Patent Publication Number: US-8997216-B2

Title: Recording medium apparatus and control method for authenticating a device based on a revocation list

Description:
This application is the National Stage of International Application No. PCT/JP2012/002656, filed Apr. 18, 2012, which claims the benefit of U.S. Provisional Application No. 61/478,714, filed Apr. 25, 2011. 
    
    
     TECHNICAL FIELD 
     The present invention relates to a recording medium device for recording of content. 
     BACKGROUND ART 
     In recent years, as digital technology rapidly spreads, systems have emerged for distributing digitalized content (hereinafter simply referred to as content) either by recording media, such as optical discs, or over a network. 
     One characteristic of such content is that quality does not degrade despite duplication. In order to protect the copyright of such content, it is necessary to prevent the holder of the content from making unauthorized copies. Therefore, within the system for distributing content, a transmission device that transmits the content and a playback device that plays back the received content each confirm that the other device is a legitimate device that protects copyright. Only when such confirmation is successful does the transmission device transmit the content to the playback device. In this way, the devices that use the content can be restricted, thus allowing for protection of the copyright on the content. 
     Confirmation that the other device is legitimate makes use of authentication technology based on a public key cryptosystem. An example of authentication technology based on the public key cryptosystem in Patent Literature 1 is as follows. 
     The transmission device transmits a random number to the playback device. Next, the playback device uses a private key allocated to the playback device in order to generate a signed text by applying a digital signature to the received random number. The playback device then returns the signed text to the transmission device. Finally, the transmission device verifies the received signed text using the public key of the playback device. 
     In such authentication technology that uses a public key cryptosystem, it is assumed that the public key itself is valid. In order to perform authentication using a public key cryptosystem, an organization referred to as a Public Key Certificate Authority issues a public key certificate indicating that the public key corresponding to a device is legitimate. The public key certificate authority also issues a revocation list (also referred to as a Certificate Revocation List (CRL) or a Public Key Revocation List) listing information identifying the revoked public key certificates, in order to notify other devices that among the issued public key certificates, public key certificates have been revoked for a reason such as the period of validity having expired, the device to which the certificate was assigned having been operated maliciously, or the private key having been divulged. 
     The revocation list includes a plurality of pieces of revocation information. Each piece of revocation information includes a serial number identifying the revoked public key certificate. 
     In Patent Literature 1, a personal computer is composed of a main body and a drive unit that accesses a recording medium. A check unit included in the main body reads a public key certificate from a buffer memory and extracts an identifier of the drive unit from the read public key certificate. Next, the check unit determines whether the extracted identifier is included in a drive identifier list that includes revocation identifiers. When it is determined that the extracted identifier is included, the main body considers the drive unit to be unauthorized and suspends communication with the drive unit. 
     CITATION LIST 
     Patent Literature
     Patent Literature 1: Japanese Patent Application Publication No. 2004-32706   Patent Literature 2: Japanese Patent Application Publication No. 2003-115838   Patent Literature 3: Japanese Patent Application Publication No. 2002-281013   Patent Literature 4: Japanese Patent Application Publication No. 2007-519994   

     SUMMARY OF INVENTION 
     Technical Problem 
     The check unit in the main body of a personal computer, however, may be tampered with maliciously. In this case, if the drive unit is unauthorized, then a check unit that has been tampered with maliciously may determine that the identifier of the unauthorized drive unit is not included in the drive identifier list. In other words, an unauthorized drive unit may be determined to be valid. The problem of unauthorized content being acquired from a recording medium via an unauthorized drive unit may therefore occur. 
     In order to resolve this sort of problem, it is an aim of an aspect of the present invention to provide a recording medium device, a system, a control method, a computer program, a recording medium, and a controller that can prevent unauthorized output of content. 
     Solution to Problem 
     In order to achieve the above aim, an aspect of the present invention is a recording medium device comprising: a storage unit; and a tamper-resistant controller, the storage unit storing a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content, and the controller including: an acquisition unit configured to acquire an acquisition request for the content from an apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment unit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control unit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Advantageous Effects of Invention 
     With this structure, it is determined within the temper-resistant controller, included in the recording medium device, whether the acquired apparatus identifier and the revocation identifier match, and when the identifiers match, content is not output, thereby preventing unauthorized output of content from the recording medium device. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is a configuration diagram showing an overall configuration of a content management system  10   g  according to Embodiment 1. 
         FIG. 2  is a configuration diagram showing an overall configuration of a content management system  10   a  according to Embodiment 2. 
         FIG. 3  is a block diagram showing the structure of a key issuing device  200 . 
         FIGS. 4A through 4D  show an example of the data structure of a public key certificate. 
         FIG. 4A  shows an example of the data structure of a key distribution device certificate  252 . 
         FIG. 4B  shows an example of the data structure of a terminal device certificate  262 . 
         FIG. 4C  shows an example of the data structure of a recording medium device certificate  272 . 
         FIG. 4D  shows an example of the data structure of a production device certificate  282 . 
         FIG. 5  shows an example of the data structure of a revocation file  242 . 
         FIG. 6  is a block diagram showing the structure of a content production device  500 . 
         FIG. 7  shows an example of a content information registration screen  551   t.    
         FIG. 8  shows an example of the data structure of content information registration data  541 . 
         FIG. 9  shows an example of the data structure of content information registration data  541   a.    
         FIG. 10  shows an example of the data structure of content information registration data  541   b.    
         FIG. 11  shows an example of the data structure of content information registration data  541   c.    
         FIG. 12  shows an example of the data structure of content information registration data  541   d.    
         FIG. 13  shows an example of the data structure of content information registration data  541   e.    
         FIG. 14  shows an example of the data structure of content information registration data  541   f.    
         FIG. 15  is a block diagram showing the structure of a content distribution device  400 . 
         FIG. 16  shows an example of the data structure of distribution request information  431 . 
         FIG. 17  is a block diagram showing the structure of a key distribution device  100 . 
         FIG. 18  shows an example of the data structure of a content information list  131   c.    
         FIG. 19  shows an example of the data structure of a content information list  131   a.    
         FIG. 20  shows an example of the data structure of a content information list  13   b.    
         FIG. 21  shows an example of the data structure of a concatenated value  180 . 
         FIG. 22  is a block diagram showing the structure of a mutual authentication unit  105  and a mutual authentication unit  604 . 
         FIG. 23  is a block diagram showing the structure of a recording medium device  600 . 
         FIG. 24  shows an example of the data structure of data stored in a title key storage unit  611 , a content information storage unit  612 , a usage condition information storage unit  613 , and a revocation file storage unit  614 . 
         FIG. 25  is a block diagram showing the structure of a terminal device  300 . 
         FIG. 26  is a sequence diagram showing the sequence for key issuing and is continued in  FIG. 27 . 
