Backup management device, backup management method, computer program, recording medium, integrated circuit, and backup system

To provide a backup management device that deletes a content so as to be restorable in the future while protecting a copyright of the content, in a case where there exists a backup of the content. In an HD recorder, a first information storage unit stores a content, a second information storage unit stores a backup of the content, a secure storage unit stores a hash value of the content. If receiving an instruction to delete the content so as to be restorable, a control unit deletes the content from the first information storage unit. When the content is played back, an encryption processing unit applies a calculation to the content to generate detection information, and the control unit compares the hash value with the detection information to judge whether the content has been tampered.

TECHNICAL FIELD

The present invention relates to an art for backing up digital contents while protecting copyrights thereof.

BACKGROUND ART

Recently, digital broadcasting for broadcasting digital contents has been started. Digital contents hardly suffer degradation due to use. Therefore, in order to protect copyrights of the digital contents, each of the digital contents has CCI (Copy Control Information) attached thereto showing whether copying of the digital content is permitted and the number of permitted copies.

However, when a hard disk recorder (hereinafter “HD recorder”) stores, in an HDD (Hard Disk Drive), a content having CCI attached thereto showing that copying of the content is not permitted, even if the HD recorder protects a copyright of the content based on the CCI, a malicious use might be performed. For example, when the HD recorder is powered off, a malicious user removes the HDD and connects the HDD to a personal computer and the like to copy the content stored in the HDD. As one example of conventional arts for preventing such a malicious copying, the following art is known. In advance, a content stored in an HDD is assigned to a one-way function to calculate illegitimacy detection information, and the calculated illegitimacy detection information is stored in the HDD. When the HD recorder is powered on, a content stored in the HDD is assigned to the one-way function to generate verification information. The generated verification information and the stored illegitimacy detection information are compared with each other to detect a malicious use of the content.

Here, although the HDD is convenient, a failure occurrence rate thereof increases depending on a usage frequency since the HDD reads and writes information by performing a rotational operation or a seek operation. If the HDD fails, the content completely disappears since there exists no copy of the content. In order to prevent such a data disappearance due to the HDD failure, it is effective to back up the content to other recording medium or recoding device.

After a content recorded in the HD recorder is backed up to the recording device, if the content needs to be deleted because of an insufficient recording capacity of the HDD relating to the HD recorder, the backup that is a copy of the content needs to be deleted from the recording device for protecting a copyright of the content while deleting the content from the HD recorder. This is for avoiding that the backup remains for use despite the content has been deleted in terms of copyright protection.

SUMMARY OF THE INVENTION

Problems the Invention is Going to Solve

However, there is a demand for later restoration of the content that even if the recording capacity of the HD recorder needs to be made temporarily and therefore the content needs to be deleted from the HD recorder since the content has a great need.

The present invention aims to provide a backup management device, a backup management method, a computer program, a recording medium, and a backup system, which each realize, in a case where a backup of a content exists, deletion of the content such that the deleted content can be restored later while protecting a copyright thereof.

Means to Solve the Problems

In order to solve the above problem, the present invention provides a backup management device comprising: a first storage unit that stores a content; a secure storage unit that stores playback right information showing a right to play back the content; a second storage unit that stores a backup of the content; an acquisition unit operable to acquire an instruction to delete the content so as to be restorable; and a deletion unit operable, if the instruction is acquired, to delete the content without deleting the playback right information.

EFFECT OF THE INVENTION

According to this structure, even if the one of the contents is deleted from the first storage unit, the backup management device according to the present invention does not delete the corresponding backup. Therefore, the one of the contents that has been deleted can be restored later. Furthermore, the backup management device holds the corresponding piece of the playback right information generated using the one of the contents before being deleted. Accordingly, after restoration of the one of the contents, whether use of the restored one of the contents is illegitimate is judged, and therefore a copyright of the one of the contents is protected.

Also, the playback right information may be used for judging whether the backup is permitted to be played back.

According to this structure, after restoration of the one of the contents, whether the restored one of the contents is permitted to be played back can be judged using the corresponding piece of the playback right information.

Here, pieces of the playback right information correspond to the contents respectively, each indicate to have a right to play back the corresponding content, and include information for identifying the content such as an identifier for identifying the content and a hash value of the content.

For example, if a playback device including the backup management device and so on that plays back contents holds pieces of the playback right information, the playback device plays back one of the contents corresponding to a piece of the playback right information. If the playback device does not hold the piece of the playback right information, the playback device does not playback the corresponding one of the contents.

Also, the playback right information may be a hash value generated by applying a calculation using a one-way function to at least part of the content, and if a value generated by applying the calculation to at least part of a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether part of any one of the contents relating to a hash value matches part of the restored one of the contents is judged using the hash value, and therefore whether the restored one of the contents is permitted to be played back can be judged.

Also, the content may include: an encryption key; and an encrypted work generated by encrypting a digital work using the encryption key, the playback right information may be a hash value generated by applying the calculation to the encryption key, and if a value generated by applying the calculation to an encryption key included in a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether an encryption key relating to a hash value matches the encryption key included in the restored one of the contents is judged using the hash value, and therefore whether the restored one of the contents is permitted to be played back can be judged.

Also, the content may include: an encrypted work generated by encrypting a digital work using an encryption key; and an encrypted key generated by encrypting the encryption key using a specific key that is specific to the backup management device, the playback right information may be a hash value generated by applying the calculation to the encrypted key, and if a value generated by applying the calculation to an encrypted key included in a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether an encrypted key relating to a hash value matches the encrypted key included in the restored one of the contents is judged using the hash value, and therefore whether the restored one of the contents is permitted to be played back can be judged.

Also, the content may include: an encrypted work generated by encrypting a digital work using an encryption key; and an encrypted key generated by encrypting the encryption key using a specific key that is specific to the backup management device, the playback right information may be a hash value generated by applying the calculation to at least part of the encrypted work, and if a value generated by applying the calculation to at least part of an encrypted work included in a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether an encrypted work relating to a hash value matches the encrypted work included in the restored one of the contents is judged using the hash value, and therefore whether the restored content is permitted to be played back can be judged.

Also, the content may include: an encrypted work generated by encrypting a digital work using an encryption key; and an encrypted key generated by encrypting the encryption key using a specific key that is specific to the backup management device, the playback right information may be a hash value generated by applying the calculation to a combination of at least part of the encrypted work and the encrypted key, and if a value generated by applying the calculation to a combination of at least part of an encrypted work and an encrypted key included in a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether a combination of an encrypted work and an encrypted key relating to a hash value matches the combination of the encrypted work and the encrypted key included in the restored one of the contents is judged using the hash value, and therefore whether the restored one of the contents is permitted to be played back can be judged.

Also, the playback right information may be a hash value generated by applying a calculation using a one-way function to the content, and if a value generated by applying the calculation to a content stored in the first storage unit matches the hash value, the content stored in the first storage unit may be permitted to be played back.

According to this structure, after restoration of the one of the contents, whether a content relating to a hash value matches the restored one of the contents is judged using the hash value, and therefore whether the restored one of the contents is permitted to be played back can be judged.

Also, the acquisition unit may further acquire a restoration instruction to restore the content, and the backup management device may further comprise a restoration unit operable, if the restoration instruction is acquired, to read the backup from the second storage unit, and write the read backup to the first storage unit.

According to this structure, the backup management device can restore of the one of the contents using the corresponding backup, and use the restored one of the contents.

Also, the acquisition unit may further acquire a deletion instruction to delete the content, and

the backup management device may further comprise a complete deletion unit operable, if the deletion instruction is acquired, to delete the backup from the second storage unit, and delete the playback right information from the secure storage unit.

According to this structure, the backup management device can completely delete the one of the contents, and therefore the one of the contents can be protected from being played back.

Also, the acquisition unit may further acquire a move instruction to move the content to another device, and the backup management device may further comprise: a transmission unit operable, if the move instruction is acquired, to read the backup from the second storage unit, and transmit the read backup to the another device; and a complete deletion unit operable to delete the backup from the second storage unit, and delete the playback right information from the secure storage unit.

According to this structure, the backup management device can move the one of the contents that has been deleted so as to be restorable to another device, while protecting a copyright thereof.

A backup management method according to the present invention is a backup management method for use in a backup management device, the backup management device comprising: a first storage unit that stores a content; a secure storage unit that stores playback right information showing a right to play back the content; a second storage unit that stores a backup of the content; the backup management method comprising the steps of: acquiring an instruction to delete the content so as to be restorable; and deleting, if the instruction is acquired, the content without deleting the playback right information.

A computer program according to the present invention is a computer program for use in a backup management device, the backup management device comprising: a first storage unit that stores a content; a secure storage unit that stores playback right information showing a right to play back the content; a second storage unit that stores a backup of the content; the computer program causing a computer to perform the steps of: acquiring an instruction to delete the content so as to be restorable; and deleting, if the instruction is acquired, the content without deleting the playback right information.

Also, a recording medium according to the present invention is a computer readable recording medium that records the computer program.

Also, an integrated circuit according to the present invention is an integrated circuit for use in a backup management device, the backup management device comprising: a first storage unit that stores a content; a secure storage unit that stores playback right information showing a right to play back the content; a second storage unit that stores a backup of the content; the integrated circuit comprising the steps of: acquiring an instruction to delete the content so as to be restorable; and deleting, if the instruction is acquired, the content without deleting the playback right information.

According to this structure, if the content is deleted from the first storage unit, the backup is not deleted. Therefore, the deleted content can be restored later. Furthermore, the backup management device holds the playback right information generated using the content before being deleted. Therefore, after restoration of the content, whether use of the restored content is illegitimate is judged, and therefore a copyright of the content can be protected.

A backup system according to the present invention is a backup system comprising a recording/playback device that stores and plays back a content and a backup device that manages a backup of the content, wherein the backup device stores the backup, the recording/playback device comprises: a storage unit that stores the content; a secure storage unit that stores playback right information showing a right to play back the content; an acquisition unit operable to acquire an instruction to delete the content so as to be restorable; and a deletion unit operable, if the instruction is acquired, to delete the content without deleting the playback right information, nor instructing the backup system to delete the backup.

According to this structure, if the content is deleted from the first storage unit, the backup stored in the backup device is not deleted. Therefore, the deleted content can be restored later. Furthermore, the backup management device holds the playback right information generated using the content before being deleted. Therefore, after restoration of the content from the backup device, whether use of the restored content is illegitimate is judged, and therefore a copyright of the content can be protected.

Also, the content and the backup may respectively include: an encrypted work generated by encrypting a digital work using an encryption key; and an encrypted key generated by encrypting the encryption key using a specific key that is specific to the recording/playback device, the backup system may further comprise a request device, the request device may include: a request key storage unit that stores a request key that is specific to the request device; a transfer request transmission unit operable to transmit a transfer request of the backup to the recording/playback device; an encryption key receiving unit operable to securely receive the encryption key, as a response to the transfer request, from the recording/playback device; and a key transmission unit operable, if the encryption key is received, to read the request key, encrypt the encryption key using the read request key to generate a re-encrypted key, and transmit the generated re-encrypted key to the backup device, the recording/playback device may further include: a specific key storage unit that stores the specific key; a transfer request receiving unit operable to receive the transfer request from the request device; an encrypted key request unit operable, if the transfer request is received, to transmit a transmission request of the encrypted key included in the backup to the backup device; an encrypted key receiving unit operable to receive the encrypted key, as a response to the transmission request, from the backup device; an encryption key transmission unit operable, if the encrypted key is received, to read the specific key, decrypt the received encrypted key using the specific key to generate an encryption key, and transmit the generated encryption key to the request device; and a playback right information deletion unit operable to delete the playback right information from the secure storage unit, and the backup device may include: an encrypted key request receiving unit operable to receive the transmission request; and an encrypted key transmission unit operable, if the transmission request is received, to transmit the encrypted key included in the backup to the recording/playback device.

According to this structure, a transfer of a proprietary right of the backup stored in the backup device is realized by performing decryption of the encrypted key and re-encryption of the decrypted encryption key, without decrypting the encrypted work. This can reduce the processing load of the system due to the transfer of the proprietary right compared with conventional arts.

Here, in order to securely receive information such as the encryption key that needs to be secret, a method is used in accordance with a specification for realizing highly confidential communication, such as DTCP (Digital Transmission Content Protection), as an example.

Also, the backup may include: an encrypted work generated by encrypting a digital work using an encryption key; and an encrypted key generated by encrypting the encryption key using a specific key that is specific to the recording/playback device, the backup system may further comprise a request device, the request device may store a secret key for decrypting an encryption key encrypted using a public key, and transmit a transfer request of the backup to the recording/playback device, the recording/playback device may further include: a transfer request receiving unit operable to receive the transfer request from the request device; an encrypted key request unit operable, if the transfer request is received, to transmit a transmission request of the encrypted key included in the backup to the backup device; an encrypted key receiving unit operable to receive the encrypted key, as a response to the transmission request, from the backup device; a re-encrypted key generation unit that stores beforehand the specific key and the public key, and operable to decrypt the received encrypted key using the specific key to generate the encryption key, and encrypt the generated encryption key using the public key to generate a re-encrypted key; a transmission unit operable to transmit, to the backup device, a rewriting request including the generated re-encrypted key and for instructing to rewrite the encrypted key included in the backup to the generated re-encrypted key; and a deletion unit operable to delete the playback right information from the secure storage unit, and the backup device may include: an encrypted key request receiving unit operable to receive the transmission request; an encrypted key transmission unit operable, if the transmission request is received, to transmit the encrypted key included in the backup to the recording/playback device; a rewriting request receiving unit operable to receive the rewriting request; and a rewriting unit operable to rewrite the encrypted key included in the backup to the re-encrypted key included in the received rewriting request.

According to this structure, a transfer of a proprietary right of the backup stored in the backup device is realized by performing decryption of the encrypted key by the backup device and re-encryption of the decrypted encryption key, without decrypting the encrypted work. This can reduce the processing load of the system due to the transfer of the proprietary right compared with conventional arts.

A backup management device according to the present invention is a backup management device that manages a backup of a content, comprising a specific key storage unit that stores a specific key for each device; a secure storage unit that stores playback right information showing a right to play back the content; a transfer request receiving unit operable to receive a transfer request of the backup from a request device that stores a first decryption key for decrypting a cyphertext encrypted using a first encryption key; an encrypted key acquisition unit operable, from a backup device that stores an encrypted key and the backup that has been encrypted, to acquire the encrypted key, the encrypted key being encrypted so as to be decrypted into a second decryption key for decrypting the encrypted backup using the specific key; a re-encrypted key generation unit operable to generate a re-encrypted key by decrypting the acquired encrypted key using the specific key to generate the second decryption key, and encrypting the generated second decryption key using the first encryption key; an instruction unit operable to transmit the re-encrypted key to the backup device to instruct the backup device to rewrite the encrypted key stored therein to the re-encrypted key; and a deletion unit operable to delete the playback right information from the secure storage unit.

According to this structure, a transfer of a proprietary right of the backup stored in the backup device is realized by performing decryption of the encrypted key and re-encryption of the decrypted encryption key, without decrypting the encrypted backup. This can reduce the processing load of the system due to the transfer of the proprietary right compared with conventional arts.

DESCRIPTION OF CHARACTERS

1: backup system

2: backup system

10: broadcast device

30: home network

101: specific information storage unit

102: information storage unit

103: information storage unit

104: secure storage unit

106: broadcast receiving unit

108: key generation unit

109: encryption processing unit

110: input unit

112: playback control unit

113: control unit

114: authentication unit

500: backup device

502: authentication unit

503: power supply unit

504: specific information storage unit

507: control unit

509: encryption processing unit

510: content storage unit

511: secure information storage unit

512: input unit

513: display unit

DETAILED DESCRIPTION OF THE INVENTION

The following describes embodiments of the present invention with reference to example drawings.

First Embodiment

A backup system1of a first embodiment according to the present invention is described with reference to the drawings.

<Outline of Backup System1>

The backup system1according to the present invention includes a hard disk recorder (hereinafter, HD recorder)100and an HD recorder400having the same internal structure as the HD recorder100, as shown inFIG. 1. The HD recorder100and the HD recorder400are connected with each other via a home network30based on IEEE1394.

The HD recorder100acquires a content composed of a video and a sound by receiving a broadcast wave transmitted from a broadcast device10, and stores the acquired content. Moreover, the HD recorder100is equipped with a DVD as an external recording medium, and can acquire contents from the external recording medium.

The HD recorder100includes two hard disks. One is a work hard disk having a small capacity for recording frequently used contents, and the other is a backup hard disk having a large capacity for recording infrequently used contents and copies of contents as backups of the contents.

Based on a user's operation, the HD recorder100backs up contents stored in the work hard disk to the backup hard disk, moves the contents to the HD recorder400, and the like.

Here, the work hard disk included in the HD recorder100has a capacity smaller than the backup hard disk, and therefore easily reaches a maximum of the capacity due to accumulation of contents.

