in order to configure a virtual communications-path therebetween. The storage device120returns the number of the virtual communications-path. The communications hereinafter are performed using the virtual communications-path number.

OPEN_FILE1202is a command by which the mobile terminal103specifies a file in the storage device120for storing the license401. The storage device120returns the allocation number of the specified file. The processings hereinafter are performed using this file allocation number. VERIFY1203is a command by which the mobile terminal103issues a certification code for starting up the applications inside the storage device120. If the storage device120verifies that the certification code is an authorized one, the applications inside the storage device120are started up. This makes it possible to access the file specified by OPEN_FILE1202.

The encrypted communications-path establishing processing510on the public line108is performed.

In the encrypted inside-communications-path establishing processing520, the following commands are exchanged:

SEND_CERT1205is a command by which the mobile terminal103requests the storage device120to transmit the certificate for certifying that the storage device120is an authentic one. The storage device120transmits the certificate to the mobile terminal103.

OPEN1206is a command by which the mobile terminal103transmits, to the server180, the certificate and the CONTENT ID read out from the storage device120. If the server180verifies the certificate, the server180generates the session key KS1, then transmitting KS1to the mobile terminal103.

SET_SESSION_KEY1207is a command by which the mobile terminal103transmits, to the storage device120, the session key KS1received from the server180. Additionally, the commands, i.e., SEND_CERT1205, OPEN1206, and SET_SESSION_KEY1207, correspond to the content request601and the session key KS1transmission602inFIG. 7.

In the transmission/reception processing1120, the following commands are exchanged:

ESTABLISH_WRITE_SESSION1208is a command by which the storage device120generates the session key KS2and transmits, to the mobile terminal103, KS2that is encrypted using KS1.

ESTABLISH_WRITE_SESSION1209is a command by which the mobile terminal103transmits, to the server180, KS2that has been encrypted using KS1received from the storage device120. The server180, after having received the encrypted KS2, decrypts the encrypted KS2by using KS1and encrypts the license401by using KS2, then transmitting the encrypted license401to the mobile terminal103.

SET_LICENSE1210is a command by which the mobile terminal103transmits the license401to the storage device120.

WRITE_LICENSE1211is a command that the mobile terminal103issues in order to cause the storage device120to perform the following: Decrypting the license401by using KS2, and creating a license-storing area in the NV memory125inside the tamper-resistant module121so as to store the decrypted license401into the license-storing area. Incidentally, ESTABLISH_WRITE_SESSION1208, ESTABLISH_WRITE_SESSION1209, SET_LICENSE1210, and WRITE_LICENSE1211correspond to the session key KS2transmission603and the license transmission604inFIG. 7.

In the termination processing1130, the following commands are exchanged:

CLOSE1212is a command by which the mobile terminal103informs the server180of the termination of the license acquisition processing. Having received CLOSE1212, the server180discards the encrypted communications-path801between the mobile terminal103and the server180.

CLOSE_FILE1213is a command that the mobile terminal103issues in order to close the file in the storage device120.

CLOSE_CHANNEL1214is a command that the mobile terminal103issues in order to terminate the processing by closing the virtual communications-path that has been utilized between the mobile terminal103and the storage device120.

FIG. 14is a diagram for illustrating the exchanges of concrete commands in the case where the content402is downloaded from the server180into the storage device120via the mobile terminal103. The explanation will be given below in a manner of corresponding toFIG. 11.

The encrypted communications-path establishing processing510on the public line108is performed.

In the transmission/reception processing1120, the following commands are exchanged: OPEN1301is a command by which the mobile terminal103transmits, to the server180, the CONTENT ID corresponding to the content402to be acquired. Having received the CONTENT ID, the server180transmits the encrypted content402to the mobile terminal103.

SET_BLOCKS_TRANSFERRED1302is a command by which the mobile terminal103transmits, to the storage device120, the size of the encrypted content402received from the server180.