         FIG. 27  is a sequence diagram showing the sequence for key issuing and is continued from  FIG. 26 . 
         FIG. 28  is a sequence diagram showing the sequence for content production and content registration and is continued in  FIG. 29 . 
         FIG. 29  is a sequence diagram showing the sequence for content production and content registration and is continued from  FIG. 28 . 
         FIG. 30  is a sequence diagram showing the sequence for content distribution and is continued in  FIG. 31 . 
         FIG. 31  is a sequence diagram showing the sequence for content distribution and is continued in  FIG. 32 . 
         FIG. 32  is a sequence diagram showing the sequence for content distribution and is continued in  FIG. 33 . 
         FIG. 33  is a sequence diagram showing the sequence for content distribution and is continued in  FIG. 34 . 
         FIG. 34  is a sequence diagram showing the sequence for content distribution and is continued from  FIG. 33 . 
         FIG. 35  is a sequence diagram showing the sequence for mutual authentication and key sharing and is continued in  FIG. 36 . 
         FIG. 36  is a sequence diagram showing the sequence for mutual authentication and key sharing and is continued from  FIG. 35 . 
         FIG. 37  is a flowchart showing operations for generation of an individual revocation list. 
         FIG. 38  is a sequence diagram showing the sequence for content playback and is continued in  FIG. 39 . 
         FIG. 39  is a sequence diagram showing the sequence for content playback and is continued from  FIG. 38 . 
         FIG. 40  is a block diagram showing the structure of a key issuing device  200   a  according to a modification. 
         FIG. 41  is a configuration diagram showing an overall configuration of a content management system  10   b  according to Embodiment 3. 
         FIG. 42  is a block diagram showing the structure of a server device  400   b.    
         FIG. 43  is a block diagram showing the structure of a terminal device  300   b.    
         FIG. 44  shows notification data  331   b  as an example of notification data. 
         FIG. 45  shows notification data  332   b  as an example of notification data. 
         FIG. 46  shows a request  350   b  as an example of a request transmitted by the terminal device  300   b.    
         FIG. 47  shows a request  360   b  as an example of a request transmitted by the terminal device  300   b.    
         FIG. 48  shows an example of the data structure of a management data table  370   b.    
         FIG. 49  shows notification data  333   b  as an example of notification data of “type 1”. 
         FIG. 50  shows notification data  334   b  as an example of notification data of “type 2”. 
         FIG. 51  shows an example of the data structure of a control data table  341   b.    
         FIG. 52  shows an example of the data structure of a control data table  381   b.    
         FIG. 53  is a configuration diagram showing an overall configuration of a content management system  10   c  according to a modification. 
         FIG. 54  is a configuration diagram showing an overall configuration of a content management system  10   d  according to a modification. 
         FIG. 55  is a configuration diagram showing an overall configuration of a content management system  10   e  according to a modification. 
         FIG. 56  is a configuration diagram showing an overall configuration of a content management system  10   f  according to a modification. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     An aspect of the present invention is a recording medium device including a storage unit and a tamper-resistant controller. The storage unit stores a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate of an apparatus related to use of the content. The controller includes an acquisition unit configured to acquire an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment unit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control unit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     The storage unit may also store, in association with the content, usage condition information indicating conditions for use of the content by a user and including entry information indicating a storage position of the apparatus identifier in the revocation list. The judgment unit may read the entry information from the usage condition information stored in the storage unit, read the apparatus identifier from the storage position in the revocation list as indicated by the read entry information, and perform the judgment using the read apparatus identifier. 
     The acquisition unit may acquire the revocation identifier identifying the revoked public key certificate allocated to a playback device as the apparatus, the playback device being capable of playing back the content. 
     When the judgment unit judges that the acquired apparatus identifier does not match the revocation identifier, the control unit may permit output of the content to the apparatus. 
     When the control unit permits output of the content to the apparatus, the control unit may perform control so that the title key for decoding the content is output to the apparatus. 
     Another aspect of the present invention is a system comprising a recording medium device and an apparatus into which the recording medium device is loaded, the recording medium device including a storage unit and a tamper-resistant controller. The storage unit stores a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate of an apparatus related to use of the content. The controller includes an acquisition unit configured to acquire an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment unit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control unit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a control method used in a tamper-resistant controller that, along with a storage unit, constitutes a recording medium device. The storage unit stores a content and a revocation list. The revocation list includes a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. The control method includes the steps of acquiring an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; judging whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and controlling to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a computer-readable recording medium having recorded thereon a computer program for control used in a tamper-resistant controller that, along with a storage unit, constitutes a recording medium device. The storage unit stores a content and a revocation list. The revocation list includes a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. The controller is a computer, and the recording medium stores a computer program for causing the computer to perform the steps of acquiring an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; judging whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and controlling to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a computer program for control used in a tamper-resistant controller that, along with a storage unit, constitutes a recording medium device. The storage unit stores a content and a revocation list. The revocation list includes a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. The controller is a computer, and the computer program causes the computer to perform the steps of acquiring an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; judging whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and controlling to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a tamper-resistant controller that, along with a storage unit, constitutes a recording medium device. The storage unit stores a content and a revocation list. The revocation list includes a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. The controller includes an acquisition unit configured to acquire an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment unit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control unit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a revocation list generation device for generating a revocation list, comprising an acquisition unit configured to acquire, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content; a revocation list generation unit configured to generate a revocation list including the acquired revocation identifier associated with the content; and an output unit configured to output the revocation list. 
     The acquisition unit may acquire the revocation identifier identifying the revoked public key certificate allocated to a playback device as the apparatus, the playback device being capable of playing back the content. 
     The revocation list generation device may be a content production device for producing a content by editing material, and the output unit may output the produced content along with the revocation list. 
     The revocation list generation device may further comprise a content information generation unit that generates content information including a title key used to encrypt the content, and the output unit may output the generated content information along with the content and the revocation list. 
     The revocation list generation device may further comprise a signature unit that generates signature data by applying a digital signature to the title key and the revocation list, and the content information generation unit may generate the content information by including the generated signature data. 
     The content information generation unit may generate the content information by including one of a content identifier identifying the content, genre information indicating a genre into which the content is categorized, and quality information indicating quality of the content. 
     The revocation list generation device may further comprise a condition information generation unit configured to generate usage condition information indicating conditions for use of the content by a user and including entry information indicating a storage position of the revocation identifier in the revocation list, wherein the output unit outputs the generated usage condition information along with the content and the revocation list. 