In the HD recorder100, if the work hard disk reaches the maximum of the capacity, a content having a lower priority level is deleted so as to make the capacity. A content targeted for recording is accumulated, and then the deleted content is restored later. In this way, the HD recorder100aims to improve in convenience. However, in compensation for the improvement in convenience, there might occur a case where a plurality of copies of a content having a copy-incapable attribute attached thereto exist in different hard disks at a time. The HD recorder100also aims to protect a copyright of the content in such a case.

The HD recorder100includes, as shown inFIG. 2, a specific information storage unit101, a first information storage unit102, a second information storage unit103, a secure storage unit104, an antenna105, a broadcast receiving unit106, a decoding unit107, a key generation unit108, an encryption processing unit109, an input unit110, an input/output unit111, a playback control unit112, a control unit113, an authentication unit114, and a transmission/reception unit115.

The HD recorder100is specifically a computer system composed of a microprocessor, a RAM, and a ROM. A computer program is stored in the RAM and the ROM. Part of functions of the HD recorder100is achieved by the microprocessor operating in accordance with the computer program.

In addition, the structure and operations of the HD recorder400are the same as those of the HD recorder100, and therefore descriptions thereof are omitted here.

The specific information storage unit101is composed of a ROM, and stores a device identifier131“ID_A” and a device-specific key132“Key_A”. Moreover, the specific information storage unit101includes a protection mechanism, and is protected against accesses from an external device.

The device identifier131“ID_A” is identification information that indicates the HD recorder100. The device-specific key132“Key_A” is key information specific to the HD recorder100. The device identifier131“ID_A” and the device-specific key132“Key_A” are prestored in the specific information storage unit101before shipment of the HD recorder100.

Moreover, a specific information storage unit101of the HD recorder400is composed of a ROM, and stores a device identifier131“ID_B” and a device-specific key132“Key_B”. The device identifier131“ID_B” is identification information that indicates the HD recorder400. The device-specific key132“Key_B” is key information specific to the HD recorder400. The device identifier131“ID_B” and the device-specific key132“Key_B” are prestored in the specific information storage unit101before shipment of the HD recorder400.

The first information storage unit102is a work hard disk composed of hard disk units, and stores content files141,145,149, and so on, as one example as shown inFIG. 3. Each of the content files includes a content ID, an encrypted content, and an encrypted content key.

Here, the content ID is identification information that indicates the encrypted content. The encrypted content is a content encrypted using one of content keys that correspond one-to-one with contents. The encrypted content key is generated by applying an encryption algorithm E1 to the content key using the device-specific key132“Key_A” stored in the specific information storage unit101. Here, the encryption algorithm E1 is the DES (Data Encryption Standard) encryption algorithm, for example.

The DES encryption algorithm is a well-known art, and therefore a description thereof is omitted here.

The content file141includes, for example, a content ID142“A001”, an encrypted content143“ENC (Key_1a, Content1a)”, and an encrypted content key144“ENC (Key_A, Key_1a)”.

The content ID142“A001” is identification information that indicates the encrypted content143. The encrypted content143is generated by applying the encryption algorithm E1 to a content “Content1a” that includes a video using a content key “Key_1a”. The encrypted content key144“ENC (Key_A, Key_1a)” is generated by applying the encryption algorithm E1 to the content key “Key_1a” using the device-specific key132“Key_A” stored in the specific information storage unit101. The content key “Key_1a” corresponds one-to-one with the content “Content1a”.

In addition to these content files, the first information storage unit102stores various types of image data used for generating a menu screen, an initial-setting screen, and the like.

The second information storage unit103is a backup hard disk composed of hard disk units, and has a storage capacity larger than the first information storage unit102. Also, the second information storage unit103is not frequently used, and therefore has a long life.

In the same way as the first information storage unit102, the second information storage unit103stores content files161,165,169, and so on, as one example as shown inFIG. 4.

Here, the content file161stored in the second information storage unit103is a backup of the content file141stored in the first information storage unit102, and is equivalent to the content file141.

With respect to the content file165including a content ID “A003”, a content file equivalent to the content file165is not stored in the first information storage unit102. In other words, only a backup of the content is stored in the second information storage unit103. The same applies to the content file169.

The secure storage unit104includes a flash memory, and is protected against accesses from an external device.

The secure storage unit104stores a content management table180shown inFIG. 5, for example. The content management table180includes a plurality of pieces of content information181,182,183,184, and185, as shown inFIG. 5. Each piece of the content information is composed of a content ID, a title, a recording date and time, a hash value, a type, a compression format, a backup flag, and a priority level. Each piece of the content information corresponds with a content file including a content ID that is the same as the content ID included in the piece of the content information.

The content ID is identification information that indicates an encrypted content included in corresponding content files respectively stored in the first information storage unit102and the second information storage unit103, and is the same as the content ID included in the corresponding content file.

The title is a name that shows a content, and is generated based on program information transmitted from a broadcasting station. The title can be rewritten by the user's operation. The recording date and time shows a date and a time when the content is acquired from the broadcasting station or the external recording medium. The type shows a type of the content such as a “broadcasting program” showing that the content is a content received from the broadcasting station, a “photograph” showing that the content is image data photographed by a digital camera, etc.

The compression format shows a name of a compression format used for compressing a video and a sound that constitute the content.

The hash value is generated by combining the encrypted content and an encrypted content key that are included in the corresponding content file and assigning the combination to a hash function. The hash function used here is the SHA-1 (Secure Hash Algorithm-1) for example.

The SHA-1 is a well-known art, and therefore a description thereof is omitted here.

The backup flag is a flag that shows whether a content file corresponding to content information including the backup flag has been backed up to the second information storage unit103. The backup flag has either values of “1” or “0”. The value of “1” shows that the content file has been backed up, and the value of “0” shows that the content file has not been backed up yet.

The priority level is information that shows a priority level of saving the content, and has either values of “1” or “2”. If an available capacity of the first information storage unit102is insufficient for writing a new encrypted content to the first information storage unit102, the control unit113backs up a content file corresponding to content information including a priority level having a value of “2” among the content files stored in the first information storage unit102to the second information storage unit103. Then, the control unit113deletes the content file from the first information storage unit102to make the storage capacity of the first information storage unit102. Even if the available capacity of the first information storage unit102becomes insufficient, the control unit113neither backs up a content file corresponding to content information having a priority level “1” nor deletes the content file from the first information storage unit102. Although the priority level is automatically set to have a value of “1” when a content is acquired, the value can be changed by the user's operation.

Regarding the content information181for example, a content ID191“A001” is identification information that indicates the encrypted contents143and163, and is the same as the content ID142“A001” and a content ID162“A001”. A title192“Content1a” is a name of a content acquired from a broadcast wave. Moreover, a recording date and time193“04. 10. 10. 17:00” shows that the encrypted content143was generated by encrypting a content acquired at 17:00 on Oct. 10, 2004. A hash value194“01a” is generated by assigning the combination of the encrypted content143and the encrypted content key144“ENC (Key_A, Key_1a)” to the hash function. Moreover, the content file161equivalent to the content file141is stored in the second information storage unit103, and therefore a backup flag197included in the content information181has a value of “1”.

Here, the content information181corresponds with the two content files, which are the content file141stored in the first information storage unit102and the content file161stored in the second information storage unit103. However, if the content file has not been backed up, the content information181corresponds with one content file stored in the first information storage unit102.

The antenna105receives a broadcast wave transmitted from the broadcasting station.

The broadcast receiving unit106includes a tuner, a modulation/demodulation unit, an error correction unit, and a demultiplexing unit. Upon receiving an instruction to receive television broadcasts from the control unit113, the broadcast receiving unit106demodulates a broadcast wave received by the antenna105, corrects an error included in the broadcast wave, and demultiplexes the broadcast wave to generate a TS (transport stream), and outputs the generated TS to the decoding unit107.

Moreover, the broadcast receiving unit106receives, from the control unit113, a recording start instruction to start recording of a content being received and a recording stop instruction to stop the recording. Upon receiving the recording start instruction, the broadcast receiving unit106outputs the generated TS to the encryption processing unit109until the broadcast receiving unit106has received the recording stop instruction.

In the following description, as long as there is no special need, no mention is made regarding a TS that constitutes a content, and a simple word “content” is used.

In accordance with an instruction by the control unit113, the decoding unit107expands a content acquired by the broadcast receiving unit106and a content generated by the encryption processing unit109(later described) in accordance with a compression format of each content, such as the MPEG (Moving Picture Experts Group) 2 and the JPEG (Joint Photographic Experts Group), to generate image data and sound data. Then, the decoding unit107outputs the generated image data and sound data to the playback control unit112.

The MPEG2 and the JPEG are well-known arts, and therefore descriptions thereof are omitted here.

The key generation unit108receives an instruction to generate a content key from the control unit113. Upon receiving the instruction to generate a content key, the key generation unit108generates a content key of 56 bit length using a pseudo-random number, and outputs the generated content key to the control unit113.

The encryption processing unit109receives a plaintext and a key from the control unit113, and is instructed by the control unit113to encrypt the plaintext. Also, the encryption processing unit109receives a ciphertext and a key from the control unit113, and is instructed by the control unit113to decrypt the ciphertext.

Upon receiving the encryption instruction, the encryption processing unit109applies the encryption algorithm E1 to the received plaintext using the received key to generate a ciphertext, and outputs the generated ciphertext to the control unit113.

Upon receiving the decryption instruction, the encryption processing unit109applies a decryption algorithm D1 to the received ciphertext using the received key to generate a decrypted text, and outputs the generated decrypted text to the control unit113.

A pair of a plaintext and a key received by the encryption processing unit109is composed of a content and a content key, or a content key and the device-specific key132“Key_A”, for example. Also, a pair of a ciphertext and a key received by the encryption processing unit109is composed of an encrypted content and a content key, or an encrypted content key and the device-specific key132“Key_A”, for example.

The decryption algorithm D1 is an algorithm for decrypting ciphertexts generated by the encryption algorithm E1.

The input unit110includes various types of buttons such as a power button, a recording button, a menu button, and a selection button, and a receiving circuit of a remote controller.

The input unit110receives operations of the buttons and the remote controller performed by the user, and outputs operation instruction information that shows the received operations of the buttons and the remote controller to the control unit113.

The input/output unit111reads and writes information from/into the DVD in accordance with an instruction by the control unit113.

The playback control unit112includes an image signal processing unit and a sound signal processing unit. The playback control unit112receives image data and sound data from the decoding unit107. The image signal processing unit generates an image signal including a vertical synchronizing signal and a horizontal synchronizing signal from the received image data, and outputs the generated image signal to a monitor120. Moreover, in accordance with an instruction by the control unit113, the image signal processing unit generates an image signal from various types of screen data, and outputs the generated image signal to the monitor120.

The sound signal processing unit generates an analog sound signal from the received sound data, and outputs the generated analog sound signal to the monitor120. Here, the monitor120is a TV receiver having a speaker and a display included therein, receives the image signal from the image signal processing unit, and displays an image based on the vertical synchronizing signal and the horizontal synchronizing signal. Moreover, the speaker receives the analog sound signal from the sound signal processing unit, converts the received analog sound signal into a sound, and outputs the sound.

The authentication unit114stores beforehand a secret key specific to the HD recorder100“SK_A”, a public key certificate “Cert_A”, a public key of a certification authority “PK_CA”, and a CRL (Certificate Revocation List). The public key certificate “Cert_A” certifies legitimacy of a public key “PK_A” corresponding to the secret key “SK_A”, and includes a certification identification number, the public key “PK_A”, and signature data of the certification authority. The signature data of the certification authority is generated by applying a signature generation algorithm S to at least the public key “PK_A” using the secret key of the certification authority “SK_A”. The signature generation algorithm S is the RSA (Rivest-Rivest-Shamir-Adleman) signature algorithm, for example.

The RSA signature algorithm is a well-known art, and therefore a description thereof is omitted here.

Instead of the RSA signature algorithm, the elliptic DSA (Digital Signature Algorithm) signature algorithm, the Elgamal signature algorithm over a finite field, etc. may be used.

Here, the certification authority is a fair independent organization, and issues a public key certificate to each device that constitutes the backup system1of the first embodiment.

The CRL includes a certification identification number of an invalidated public key certificate.

The public key of the certification authority “PK_CA” is a public key that forms a pair with the secret key of the certification authority “SK_CA”.

Upon receiving an instruction by the control unit113, the authentication unit114performs device authentication between the HD recorder100and the external device in accordance with the DTCP (Digital Transmission Content Protection). If the device authentication fails, the authentication unit114prohibits a communication between the control unit113and the external device. If the device authentication succeeds, the authentication unit114generates a session key that is shared between the control unit113and the external device, and outputs the generated session key to the control unit113. Operations in the device authentication are described in detail later.

The transmission/reception unit115is connected with the home network30, and transmits and receives information between the external device and each of the control unit113and the authentication unit114. Here, the external device is the HD recorder400.

The transmission/reception unit115periodically detects whether the transmission/reception unit115is connected to the home network30. If the transmission/reception unit115gets connected to the home network30, the transmission/reception unit115transmits a connection notification to the control unit113.

The transmission/reception unit115receives a broadcast instruction from the control unit113as a response to the connection notification. In accordance with the broadcast instruction, the transmission/reception unit115performs broadcast transmission of information acquisition request including device identification information of the HD recorder100“ID_A” to the home network30.

The transmission/reception unit115receives, from another device connected to the home network30, an information acquisition response including device identification information of the another device as a response to the information acquisition request, and transmits the received information acquisition response to the control unit113.

The control unit113controls the overall operations of the HD recorder100.

The control unit113includes, as shown inFIG. 39, an operation judgment unit1001, a panel generation unit1002, a restorability instruction unit1003, a content operation unit1004, a hash deletion unit1011, a hash writing unit1012, a hash calculation unit1013, and a hash comparison unit1014.

The operation judgment unit1001receives various types of operation instruction information from the input unit110, and transmits a motion instruction to other processing units included in the control unit113depending on a type of received operation instruction information. Moreover, the operation judgment unit1001manages input requests to the user and a hierarchical structure of the menu screen that displays various types of information. Depending on a type of received operation instruction information, the operation judgment unit1001judges which panel is to be displayed next, and instructs the panel generation unit1002to generate the panel to be displayed next.

For example, if receiving operation instruction information that shows that the recording button has been pressed, the operation judgment unit1001transmits a recording instruction to perform the later-described recording processing to the content operation unit1004. If receiving operation instruction information that shows that the menu button has been pressed, the operation judgment unit1001instructs the panel generation unit1002to generate a menu screen.

Also, if receiving operation instruction information that shows selection of the other button, the operation judgment unit1001performs various processing depending on data included in the operation instruction information, such as reception of TV broadcasts by the broadcast receiving unit106, reception of timer programming, display of program lists, and input/output of information to/from the external recording medium.

The panel generation unit1002receives various types of panel generation instructions from the operation judgment unit1001. The panel generation unit1002generates a panel specified by a received panel generation instruction using image data stored in the first information storage unit102, and outputs the generated panel to the playback control unit112.

For example, if receiving a menu generation instruction from the operation judgment unit1001, the panel generation unit1002generates a content management panel201shown inFIG. 18Abased on the content management table180stored in the secure storage unit104, and outputs the generated content management panel201to the playback control unit112.

The content management panel201includes a content list panel202, a Move button211, a Delete button212, a Backup button213, and a Restore button214. The content list panel202includes content panels203to207. The content panels correspond one-to-one with pieces of the content information included in the content management table180stored in the secure storage unit104.

Each of the content panels has items of a “title”, a “work”, and a “backed up”. The item “title” indicates a “title” included in the corresponding content information, as it is. If a content file corresponding to the content information is stored in the first information storage unit102, the item “work” shows “Yes”. If the corresponding content file is not stored, the item “work” shows “No”. If a backup flag included in the corresponding content information has a value of “1”, the item “backed up,” shows “Yes”. If the backup flag has a value of “0”, the item “backed up” shows “No”.

For example, on the content panel203corresponding to the content information181, the item “title” shows “Content1a”, which is a title of the content information181. The item “work” shows “Yes”, which indicates that the content file141is stored in the first information storage unit102. The item “backed up” shows “Yes”, which indicates that a backup flag included in the content information181has a value of “1”.

The panel generation unit1002generates content panels in accordance with the number of pieces of content information included in the content management table180, and generates the content list panel202including the generated content panels.

The content list panel202is generated by combining pieces of image data held in the first information storage unit102. The pieces of the image data include a bitmap representing a word “Yes” and a bitmap representing the Backup button213having a word “backed up” written thereon, for example.

The content operation unit1004receives instructions for operating contents from the operation judgment unit1001, such as a move instruction, a deletion instruction, a backup instruction, and a restoration instruction. In accordance with a type of the received instruction, the content operation unit1004performs processing on the contents such as move processing, deletion processing, backup processing, and restoration processing.

The restorability instruction unit1003receives, from the operation judgment unit1001, a restorability specification that shows whether to delete a content so as to be restorable or delete the content so as to be unrestorable, and performs control for deleting hash values.