WRITE_BLOCK1303is a command by which the mobile terminal103allows the encrypted content402received from the server180to be transferred to an arbitrary address on the flash memory140inside the storage device120. As the addressing method, there can be considered the following method or the like: A file system is provided on the flash memory140, and a file corresponding to the encrypted content402is created based on the CONTENT ID, then addressing an address determined by the file system. There are some cases where, when the encrypted content402has a large-capacity, SET_BLOCKS_TRANSFERRED1302and WRITE_BLOCK1303are issued a plurality of times.

CLOSE1304is a command by which the mobile terminal103informs the server180of the termination of the license acquisition processing. Having received CLOSE1304, the server180discards the encrypted communications-path between the mobile terminal103and the server180. Incidentally, the steps inFIG. 14correspond to the content transmission605inFIG. 7.

FIG. 15is a conceptual diagram in the case where the decoder circuit206inside the mobile terminal103reproduces the encrypted content402inside the storage device120. The decoder circuit206can also be used in a state of being mounted on an appliance other than the mobile terminal103. The storage device120can also be connected to an appliance other than the mobile terminal103. As the concrete examples, there can be considered an MP3 player, a stereo, and a digital image reproducer. Out of the tamper-resistant module121in the storage device120, the decoder circuit206fetches the license401corresponding to the encrypted content402that is wished to be reproduced. The decoder circuit206fetches the encrypted content402out of the flash memory140so as to decrypt the encrypted content402using the license401, then reproducing the content402. A license transmission1402is performed using the hierarchical command405. A content transmission1403is performed using the physical access command408. Incidentally, this is not the case concerning the respective command configurations at the times of the transmissions.

FIG. 16is a flow diagram for explaining the details of the communications inFIG. 15.

The processings ranging from the application starting-up processing (1100) to the application executing processing (1106) are the same as those of the flow explained inFIG. 11, and accordingly the explanation thereof will be omitted.

The starting-up of the application executes the encrypted inside-communications-path establishing processing520, thereby establishing the communications-path between the decoder circuit206and the storage device120. In this case, the communications-path is established using the secret information KL157created specifically for the decoder circuit206.

The execution of a transmission/reception processing1500brings about an actual transmission/reception of the data between the storage device120and the decoder circuit206. At this time, taking advantage of the secret information KL157used in the encrypted inside-communications-path establishing processing520, the decoder circuit206and the storage device120encrypt the data of each other, thus performing the transmission/reception (1501to1508). While the transmission/reception processing1500is being executed, the decoder circuit206performs the control of the mobile terminal103. When the transmission/reception has been terminated, the decoder circuit206sends the CPU201of the mobile terminal103a command for notify a termination interruption. Having received the command on the termination interruption, the CPU201starts a termination processing1510. Concretely, the CPU201of the mobile terminal103transmits a processing-termination notice to the storage device120(1512), thereby causing the application to be terminated (1513).

FIG. 17is a diagram for explaining commands for the steps between the decoder circuit206and the storage device120at the time when the decoder circuit206acquires the license401. The explanation will be given below in a manner of corresponding toFIG. 16. Incidentally, inFIG. 17, the items of “secret information KI155” given in “Data Location” of the table notation definition2101are all replaced by “secret information KL157”. Also, the encryption processing circuit126in the storage device120generates KS5by using a random number or the like, and the encryption processing circuit304in the decoder circuit206generates KS6by using a random number or the like.

In the application starting-up processing1100, the following commands are exchanged:

OPEN_CHANNEL1600is a command that the decoder circuit206issues to the storage device120via the storage device interface207in the mobile terminal103in order to establish the virtual communications-path between the decoder circuit206and the storage device120. Having received the OPEN_CHANNEL1600command, the storage device120returns the number of the virtual communications-path. The communications hereinafter are performed using this virtual communications-path number.

OPEN_FILE1601is a command by which the decoder circuit206specifies a file in the storage device120where the license401has been stored. Having received the OPEN_FILE1601command, the storage device120returns the allocation number of the specified file. The processings hereinafter are performed using the file allocation number.