     Another aspect of present invention is a content management system comprising a revocation list generation device, a recording medium device, and an apparatus into which the recording medium device is loaded. The revocation list generation device generates a revocation list and includes an acquisition unit configured to acquire, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content; a revocation list generation unit configured to generate a revocation list associated with the content and including the acquired revocation identifier; and an output unit configured to output the revocation list. The recording medium device includes a storage unit and a tamper-resistant controller. The storage unit stores a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate of an apparatus related to use of the content. The controller includes an acquisition unit configured to acquire an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment unit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control unit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     Another aspect of the present invention is a revocation list generation method used in a revocation list generation device for generating a revocation list, comprising the steps of: acquiring, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content; generating a revocation list including the acquired revocation identifier associated with the content; and outputting the revocation list. 
     Another aspect of the present invention is a computer-readable recording medium having recorded thereon a computer program for revocation list generation used in a revocation list generation device for generating a revocation list. The revocation list generation device is a computer, and the computer program causes the computer to perform the steps of acquiring, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content; generating a revocation list including the acquired revocation identifier associated with the content; and outputting the revocation list. 
     Another aspect of the present invention is a computer program for revocation list generation used in a revocation list generation device for generating a revocation list. The revocation list generation device is a computer, and the computer program causes the computer to perform the steps of acquiring, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content, generating a revocation list including the acquired revocation identifier associated with the content, and outputting the revocation list. 
     Another aspect of the present invention is an integrated circuit implementing a revocation list generation device for generating a revocation list, comprising an acquisition unit configured to acquire, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content; a revocation list generation unit configured to generate a revocation list including the acquired revocation identifier associated with the content; and an output unit configured to output the revocation list. 
     1. Embodiment 1 
     As Embodiment 1 of the present invention, a content management system  10   g  is described with reference to the drawings. 
     (1) As shown in  FIG. 1 , the content management system  10   g  includes a revocation list generation device  500   g , an apparatus  300   g , and a recording medium device  600 . 
     The revocation list generation device  500   g  includes an acquisition unit  501   g , a revocation list generation unit  502   g , and an output unit  503   g.    
     The acquisition unit  501   g  acquires, for a content, a revocation identifier identifying a revoked public key certificate allocated to an apparatus related to use of the content. 
     The revocation list generation unit  502   g  generates a revocation list including the acquired revocation identifier associated with the content. 
     The output unit  503   g  outputs the revocation list. 
     The recording medium device  600  includes a storage unit  601   g  and a tamper-resistant controller  602   g.    
     The storage unit  601   g  stores a content  611   g  and a revocation list  612   g . The revocation list  612   g  includes a revocation identifier, associated with the content  611   g , that identifies a revoked public key certificate and is allocated to an apparatus related to use of the content  611   g.    
     The controller  602   g  includes an acquisition unit  621   g , a judgment unit  622   g , and a control unit  623   g.    
     The acquisition unit  621   g  acquires an acquisition request for a content from the apparatus  300   g  into which the recording medium device  600   g  is loaded and acquires an apparatus identifier identifying a public key certificate allocated to the apparatus  300   g.    
     The judgment unit  622   g  judges whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired. 
     The control unit  623   g  controls to prohibit output of the content to the apparatus  300   g  when the judgment unit  622   g  judges that the apparatus identifier and the revocation identifier match. 
     (2) The acquisition unit  501   g  may acquire the revocation identifier identifying the revoked public key certificate allocated to a playback device as the apparatus, the playback device being capable of playing back the content. 
     (3) The revocation list generation device  500   g  may be a content production device for producing a content by editing material, and the output unit  503   g  may output the produced content along with the revocation list. 
     (4) The revocation list generation device  500   g  may further include a content information generation unit (not shown in the figures) that generates content information including a title key used to encrypt the content, and the output unit  503   g  may output the generated content information along with the content and the revocation list. 
     (5) The revocation list generation device  500   g  may further include a signature unit (not shown in the figures) that generates signature data by applying a digital signature to the title key and the revocation list, and the content information generation unit may generate the content information by including the generated signature data. 
     (6) The content information generation unit generates the content information by including one of a content identifier identifying the content, genre information indicating a genre into which the content is categorized, and quality information indicating quality of the content. 
     (7) The revocation list generation device  500   g  may further include a condition information generation unit (not shown in the figures) that generates usage condition information indicating conditions for use of the content by a user and including entry information indicating a storage position of the revocation identifier in the revocation list, and the output unit  503   g  may output the generated usage condition information along with the content and the revocation list. 
     (8) The storage unit  601   g  may also store, in association with the content  611   g , usage condition information indicating conditions for use of the content by a user and including entry information indicating a storage position of the apparatus identifier in the revocation list  612   g . The judgment unit  622   g  may read the entry information from the usage condition information stored in the storage unit  601   g , read the apparatus identifier from the storage position in the revocation list  612   g  as indicated by the read entry information, and perform the judgment using the read apparatus identifier. 
     (9) The acquisition unit  621   g  may acquire the revocation identifier identifying the revoked public key certificate allocated to a playback device as the apparatus, the playback device being capable of playing back the content. 
     (10) When the judgment unit  622   g  judges that the acquired apparatus identifier does not match the revocation identifier, the control unit  623   g  may permit output of the content to the apparatus  300   g.    
     (11) When the control unit  623   g  permits output of the content to the apparatus, the control unit  623   g  may perform control so that the title key for decoding the content is output to the apparatus  300   g.    
     2. Embodiment 2 
     As Embodiment 2 of the present invention, a content management system  10   a  is described with reference to the drawings. 
     2.1 Overall Configuration of Content Management System  10   a    
     As illustrated in  FIG. 2 , the content management system  10   a  includes a key distribution device  100 , a key issuing device  200 , a terminal device  300 , a content distribution device  400 , a content production device  500 , and a recording medium device  600 . 
     The key distribution device  100 , the key issuing device  200 , the terminal device  300 , the content distribution device  400 , and the content production device  500  are connected to each other over a network  20 . 
     The network  20  is, for example, the Internet. The recording medium device  600  is, for example, a memory card. 
     2.2 Detailed Configuration of Key Issuing Device  200   
     As illustrated in  FIG. 3 , the key issuing device  200  includes a key pair generation unit  201 , a root key pair storage unit  202 , a certificate generation unit  203 , a private key certificate storage unit  204 , an input unit  205 , a revocation data storage unit  206 , a signature unit  207 , a revocation file storage unit  208 , a control unit  209 , a communications unit  210 , and revocation file generation unit  211 . 
     The key issuing device  200  is a computer system composed of a CPU, memory, a secondary storage unit, a network connection unit, a keyboard, and the like. The root key pair storage unit  202 , the private key certificate storage unit  204 , the revocation data storage unit  206 , and the revocation file storage unit  208  are each constituted by the secondary storage unit. The key pair generation unit  201 , the certificate generation unit  203 , the signature unit  207 , the control unit  209 , and the revocation file generation unit  211  are each constituted by the CPU and computer programs running on the CPU. The communications unit  210  is constituted by the network connection unit. Finally, the input unit  205  is constituted by the keyboard. 