The hash deletion unit1011deletes a specified hash value from the secure storage unit104.

The hash writing unit1012writes a specified hash value into the secure storage unit104.

The hash calculation unit1013generates a hash value.

The hash comparison unit1014compares two specified hash values with each other, and transmits a comparison result to the content operation unit1004.

Next, main processing performed by the control unit113is described in the order of control of the recording processing, control of the playback processing, control of the move processing, control of the deletion processing, control of the backup processing, and control of the restoration processing.

(1) Control of Recording Processing

The recording processing is described using an example where the broadcast receiving unit106records a TV broadcast being received.

In order to start recording of a TV broadcast being received by the broadcast receiving unit106, the user of the HD recorder100presses the recording button included in the remote controller. The input unit110detects the press of the recording button, and transmits operation instruction information that shows the press of the recording button to the operation judgment unit1001.

Upon receiving the operation instruction information from the input unit110, the operation judgment unit1001judges that the operation instruction information shows the press of the recording button, and transmits a recording instruction to the content operation unit1004.

Upon receiving the recording instruction, the content operation unit1004generates a new content ID to be assigned to a content being recorded, and adds content information including the generated content ID to the content management table180stored in the secure storage unit104. At this time, with respect to the added content information, the content operation unit1004writes a current time into the item “recording date and time”, a “broadcast program” to the item “type”, “MPEG2” to the item “compression format”, a value of “0” to the item “backup flag”, and a value of “1” to the item “priority level”.

Next, the content operation unit1004transmits a content key generation instruction to the key generation unit108, and receives a content key, as a response to the generation instruction, from the key generation unit108. Upon receiving the content key, the content operation unit1004newly generates a content file in the first information storage unit102.

Next, the content operation unit1004transmits a recording instruction to the broadcast receiving unit106, and appropriately receives a content received from the broadcast receiving unit106. The content operation unit1004outputs the content key received from the key generation unit108and the content received from the broadcast receiving unit106to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content. Then, the content operation unit1004receives an encrypted content from the encryption processing unit109.

The content operation unit1004writes the received encrypted content into the content file newly generated in the first information storage unit102.

Note that the broadcast receiving unit106does not receive all parts of the content at a time. Therefore, the broadcast receiving unit106transmits a received part of the content to the content operation unit1004. Each time a part of the content received from the broadcast receiving unit106reaches a predetermined length, the content operation unit1004outputs the part of the content to the encryption processing unit109. The encryption processing unit109performs the encryption for each part of the content having the predetermined length.

Simultaneously with this writing, the content operation unit1004monitors whether the first information storage unit102has an available capacity. If the available capacity is insufficient, the content operation unit1004selects a piece of content information whose priority level has a value of “2” among pieces of content information included in the content management table180, deletes a content file corresponding to the selected piece of the content information from the first information storage unit102, and deletes the selected piece of the content information from the content management table180.

If a piece whose propriety level having a value of “2” among pieces of the content information that constitute the content management table180does not exist, that is, if no content that may be deleted exists in the first information storage unit102, the content operation unit1004notifies the user of a stop of the recording because of an insufficient available capacity by flashing a lamp (not illustrated), for example.

If the available capacity of the first information storage unit102is insufficient and therefore the content operation unit1004stops the recording, or if the content operation unit1004receives operation instruction information that shows that a stop button has been pressed from the input unit110via the operation judgment unit1001, the content operation unit1004transmits a recording stop instruction to the broadcast receiving unit106.

Next, the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the read device-specific key132“Key_A” and the content key to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content key. The content operation unit1004receives an encrypted content key, as a response to the encryption instruction, from the encryption processing unit109, writes the received encrypted content key and the generated content ID into the generated content file, and transmits a hash generation instruction including the content ID to the hash calculation unit1013.

Next, upon receiving the hash generation instruction including the content ID, the hash calculation unit1013reads the encrypted content and the encrypted content key from the content file corresponding to the content ID. The hash calculation unit1013combines the read encrypted content and encrypted content key, assigns the combination to a hash function to generate a hash value of 160 bit length, and transmits the content ID and the hash value to the hash writing unit1012.

The hash writing unit1012writes the received hash value into the content information including the content ID.

(2) Control of Playback Processing

In a state where the content management panel201shown inFIG. 18Ais displayed on the monitor120and any one of the content panels203to207is selected, if receiving operation instruction information that shows that the playback button has been pressed from the input unit110, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a playback instruction including the read content ID to the content operation unit1004.

The content operation unit1004detects, from the first information storage unit102, a content file including a content ID that matches the content ID included in the playback instruction. The content operation unit1004reads an encrypted content and an encrypted content key from the detected content file, and transmits the content ID, the read encrypted content, and the read encrypted content key to the hash calculation unit1013.

The hash calculation unit1013combines the received encrypted content and encrypted content key, assigns the combination to the hash function to calculate a hash value, and transmits the calculated hash value and the content ID to the hash comparison unit1014.

The hash comparison unit1014reads the content information including the content ID from the secure storage unit104, compares the hash value included in the read content information with the received hash value, and transmits a comparison result that shows whether they match each other to the content operation unit1004.

The content operation unit1004receives the comparison result from the hash comparison unit1014. If the comparison result shows that the values do not match each other, the content operation unit1004transmits a playback error notification to the operation judgment unit1001.

Upon receiving the playback error notification, the operation judgment unit1001instructs the panel generation unit1002to generate a panel that displays an error screen that shows that the selected content cannot be played back.

The panel generation unit1002generates the panel that displays the error screen in accordance with the generation instruction received from the operation judgment unit1001, and outputs the generated panel to the playback control unit112. Moreover, the content operation unit1004stops the playback processing of the content.

If the comparison result received from the hash comparison unit1014shows that the values match each other, the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the read device-specific key132“Key_A” and the read encrypted content key to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key.

The content operation unit1004receives a content key, as a response to the decryption instruction, from the encryption processing unit109. Upon receiving the content key, the content operation unit1004reads the encrypted content from the detected content file, outputs the read encrypted content and the received content key to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content. The content operation unit1004receives a decrypted content, as a response to the decryption instruction, from the encryption processing unit109, and outputs the received content to the decoding unit107.

(3) Control of Move Processing

In a state where the content management panel201shown inFIG. 18Ais displayed on the monitor120and any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Move button211from the input unit110, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a Move instruction including the read content ID to the content operation unit1004. Moreover, the operation judgment unit1001instructs the panel generation unit1002to generate the move destination selection panel215shown inFIG. 18that shows a list of candidates for a move destination of a content. In accordance with the generation instruction, the panel generation unit1002generates the move destination selection panel215, and outputs the generated move destination selection panel215to the playback control unit112.

The move destination selection panel215includes move destination panels216and217.

In order to generate the move destination selection panel215, the operation judgment unit1001transmits the broadcast instruction to the transmission/reception unit115, and receives, as a response to the broadcast instruction, an information acquisition response including device identification information of another device connected to the home network30, from the transmission/reception unit115. The operation judgment unit1001extracts pieces of device identification information included in the received information acquisition response, and instructs the panel generation unit1002to generate move destination panels corresponding one-to-one with the acquired pieces of the device identification information.

The panel generation unit1002generates a move destination panel for all devices whose response to the broadcast instruction have been received, combines all the move destination panels with each other to generate a move destination selection panel215, and outputs the generated move destination selection panel215to the playback control unit112.

For example, the move destination selection panel215shown inFIG. 18Bdisplays device identification information of a device connected to the home network30. The move destination selection panel215includes the move destination panel216corresponding to a device having device identification information “ID_B”, and the move destination panel217corresponding to a device having device identification information “ID_C”.

Next, the operation judgment unit1001receives, from the input unit110, operation instruction information that shows a move destination corresponding to a move destination panel selected by the user's operation. The operation judgment unit1001instructs the authentication unit114to perform authentication processing between the HD recorder100and the move destination device. The operation judgment unit1001receives an authentication result, as a response to the authentication instruction, from the authentication unit114.

If the authentication result shows failure, the operation judgment unit1001transmits a move processing end instruction to the content operation unit1004. Upon receiving the move processing stop instruction, the content operation unit1004ends the move processing.

If the authentication result shows success, the operation judgment unit1001transmits a move instruction including the content ID to the content operation unit1004. Upon receiving the move instruction, the content operation unit1004reads content information corresponding to the content ID from the secure storage unit104, and judges whether a backup flag included in the content information has a value of “1”.

If the backup flag has a value of “0”, the content operation unit1004detects a content file including the content ID included in the content information from the first information storage unit102.

Moreover, if the backup flag has a value of “1”, the content operation unit1004detects whether the second information storage unit103is connected. If the second information storage unit103is not connected, the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate a connection request panel221shown inFIG. 19Athat promotes connection of the second information storage unit103.

In accordance with the generation instruction, the panel generation unit1002generates a connection request panel221, and outputs the generated connection request panel221to the playback control unit112.

The content operation unit1004continues monitoring whether the second information storage unit103is connected. If the second information storage unit103does not get connected, the content operation unit1004ends the move processing.

If the second information storage unit103gets connected, the content operation unit1004judges whether the content file including the content ID is stored in the first information storage unit102and the second information storage unit103. If the content file is stored, the content operation unit1004deletes the content file from the second information storage unit103.

Next, if the content file including the content ID has not been backed up, the content operation unit1004detects the content file from the first information storage unit102. If the content file has been backed up, the content operation unit1004detects the content file from the second information storage unit103.

The content operation unit1004reads an encrypted content and an encrypted content key from the detected content file, and transmits the read encrypted content and encrypted content key to the hash calculation unit1013together with the content ID. The hash calculation unit1013combines the encrypted content and the encrypted content key to calculate a hash value, and transmits the calculated hash value to the hash comparison unit1014together with the content ID.

The hash comparison unit1014reads the content information including the content ID from the secure storage unit104, and compares a hash value included in the read content information with the received hash value. Then, the hash comparison unit1014a comparison result that shows whether these hash values match each other to the content operation unit1004.

If the comparison result received from the hash comparison unit1014shows that the values do not match each other, the content operation unit1004transmits a move error notification to the operation judgment unit1001.

Upon receiving the move error notification, the operation judgment unit1001instructs the panel generation unit1002to generate a panel that displays an error screen that shows that the selected content cannot be moved. The panel generation unit1002generates a panel that displays the error screen in accordance with the generation instruction, and outputs the generated panel to the playback control unit112. The content operation unit1604stops the move processing of the content.

If the comparison result received from the hash comparison unit1014shows that the values match each other, the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the read device-specific key132“Key_A” and the read encrypted content key to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key.

The content operation unit1004receives a content key that has been decrypted, as a response to the decryption instruction, from the encryption processing unit109. Upon receiving the content key, the content operation unit1004reads the encrypted content from the detected content file, outputs the read encrypted content and the received content key to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content. Next, the content operation unit1004receives a content that has been decrypted from the encryption processing unit109, and outputs the received content to the decoding unit107.

The content operation unit1004instructs the transmission/reception unit115to transmit the content decoded by the decoding unit107to the move destination device.

The transmission/reception unit115receives the content from the decoding unit107, and outputs the received content to the move destination device based on the DTCP.

The content operation unit1004deletes a content file corresponding to the output content, and furthermore instructs the hash deletion unit1011to delete the content information including the content ID. The hash deletion unit1011deletes the content information.

(4) Control of Deletion Processing

In a state where the content management panel201shown inFIG. 18Ais displayed on the monitor120and any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Delete button212from the input unit110, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a deletion instruction including the read content ID to the content operation unit1004.

Moreover, the content operation unit1004reads a backup flag included in the content information including the content ID. Moreover, the operation judgment unit1001instructs the panel generation unit1002to generate the restoration attribute selection panel241shown inFIG. 20.

The panel generation unit1002generates a restoration attribute selection panel241in accordance with the generation instruction, and outputs the generated restoration attribute selection panel241to the playback control unit112. The operation judgment unit1001gets into a state to receive an input of selection of restoration attribute.

The restoration attribute selection panel241includes a button242that shows restoration is possible “restorable” and a button243that shows restoration is impossible “unrestorable”. Either the button242or the button243is selected by the user's operation.

Under the state to receive an input, if receiving operation instruction information that shows selection of “restorable”, the operation judgment unit1001transmits the operation instruction information to the content operation unit1004. The content operation unit1004judges whether the read backup flag has a value of “1”. If the backup flag has a value of “0”, the content operation unit1004detects whether the second information storage unit103is connected. If not connected, the content operation unit1004transmits an unconnection notification to the operation judgment unit1001.

Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate the connection request panel221shown inFIG. 19Athat promotes connection of the second information storage unit103.

The panel generation unit1002generates a connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221.

The content operation unit1004monitors whether the second information storage unit103gets connected for a predetermined time period. If the second information storage unit103does not get connected, the content operation unit1004ends the deletion processing.

If the second information storage unit103gets connected, the content operation unit1004copies the content file corresponding to the content ID from the first information storage unit102to the second information storage unit103, and rewrites the value of the backup flag of the content information corresponding to the read content ID to “1”. Moreover, the content operation unit1004deletes the content file corresponding to the content ID from the first information storage unit102.

On the other hand, under the state to receive an input, if receiving operation instruction information that shows selection of “unrestorable”, the operation judgment unit1001transmits the operation instruction information to the restorability instruction unit1003and the content operation unit1004.

The content operation unit1004judges whether the read backup flag has a value of “1”. If the backup flag has a value of “1”, the content operation unit1004detects whether the second information storage unit103is connected. If not connected, the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate the connection request panel221shown inFIG. 19Athat promotes connection of the second information storage unit103.

The panel generation unit1002generates a connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221.

The content operation unit1004monitors whether the second information storage unit103gets connected for a predetermined time period. If the second information storage unit103does not get connected, the content operation unit1004ends the deletion processing.

If the second information storage unit103gets connected, the content operation unit1004deletes the content file corresponding to the content ID from the second information storage unit103.

If the backup flag has either values of “1” or “0”, the content operation unit1004deletes the content file from the first information storage unit102.

Also, if receiving the operation instruction information that shows the selection of “unrestorable”, the restorability instruction unit1003transmits a deletion instruction including the content ID to the hash deletion unit1011. The hash deletion unit1011deletes the content information including the content ID and the hash value.

(5) Control of Backup Processing

In a state where the content management panel201shown inFIG. 18Ais displayed on the monitor120and any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Backup button213from the input unit110, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a backup instruction including the read content ID to the content operation unit1004.

The content operation unit1004reads the content information including the content ID from the secure storage unit104.

Moreover, the content operation unit1004judges whether a backup flag included in the content information has a value of “1”.

If the backup flag has a value of “1”, a content file corresponding to the content ID has been already backed up. Therefore, the content operation unit1004ends the backup processing.

If the backup flag has a value of “0”, the content operation unit1004detects whether the second information storage unit103is connected. If not connected, the content operation unit1004transmits an unconnection notification to the operation judgment unit1001.

Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate a connection request panel221that promotes connection of the second information storage unit103.

The panel generation unit1002generates a connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221.

The content operation unit1004monitors whether the second information storage unit103gets connected for a predetermined time period. If the second information storage unit103does not get connected, the content operation unit1004ends the backup processing.

If the second information storage unit103gets connected, the content operation unit1004copies the content file including the content ID from the first information storage unit102to the second information storage unit103, and rewrites the value of the backup flag of the content information including the read content ID to “1”.

(6) Control of Restoration Processing

In a state where the content management panel201shown inFIG. 18Ais displayed on the monitor120and any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Restore button214from the input unit110, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a restoration instruction including the read content ID to the content operation unit1004.

Upon receiving the restoration instruction, the content operation unit1004judges whether a backup flag included in the content information including the content ID has a value of “1”.

If the backup flag has a value of “0”, a content file corresponding to the content ID has not been backed up. Therefore, the content operation unit1004ends the restoration processing.

If the backup flag has a value of “1”, the content operation unit1004monitors whether the second information storage unit103is connected. If not connected, the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate a connection request panel221shown inFIG. 19Athat promotes connection of the second information storage unit103.

The panel generation unit1002generates a connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221.

The content operation unit1004monitors whether the second information storage unit103gets connected for a predetermined time period. If the second information storage unit103does not get connected, the content operation unit1004ends the restoration processing.

If the second information storage unit103gets connected, the content operation unit1004judges whether a content file corresponding to the content ID is stored in the second information storage unit103. If the corresponding content file is not stored, the content operation unit1004ends the restoration processing.

If the corresponding content file is stored, the content operation unit1004transmits a deletion confirmation instruction to the operation judgment unit1001. Upon receiving the deletion confirmation instruction, the operation judgment unit1001instructs the panel generation unit1002to generate a backup deletion execution selection panel231shown inFIG. 19B.

The panel generation unit1002generates a backup deletion execution selection panel231in accordance with the generation instruction, and outputs the generated backup deletion execution selection panel231to the playback control unit112.