VERIFY1602is a command by which the decoder circuit206issues a certification code for starting up the applications inside the storage device120. If the storage device120verifies that the certification code is an authorized one, the applications inside the storage device120are started up. This makes it possible to access the file specified by OPEN_FILE1601.

In the encrypted inside-communications-path establishing processing520where the secret information KL157is used, the following commands are exchanged:

VERIFY_CERT1604is a command by which the decoder circuit206transmits the certificate to the storage device120. Having received the VERIFY_CERT1604command, the storage device120verifies the certificate.

SEND_SESSION_KEY1605is a command by which the storage device120transmits, to the decoder circuit206, the session key KS5generated by the encryption processing circuit126.

ESTABLISH_PLAY_SESSION1606is a command by which the decoder circuit206, after having received KS5, performs the following: Generating the session key KS6by using the encryption processing circuit304, and encrypting KS6by using KS5so as to transmit the encrypted KS6to the storage device120.

In the transmission/reception processing1500, the following commands are exchanged:

READ_LICENSE1607is a command by which the decoder circuit206instructs the storage device120to make a preparation for the license401to be read out. SEND_PLAY_LICENSE1608is a command by which the decoder circuit206reads out the license401from the storage device120.

In the termination processing1510, the following commands are exchanged:

CLOSE_FILE1609is a command that the decoder circuit206issues in order to close the file in the storage device120.

CLOSE_CHANNEL1610is a command that the mobile terminal103issues in order to terminate the processing by closing the virtual communications-path that has been utilized between the mobile terminal103and the storage device120.

FIG. 18is a diagram for explaining the processing where, after having terminated the acquisition of the license401, the decoder circuit206reads out, from the storage device120, the encrypted content402to be reproduced. Additionally, since the content402has been already encrypted, at this step, it is well enough to simply store the data from the storage device120into the decoder circuit206. Consequently, the processing is performed using only the physical access command408. Using the logical access command409is also allowable.

In the processings inFIG. 18, the following commands are exchanged:

SET_BLOCKLEN1704is a command by which the decoder circuit206transmits, to the storage device120, the size of the encrypted content402to be read out.

SET_BLOCKS_TRANSFERRED1705is a command for specifying the amount by which the decoder circuit206will read out, at one time, the encrypted content402inside the storage device120.

READ_BLOCK1706is a command that the decoder circuit206issues in order to perform the following: Specifying, to the storage device120, the address of the encrypted content402to be reproduced, and reading out the encrypted content402so as to perform the reproduction.

Employing the configuration like this permits the data to be stored safely and in a large-capacity.

In the present invention, using the storage device including the tamper-resistant module and the large-capacity flash memory, the high-security data is encrypted and stored into the large-capacity flash memory. This makes it possible to configure the inexpensive storage device that allows the large-capacity and high-security data to be stored with the data's security maintained. Also, since the encryption processing is performed inside the storage device, an external appliance need not perform the encryption key acquisition and the encryption/decryption processing. This reduces the burden imposed on the external appliance.

Also, in the present invention, the tamperresistant module includes the CPU. This CPU, depending on the various conditions, judges the security of information transmitted from the outside. Moreover, the CPU stores the high-security information into the non-volatile memory inside the tamper-resistant module, and stores low-security information into the external flash memory. As a result, the data processing becomes faster as compared with the case where all the data are encrypted. What is more, it becomes possible to effectively utilize the record area inside the tamper-resistant module.

Furthermore, in the present invention, the applications to be executed inside the tamper-resistant module are encrypted and stored into the external flash memory. In addition, when required, the applications are read out from the flash memory, then being expanded onto the internal RAM so as to be executable. The employment of this configuration allows the various types of applications to be installed into the storage device at one time. What is more, it becomes possible to execute a large-sized application inside the storage device.

It should be further understood by those skilled in the art that the foregoing description has been made on embodiments of the invention and that various changes and modifications may be made in the invention without departing from the spirit of the invention and scope of the appended claims.