     Of course, the present invention is not limited to the above structure. For example, the key pair generation unit  201 , the certificate generation unit  203 , and the signature unit  207  may alternatively be constituted by dedicated hardware circuits. 
     (1) Root Key Pair Storage Unit  202 , Private Key Certificate Storage Unit  204 , Revocation Data Storage Unit  206 , and Revocation File Storage Unit  208   
     The root key pair storage unit  202  is provided with a region for storing a root private key  231  and a root public key  232 . The root private key  231  and the root public key  232  are described below. 
     The private key certificate storage unit  204  is provided with a region for storing a key distribution device private key  251 , a key distribution device certificate  252 , a terminal device private key  261 , a terminal device certificate  262 , a recording medium device private key  271 , a recording medium device certificate  272 , a production device private key  281 , and a production device certificate  282 . The key distribution device private key  251 , the key distribution device certificate  252 , the terminal device private key  261 , the terminal device certificate  262 , the recording medium device private key  271 , the recording medium device certificate  272 , the production device private key  281 , and the production device certificate  282  are described below. 
     The revocation data storage unit  206  is provided with a region for storing revocation data  241 . The revocation data  241  is described below. 
     The revocation file storage unit  208  is provided with a region for storing a revocation file  242 . The revocation file  242  is described below. 
     (2) Input Unit  205   
     By user operation, the input unit  205  receives input of a terminal device ID that identifies a revoked terminal device and a recording medium device ID that identifies a revoked recording medium device. 
     Alternatively, the input unit  205  may receive input of a model ID for a revoked terminal device or recording medium device. The model ID is a number identifying the type of the terminal device or recording medium device. The input unit  205  may instead receive input of identifying information that identifies the public key certificate allocated to a revoked terminal device or recording medium device. 
     Next, the input unit  205  writes the received terminal device ID and recording medium device ID in revocation data  241  stored in the revocation data storage unit  206 . 
     In the example in  FIG. 5 , the revocation data  241  includes a terminal device ID ( 243 ), a terminal device ID ( 244 ), . . . , a recording medium device ID ( 245 ), a recording medium device ID ( 246 ), . . . . 
     Note that in order to distinguish between the terminal device IDs and the recording medium device IDs included in the revocation data  241 , different values may be embedded at the heads of these IDs. For example, terminal device IDs may start with “00”, and recording medium device IDs may start with “10”. 
     (3) Key Pair Generation Unit  201   
     The key pair generation unit  201  receives a key generation instruction from the control unit  209 . This key generation instruction indicates to generate the private keys and the public keys that are to be allocated respectively to the key distribution device  100 , the key issuing device  200 , the terminal device  300 , the content production device  500 , and the recording medium device  600 . 
     Upon receiving the key generation instruction, the key pair generation unit  201  generates the private keys and the public keys to be allocated to the devices, using the key generation method described below. 
     The following is an example of the key generation method. 
     For example, when using a public key cryptosystem based on elliptic curve cryptography, the key pair generation unit  201  generates a random number x and takes the random number x to be the private key. Next, the key pair generation unit  201  calculates Y=x*P and takes Y to be the public key. In this context, P is a point on an elliptic curve, and a*B denotes multiplication on an elliptic curve. 
     Note that instead of a public key cryptosystem based on elliptic curve cryptography, the key pair generation unit  201  may generate the private key and the public key using a public key cryptosystem based on RSA encryption. 
     Using the above key generation method, the key pair generation unit  201  generates the root private key  231  and the root public key  232  to be allocated to the key issuing device  200 . Next, the key pair generation unit  201  writes the root private key  231  and the root public key  232  in the root key pair storage unit  202 . 
     The root private key  231  and the root public key  232  form the security core of the content management system  10   a.    
     Using the above key generation method, the key pair generation unit  201  then generates the key distribution device private key  251  and a key distribution device public key  254  to be allocated to the key distribution device  100 . Using the above key generation method, the key pair generation unit  201  then generates the terminal device private key  261  and a terminal device public key  264  to be allocated to the terminal device  300 . Furthermore, using the above key generation method, the key pair generation unit  201  generates the recording medium device private key  271  and a recording medium device public key  274  to be allocated to the recording medium device  600 . Finally, using the above key generation method, the key pair generation unit  201  generates the production device private key  281  and a production device public key  284  to be allocated to the content production device  500 . 
     Next, the key pair generation unit  201  writes the key distribution device private key  251 , the terminal device private key  261 , the recording medium device private key  271 , and the production device private key  281  in the private key certificate storage unit  204 . 
     The key pair generation unit  201  then outputs the key distribution device public key  254 , the terminal device public key  264 , the recording medium device public key  274 , and the production device public key  284  to the certificate generation unit  203 . 
     (4) Certificate Generation Unit  203   
     The certificate generation unit  203  receives a certificate generation instruction from the control unit  209 . This certificate generation instruction indicates to generate the public key certificates for the key distribution device  100 , the terminal device  300 , the content production device  500 , and the recording medium device  600 . 
     Upon receiving the certificate generation instruction, the certificate generation unit  203  generates the public key certificate for each of these devices as shown below. 
     The certificate generation unit  203  generates identifiers, described below, uniquely identifying the public key certificates. 
     The identifiers are generated as described below. 
     An identifier is a numerical value. The certificate generation unit  203  stores the identifier generated immediately before. When generating a new identifier, the certificate generation unit  203  increments the stored identifier by one to yield the new identifier. 
     Next, the certificate generation unit  203  receives the public key allocated to the device from the key pair generation unit  201 . The certificate generation unit  203  then concatenates the generated identifier with the received public key, yielding a concatenated value. 
     Concatenated value=identifier∥public key 
     A∥B indicates a concatenated value generated by concatenating data A and data B in this order. The identifier and the public key may be further concatenated with other data to generate the concatenated value. Examples of other such data include a format version of the public key certificate, an expiration date of the certificate, and an identifier identifying the public key cryptosystem. Next, the certificate generation unit  203  outputs the generated concatenated value to the signature unit  207  and instructs the signature unit  207  to generate signature data. 
     Next, the certificate generation unit  203  receives the signature data from the signature unit  207 . 
     Signature data=Sign(root private key, concatenated value) 
     Here, Sign(A, B) indicates signature data that is generated with a signature generation algorithm S 1  by applying a digital signature to the data B using the key A. The signature generation algorithm S 1  is, for example, EC-DSA (Elliptic Curve-Digital Signature Algorithm). 
     Upon receiving the signature data, the certificate generation unit  203  generates a public key certificate that includes the generated concatenated value and the received signature data, writing the generated public key certificate in the private key certificate storage unit  204 . 