The backup deletion execution selection panel231includes, as shown inFIG. 19B, a deletion execution button232that shows execution of backup deletion and a deletion no-execution button233that shows no-execution of backup deletion. Either the deletion execution button232or the deletion no-execution button233is selected by the user's operation.

The content operation unit1004receives the selection whether backup deletion is executed via the operation judgment unit1001. Also, the content operation unit1004copies content file from the second information storage unit103to the first information storage unit102.

Here, upon receiving operation instruction information that shows execution of backup deletion, the content operation unit1004copies the content file from the second information storage unit103to the first information storage unit102. And then, the content operation unit1004deletes the content file corresponding to the read content ID stored in the second information storage unit103, and rewrites a value of a backup flag of the content information corresponding to the read content ID to “0”.

The following describes operations of the backup system1focusing on operations of the HD recorder100. The description uses an example where a content corresponding to a content ID “A001” shown inFIG. 3toFIG. 5is processed unless otherwise specified.

(1) Operations of HD Recorder100

Operations of the HD recorder100are described using a flow chart shown inFIG. 6.

The operation judgment unit1001judges whether operation instruction information that shows that a power button has been pressed by the user's operation is received via the input unit110(Step S101). If the operation instruction information has not been received (Step S101: NO), the operation judgment unit1001repeats Step S101until the operation instruction information has been received.

If receiving the operation instruction information that shows the press of the power button (Step S101: YES), the operation judgment unit1001further receives a button operation and a remote controller operation by the user via the input unit110(Step S102), and transmits an instruction in accordance with the received button operation to other units.

In Step S102, if receiving operation instruction information that shows that the recording button has been pressed, the operation judgment unit1001transmits a recording instruction to the content operation unit1004. The content operation unit1004performs recording processing (Step S103). When the recording processing completes, the flow returns to Step S102. Here, the detection of a press of the various types of buttons by the input unit110and the judgment of the button operations in Step S102by the operation judgment unit1001are constantly performed simultaneously with other processing including the above-mentioned recording processing. For example, a recording stop instruction by the user's operation is received even during the recording.

In Step5102, if the operation judgment unit1001receives operation instruction information that shows a button other than the menu button and the recording button has been pressed, the content operation unit1004performs other processing (Step S104).

In Step S102, if receiving operation instruction information that shows that the menu button has been pressed, the operation judgment unit1001instructs the panel generation unit1002to generate the content management panel201shown inFIG. 18A. The panel generation unit1002generates the content management panel201in accordance with the generation instruction, and outputs the generated content management panel201to the playback control unit112.

The playback control unit112displays the content management panel201on the monitor120(Step S105). The operation judgment unit1001further receives selection of a content by the user (Step S106).

Here, in order to select a content that is a processing target, the user presses any of the input unit110, and an up-selection key and a down-selection key included in the remote controller.

Operation instruction information showing a pressed key is output from the input unit110to the operation judgment unit1001.

If receiving operation instruction information that shows that the lower selection key has been pressed, the operation judgment unit1001instructs the panel generation unit1002to generate a content management panel201in which a focus that shows selection of any of the content panels203to207is moved to a lower content panel. The panel generation unit1002generates a content management panel201in accordance with the generation instruction, and outputs the generated content management panel201to the playback control unit112. The playback control unit112displays the received content management panel201on the monitor120.

Here, the focus is performed by displaying a selected panel in a color different from other panels included in the content panels203to207.

In the same way as the case where the lower selection key pressed, if receiving operation instruction information that shows that the upper selection key has been pressed, the operation judgment unit1001instructs the panel generation unit1002to generate a content management panel201in which a focus that shows selection of any of the content panels203to207is moved to an upper content panel.

The panel generation unit1002generates the content management panel201in accordance with the generation instruction, and outputs the generated content management panel201to the playback control unit112. The playback control unit112displays the received content management panel201on the monitor120.

If receiving operation instruction information that shows that the playback button has been pressed by the user's operation from the input unit110(Step S107: YES), the operation judgment unit1001transmits a playback instruction to the content operation unit1004. The content operation unit1004performs playback processing in accordance with the playback instruction (Step S108).

Also, if any of the Move button211, the Delete button212, the Backup button213, and the Restore button214is selected by the user's operation (Step S109), the operation judgment unit1001judges which button has been selected in accordance with the operation instruction information received from the input unit110.

If the Move button211is selected (Step S110: YES), the operation judgment unit1001transmits a move instruction to the content operation unit1004. The content operation unit1004performs move processing (Step S111). When the move processing completes, the flow returns to Step S102.

If the Delete button212is selected (Step S110: NO and Step S112: YES), the operation judgment unit1001transmits a deletion instruction to the content operation unit1004. The content operation unit1004performs deletion processing (Step S113). When the deletion processing ends, the flow returns to Step S102.

If the Backup button213is selected (Step S112: NO and Step S114: YES), the operation judgment unit1001transmits a backup instruction to the content operation unit1004. The content operation unit1004performs backup processing (Step S115). When the backup processing completes, the flow returns to Step S102.

If the Restore button214is selected (Step S114: NO and Step S116: YES), the operation judgment unit1001transmits a restoration instruction to the content operation unit1004. The content operation unit1004performs restoration processing (Step S117). When the restoration processing completes, the flow returns to Step S102.

If other processing is selected (Step S116: NO), the operation judgment unit1001performs other processing (Step S118). When the other processing completes, the flow returns to Step S102.

(2) Recording Processing by HD Recorder100

The following describes operations of recording processing performed by the HD recorder100using flow charts shown inFIG. 7andFIG. 8. This is a detailed description of Step S103inFIG. 6.

Upon receiving a recording instruction from the operation judgment unit1001, the content operation unit1004generates a new content ID (Step S131), and adds content information including the generated content ID to the content management table180(Step S132). In the added content information, the content operation unit1004writes a current time into the column “recording date and time” (Step S133), and writes “program” into the column “type” (Step S134). Moreover, the content operation unit1004writes “MPEG 2” into the column “compression format” (Step S135), writes “0” into the column “backup flag” (Step S136), and writes “1” into the column “priority level” (Step S137).

Next, the content operation unit1004instructs the key generation unit108to generate a content key. The key generation unit108generates a content key, and outputs the generated content key to the content operation unit1004(Step S138).

Next, the content operation unit1004generates a new content file in the first information storage unit102(Step S139), and then transmits a recording instruction to the broadcast receiving unit106. The broadcast receiving unit106starts receiving a part of the content that has been broadcasted via the antenna105(Step S140), and outputs the received part to the content operation unit1004.

Until the stop button has been pressed by the user, the content operation unit1004repeats the following processing in Steps S140to S143. When the stop button is pressed (Step S141: YES), the flow proceeds to Step S144.

If the stop button has not been pressed (Step S141: NO), the content operation unit1004outputs the content received from the broadcast receiving unit106and the content key received from the key generation unit108to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content. The encryption processing unit109encrypts the content to generate an encrypted content using the received content key, and outputs the generated encrypted content to the content operation unit1004(Step S142).

The content operation unit1004writes the encrypted content generated by the encryption processing unit109into the content file generated in the first information storage unit102(Step S143), and the flow returns to Step S140.

If the stop button is pressed or all parts of the content have been recorded to the end (Step S141: YES), the operation judgment unit1001transmits a stop instruction to the content operation unit1004. Upon receiving the stop instruction, the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101(Step S144), outputs the read device-specific key132“Key_A” and the content key to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content key. The encryption processing unit109encrypts the content key using the received device-specific key132“Key_A” to generate an encrypted content key. The encryption processing unit109outputs the generated encrypted content key to the content operation unit1004(Step S145).

The content operation unit1004receives the encrypted content key from the encryption processing unit109, and writes the received encrypted content key and the generated content ID into the content file (Step S146).

Next, the content operation unit1004transmits a hash value calculation instruction to the hash calculation unit1013. The hash calculation unit1013combines the encrypted content and the encrypted content key, assigns the combination to the hash function to calculate a hash value, and transmits the hash value to the hash writing unit1012(Step S147). The hash writing unit1012writes the calculated hash value into the added content information (Step S148).

Simultaneously with performing Steps S140to S143, the content operation unit1004performs Steps S161to S167. First, the content operation unit1004monitors whether an available capacity of the first information storage unit102is sufficient (Step S161). If the available capacity is sufficient (Step S161: YES) and the stop button is not pressed by the user (Step S162: NO), the flow returns to Step S161and the content operation unit1004continues monitoring the available capacity. If the stop button is pressed by the user (Step S162: YES), the flow proceeds to Step S144.

If the available capacity is insufficient (Step S161: NO), the content operation unit1004sequentially selects pieces of content information included in the content management table180stored in the secure storage unit104in the order as listed (Step S163). At this time, if processing in Step S165to167performed on all pieces of the content information included in the content management table180has completed, that is, if no deletable content exists in the first information storage unit102(Step S164: YES), the content operation unit1004notifies the user that the available capacity is insufficient by flashing the lamp, etc., and then the flow proceeds to Step S144.

If a deletable content exists in the first information storage unit102(Step S164: NO), the content operation unit1004reads a priority level included in a selected piece of the content information, and judges whether the read priority level has a value of “2” (Step S165). If the priority level does not have a value of “2” (Step S165: NO), the flow returns to Step S163and the content operation unit1004selects a next piece of the content information.

If the priority level has a value of “2” (Step S165: YES), the content operation unit1004detects a content file corresponding to the selected piece of the content information based on a content ID included in the selected piece of the content information, backs up the detected content file to the second information storage unit103, and then deletes the content file from the first information storage unit102(Step S166). Next, the content operation unit1004deletes the selected piece of the content information from the content management table180(Step S167), and the flow returns to Step S161.

(3) Operations HD Recorder100Performing Playback Processing

The following describes operations of the HD recorder100performing playback processing using a flow chart shown inFIG. 9. This is a detailed description of Step S108inFIG. 6.

In a state where the content management panel201shown inFIG. 18Ais displayed, if the playback button is pressed by the user's operation, the operation judgment unit1001receives operation instruction information that shows the press of the playback button from the input unit110. The operation judgment unit1001reads, from the secure storage unit104, the content ID “A001” included in the content information181corresponding to the selected content panel203(Step S181), and transmits a playback instruction including the content ID to the content operation unit1004.

Here, the following description is given based on the assumption that the content panel203is selected.

The content operation unit1004detects the content file141corresponding to the content information181from the first information storage unit102, based on the content ID “A001” (Step S182). The content operation unit1004reads the encrypted content143and the encrypted content key144“ENC (Key_A, Key_1a)” from the detected content file141(Step S183). The content operation unit1004transmits the content ID, the read encrypted content143, and the read encrypted content key144“ENC (Key_A, Key_1a)” to the hash calculation unit1013. The hash calculation unit1013combines the encrypted content143and the encrypted content key144“ENC (Key_A, Key_1a)” and assigns the combination to the hash function to calculate a hash value, and transmits the calculated hash value and the content ID to the hash comparison unit1014(Step S184).

Next, the hash comparison unit1014reads a hash value “01a” from the content information181including the content ID “A001” (Step S185). The hash comparison unit1014compares the calculated hash value with the read hash value (Step S186), and transmits a comparison result that shows whether these hash values match each other to the content operation unit1004.

If the comparison result received from the hash comparison unit1014shows that the values do not match each other (Step S186: NO), the content operation unit1004transmits an error notification to the operation judgment unit1001.

The operation judgment unit1001instructs the panel generation unit1002to generate an error screen. The panel generation unit1002generates an error screen that shows that the selected content cannot be played back, and displays the generated error screen (Step S187). The content operation unit1004ends the playback processing.

If the comparison result shows that the values match each other (Step S186: YES), the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the read device-specific key132“Key_A” and the encrypted content key144“ENC (Key_A, Key_1a)” to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key144“ENC (Key_A, Key_1a)”.

The encryption processing unit109receives the encrypted content key144“ENC (Key_A, Key_1a)” and the device-specific key132“Key_A” from the content operation unit1004. The encryption processing unit109decrypts the encrypted content key144“ENC (Key_A, Key_1a)” using the received device-specific key132“Key_A” to generate a content key “Key_1a”, and outputs the generated content key “Key_1a” to the content operation unit1004(Step S188).

Upon receiving the content key “Key_1a” from the encryption processing unit109, the content operation unit1004reads the encrypted content143from the content file141, outputs the read encrypted content143and the content key “Key_1a” to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content143.

In accordance with the decryption instruction by the content operation unit1004, the encryption processing unit109decrypts the encrypted content143using the content key “Key_1a” to generate a content, and outputs the generated content to the content operation unit1004(Step S190).

The content operation unit1004receives the content from the encryption processing unit109, and outputs the received content to the decoding unit107. Upon receiving the content, the decoding unit107expands the received content to generate an image signal and a sound signal (Step S191), and outputs the generated image signal and sound signal. The monitor120plays back an image and a sound (Step S192).

Here, if a content targeted for playback is not stored in the first information storage unit102and is stored only in the second information storage unit103, the content operation unit1004performs the later-described restoration processing before playing back the content. And then, after making the content get stored in the first information storage unit102, the content operation unit1004plays back the content.

(4) Operations of HD Recorder100Performing Move Processing

The following describes operations of the HD recorder100performing the move processing using flow charts shown inFIG. 10,FIG. 11, andFIG. 12. This is a detailed description of Step S111inFIG. 6.

In a state where the content management panel201shown inFIG. 18Ais displayed, if receiving operation instruction information that shows selection of the Move button211from the input unit110, the operation judgment unit1001instructs the panel generation unit1002to generate the move destination selection panel215that shows a list of candidates for a move destination. The panel generation unit1002generates the move destination selection panel215in accordance with the generation instruction, and outputs the generated move destination selection panel215to the playback control unit112. The playback control unit112generates an image composed of the move destination selection panel215overlaying the content management panel201, and displays the generated image on the monitor120, as shown inFIG. 18B(Step S201).

The move destination selection panel215displays device identification information of a device connected to the home network30, and includes the move destination panel216corresponding to a device that has device identification information “ID_B”, and the move destination panel217corresponding to a device that has device identification information “ID_C”.

The user operates to select either the move destination panels216or217. In accordance with the user's operation, the operation judgment unit1001receives operation instruction information that shows the selection of a transmission destination device of the content from the input unit110(Step S202).

The operation judgment unit1001instructs the authentication unit114to perform authentication processing between the HD recorder100and the transmission destination device.

The authentication unit114performs authentication processing between the HD recorder100and the transmission destination device (Step S203). The authentication processing in Step S203is described later.

The operation judgment unit1001receives an authentication result in the authentication processing from the authentication unit114.

If the authentication fails (Step S204: NO), the operation judgment unit1001ends the move processing.

If the authentication succeeds (Step S204: YES), the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104(Step S205), and transmits the move instruction including the content ID to the content operation unit1004.

The content operation unit1004reads a backup flag included in the content information including the content ID (Step S206).

If the backup flag has a value of “0” (Step S207: NO), the flow proceeds to Step S215, which is described later. If the backup flag has a value of “1” (Step S207: YES), the content operation unit1004detects whether the second information storage unit103is connected (Step S208). If not connected (Step S208: NO), the content operation unit1004transmits, to the operation judgment unit1001, an unconnection notification that shows that the second information storage unit103is not connected. Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate a connection request panel221that promotes connection of the second information storage unit103. The panel generation unit1002generates a connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221(Step S209).

The playback control unit112generates an image composed of the connection request panel221overlaying the content management panel201, and displays the generated image on the monitor120, as shown inFIG. 19A.

Also, the content operation unit1004continues monitoring whether the second information storage unit103is connected (Step S210). If not connected (Step S210: NO), the content operation unit1004judges whether operation instruction information has been received that shows stop of the processing (Step S211).

If receiving the operation instruction information that shows stop of the processing from the input unit110(Step S211: YES), the operation judgment unit1001transmits a stop instruction of the move processing to the content operation unit1004. The content operation unit1004stops the move processing.

If not receiving the operation instruction information that shows stop of the processing (Step S211: NO), the content operation unit1004performs Step S210.

If the second information storage unit103is connected (Step208: YES, and Step S210: YES), the content operation unit1004judges whether a content file including the encrypted content indicated by the content ID is stored in the second information storage unit103(Step S212).

If the content file is not stored in the second information storage unit103(Step S212: NO), the content operation unit1004ends the move processing. This is because the backup flag does not match a backup condition, and therefore there is a possibility that an illegitimate processing is performed.

If the content file is stored in the second information storage unit103(Step S212: YES), the content operation unit1004judges whether the content file including the encrypted content indicated by the content ID is stored the first information storage unit102(Step S213).

If the content file is stored in the first information storage unit102(Step S213: YES), the content operation unit1004deletes the content file from the second information storage unit103(Step5214).

The content operation unit1004detects the content file including the encrypted content indicated by the content ID from the first information storage unit102(Step S215).

If the content file is not stored in the first information storage unit102(Step S213: NO), the content operation unit1004detects the content file including the encrypted content indicated by the content ID from the second information storage unit103(Step S216).

The content operation unit1004reads the encrypted content and the encrypted content key “ENC (Key_A, Key_1a)” that are included in the detected content file (Step S217).