     Next, generation of the public key certificate for each of the key distribution device  100 , the terminal device  300 , the recording medium device  600 , and the content production device  500  is described. Here, the public key certificate for the key distribution device  100  is the key distribution device certificate  252 , and the public key certificate for the terminal device  300  is the terminal device certificate  262 . The public key certificate for the recording medium device  600  is the recording medium device certificate  272 , and the public key certificate for the content production device  500  is the production device certificate  282 . 
     Generation of the Key Distribution Device Certificate  252  for the Key Distribution Device  100   
     The certificate generation unit  203  generates a key distribution device ID ( 253 ) that uniquely identifies the key distribution device certificate  252 . Next, the certificate generation unit  203  receives the key distribution device public key  254  allocated to the key distribution device  100  from the key pair generation unit  201 . The certificate generation unit  203  then concatenates the key distribution device ID ( 253 ) and the key distribution device public key  254  to generate a concatenated value. Next, the certificate generation unit  203  outputs the generated concatenated value to the signature unit  207 . The certificate generation unit  203  then receives signature data  255  from the signature unit  207 . 
     Signature data  255 =Sign(root private key, key distribution device ID ( 253 )∥key distribution device public key  254 ) 
     Upon receiving the signature data  255 , the certificate generation unit  203  generates the key distribution device certificate  252  to include the generated concatenated value and the received signature data  255 , as illustrated in  FIG. 4A . Next, the certificate generation unit  203  writes the generated key distribution device certificate  252  in the private key certificate storage unit  204 . 
     Generation of the Terminal Device Certificate  262  for the Terminal Device  300   
     The certificate generation unit  203  generates a terminal device ID ( 263 ) that uniquely identifies the terminal device certificate  262 . Next, the certificate generation unit  203  receives the terminal device public key  264  allocated to the terminal device  300  from the key pair generation unit  201 . The certificate generation unit  203  then concatenates the terminal device ID ( 263 ) and the terminal device public key  264  to generate a concatenated value. Next, the certificate generation unit  203  outputs the generated concatenated value to the signature unit  207 . The certificate generation unit  203  then receives signature data  265  from the signature unit  207 . 
     Signature data  265 =Sign(root private key, terminal device ID ( 263 )∥terminal device public key  264 ) 
     Upon receiving the signature data  265 , the certificate generation unit  203  generates the terminal device certificate  262  to include the generated concatenated value and the received signature data  265 , as illustrated in  FIG. 4B . Next, the certificate generation unit  203  writes the generated terminal device certificate  262  in the private key certificate storage unit  204 . 
     Generation of the Recording Medium Device Certificate  272  for the Recording Medium Device  600   
     The certificate generation unit  203  generates a recording medium device ID ( 273 ) that uniquely identifies the recording medium device certificate  272 . Next, the certificate generation unit  203  receives the recording medium device public key  274  allocated to the recording medium device  600  from the key pair generation unit  201 . The certificate generation unit  203  then concatenates the recording medium device ID ( 273 ) and the recording medium device public key  274  to generate a concatenated value. Next, the certificate generation unit  203  outputs the generated concatenated value to the signature unit  207 . The certificate generation unit  203  then receives signature data  275  from the signature unit  207 . 
     Signature data  275 =Sign(root private key, recording medium device ID ( 273 )∥recording medium device public key  274 ) 
     Upon receiving the signature data  275 , the certificate generation unit  203  generates the recording medium device certificate  272  to include the generated concatenated value and the received signature data  275 , as illustrated in  FIG. 4C . Next, the certificate generation unit  203  writes the generated recording medium device certificate  272  in the private key certificate storage unit  204 . 
     Generation of the Production Device Certificate  282  for the Content Production Device  500   
     The certificate generation unit  203  generates a content provider ID ( 283 ) that uniquely identifies the production device certificate  282 . Next, the certificate generation unit  203  receives the production device public key  284  allocated to the content production device  500  from the key pair generation unit  201 . The certificate generation unit  203  then concatenates the content provider ID ( 283 ) and the production device public key  284  to generate a concatenated value. Next, the certificate generation unit  203  outputs the generated concatenated value to the signature unit  207 . The certificate generation unit  203  then receives signature data  285  from the signature unit  207 . 
     Signature data  285 =Sign(root private key, content provider ID ( 283 )∥production device public key  284 ) 
     Upon receiving the signature data  285 , the certificate generation unit  203  generates the production device certificate  282  to include the generated concatenated value and the received signature data  285 , as illustrated in  FIG. 4D . Next, the certificate generation unit  203  writes the generated production device certificate  282  in the private key certificate storage unit  204 . 
     (5) Revocation File Generation Unit  211   
     The revocation file generation unit  211  is controlled by the control unit  209  to read the revocation data  241  from the revocation data storage unit  206 . Next, the revocation file generation unit  211  outputs the revocation data  241  to the signature unit  207  and instructs the signature unit  207  to generate signature data  247 . 
     The revocation file generation unit  211  then receives the signature data  247  from the signature unit  207 . 
     Signature data  247 =Sign(root private key, revocation data  241 ) 
     Next, the revocation file generation unit  211  generates the revocation file  242  to include the revocation data  241  and the signature data  247 , as illustrated in  FIG. 5 . The revocation file generation unit  211  then writes the generated revocation file  242  in the revocation file storage unit  208 . 
     (6) Signature Unit  207   
     The signature unit  207  reads the root private key  231  from the root key pair storage unit  202 . 
     Next, the signature unit  207  receives the concatenated value from the certificate generation unit  203 . The signature unit  207  also receives the revocation data  241  from the revocation file generation unit  211 . 
     Upon receiving the concatenated value, the signature unit  207  generates signature data by applying a digital signature with the signature generation algorithm S 1  to the received concatenated value using the read root private key  231 . 
     Signature data=Sign(root private key  231 , concatenated value) 
     Next, the signature unit  207  outputs the generated signature data to the certificate generation unit  203 . 
     Upon receiving the revocation data  241 , the signature unit  207  generates signature data by applying a digital signature with the signature generation algorithm S 1  to the received revocation data  241  using the read root private key  231 . 
     Signature data=Sign(root private key  231 , revocation data  241 ) 
     Next, the signature unit  207  outputs the generated signature data to the revocation file generation unit  211 . 
     (7) Communications Unit  210   
     The communications unit  210  is controlled by the control unit  209  to read the root public key  232  from the root key pair storage unit  202 . Next, the communications unit  210  transmits the read root public key  232  over the network  20  to the key distribution device  100 , the terminal device  300 , and the recording medium device  600 . 
     The communications unit  210  also reads the pair of the key distribution device private key  251  and the key distribution device certificate  252  from the private key certificate storage unit  204 . Next, the communications unit  210  transmits the read pair of the key distribution device private key  251  and the key distribution device certificate  252  over the network  20  to the key distribution device  100 . 
     The communications unit  210  is also controlled by the control unit  209  to read the pair of the terminal device private key  261  and the terminal device certificate  262  from the private key certificate storage unit  204 . Next, the communications unit  210  transmits the read pair of the terminal device private key  261  and the terminal device certificate  262  over the network  20  to the terminal device  300 . 
     The communications unit  210  is also controlled by the control unit  209  to read the pair of the recording medium device private key  271  and the recording medium device certificate  272  from the private key certificate storage unit  204 . Next, the communications unit  210  outputs the pair of the recording medium device private key  271  and the recording medium device certificate  272  to the terminal device  300  via a manufacturer&#39;s device, not shown in the figures, possessed by the recording medium device manufacturer. 
     The communications unit  210  is also controlled by the control unit  209  to read the pair of the production device private key  281  and the production device certificate  282  from the private key certificate storage unit  204 . Next, the communications unit  210  transmits the read pair of the production device private key  281  and the production device certificate  282  over the network  20  to the content production device  500 . 
     The communications unit  210  is also controlled by the control unit  209  to read the revocation file  242  from the revocation file storage unit  208 . Next, the communications unit  210  transmits the revocation file  242  over the network  20  to the key distribution device  100 . 
     (8) Control Unit  209   
     The control unit  209  generates a key generation instruction. As described above, this key generation instruction indicates to generate the private keys and the public keys that are to be allocated respectively to the key distribution device  100 , the key issuing device  200 , the terminal device  300 , the content production device  500 , and the recording medium device  600 . Next, the control unit  209  outputs the generated key generation instruction to the key pair generation unit  201 . 
     The control unit  209  also generates a certificate generation instruction. As described above, this certificate generation instruction indicates to generate the public key certificates for the key distribution device  100 , the terminal device  300 , the content production device  500 , and the recording medium device  600 . 
     The control unit  209  also instructs the revocation file generation unit  211  to generate the revocation file  242 . 
     Furthermore, the control unit  209  instructs the communications unit  210  to transmit the root public key  232 . The control unit  209  also instructs the communications unit  210  to transmit the key distribution device private key  251  and the key distribution device certificate  252 , the terminal device private key  261  and the terminal device certificate  262 , the recording medium device private key  271  and the recording medium device certificate  272 , the production device private key  281  and the production device certificate  282 , and finally the revocation file  242 . 
     2.3 Detailed Configuration of Content Production Device  500   
     As illustrated in  FIG. 6 , the content production device  500  includes a material storage unit  501 , an editing unit  502 , an encryption unit  503 , a content storage unit  504 , a content registration request unit  505 , a control unit  506 , a title key generation unit  507 , a title key storage unit  508 , a private key certificate storage unit  509 , a signature unit  510 , a content information registration request unit  511 , a registration data storage unit  512 , an input unit  513 , a display unit  514 , and a communications unit  515 . 
     Note that the content production device  500  is a computer system constituted by a CPU, a memory, a secondary storage unit, a network connection unit, a keyboard, a liquid crystal display unit, and the like. The material storage unit  501 , the content storage unit  504 , the title key storage unit  508 , the private key certificate storage unit  509 , and the registration data storage unit  512  are each constituted by the secondary storage unit. The editing unit  502 , the encryption unit  503 , the content registration request unit  505 , the control unit  506 , the title key generation unit  507 , the signature unit  510 , and the content information registration request unit  511  are each constituted by the CPU and computer programs running on the CPU. The communications unit  515  is constituted by the network connection unit. The input unit  513  is constituted by the keyboard. Finally, the display unit  514  is constituted by the liquid crystal display unit. 
     Of course, the present invention is not limited to the above structure. For example, the encryption unit  503 , the title key generation unit  507 , and the signature unit  510  may alternatively be constituted by dedicated hardware circuits. 
     (1) Material Storage Unit  501 , Content Storage Unit  504 , Title Key Storage Unit  508 , and Private Key Certificate Storage Unit  509   
     The material storage unit  501  stores one or more materials such as video and audio for a movie or the like. For each material, the video and audio are digitalized, encoded, and compressed. As production of the video and the audio is not related to the subject of the present invention, a description thereof is omitted. 
     The content storage unit  504  is provided with a region for storing a content  532 . As described below, the content  532  is generated by encrypting a plaintext content  531 . 
     The title key storage unit  508  is provided with a region for storing a title key  533 . The title key  533  is used to encrypt the plaintext content  531 . 
     The private key certificate storage unit  509  is provided with a region for storing the production device private key  281  and the production device certificate  282 . The production device private key  281  and the production device certificate  282  are received from the key issuing device  200 . 
     (2) Editing Unit  502   
     By user operation, the editing unit  502  reads the material stored in the material storage unit  501  and edits the read material to generate the plaintext content  531 . The editing unit  502  outputs the generated plaintext content  531  to the encryption unit  503 . 
     (3) Title Key Generation Unit  507   
     The title key generation unit  507  generates a 128-bit random number and takes the generated random number to be the title key  533 . The title key generation unit  507  outputs the generated title key  533  to the encryption unit  503 . The title key generation unit  507  also writes the generated title key  533  in the title key storage unit  508 . 
     (4) Encryption Unit  503   
     The encryption unit  503  receives the plaintext content  531  from the editing unit  502 . The encryption unit  503  also receives the title key  533  from the title key generation unit  507 . 
     Next, the encryption unit  503  encrypts the plaintext content  531  with an encryption algorithm E 1  using the title key  533 , thereby generating the content  532 . Unless otherwise noted, the content  532  hereinafter refers to content that has been encrypted. 
     The encryption algorithm E 1  is an encryption algorithm that uses a private key cryptosystem. The encryption algorithm E 1  is, for example, AES (Advanced Encryption Standard). 
     Next, the encryption unit  503  writes the content  532  in the content storage unit  504 . 
     (5) Content Registration Request Unit  505   
     The content registration request unit  505  is controlled by the control unit  506  to generate a registration request that requests registration of the content  532  in the content distribution device  400 . Next, the content registration request unit  505  reads the content  532  from the content storage unit  504 . 
     The content registration request unit  505  outputs the read content  532  and the registration request generated for the content to the communications unit  515 . Next, the content registration request unit  505  instructs the communications unit  515  to transmit the content  532  and the registration request for the content to the content distribution device  400 . 
     (6) Input Unit  513  and Display Unit  514   
     Display Unit  514   
     As illustrated in the example in  FIG. 7 , the display unit  514  displays a content information registration screen  551   t.    
     The registration screen  551   t  includes an input field  552   t , an input field  553   t , an input field  554   t , an input field  555   t , an input field  556   t , an input field  557   t , an input field  558   t , a button  559   t , and a button  560   t.    