The content operation unit1004outputs the encrypted content and the encrypted content key “ENC (Key_A, Key_1a)” that are included in the detected content file to the hash calculation unit1013. The hash calculation unit1013combines the encrypted content and the encrypted content key “ENC (Key_A, Key_1a)”, assigns the combination to the hash function to calculate a hash value, and outputs the calculated hash value and the content ID to the hash comparison unit1014(Step S218).

Next, the hash comparison unit1014reads the hash value “01a” from the content information181including the content ID (Step S219). The hash comparison unit1014compares the calculated hash value with the read hash value (Step S220), and transmits a comparison result to the content operation unit1004. If the comparison result shows that the two values do not match each other (Step S220: NO), the content operation unit1004transmits an error notification to the operation judgment unit1001. The operation judgment unit1001instructs the panel generation unit1002to generate an error screen that shows that the selected content cannot be moved. The panel generation unit1002generates a panel that displays the error screen in accordance with the generation instruction, and outputs the generated panel to the playback control unit112. The playback control unit112displays the error screen on the monitor120(Step S221). The content operation unit1004ends the move processing.

If the comparison result received from the hash calculation unit1013shows that the two values match each other (Step S220: YES), the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the encrypted content key “ENC (Key_A, Key_1a)” and the read device-specific key132“Key_A” to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key “ENC (Key_A, Key_1a)”.

The encryption processing unit109receives the encrypted content key “ENC (Key_A, Key_1a)” and the device-specific key132“Key_A” from the content operation unit1004. The encryption processing unit109decrypts the encrypted content key “ENC (Key_A, Key_1a)” using the device-specific key132“Key_A” to generate a content key “Key_1a”, and outputs the generated content key “Key_1a” to the content operation unit1004(Step S222).

The content operation unit1004receives the content key “Key_1a” from the encryption processing unit109. Upon receiving the content key “Key_1a”, the content operation unit1004reads the encrypted content from the content file141(Step S223), outputs the read encrypted content and the content key “Key_1a” to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content.

In accordance with the decryption instruction by the content operation unit1004, the encryption processing unit109decrypts the encrypted content using the content key “Key_1a” to generate a content, and outputs the generated content to the content operation unit1004(Step S224).

The content operation unit1004receives the content from the encryption processing unit109, and outputs the received content to the transmission destination device via the transmission/reception unit115(Step S225).

Note that, if the authentication processing succeeds, a communication path to be encrypted has been established based on the DTCP between the HD recorder100and the transmission destination device.

After completing the output, the content operation unit1004deletes the detected content file (Step S226).

The content operation unit1004deletes content information including the content ID from the content management table180(Step S227).

(5) Operations of HD Recorder100Performing Deletion Processing

The following describes operations of the HD recorder100performing the deletion processing using flow charts shown inFIG. 13andFIG. 14. This is a detailed description of Step S113inFIG. 6.

As described above, in a state where any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Delete button212, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104, and transmits a deletion instruction including the content ID to the content operation unit1004.

Upon receiving the deletion instruction, the content operation unit1004reads a backup flag included in the content information (Step S252).

The operation judgment unit1001instructs the panel generation unit1002to generate the restoration attribute selection panel241that promotes the user to select whether to set the content to “restorable” or “unrestorable”. The panel generation unit1002generates the restoration attribute selection panel241in accordance with the generation instruction, outputs the generated restoration attribute selection panel241to the playback control unit112, and instructs the playback control unit112to display the restoration attribute selection panel241(Step S253).

The playback control unit112displays the restoration attribute selection panel241overlaying the content management panel201on the monitor120.

The operation judgment unit1001receives operation instruction information that shows either the button242indicating “restorable” or the button243indicating “unrestorable” selected by the user via the input unit110, and transmits the operation instruction information to the restorability instruction unit1003(Step S254).

If the operation instruction information shows selection of “restorable” (Step S255: YES), the content operation unit1004judges whether a backup flag included in the content information has a value of “1” (Step S256).

If the backup flag has a value of “1” (Step S256: YES), a content file corresponding to the content ID has been backed up. Therefore, the content operation unit1004deletes the content file corresponding to the content ID from the first information storage unit102, and ends the deletion processing.

If the backup flag has a value of “0” (Step S256: NO), the content operation unit1004detects whether the second information storage unit103is connected (Step S257). If connected (Step S257: YES), the content operation unit1004copies the content file including the encrypted content indicated by the content ID from the first information storage unit102to the second information storage unit103(Step S261).

If not connected (Step S257: NO), the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. The operation judgment unit1001receives the unconnection notification, and instructs the panel generation unit1002to generate the connection request panel221that promotes connection of the second information storage unit103.

The panel generation unit1002generates the panel in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221(Step S258).

The playback control unit112displays the connection request panel221overlaying the content management panel201on the monitor120.

Also, the content operation unit1004continues monitoring whether the second information storage unit103gets connected (Step S259). If the second information storage unit103does not get connected (Step S259: NO), the content operation unit1004judges whether operation instruction information has been received that shows stop of the processing (Step S260).

If receiving the operation instruction information that shows stop of the processing (Step S260: YES), the operation judgment unit1001transmits a deletion stop instruction to the content operation unit1004. The content operation unit1004stops the deletion processing in accordance with the deletion stop instruction.

If not receiving the operation instruction information that shows stop of the processing via the input unit110(Step S260: NO), the content operation unit1004performs Step S259.

If the second information storage unit103gets connected (Step S259: YES), the flow proceeds to Step S261.

The content operation unit1004rewrites the value of the backup flag of the content information including the content ID to “1” (Step S262), deletes the content file corresponding to the content ID from the first information storage unit102, and ends the deletion processing.

In Step S255, if “unrestorable” is selected (Step S255: NO), the content operation unit1004judges whether the backup flag included in the content information has a value of “1” (Step S264).

If the backup flag has a value of “1” (Step S264: YES) the content operation unit1004detects whether the second information storage unit103is connected (Step S265). If not connected (Step S265: NO), the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. The operation judgment unit1001receives the unconnection notification, and instructs the panel generation unit1002to generate the connection request panel221that promotes connection of the second information storage unit103.

The panel generation unit1002generates the connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221(Step S266).

The playback control unit112displays the connection request panel221overlaying the content management panel201on the monitor120.

Also, the content operation unit1004continues monitoring whether the second information storage unit103gets connected (Step S267). If the second information storage unit103does not get connected (Step S267: NO), the content operation unit1004judges whether operation instruction information has been received that shows stop of the processing (Step S268).

If receiving the operation instruction information that shows stop of the processing (Step S268: YES), the operation judgment unit1001transmits a deletion stop instruction to the content operation unit1004. The content operation unit1004stops the deletion processing.

If not receiving the operation instruction information that shows stop of the processing via the operation judgment unit1001(Step S268: NO), the content operation unit1004performs Step S267.

If the second information storage unit103gets connected (Step S267: YES, Step S265: YES), the content operation unit1004deletes the content file including the encrypted content indicated by the content ID from the second information storage unit103(Step S269). Moreover, the content operation unit1004deletes the content file including the encrypted content indicated by the content ID from the first information storage unit102(Step S270).

Also, if the operation instruction information shows selection of “unrestorable”, the restorability instruction unit1003transmits a deletion instruction to the hash deletion unit1011. The hash deletion unit1011deletes the content information including the content ID and the hash value (Step S271).

If the backup flag has a value of “1” (Step S264: NO), the content operation unit1004performs the above-described Step S270and Step S271, and ends the deletion processing.

(6) Operations of HD Recorder100Performing Backup Processing

The following describes operations of the HD recorder100performing backup processing using a flow chart shown inFIG. 15. This is a detailed description of Step S115inFIG. 6.

As described above, in a state where any one of the content panels203to207is selected, if receiving operation instruction information that, shows selection of the Backup button213, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104(Step S281), and transmits a backup instruction including the read content ID to the content operation unit1004.

Moreover, the content operation unit1004receives the backup instruction, reads a backup flag included in the content information (Step S282), and judges whether the backup flag has a value of “1” (Step S283).

If the backup flag has a value of “1” (Step S283: YES), a content file corresponding to the content ID has been backed up. Therefore, the content operation unit1004ends the backup processing.

If the backup flag has a value of “0” (Step S283: NO), the content operation unit1004detects whether the second information storage unit103is connected (Step S284). If connected (Step S284: YES), the flow proceeds to Step S288described later. If not connected (Step S284: NO), the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. The operation judgment unit1001instructs the panel generation unit1002to generate the connection request panel221that promotes connection of the second information storage unit103. The panel generation unit1002generates the connection request panel221in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221(Step S285).

The playback control unit112displays the connection request panel221overlaying the content management panel201on the monitor120.

Also, the content operation unit1004continues monitoring whether the second information storage unit103gets connected (Step S286). If the second information storage unit103does not get connected (Step S286: NO), the content operation unit1004judge whether the operation judgment unit1001has received operation instruction information that shows stop of the processing (Step S287).

If receiving the operation instruction information that shows stop of the processing via the operation judgment unit1001(Step S287: YES), the content operation unit1004stops the deletion processing.

If not receiving the operation instruction information that shows stop of the processing via the operation judgment unit1001(Step S287: NO), the content operation unit1004performs Step S286.

If the second information storage unit103gets connected (Step S286: YES), the content operation unit1004copies the content file including the content ID from the first information storage unit102to the second information storage unit103(Step S288).

The content operation unit1004rewrites the value of the backup flag of the content information including the content ID to “1” (Step S289).

(7) Operations of HD Recorder100Performing Restoration Processing

The following describes operations of the HD recorder100performing restoration processing using flow charts shown inFIG. 16andFIG. 17. This is a detailed description of Step S117inFIG. 6.

As described above, in a state where any one of the content panels203to207is selected, if receiving operation instruction information that shows selection of the Restore button214, the operation judgment unit1001reads a content ID included in content information corresponding to the selected content panel from the secure storage unit104(Step S301), and transmits a restoration instruction including the read content ID to the content operation unit1004.

Moreover, the content operation unit1004receives the restoration instruction, reads a backup flag included in the content information (Step S302), and judges whether the backup flag has a value of “1” (Step S303).

If the backup flag has a value of “0” (Step S303: NO), no backup content file exists, and therefore restoration cannot be performed. Therefore, the content operation unit1004ends the restoration processing.

If the backup flag has a value of “1” (Step S303: YES), the content operation unit1004detects whether the second information storage unit103is connected (Step S304). If not connected (Step S304: NO), the content operation unit1004transmits an unconnection notification to the operation judgment unit1001. Upon receiving the unconnection notification, the operation judgment unit1001instructs the panel generation unit1002to generate the connection request panel221that promotes connection of the second information storage unit103. The panel generation unit1002generates the panel in accordance with the generation instruction, outputs the generated connection request panel221to the playback control unit112, and instructs the playback control unit112to display the connection request panel221(Step S305).

The playback control unit112displays the connection request panel221overlaying the content management panel201on the monitor120.

Also, the content operation unit1004continues monitoring whether the second information storage unit103gets connected (Step S306). If the second information storage unit103does not get connected (Step S306: NO), the content operation unit1004judges whether the operation judgment unit1001has received operation instruction information that shows stop of the processing (Step S307).

If receiving the operation instruction information that shows stop of the processing via the operation judgment unit1001(Step S307: YES), the content operation unit1004stops the restoration processing.

If not receiving the operation instruction information that shows stop of the processing via the operation judgment unit1001(Step S307: NO), the content operation unit1004performs Step S306.

If the second information storage unit103gets connected (Step S304: YES, Step S306: YES), the content operation unit1004judges whether the content file including the content ID is stored in the second information storage unit103.

If the content file is not stored in the second information storage unit103(Step S308: NO), the content operation unit1004ends the restoration processing.

If the content file is stored in the second information storage unit103(Step S308: YES), the content operation unit1004transmits a notification that shows an existence of a backup to the operation judgment unit1001.

The operation judgment unit1001receives the notification, and instructs the panel generation unit1002to generate the backup deletion execution selection panel231that promotes selection whether backup deletion is executed.

The panel generation unit1002generates the backup deletion execution selection panel231in accordance with the generation instruction, and outputs the generated backup deletion execution selection panel231to the playback control unit112(Step S309).

The playback control unit112displays the backup deletion execution selection panel231overlaying the content management panel201on the monitor120.

The user selects either the deletion execution button232or the deletion no-execution button233via the input unit110. The content operation unit1004receives operation instruction information that shows selection whether deletion is executed via the operation judgment unit1001(Step S310).

The content operation unit1004copies the content file stored from the second information storage unit103to the first information storage unit102(Step S311).

The content operation unit1004judges whether the operation instruction information received in Step S310shows execution of deletion (Step S312). If the operation instruction information shows execution of deletion (Step S312: YES), the content operation unit1004deletes the content file from the second information storage unit103(Step S313), and rewrites the value of the backup flag included in the content information to “0” (Step S314).

If the operation instruction information shows no-execution of deletion (Step S312: NO), the content operation unit1004ends the restoration processing.

(8) Device Authentication Processing

The following describes device authentication processing using an example of operations of device authentication processing between the HD recorder100and the HD recorder400using flow charts shown inFIG. 21andFIG. 22.

Note that the method used here for device authentication is just one example, and other authentication methods or key sharing schemes may be used. Here, “Gen( )” is a key generation function and “Y” is a system-specific parameter. Also, the key generation function “Gen( )” is a function that satisfies a relation “Gen(x, Gen(Y,z))=Gen(Y, Gen(x, z))”. Moreover, since key generation functions are realizable by arbitrary well-known arts, the details of such functions are not described here.

The authentication unit114of the HD recorder100reads the public key certificate “Cert_A” (Step S501), and transmits read public key certificate “Cert_A” to the HD recorder400via the transmission/reception unit115(Step S502).

Upon receiving the public key certificate “Cert_A”, the authentication unit414of the HD recorder400performs signature verification by applying a signature verification algorithm V to signature data of the certification authority “Sig_CA” included in the received public key certificate of the certification authority “Cert_A” using the public key of the certification authority “PK_CA” (Step S503). Here, the signature verification algorithm V is an algorithm for verifying signature data generated by using the signature generation algorithm S. If the signature verification fails (Step S504: NO), the authentication unit414ends the device authentication processing.

If the signature verification succeeds (Step S504: YES), the authentication unit414reads a CRL (Step S505), and judges whether a certification identification number “ID_a” included in the received public key certificate “Cert_A” is registered in the read CRL (Step S506). If registered (Step S506: YES), the authentication unit414ends the device authentication processing.

If not registered (Step S506: NO), the authentication unit414reads a public key certificate “Cert_B” (Step S507), and transmits the read public key certificate “Cert_B” to the HD recorder100.

Upon receiving the public key certificate “Cert_B”, the authentication unit114of the HD recorder100performs signature verification by applying the signature verification algorithm V to the signature data of the certification authority “Sig_CA” included in the received public key certificate of the certification authority “Cert_B” using the public key of the certification authority “PK_CA” (Step S509). If the signature verification fails (Step S510: NO), the authentication unit414ends the device authentication processing.

If the signature verification succeeds (Step S510: YES), the authentication unit114reads a CRL (Step S511), and judges whether a certification identification number “ID_b” included in the received public key certificate “Cert_B” is registered in the read CRL (Step S512). If registered (Step S512: YES), the authentication unit414ends the device authentication processing. If not registered (Step S512: NO), the authentication unit414continues the device authentication processing.

The authentication unit414of the HD recorder400generates a random number “Cha_B” (Step S513), and transmits the generated random number “Cha_B” to the HD recorder100(Step S514).

The authentication unit114of the HD recorder100receives the random number “Cha_B”, and applies the signature generation algorithm S to the received random number “Cha_B” using the secret key of the HD recorder100“SK_A” to generate signature data “Sig_A” (Step S515), and transmits the generated signature data “Sig_A” to the HD recorder400(Step S516).

Upon receiving the signature data “Sig_A”, the authentication unit414of the HD recorder400performs signature verification by applying the signature verification algorithm V to the received signature data “Sig_A” using the public key of the HD recorder100“PK_A” included in the received public key certificate “Cert_A” (Step S517). If the signature verification fails (Step S518: NO), the authentication unit414ends the device authentication processing. If the signature verification succeeds (Step S518: YES), the authentication unit414continues the device authentication processing.

The authentication unit114of the HD recorder100generates a random number “Cha_A” (Step S519), and transmits the generated random number “Cha_A” to the HD recorder400(Step S520).

The authentication unit414of HD recorder400receives the random number “Cha_A”, and applies the signature generation algorithm S to the received random number “Cha_A” using the secret key of the HD recorder400“SK_B” to generate signature data “Sig_B” (Step S521), and transmits the generated signature data “Sig_B” to the HD recorder100(Step S522).

Upon receiving the signature data “Sig_B”, the authentication unit114of the HD recorder100performs signature verification by applying the signature verification algorithm V to the received signature data “Sig_B” using the public key of the HD recorder400“PK_B” included in the received public key certificate “Cert_B” (Step S523). If the signature verification fails (Step S524: NO), the authentication unit114ends the device authentication processing. If the signature verification succeeds (Step S524: YES), the authentication unit114generates a random number “a” (Step S525), generates “Key_a=Gen(a, Y)” using the generated random number “a” (Step S526), and transmits the generated “Key_a” to the HD recorder400(Step S527).

Upon receiving “Key_a”, the authentication unit414of the HD recorder400generates a random number “b” (Step S528), generates “Key_b=Gen (b, Y)” using the generated random number “b” (Step S529), and transmits the generated. “Key_1b” to the HD recorder100(Step S530).

Moreover, the authentication unit414generates, as a session key, “Key_ab=Gen(b, Key_A)=Gen(b, Gen(a, Y))” using the generated random number “b” and the received “Key_a” (Step S531).

Upon receiving “Key_b”, the HD recorder100generates, as a session key, “Key_ab=Gen(a, Key_b)=Gen(a, Gen(b, Y))” using the generated random number “a” and the received “Key_b” (Step S532).

Second Embodiment

<Outline of Backup System2>

In the first embodiment, the HD recorder100includes the backup hard disk included for backing up of contents. Contents are backed up using the backup hard disk. In a second embodiment, the HD recorder100does not include a backup hard disk. Instead, a backup device500includes a backup hard disk. If a content needs to be backed up, the HD recorder100requests the backup device500to back up the content. Upon receiving the request, the backup device500backs up the content.

A backup system2according to the present invention includes an HD recorder100, an HD recorder400, and the backup device500, as shown inFIG. 23. The HD recorder100, the HD recorder400, and the backup device500are connected with each other via a home network30based on IEEE1394.

The HD recorder100acquires a content composed of a video and a sound by receiving a broadcast wave transmitted from a broadcast device10, and stores the acquired content. Moreover, the HD recorder100is equipped with a DVD as an external recording medium, and can acquire contents from the external recording medium.

If a content needs to be backed up, the HD recorder100transmits the content stored therein to the backup device500. The backup device500receives the content from the HD recorder100, and stores the received content therein.

Moreover, in accordance with a request by the HD recorder400, the HD recorder100can move a content stored therein or the content stored in the backup device500to the HD recorder400.

Furthermore, when deleting a content stored therein, the HD recorder100can set up an attribute whether the content is restorable later.

When deleting a content having an attribute set up as to be restorable, the HD recorder100stores a copy of the content in the backup device500, and then deletes the content stored in the HD recorder100itself.

In the same way as the HD recorder100, the HD recorder400receives a content including a broadcast program, stores and plays back the content, and then transmits the content to the backup device500.

The HD recorder100of the second embodiment includes units that constitute the HD recorder100of the first embodiment except for the second information storage unit103, as shown inFIG. 24.

Also, the control unit113performs processing different from those in the first embodiment, in the backup processing in Step S115, the restoration processing in Step S117, the deletion processing in Step S113, and the move processing in Step S111shown inFIG. 6described in the first embodiment. Furthermore, if receiving a move request from an external device, the control unit113performs new processing that is not in the first embodiment. The processing performed by the control unit113is described here.

(1) Control of Backup Processing

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Backup button213, the operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104.

Moreover, the operation judgment unit1001judges whether a backup flag included in the content information has a value of “1”.

If the backup flag has a value of “1”, a content file corresponding to the content information has been already backed up. Therefore, the operation judgment unit1001ends the backup processing. If the backup flag has a value of “0”, the operation judgment unit1001transmits an activation instruction to the backup device500via the transmission/reception unit115.

If not receiving an activation notification from the backup device500within a predetermined time period, the content operation unit1004ends the backup processing. If receiving the activation notification, the operation judgment unit1001instructs the authentication unit114to perform device authentication between the HD recorder100and the backup device500.

If the device authentication fails, the operation judgment unit1001ends the processing. If the device authentication succeeds, the operation judgment unit1001transmits a backup instruction including the content ID to the content operation unit1004.

The content operation unit1004reads a title, a recording date and time, and a hash value from the content information including the content ID, reads the content file including the content ID from the first information storage unit102, and reads a device identifier from the specific information storage unit101. Then, the content operation unit1004transmits a backup request, the content ID, the title, the recording date and time, the hash value, the device identifier, and the content file, to the backup device500via the transmission/reception unit115.

If receiving a backup response, as a response to the backup request, from the backup device500via the transmission/reception unit115, the content operation unit1004rewrites a value of the backup flag of the content information including the content ID to “1”, rewrites a value of a priority level to “2”, notifies the operation judgment unit1001that the backup has completed, and ends the backup processing.

(2) Control of Restoration Processing

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Restore button214, the operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104. The operation judgment unit1001reads a content ID included in the content information, and transmits an activation instruction to the backup device500via the transmission/reception unit115.

If not receiving an activation notification from the backup device500within a predetermined time period, the operation judgment unit1001ends the restoration processing. If receiving the activation notification, the operation judgment unit1001instructs the authentication unit114to perform device authentication between the HD recorder100and the backup device500.

If the device authentication fails, the content operation unit1004ends the restoration processing. If the device authentication succeeds, the operation judgment unit1001transmits a restoration instruction including the content ID to the content operation unit1004.

The content operation unit1004reads the device identifier131“ID_A” from the specific information storage unit101, and transmits a restoration request, the content ID, and the read device identifier131“ID_A”, to the backup device500via the transmission/reception unit115.

The content operation unit1004receives a content file, as a response to the restoration request, from the backup device500via the transmission/reception unit115, and writes the received content file into the first information storage unit102.

(3) Control of Deletion Processing

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Delete button212, the operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104, and instructs the panel generation unit1002to generate a restoration attribute selection panel241. The panel generation unit1002generates the restoration attribute selection panel241in accordance with the generation instruction, and outputs the generated restoration attribute selection panel241to the playback control unit112.

Next, if receiving operation instruction information that shows selection of “restorable” from the input unit110, the operation judgment unit1001transmits the operation instruction information and a deletion instruction including a content ID to the content operation unit1004.

The content operation unit1004judges whether a backup flag included in the content information including the content ID has a value of “1”. If the backup flag has a value of “1”, the content operation unit1004deletes a content file including the content ID included in the content information from the first information storage unit102.

If the backup flag has a value of “0”, the content operation unit1004backs up the content file including the content ID included in the content information from the first information storage unit102to the second information storage unit103. Then, the content operation unit1004deletes the content file from the first information storage unit102.

If receiving operation instruction information that shows selection of “unrestorable”, the operation judgment unit1001transmits a deletion instruction including the operation instruction information and the content ID to the content operation unit1004.

The content operation unit1004judges whether the backup flag included in the content information including the content ID has a value of “1”. If the backup flag has a value of “0”, the content operation unit1004deletes the content file including the content ID from the first information storage unit102, and transmits a deletion instruction including the content ID to the hash deletion unit1011. The hash deletion unit1011deletes the content information from the secure storage unit104in accordance with the deletion instruction.

If the backup flag has a value of “1”, the content operation unit1004transmits an activation instruction to the backup device500via the transmission/reception unit115.

If not receiving an activation notification from the backup device500within a predetermined time period, the content operation unit1004ends the deletion processing. If receiving the activation notification, the content operation unit1004instructs the authentication unit114to perform device authentication between the HD recorder100and the backup device500.

If the device authentication fails, the content operation unit1004ends the deletion processing. If the device authentication succeeds, the content operation unit1004reads a device identifier from the specific information storage unit101, and transmits a deletion request, the content ID, and the read device identifier, to the backup device500via the transmission/reception unit115.

The content operation unit1004receives a deletion response, as a response to the deletion request, from the backup device500, deletes the content file including the content ID from the first information storage unit102, and transmits a deletion instruction including the content ID to the hash deletion unit1011.

The hash deletion unit1011deletes the content information from the secure storage unit104in accordance with the deletion instruction.

(4) Control of Move Processing

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Move button211, the operation judgment unit1001instructs the panel generation unit1002to generate the move destination selection panel215that shows a list of candidates for a move destination.

The panel generation unit1002generates the move destination selection panel215in accordance with the generation instruction, and outputs the generated move destination selection panel215to the playback control unit112.

In order to generate the move destination selection panel215, the operation judgment unit1001transmits a broadcast instruction to the transmission/reception unit115, and receives an information acquisition response including pieces of device identification information of other devices connected to the home network30, as a response to the broadcast instruction, via the transmission/reception unit115. The operation judgment unit1001extracts the pieces of device identification information included in the received information acquisition response, and instructs the panel generation unit1002to generate move destination panels that correspond one-to-one with the pieces of device identification information. The panel generation unit1002generates move destination panels that correspond to all devices whose responses to the broadcast instruction have been received, combines all the generated move destination panels to generate a move destination selection panel215.

Next, the operation judgment unit1001receives operation information instruction that shows a move destination selected by the user's operation from the input unit110.

Here, the HD recorder400is selected as the move destination.

The operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104, and transmits a move instruction including a content ID included in the content information to the content operation unit1004.

The content operation unit1004judges whether a backup flag included in the content information including the content ID has a value of “1”.

If the backup flag has a value of “1”, the content operation unit1004judges whether a content file including the selected content ID is stored in the first information storage unit102. If the content file is not stored, the content operation unit1004performs the above-described restoration processing on the content file including the content ID.

If the content file is stored, the content operation unit1004performs deletion processing on the content file including the content ID that has been restored in the backup device500.

If the content file including the content ID is stored only in the first information storage unit102, the content operation unit1004detects the content file including the content ID from the first information storage unit102, reads an encrypted content and an encrypted content key that are included in the detected content file, and transmits the content ID, the read encrypted content, and the read encrypted content key to the hash calculation unit1013.

The hash calculation unit1013combines the read encrypted content and the read encrypted content key, assigns the combination to the hash function to calculate a hash value, and transmits the read hash value and the content ID to the hash comparison unit1014.

The hash comparison unit1014reads the hash value from the content information including the content ID. The hash comparison unit1014compares the calculated hash value with the read hash value, and transmits a comparison result that shows whether these hash values match each other to the content operation unit1004.

If the comparison result shows that the values do not match each other, the content operation unit1004ends the move processing. If the comparison result shows that the values match each other, the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the read device-specific key132“Key_A” and the encrypted content key to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key. The content operation unit1004receives a content key, as a response to the decryption instruction, from the encryption processing unit109.

The content operation unit1004instructs the authentication unit114to perform device authentication between the HD recorder100and the HD recorder400.

If the device authentication fails, the content operation unit1004ends the move processing.

If the device authentication succeeds, the content operation unit1004instructs the transmission/reception unit115to transmit a move request to the HD recorder400, together with the content key corresponding to the content ID, the content information, and the content file.

Next, the content operation unit1004receives a move response, as a response to the move request, from the HD recorder400via the transmission/reception unit115, and transmits a deletion instruction to delete the content information transmitted together with the move request to the hash deletion unit1011.

The hash deletion unit1011deletes the content information from the secure storage unit104of the HD recorder100.

Moreover, the content operation unit1004deletes the content file from the first information storage unit102of the HD recorder100, and ends the move processing.

(5) Control if Receiving Move Request from External Device

If receiving a move request, content information, a content file, and a content key from the external device via the transmission/reception unit115and the operation judgment unit1001, the content operation unit1004reads the device-specific key132“Key_B” from the specific information storage unit101, transmits the received content key and the read device-specific key132“Key_B” to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content key.

The content operation unit1004receives an encrypted content key, as a response to the encryption instruction, from the encryption processing unit109.

The content operation unit1004writes the received content file into the first information storage unit102, and rewrites an encrypted content key included in the written content file to the encrypted content key received from the encryption processing unit109.

The content operation unit1004transmits an encrypted content and the encrypted content key that are included in the content file to the hash calculation unit1013.

The hash calculation unit1013receives and combines the encrypted content and the encrypted content key, and assigns the combination to the hash function to calculate a hash value. The hash calculation unit1013replaces the hash value included in the content information with the calculated hash value, and then writes the calculated hash value into the secure storage unit104.

The content operation unit1004instructs the transmission/reception unit115to transmit a move response to the external device.

The backup device500includes, as shown inFIG. 25, a transmission/reception unit501, an authentication unit502, a power supply unit503, a control unit507, an encryption processing unit509, a specific information storage unit504, a content storage unit510, a secure information storage unit511, an input unit512, and a display unit513.

The backup device500is specifically a computer system composed of a microprocessor, a RAM, and a ROM. A computer program is stored in the RAM and the ROM. Part of functions of the backup device500is achieved by the microprocessor operating in accordance with the computer program.

The specific information storage unit504is composed of a ROM, and stores a device-specific key516“Key_C”. The device-specific key516“Key_C” is key data specific to the backup device500, and is prestored before shipment of the backup device500.

The content storage unit510is composed of hard disk units, and stores content files161,165,169,539, and so on as shown inFIG. 26, for example.

The content files161,165, and169are the same as those described in the first embodiment usingFIG. 4.

Moreover, the content file539includes a content ID541“B005”, an encrypted content542“ENC(Key_5b, Content5b)”, and an encrypted content key543“ENC(Key_B, Key_5b)”.

Here, the content file539is a backup of a content file stored in the first information storage unit102of the HD recorder400. Content information corresponding to the content file stored in the first information storage unit102is stored in the secure storage unit104of the HD recorder400.

The content ID541“B001” is information for uniquely identifying the encrypted content542“ENC(Key_5b, Content5b)”, and is the same as a content ID “B001” stored in the first information storage unit102of the HD recorder400. The encrypted content542“ENC(Key_5b, Content5b)” is generated by applying the encryption algorithm E1 to a content “Content5b” using a content key “Key_5b”. The encrypted content542is the same as that stored in the first information storage unit102of the HD recorder400.

The encrypted content key543“ENC(Key_B, Key_5b)” is generated by applying the encryption algorithm E1 to the content key “Key_5b” using the device-specific key132“Key_B” stored in the specific information storage unit101of the HD recorder400.

The secure information storage unit511includes a flash memory. Moreover, the secure information storage unit511includes a protection mechanism, and is protected against accesses from an external device.

The secure information storage unit511stores, for example, a backup management table521and permitted device identification information551, as shown inFIG. 27.

The backup management table521includes a plurality of pieces of backup information522,523,524,525, and so on, as shown inFIG. 28. Each piece of the backup information includes a content ID, a title, a recording date and time, a backup source device identifier, and a hash value. Pieces of the content information correspond one-to-one with content files stored in the content storage unit510.

The content ID is the same as a content ID included in a corresponding content file, and is identification information for identifying an encrypted content. The title is a name of a corresponding encrypted content.

The recording date and time shows a date and time when the HD recorder100or the HD recorder400has acquired a content before being encrypted from the broadcast device10or the external recording medium. The backup source device identifier is a device identifier of a device that requests backup of an encrypted content included in the corresponding content file. The hash value is a value generated by combining the encrypted content and an encrypted content key that are included in the corresponding content file and assigning the combination to the hash function.

The permitted device identification information551includes identification information of a device by which the backup device500receives various types of instructions, such as a backup request. In the second embodiment, the permitted device identification information551includes a device identifier552“ID_A” indicating the HD recorder100that constitutes the backup system1and a device identifier553“ID_B” indicating the HD recorder400.

The power supply unit503acquires an electric power from an external power, and supplies the acquired electric power to each circuit that constitutes the backup device500in accordance with instruction by the control unit507.

Normally, the power supply unit503supplies an electric power to the transmission/reception unit501and the control unit507.

The power supply unit503is instructed by the control unit507to start supplying an electric power, and starts supplying an electric power to other units. Also, the power supply unit503is instructed by the control unit507to stop supplying an electric power, stops supplying an electric power to other units except for the transmission/reception unit501and the control unit507.

The transmission/reception unit501is connected with the home network30, and transmits and receives various types of information between the external device connected with the home network30and each of the control unit507and the authentication unit502. The external devices used here are the HD recorder100and the HD recorder400.

The authentication unit502stores beforehand a secret key specific to the backup device500“SK_C”, a public key certificate “Cert_C”, a public key of the certification authority “PK_CA”, and a CRL. The public key certificate “Cert_C” certifies validity of a public key “PK_C” corresponding to the secret key “SK_C”, and includes a certification identification number, the public key “PK_C”, and signature data of the certification authority. The signature data of the certification authority is generated by at least applying a signature generation algorithm S to the public key “PK_C” using the secret key of the certification authority “SK_C”.

The CRL includes a certification identification number of an invalidated public key certificate.

The public key of the certification authority “PK_CA” is a public key that forms a pair with the secret key of the certification authority “SK_CA”.

Upon receiving an instruction by the control unit507, the authentication unit502performs device authentication between the HD recorder100and the external device in accordance with the DTCP. If the device authentication fails, the authentication unit502prohibits a communication between the control unit507and the external device. If the device authentication succeeds, the authentication unit502generates a session key that is shared between the HD recorder100and the external device, and outputs the generated session key to the control unit507.