     The input field  552   t  is a field for receiving input of the content provider ID from the producer of the content. Here, the content provider ID is identifying information that identifies the provider of the content. 
     The input field  553   t  is a field for receiving input of the content ID from the producer of the content. Here, the content ID is identifying information that identifies the content. 
     The input field  554   t  is a field for receiving input of the quality level from the producer of the content. Here, the quality level is information indicating the level of quality of the content. As an example, a quality level of “HD” indicates that the content is high quality. Specifically, “HD” indicates that the content is high resolution. A quality level of “SD” indicates that the content is standard quality. Specifically, “SD” indicates that the content is standard resolution. 
     The input field  555   t  is a field for receiving input of genre information from the producer of the content. Here, the genre information is information indicating the type or category of content and indicates the genre to which the content belongs. Examples of genre include “action”, fantasy”, thriller”, “comedy”, and the like. 
     The input field  556   t  is a field for receiving input of usage condition information from the producer of the content. Here, the usage condition information is information indicating conditions placed on the user of the content by the producer of the content. Examples of usage condition information include limiting the period of usage of the content or the number of times the content may be used, e.g. “Usable through December 2012” or “playable up to 10 times”. 
     The input field  557   t  is a field for receiving input of authentication condition information from the producer of the content. Here, the authentication condition information is information indicating conditions placed on the user of the content by the producer of the content. 
     An example of authentication condition information is “confirm connection once every three times”. If “confirm connection once every three times” is set as the authentication condition information, authentication is performed as follows. When the content is used on the terminal device  300 , the terminal device  300  requests connection to the content distribution device  400  once every three usages. After the connection is established, the content distribution device  400  confirms the authenticity of the terminal device  300 , the authenticity of the content, and the authenticity of the recording medium device  600  on which the content is stored. If the authenticity of any of the above cannot be confirmed, playback of the content is not permitted. Conversely, when the authenticity of all of the above is confirmed, playback of the content is permitted. 
     Another example of authentication condition information is “confirm connection of the title key”. If “confirm connection of the title key” is set as the authentication condition information, authentication is performed as follows. When the content is used on the terminal device  300 , the terminal device  300  requests connection to the key distribution device  100 . After the connection is established, the key distribution device  100  confirms the authenticity of the terminal device  300 , the authenticity of the title key, and the authenticity of the recording medium device  600  on which the title key is stored. If the authenticity of any of the above cannot be confirmed, playback of the content is not permitted. Conversely, when the authenticity of all of the above is confirmed, use of the title key and playback of the content is permitted. 
     The input field  558   t  is a field for receiving input of a revoked device ID from the producer of the content. Here, the revoked device ID is identifying information that identifies a revoked device. 
     An example of input of a revoked device ID is “0005, 0006”. The numbers “0005, 0006” indicate that the devices identified by identifying information “0005” and “0006” have been revoked. 
     Another example of input of a revoked device ID is “0101-0106”. The range “0101-0106” indicates that the devices identified by identifying information “0101”, “0102”, “0103”, “0104”, “0105”, and “0106” have been revoked. 
     Another example of input of a revoked device ID is “0101-0106, 0110-0120”. The ranges “0101-0106, 0110-0120” indicate that the devices identified by identifying information “0101”, “0102”, . . . , and “0106”, as well as by identifying information “0110”, “0111”, . . . , and “0120” have been revoked. 
     The buttons  559   t  and  560   t  are for receiving input of whether the producer of the content approves of revocation or not. The producer of the content selects one of the buttons  559   t  and  560   t.    
     Approval of revocation indicates that the producer of the content approves of confirmation, when the terminal device  300  uses the content, of whether the terminal device  300  has been revoked based on an individual revocation list attached to the content. 
     In order to approve of revocation, the producer of the content selects the button  559   t . In order not to approve of revocation, the producer of the content selects the button  560   t.    
     As described above, one of the buttons  559   t  and  560   t  must be selected. When the button  559   t  is selected, the producer of the content must fill in the input field  558   t.    
     Note that the registration screen is not limited to the registration screen  551   t  illustrated in  FIG. 7 . 
     The registration screen  551   t  need not include the input fields  554   t ,  555   t ,  556   t , and  557   t . Alternatively, the registration screen  551   t  need not include the input fields  553   t ,  554   t ,  556   t , and  557   t . Finally, the registration screen  551   t  need not include the input fields  553   t ,  555   t ,  556   t , and  557   t.    
     Input Unit  513   
     The input unit  513  receives the results of input from the producer of the content for the input fields  552   t ,  553   t , . . . ,  558   t , and the buttons  559   t  and  560   t . In other words, the input unit  513  receives, from the producer of the content, input of the content provider ID, the content ID, the quality level, the genre information, the usage condition information, the authentication condition information, the revoked device ID, and the revocation approval. Upon receiving input of the above, the input unit  513  generates content information registration data  541  that includes the content provider ID, the content ID, the quality level, the genre information, the usage condition information, the authentication condition information, the revoked device ID, and a revocation approval flag. Next, the input unit  513  writes the generated registration data  541  in the registration data storage unit  512 . 
     Here, the revocation approval flag is set to “ON” when the button  559   t  is selected. Conversely, when the button  560   t  is selected, the revocation approval flag is set to “OFF”. 
     Items that were not input on the registration screen  551   t  are not included in the registration data  541 . For example, as described above, data might not be input for the input fields  554   t ,  555   t ,  556   t ,  557   t , and  558   t . Accordingly, the quality level, the genre information, the usage condition information, the authentication condition information, and the revoked device ID might not be included in the registration data  541 . 
     (7) Signature Unit  510   
     The signature unit  510  receives an instruction to generate a signature from the control unit  506 . Upon receipt of the instruction to generate a signature, the signature unit  510  reads the registration data  541  from the registration data storage unit  512 . The signature unit  510  then determines whether the revocation approval flag included in the read registration data  541  is “ON” or “OFF”. 
     If the revocation approval flag is “OFF”, the signature unit  510  does nothing. 
     If the revocation approval flag is “ON”, the signature unit  510  reads the production device private key  281  from the private key certificate storage unit  509 . Next, the signature unit  510  generates signature data by applying a digital signature with the signature generation algorithm S 1  to the read registration data  541  using the production device private key  281 . 
     Here, the signature generation algorithm S 1  is a signature generation algorithm based on a public key cryptosystem. An example of encryption technology used in a public key cryptosystem is elliptic curve cryptography. In this case, the signature generation algorithm S 1  is, for example, EC-DSA (Elliptic Curve-Digital Signature Algorithm). 
     Next, the signature unit  510  adds the generated signature data to the registration data  541  and overwrites the registration data  541  stored in the registration data storage unit  512  with the registration data  541  to which the signature data has been added. 