The operations in the device authentication between the HD recorder100and the HD recorder400have been already described usingFIG. 21andFIG. 22. Regarding operations in device authentication between the HD recorder100and the backup device500, the following replacement is used in place of a description thereof. The HD recorder400, “Cert_B”, “Cha_B”, “Sig_B”, the random number “b”, “Key_b”, and “Key_ab” in Steps S501to S532are replaced with the backup device500, “Cert_C”, “Cha_C”, “Sig_C”, a random number “c”, “Key_c”, and “Key_ac”, respectively.

The encryption processing unit509receives a plaintext and a key from the control unit507, and is instructed to encrypt the received plaintext. Also, the encryption processing unit509receives a ciphertext and a key from the control unit507, and is instructed to decrypt the received ciphertext.

Upon instructed to encrypt the received plaintext, the encryption processing unit509applies the encryption algorithm E1 to the received plaintext using the received key to generate a ciphertext, and outputs the generated ciphertext to the control unit507.

Upon instructed to decrypt the received ciphertext, the encryption processing unit509applies the decryption algorithm D1 to the received ciphertext using the received key to generate a decrypted text, and outputs the generated decrypted text to the control unit507.

A pair of a plaintext and a key received by the encryption processing unit509is composed of a content key and the device-specific key132“Key_C”, for example. Also, a pair of a ciphertext and a key received by the encryption processing unit509is composed of an encrypted content key and the device-specific key132“Key_C”, for example.

The control unit507receives an activation instruction to activate the backup device500from the external device via the transmission/reception unit501. The external device is the HD recorder100or the HD recorder400.

Upon receiving the activation instruction, the control unit507instructs the power supply unit503to start supplying electric power. Next, the control unit507transmits an activation notification that shows activation of the backup device500to the external device via the transmission/reception unit501.

Next, the control unit507instructs the authentication unit502to perform device authentication between the backup device500and the external device. If the device authentication performed by the authentication unit502fails, the control unit507instructs the power supply unit503to stop supplying electric power.

If the device authentication succeeds, the control unit507receives a session key from the authentication unit502. In the following processing, the control unit507realizes a secret communication between the backup device500and the external device in accordance with a common key encryption system using the received session key. A description of encryption and decryption processing relating to the secret communication is omitted here.

Next, the control unit507receives a device identifier, a backup request, a content ID, a content key, a title, a recording date and time, and an encrypted content from the external device via the transmission/reception unit501. Or, instead of these, the control unit507receives a device identifier, an extension request, and content ID. Or, instead of these, the control unit507receives a device identifier and a restoration information request.

(1) Backup Processing

Upon receiving a backup request, a device identifier, a content ID, a title, a recording date and time, a hash value, and a content file, the control unit507checks whether the received device identifier is included in the permitted device identification information551stored in the secure information storage unit511. If the identifier is not included, the control unit507transmits an error notification that shows reception of the backup request is impossible to the external device via the transmission/reception unit501. Next, the control unit507instructs the power supply unit503to stop supplying electric power.

If the received identifier is included in the permitted device identification information551, the control unit507writes the received content file into the content storage unit510.

Next, the control unit507generates backup information that consists of the received content ID, title, recording date and time, hash value, and device identifier, and adds the generated backup information to the backup management table521. Here, the received device identifier is set as a backup source device identifier.

Next, the control unit507transmits a backup response that shows completion of the backup to the external device via the transmission/reception unit501.

When the transmission has completed, the control unit507instructs the power supply unit503to stop supplying electric power.

(2) Restoration Processing

Upon receiving a restoration request, a content ID, and a device identifier from the external device via the transmission/reception unit501, the control unit507checks whether the received device identifier is included in the permitted device identification information551stored in the secure information storage unit511. If the identifier is not included, the control unit507transmits an error notification that shows reception of the restoration request is impossible to the external device via the transmission/reception unit501. Next, the control unit507instructs the power supply unit503to stop supplying electric power.

If the received identifier is included in the permitted device identification information551, the control unit507selects and read backup information, which includes an content ID that is the same as the received content ID included in the backup management table521stored in the secure information storage unit511and a backup source device identifier that is the same as the received device identifier.

Next, the control unit507detects and reads a content file corresponding to the selected backup information based on the received content ID and device identifier, and transmits the read content file to the external device.

Upon receiving a deletion request, a content ID, and a device identifier from the external device via the transmission/reception unit501, the control unit507checks whether the received device identifier is included in the permitted device identification information551stored in the secure information storage unit511. If the identifier is not included, the control unit507transmits an error notification that shows reception of the deletion request is impossible to the external device via the transmission/reception unit501. Next, the control unit507instructs the power supply unit503to stop supplying electric power.

If the received identifier is included in the permitted device identification information551, the control unit507selects backup information, which includes a content ID that is the same as the received content ID included in the backup management table521stored in the secure information storage unit511and a backup source device identifier that is the same as the received device identifier, and deletes the selected backup information from the secure information storage unit511. The control unit507detects a content file including the received content ID corresponding to the deleted backup information, and deletes the detected content file from the content storage unit510.

The control unit507transmits a deletion response that shows the deletion of the content file to the external device.

The input unit512receives an input of information and an instruction by the user, and outputs the received information and operation instruction information based on the received instruction to the control unit507.

The display unit513displays various types of information under control of the control unit507.

The following operations of the backup system2, especially operations different from those of the backup system1in the second embodiment, are described focusing on operations of the HD recorder100using flow charts.

(1) Operations of HD Recorder100

In the operation of the HD recorder100in the second embodiment, backup processing in Step S115, restoration processing in Step S117, deletion processing in Step S113, and move processing in Step S111shown inFIG. 6are different from those in the first embodiment. The following describes the backup processing, the restoration processing, the deletion processing, and the move processing.

(2) Backup Processing

Operations in the backup processing are described using flow charts shown inFIG. 29andFIG. 30.

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Backup button213, the operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104. The operation judgment unit1001reads a content ID included in the content information (Step S621), and transmits a backup instruction including the content ID to the content operation unit1004.

Moreover, the content operation unit1004reads a backup flag included in the content information (Step S622), and judges whether the backup flag has a value of “1” (Step S623).

If the backup flag has a value of “1” (Step S623: YES), a content file corresponding to the content information has been already backed up. Therefore, the content operation unit1004ends the backup processing.

If the backup flag has a value of “0” (Step S623: NO), the content operation unit1004transmits an activation instruction to the backup device500via the transmission/reception unit115(Step S624).

The control unit507of the backup device500receives the activation instruction from the HD recorder100via the transmission/reception unit501, and instructs the power supply unit503to start supplying electric power. Upon receiving the start instruction, the power supply unit503starts supplying electric power to the units that constitutes the backup device500(Step S626).

The control unit507transmits an activation notification to the HD recorder100via the transmission/reception unit501(Step S627).

If not receiving the activation notification from the backup device500within a predetermined time period (Step S628: NO), the content operation unit1004of the HD recorder100ends the backup processing.

If receiving the activation notification within the predetermined time period (Step S628: YES), the content operation unit1004instructs the authentication unit114to perform device authentication between the HD recorder100and the backup device500.

In accordance with the authentication instruction by the content operation unit1004, the authentication unit114performs device authentication between the HD recorder100and the backup device500(Step S631). If the device authentication fails (Step S632: NO), the control unit507ends the backup processing.

Here, Step S631is the same as the above-described Steps S501to S532in which the HD recorder400, “Cert_B”, “Cha_B”, “Sig_B”, the random number “b”, “Key_b”, and “Key_ab” are replaced with the backup device500, “Cert_C”, “Cha_C”, “Sig_C”, the random number “c”, “Key_c”, and “Key_ac”, respectively.

If the device authentication succeeds (Step S632: YES), the content operation unit1004reads a content ID, a title, a recording date and time, and a hash value that are included in the content information (Step S634).

The content operation unit1004reads the device identifier131“ID_A” from the specific information storage unit101, and reads a content file including the content ID from the first information storage unit102(Step S636).

The content operation unit1004transmits a backup request, the read device identifier131“ID_A”, the content ID, the title, the recording date and time, the hash value, and the content file to the backup device500via the transmission/reception unit115(Step S637).

If the device authentication between the backup device500and the HD recorder100fails (Step S638: NO), the control unit507instructs the power supply unit503to stop supplying electric power. The power supply unit503stops supplying electric power to other units except for the transmission/reception unit501and the control unit507(Step S639).

If the device authentication succeeds (Step S638: YES), the control unit507receives the backup request, the device identifier131“ID_A”, the content ID, the title, the recording date and time, the hash value, and the content file from the HD recorder100via the transmission/reception unit501. The control unit507judges whether the received device identifier131“ID_A” is registered in the permitted device identification information551stored in the secure information storage unit511(Step S641). If not registered (Step S641: NO), the control unit507transmits an error notification that shows reception of the backup request is impossible to the HD recorder100via the transmission/reception unit501(Step S642), and stops supplying electric power to each unit that constitutes the backup device500(Step S643). Here, upon receiving the error notification, the HD recorder100ends the backup processing.

If the received device identifier131“ID_A” is registered (Step S641: YES), the control unit507writes the received content file into the content storage unit510(Step S647).

Next, the control unit507generates backup information including the received content ID, title, recording date and time, device identifier131“ID_A”, and hash value, and adds the generated backup information to the backup management table521(Step S648). Here, the received device identifier131“ID_A” is set as a backup source device identifier.

The control unit507transmits a backup response that shows completion of the backup to the HD recorder100via the transmission/reception unit501(Step S652). When the transmission has completed, the control unit507instructs the power supply unit503to stop supplying electric power (Step S654).

The content operation unit1004of the HD recorder100receives the backup response from the backup device500via the transmission/reception unit115, rewrites the value of the backup flag included in the content information to “1” (Step S657), rewrites a value of a priority level to “2” (Step S658), and ends the backup processing.

(3) Restoration Processing

Operations in the restoration processing are described using a flow chart shown inFIG. 31.

In a state where any one of the content panels203to207is selected in Steps S101to S106described in the first embodiment usingFIG. 6, if receiving operation instruction information that shows selection of the Restore button214, the operation judgment unit1001reads content information corresponding to the selected content panel from the secure storage unit104, and a content ID included in the content information (Step S810).

Steps S624to S639are the same processing as those above described.

If not receiving an activation notification from the backup device500within a predetermined time period via the transmission/reception unit115(Step S628: NO), the content operation unit1004ends the restoration processing.

If the device authentication succeeds (Step S632: YES), the content operation unit1004reads the device identifier131“ID_A” from the specific information storage unit101(Step S811), and transmits a restoration request, the content ID, and the read device identifier131“ID_A” to the backup device500via the transmission/reception unit115(Step S814).

If the device authentication succeeds (Step S638: YES), the control unit507receives the restoration request, the content ID, and the device identifier131“ID_A” from the HD recorder100via the transmission/reception unit501. The control unit507judges whether the received device identifier131“ID_A” is registered in the permitted device identification information551stored in the secure information storage unit511(Step S816). If not registered (Step S816: NO), the control unit507proceeds to Step S639.

If registered (Step S816: YES), the control unit507selects backup information, which includes the content ID received from the backup management table521stored in the secure information storage unit511and a backup source device identifier that is the same as the received device identifier (Step S827).

Next, the control unit507detects a content file corresponding to the backup information and including the content ID stored in the content storage unit510, and reads the detected content file from the content storage unit510(Step S829).

Next, the control unit507transmits the read content file to the HD recorder100via the transmission/reception unit501(Step S831). Then, the control unit507instructs the power supply unit503to stop supplying electric power. The power supply unit503receives the stop instruction by the control unit507, and stops supplying electric power to the units except for the transmission/reception unit501and the control unit507(Step S832).

The content operation unit1004of the HD recorder100receives the content file from the backup device500via the transmission/reception unit115. The content operation unit1004writes the received content file into the first information storage unit102(Step S834).

Operations in the deletion processing are described using flow charts shown inFIG. 32andFIG. 33.

Note that processing in Steps S251to S256, S264, S270, and S271inFIG. 32are the same as those in Steps having the same step numbers inFIG. 13andFIG. 14. Furthermore, in Step S256, if the backup flag does not have a value of “1” (Step S256: NO), the same processing as shown inFIG. 30is performed.

Moreover, the processing performed in the case where the backup flag has a value of “1” (Step S264: YES) is shown inFIG. 33. Processing in Steps S624to S639, and S641to S643inFIG. 33are the same as those in Steps having the same step numbers inFIG. 30.

If the device authentication succeeds (Step S632: YES), the content operation unit1004reads the device identifier131“ID_A” from the specific information storage unit101(Step S901), and transmits a deletion request, the read device identifier131“ID_A”, and the content ID read in Step S251to the backup device500(Step S902).

If the device authentication between the backup device100and the HD recorder100succeeds (Step S638: YES), the control unit507receives the deletion request, the device identifier131“ID_A”, and the content ID from the HD recorder100via the transmission/reception unit501. The control unit507judges whether the received device identifier131“ID_A” is registered in the permitted device identification information551stored in the secure information storage unit511(Step S641).

If the received identifier is registered (Step S641: YES), the control unit507deletes a content file, which corresponds to backup information including the content ID and a backup source device identifier that is the same as the received device identifier and includes the content ID, and deletes the backup information from the backup management table521(Step S903).

When the deletion in Step S903has completed, the control unit507transmits a deletion response to the HD recorder100via the transmission/reception unit501(Step S904).

The content operation unit1004of the HD recorder100receives the deletion response via the transmission/reception unit115, and performs processing subsequent to Step S270.

(5) Move Processing

Operations in the move processing are described using flow charts shown inFIG. 34andFIG. 35.

Steps S201to S207inFIG. 34are the same as those described inFIG. 10.

If the backup flag has a value of “1” (Step S207: YES), the content operation unit1004detects whether a content file including the selected content ID is stored in the first information storage unit102(Step S951).

If the content file is not stored (Step S951: NO), the content operation unit1004performs restoration processing (Step S952).

The restoration processing in Step S952is the same as that described usingFIG. 31.

If the content file is stored (Step S951: YES), the content operation unit1004performs the deletion processing described usingFIG. 33(Steps S624to S904).

By performing the above-described processing, the content file gets stored in only the first information storage unit102.

The content operation unit1004detects the content file including the content ID from the first information storage unit102(Step S953).

The content operation unit1004reads an encrypted content and an encrypted content key that are included in the detected content file (Step S961), and transmits the encrypted content, the encrypted content key, and the content ID to the hash calculation unit1013.

The hash calculation unit1013receives the encrypted content and the encrypted content key, combines the encrypted content and the encrypted content key, and assigns the combination to the hash function to calculate a hash value (Step S962). The hash calculation unit1013transmits the content ID and the hash value to the hash comparison unit1014.

The hash comparison unit1014reads the hash value from the content information181including the content ID (Step S963), and compares the received hash value with the read hash value (Step S964), and transmits a comparison result that shows whether the two hash values match each other to the content operation unit1004.

If the comparison result shows that the values do not match each other (Step5964: NO), the content operation unit1004ends the move processing.

If the comparison result shows that the values match each other (Step S964: YES), the content operation unit1004reads the device-specific key132“Key_A” from the specific information storage unit101, outputs the encrypted content key and the read device-specific key132“Key_A” to the encryption processing unit109, and instructs the encryption processing unit109to decrypt the encrypted content key.

The encryption processing unit109receives the encrypted content key and the device-specific key132“Key_A” from the content operation unit1004, decrypts the encrypted content key using the received device-specific key132“Key_A” to generate a content key, and outputs the generated content key to the content operation unit1004(Step S965).

The content operation unit1004instructs the authentication unit114to perform device authentication between the HD recorder and the HD recorder400.

The authentication unit114performs device authentication between the HD recorder100and the HD recorder400(Step S966).

The device authentication in Step S966is the same as those described usingFIG. 21andFIG. 22.

If the device authentication performed by the authentication unit114fails (Step S967: NO), the content operation unit1004ends the move processing.

If the device authentication succeeds (Step S967: YES), the content operation unit1004instructs the transmission/reception unit115to transmit a move request to the HD recorder400together with a content key, content information, and content file that each correspond to the selected content ID.

The transmission/reception unit115transmits the move request and the decrypted content key, the content information, and the content file to the HD recorder400(Step S971).

The HD recorder400receives the move request and the content key, the content information, and the content file that each correspond to the selected content ID from the HD recorder100.

The following Steps S972to S975are performed within the HD recorder400.

The content operation unit1004of the HD recorder400reads the device-specific key132“Key_B” from the specific information storage unit101, and transmits the received content key and the device-specific key132“Key_B” to the encryption processing unit109, and instructs the encryption processing unit109to encrypt the content key.

Upon receiving the encryption instruction by the content operation unit1004, the encryption processing unit109encrypts the content key using the received device-specific key132“Key_B” to generate an encrypted content key, and outputs the generated encrypted content key to the content operation unit1004(Step S972).

The content operation unit1004writes the received content file into the first information storage unit102, and rewrites the encrypted content key included in the written content file to the generated encrypted content key (Step S973).

The content operation unit1004transmits the encrypted content, the encrypted content key, and the content ID that are included in the content file to the hash calculation unit1013. The hash calculation unit1013combines the encrypted content and the encrypted content key, assigns the combination to the hash function to calculate a hash value (Step S974), and transmits the calculated hash value to the hash writing unit1012together with the content ID.

The hash writing unit1012rewrites the hash value included in the content information including the content ID to the hash value received from the hash calculation unit1013, and then writes the written hash value into the secure storage unit104(Step S975).

The content operation unit1004instructs the transmission/reception unit115to transmit a move response.

The transmission/reception unit115transmits the move response to the HD recorder100(Step S976).

The HD recorder100receives the move response, deletes the transmitted content information from the secure storage unit104of the HD recorder100together with the move request, deletes the content file from the first information storage unit102of the HD recorder100(Step S977), and ends the move processing.

While the present invention has been described based on the above embodiments, the present invention is not limited to the above embodiments. Various modifications may be made in a range that does not deviate from the scope of the present invention. The present invention also includes the following cases.

(a) In a state where a content file is not stored in a backup source device and a backup of the content file is stored in only the backup device500, move (backup transfer) may be realized by transferring a proprietary right of the backup of the content without actually moving the backup of the content file.

For example, the following case is described usingFIG. 36,FIG. 37, andFIG. 38. In the second embodiment, the backup device500stores the content file539whose backup source device is the HD recorder400. If the HD recorder400does not store a content file that is the same as the content file539, backup transfer is performed on the content file539is transferred to the HD recorder100.

The control unit113of the HD recorder100transmits a request for a simplified backup management table to the backup device500via the transmission/reception unit115(Step s1001).

Upon receiving the request for the simplified backup management table via the transmission/reception unit501, the control unit507of the backup device500reads the backup management table521stored in the secure information storage unit511, and removes the hash values from the backup management table521to generate a simplified backup management table601as shown inFIG. 38(Step S1002).

The simplified backup management table601includes pieces of simplified backup information602,603,604, and605.

The control unit507transmits the simplified backup management table601to the HD recorder100via the transmission/reception unit501.

The control unit113of the HD recorder100receives the simplified backup management table601via the transmission/reception unit115, and searches the simplified backup management table601for simplified backup information having a backup source device identifier that indicates other device.

With respect to the HD recorder100, the simplified backup information having a backup source device identifier that indicates other device is the simplified backup information604having a backup source device identifier “ID_B” included in the simplified backup management table601shown inFIG. 38.

The HD recorder,100generates a backup transfer selection panel that includes all pieces of the simplified backup information each having a backup source device identifier indicates other device, and outputs the generated backup transfer selection panel to the playback control unit112(Step S1004).

The playback control unit112receives the backup transfer selection panel, and displays the received backup transfer selection panel on the monitor120.

When the backup transfer selection panel is displayed, displays corresponding to the piece of the simplified backup information searched for are shown on the monitor120, such as “content ID “B005”, title “Content5b” ”, in accordance with the number of pieces of the simplified backup information searched for. The user can select a content targeted for backup transfer among contents displayed on the backup transfer selection panel.

The user operates to select a content targeted for backup transfer. The control unit113receives operation instruction information that shows the content on which backup transfer is to be performed.

The control unit113transmits a backup transfer request and the content ID “B005”, to the HD recorder400indicated by the backup transfer source device identifier “ID_B” included by the simplified backup information (Step S1006).

Device authentication is performed between the HD recorder100and the HD recorder400(Step S1007).

If the device authentication fails (Step S1008: NO), the HD recorder100ends the backup transfer processing. If the device authentication fails (Step S1009: NO), the HD recorder400ends the backup transfer processing.

If the device authentication succeeds (Step S1009: YES), the control unit113of the HD recorder400transmits the backup transfer request, the content ID “B005”, a backup transfer source device identifier “ID_B”, a backup transfer destination device identifier “ID_A” to the backup device500via the transmission/reception unit115(Step S1010).

Device authentication is performed between the HD recorder400and the backup device500(Step S1020).

If the device authentication fails (Step S1021: NO), the HD recorder400ends the backup transfer processing. If the device authentication fails (Step S1022: NO), the backup device500ends the backup transfer processing.

If the device authentication succeeds (Step S1022: YES), the control unit507of the backup device500reads an encrypted content key “ENC (Key_B, Key_5b)” from the content storage unit510(Step S1023).

Here, the device-specific key132“Key_A” stored in the specific information storage unit101of the HD recorder100is a secret key. A ciphertext generated by encrypting a plaintext using the device-specific key132“Key_A” can be decrypted using the device-specific key132“Key_A”.

Moreover, the device-specific key132“Key_B” stored in the specific information storage unit101of the HD recorder400is a secret key. A ciphertext generated by encrypting a plaintext using the device-specific key132“Key_B” can be decrypted using the device-specific key132“Key_B”.

The backup device500stores beforehand the device-specific keys132“Key_A” and “Key_B” in the secure information storage unit511.

The control unit507transmits the encrypted content key “ENC (Key_B, Key_5b)” and the device-specific key132“Key_B” to the encryption processing unit509, and instructs the encryption processing unit509to decrypt the encrypted content key “ENC (Key_B, Key_5b)”. The encryption processing unit509decrypts the encrypted content key “ENC (Key_B, Key_5b)” using the device-specific key132“Key_B” (Step S1024), and transmits a content key “Key_5b” that is a result of the decryption to the control unit507.

The control unit507receives the content key “Key_5b” from the encryption processing unit509, transmits the secret key “Key_A” and the received content key “Key_5b” to the encryption processing unit509, and instructs the encryption processing unit509to encrypt the content key “Key_5b”.

The encryption processing unit509encrypts the content key “Key_5b” using the secret key “Key_A”, and transmits an encrypted content key “ENC (Key_A, Key_5b)” that is a result of the encryption to the control unit507(Step S1025).

The control unit507rewrites the encrypted content key543“ENC (Key_B, Key_5b)” included in the content file539including the content ID “B005” to the encrypted content key “ENC (Key_A, Key_5b)” (Step S1026).

The control unit507reads the encrypted content542from the content file539(Step S1027), and calculates a hash value using the encrypted content key “ENC (Key_A, Key_5b)” and the encrypted content542“ENC (Key_5b, Conten_5b)” (Step S1028).

The control unit507transmits a backup transfer response and the content ID “B005” to the HD recorder400that is the backup transfer source device via the transmission/reception unit501.

The control unit113of the HD recorder400receives the backup transfer response and the content ID “B005” via the transmission/reception unit115, deletes the content information including the content ID “B005” from the secure storage unit104of the HD recorder400(Step S1030), and ends the backup transfer processing.

The control unit507of the backup device500instructs the authentication unit502to perform device authentication between the backup device500and the HD recorder100that is the backup transfer destination device.

Device authentication is performed between the backup device500and the HD recorder100(Step S1040).

If the device authentication fails (Step S1051: NO), the HD recorder100ends the backup transfer processing. If the device authentication fails (Step S1041: NO), the backup device500ends the backup transfer processing.

If the device authentication succeeds (Step S1041: YES), the control unit507of the backup device500transmits a backup transfer notification, the content ID “B005”, the title “Content5b”, a recording date and time, and the calculated hash value to the HD recorder100(Step S1042).

The backup device500rewrites the backup source device identifier included in the backup information524including the content ID “B005” in the backup management table521from “ID_B” to “ID_A” (Step S1043), and ends the backup transfer processing.

The HD recorder100receives the backup transfer notification, the content ID “B005”, the title “Content5b”, the recording date and time, and the calculated hash value, and generates content information including the received content ID “B005”, title “Content5b”, recording date and time, and calculated hash value. The HD recorder100sets a value of a backup flag of the generated content information as “1”, adds the content information to the content management table180stored in the secure storage unit104(Step S1052), and ends the backup transfer processing.

As have been described, backup transfer can be performed without actually moving a content from a transfer source device to a transfer destination device.

(b) Each device may hold a public key of other device.

For example, the HD recorder100holds a public key of the HD recorder400beforehand. The HD recorder100decrypts an encrypted content key stored in the backup device500using a device-specific key of the HD recorder100to generate a content key, and re-encrypts the content key using the public key of the HD recorder400to generate a re-encrypted content key.

The HD recorder100transmits the re-encrypted content key to the backup device500, and instructs the backup device500to rewrite the encrypted content key held in the backup device500to the re-encrypted key.

The HD recorder100deletes content information corresponding to the encrypted content key from the secure storage unit104.

The HD recorder400decrypts the re-encrypted key stored in the backup device500using the device-specific key of the backup device500corresponding to the public key to acquire a content key.

The HD recorder400can decrypt an encrypted content corresponding to the content key using the content key.

(c) In the first and second embodiments, the control units of the HD recorders each combine an encrypted content and an encrypted content key, and assign the combination to the hash function to calculate a hash value. Without limiting to this, the hash value may be calculated by assigning only an encrypted content key to the hash function. Or, the hash value may be calculated by assigning only an encrypted content to the hash function. Or, the hash value may be calculated by assigning only a content key to the hash function.
(d) The key generation unit108may use other methods for generating content keys.
(e) The recording medium from/to which information is read/written by the input/output unit111is not limited to the DVD. Without limiting to this, other recording media, such as memory cards, CDs, BDs, and videotapes may be employed.
(f) The following may be employed. Each of contents has a backup permission flag attached thereto, which shows whether backing up of the content is permitted. If receiving operation instruction information that shows backing up of a content, the control unit113reads a backup permission flag attached to the content. Only if the backup permission flag shows that backing up of the content is permitted, the control unit113backs up the content.
(g) The second information storage unit103in the first embodiment and the content storage unit510in the second embodiment have been described to be structured with an HDD. Without limiting to this, these units each may be structured with a writable optical disk drive and an optical disk. Moreover, the optical disk drive may be a disk changeable optical disk drive.
(h) The second information storage unit103in the first embodiment and the content storage unit510in the second embodiment have been described to be included in the HD recorder100and the backup device500, respectively. Without limiting to this, the second information storage unit103and the content storage unit510respectively may be externally connected with the HD recorder100and the backup device500via a digital interface.
(i) In (3) Control of Move Processing described in the first embodiment, the control unit113generates the connection request panel221. Without limiting to this, a “force execution button” may be further arranged in the connection request panel221. In this case, the control unit113outputs the connection request panel221having the “force execution button” arranged therein to the playback control unit112, and instructs the playback control unit112to display the connection request panel221.

In accordance with the instruction by the control unit113, the playback control unit112displays the connection request panel221having the “force execution button” arranged therein, on the monitor120.

If the second information storage unit103cannot be connected due to a good reason such as breakage, the user operates the buttons and the remote controller to select and press the force execution button.

By the user's operation, the control unit113receives operation instruction information that shows force execution from the input unit110, and performs move processing on a content except for processing relating to the second information storage unit103even if judged that the second information storage unit103is not connected.

In this case, although the content remains in the second information storage unit103, content information corresponding to the content that has been moved is deleted, and therefore the content cannot be played back. The content is substantially invalidated, and therefore the content is prevented from being maliciously used.

(j) In the first and second embodiments, the network communication between the devices has been described using an example of connection of the network in accordance with the DTCP. The DTCP does not necessarily need to be used, and other copyright protection systems may be used for the network connection and so on.

Moreover, the backup device500has been described to securely stores, in the secure information storage unit511, a hash value generated based on a content. Without limiting to this, the backup device500may not have a secure function for storing the hash value, and only a backup source device of the content corresponding to the hash value may store the hash value.

(k) In the first and second embodiments, simultaneously with writing a received content to the first information storage unit102, the content operation unit1004monitors whether an available capacity of the first information storage unit102is sufficient. If the available capacity is insufficient, the content operation unit1004deletes a content file including a priority level having a “2” from the first information storage unit102so as to make the available capacity. However, as long as the available capacity is made, the present invention is not limited to this structure.

For example, the following may be employed. Before writing a content file, the content operation unit1004estimates a size of the content file to be written, and judges whether an available capacity of the first information storage unit102will become insufficient if writing the content file. If judged to become insufficient, the content operation unit1004deletes a content file including a priority level having a value of “2” from the first information storage unit102.

(l) In (3) Control of Move Processing in the first embodiment, if the authentication by the authentication unit114fails, the content operation unit1004ends the move processing. Without limiting to this, whether the move processing is permitted to be performed may be judged using other methods.

For example, the following may be employed. Move control information showing whether move processing is permitted to be performed is added to each piece of content information. Before the authentication unit114performs authentication processing, the content operation unit1004reads move control information from a piece of content information corresponding to a content file that is a target for judgment on permission of move processing, and judges whether the read move control information shows that move processing is permitted to be performed. If judged to indicate that move processing is permitted to be performed, the content operation unit1004continues the subsequent processing. If not judged to indicate that move processing is permitted to be performed, the content operation unit1004ends the processing.

(m) In the move processing, the transmission/reception unit115is instructed to transmit contents that have been decoded by the decoding unit107. The present invention is not limited to this.

For example, in the move processing, encrypted content keys are decrypted, and then are transmitted. However, encrypted contents may be transmitted without being decrypted.

(n) When a content is not stored in the first information storage unit102and a backup of the content file is not stored in the second information storage unit103, if an abnormal situation occurs, for example, content information relating to the content file is included in the content management table180, the HD recorder100may display a message such as “This content has not been backed up. Restoration is impossible”. Also, the HD recorder100may delete the content information relating to the content file in which an error occurs in order to address the error.

Also, a backup flag that has a value of “0” at a time when content has not been selected may not be listed on the content management table180.

(o) The hash calculation unit1013combines a read encrypted content and encrypted content key, and assigns the combination to the hash function. However, without limiting to this, part of data may be assigned to the hash function.

For example, the hash calculation unit1013may combine part of an encrypted content and an encrypted content key, and assign the combination to the hash function.

(p) Each of the above devices is specifically a computer system composed of a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or the hard disk unit. Functions of each of the devices are achieved by the microprocessor operating in accordance with the computer program. Here, the computer program is composed of a plurality of command codes that show instructions to the computer, in order to achieve predetermined functions.
(q) All or part of compositional elements of each of the above devices may be composed of one system LSI (Large Scale Integration). The system LSI is a super-multifunctional LSI manufactured by integrating a plurality of compositional units on one chip, and is specifically a computer system composed of a microprocessor, a ROM, a RAM, and the like. A computer program is stored in the RAM. Functions of the system LSI are achieved by the microprocessor operating in accordance with the computer program.
(r) All or part of the compositional elements of each of the above devices may be composed of a removable IC card or a single module. The IC card or the single module is a computer system composed of a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the above-described super-multifunctional LSI. Functions of the IC card or the module are achieved by the microprocessor operating in accordance with the computer program. The IC card or the module may be tamper-resistant.
(s) The present invention may be the above methods. Also, the present invention may be a computer program that realizes the methods by a computer, or a digital signal composed of the computer program.

Furthermore, the present invention may be a computer-readable storage medium such as a flexible disk, a hard disk, a CD-ROM (Compact Disk Read Only Memory), an MO (Magneto-Optical), a DVD (Digital Versatile Disk), a DVD-ROM (Digital Versatile Disk Read Only Memory), a DVD-RAM (Digital Versatile Disk Random Access Memory), a BD (Blu-ray Disc), and a semiconductor memory, which stores the computer program or the digital signal. Furthermore, the present invention may be the computer program or the digital signal stored in the storage medium.

Furthermore, the present invention may be the computer program or the digital signal transmitted via an electric communication network, a wireless or wired communication network, a network such as Internet, data broadcasting, and the like.

Furthermore, the present invention may be a computer system that includes a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program.

Furthermore, the program or the digital signal may be executed by other independent computer system, by transferring the program or the digital signal to the recording medium, or by transferring the program or the digital signal via a network or the like.

(t) The system LSI may be manufactured by separately integrating the plurality of compositional units into one chip, or by integrating the plurality of compositional units into one chip including all or part of the functions.

Here, the LSI may be called an IC, a system LSI, a super LSI, and an ultra LSI, depending on integration degree.

Also, a method of forming integrated circuits is not limited to LSIs, and may be realized using a dedicated circuit or a general-purpose processor. Furthermore, the following may be used: an FPGA (Field Programmable Gate Array) programmable after manufacturing LSIs; and a reconfigurable processor in which connection and setting of the circuit cell inside an LSI can be reconfigured.

Furthermore, when new technology for forming integrated circuits that replaces LSIs becomes available as a result of progress in semiconductor technology or semiconductor-derived technologies, functional blocks may be integrated using such technology. One possibility lies in adaptation of biotechnology.

(u) The present invention may be any combination of the above-described embodiment and modifications.

INDUSTRIAL APPLICABILITY

The present invention can be continuously and repeatedly used in an industry that creates, distributes, broadcasts, and uses digital contents, and in an industry that manufactures and sells devices for creating contents, devices for distributing contents, and various types of electric devices for playing back and editing contents.