     (8) Content Information Registration Request Unit  511   
     The content information registration request unit  511  is controlled by the control unit  506  to read the title key  533  from the title key storage unit  508 . Next, the content information registration request unit  511  appends the read title key  533  to the registration data  541  stored in the registration data storage unit  512 . 
     The content information registration request unit  511  is controlled by the control unit  506  to generate a registration request indicating a request to register content information registration data in the key distribution device  100 . Next, the content information registration request unit  511  reads the registration data  541  from the registration data storage unit  512 , outputs the registration request and the registration data  541  to the communications unit  515 , and instructs the communications unit  515  to transmit these items to the key distribution device  100 . 
     (9) Communications Unit  515   
     The communications unit  515  receives the production device private key  281  and the production device certificate  282  from the key issuing device  200  over the network  20 . Next, the communications unit  515  writes the production device private key  281  and the production device certificate  282  in the private key certificate storage unit  509 . 
     The communications unit  515  receives the production device private key  281  and the production device certificate  282  from the key issuing device  200  over the network  20 . Next, the communications unit  515  writes the production device private key  281  and the production device certificate  282  in the private key certificate storage unit  509 . 
     The communications unit  515  receives the content registration request and the content  532  from the content registration request unit  505 . Next, the communications unit  515  transmits the received registration request and content  532  to the content distribution device  400  over the network  20 . 
     The communications unit  515  receives the content information registration request and the registration data  541  from the content information registration request unit  511 . Next, the communications unit  515  transmits the received registration request and registration data  541  to the key distribution device  100  over the network  20 . 
     (10) Registration Data Storage Unit  512   
     The registration data storage unit  512  stores the content information registration data  541 . 
       FIGS. 8 through 14  show examples of registration data. Note that in the examples of registration data shown in  FIGS. 8 through 14 , a title key and signature data has been added. 
     Registration Data  541   
     The registration data  541  shown in  FIG. 8  includes a content provider ID ( 542 ), a content ID ( 543 ), genre information  544 , a quality level ( 545 ), a title key  546 , usage condition information  547 , connection condition information  548 , revocation information  549 , and a revocation approval flag  552 . The revocation information  549  includes a terminal device ID ( 550 ) and a terminal device ID ( 551 ). 
     Here, the revocation approval flag  552  is “ON”, and therefore the registration data  541  includes the revocation information  549 . 
     The registration data  541  thus indicates that the producer of the content approves of confirmation, when the terminal device  300  uses the content, of whether the terminal device  300  has been revoked based on an individual revocation list attached to the content. 
     Registration Data  541   a    
     The registration data  541   a  shown in  FIG. 9  includes a content provider ID ( 542   a ), a content ID ( 543   a ), genre information  544   a , a quality level ( 545   a ), a title key  546   a , usage condition information  547   a , connection condition information  548   a , and a revocation approval flag  552   a.    
     Here, the revocation approval flag  552   a  is “OFF”, and therefore the registration data  541   a  does not include revocation information. 
     The registration data  541   a  thus indicates that the producer of the content does not approve of confirmation, when the terminal device  300  uses the content, of whether the terminal device  300  has been revoked based on an individual revocation list attached to the content. 
     Registration Data  541   b    
     The registration data  541   b  shown in  FIG. 10  includes a content provider ID ( 542   b ), a content ID ( 543   b ), genre information  544   b , a quality level ( 545   b ), a title key  546   b , usage condition information  547   b , connection condition information  548   b , revocation information  549   b , a revocation approval flag  552   b , and signature data  553   b . The revocation information  549   b  includes a terminal device ID ( 550   b ) and a terminal device ID ( 551   b ). 
     Here, the revocation approval flag  552   b  is “ON”, and therefore the registration data  541   b  includes the revocation information  549   b.    
     The signature data  553   b  is data generated by applying a digital signature with the signature generation algorithm S 1  to a concatenated value using the production device private key  281 . In this case, the concatenated value is a concatenation, in the following order, of the content provider ID ( 542   b ), the content ID ( 543   b ), the genre information  544   b , the quality level ( 545   b ), the title key  546   b , the usage condition information  547   b , the connection condition information  548   b , the revocation information  549   b , and the revocation approval flag  552   b.    
     The registration data  541   b  thus indicates that the producer of the content approves of confirmation, when the terminal device  300  uses the content, of whether the terminal device  300  has been revoked based on an individual revocation list attached to the content. 
     Registration Data  541   c    
     The registration data  541   c  shown in  FIG. 11  includes a content provider ID ( 542   c ), a content ID ( 543   c ), genre information  544   c , a quality level ( 545   c ), a title key  546   c , usage condition information  547   c , and connection condition information  548   c.    
     The registration data  541   c  includes neither a revocation approval flag nor revocation information. 
     The registration data  541   c  thus indicates that the producer of the content does not approve of confirmation, when the terminal device  300  uses the content, of whether the terminal device  300  has been revoked based on an individual revocation list attached to the content. 
     Registration Data  541   d    
     The registration data  541   d  shown in  FIG. 12  includes a content provider ID ( 542   d ), a content ID ( 543   d ), genre information  544   d , a quality level ( 545   d ), a title key  546   d , usage condition information  547   d , connection condition information  548   d , revocation information  549   d , a revocation approval flag  552   d , and signature data  553   d . The revocation information  549   d  includes a terminal device ID ( 550   d ) and a terminal device ID ( 551   d ). 
     Here, the revocation approval flag  552   d  is “ON”, and therefore the registration data  541   d  includes the revocation information  549   d.    
     The signature data  553   d  is data generated by applying a digital signature with the signature generation algorithm S 1  to a concatenated value using the production device private key  281 . In this case, the concatenated value is a concatenation, in the following order, of the content provider ID ( 542   d ), the content ID ( 543   d ), the genre information  544   d , the quality level ( 545   d ), the title key  546   d , the usage condition information  547   d , the connection condition information  548   d , the revocation information  549   d , and the revocation approval flag  552   d.    
     Registration Data  541   e    
     The registration data  541   e  shown in  FIG. 13  includes a content provider ID ( 542   e ), a content ID ( 543   e ), genre information  544   e , usage condition information  547   e , connection condition information  548   e , revocation information  549   e , a revocation approval flag  552   e , and signature data  553   e . The revocation information  549   e  includes a terminal device ID ( 550   e ) and a terminal device ID ( 551   e ). 
     Here, the revocation approval flag  552   e  is “ON”, and therefore the registration data  541   e  includes the revocation information  549   e.    
     The signature data  553   e  is data generated by applying a digital signature with the signature generation algorithm S 1  to a concatenated value using the production device private key  281 . In this case, the concatenated value is a concatenation, in the following order, of the content provider ID ( 542   e ), the content ID ( 543   e ), the genre information  544   e , the usage condition information  547   e , the connection condition information  548   e , the revocation information  549   e , and the revocation approval flag  552   e.    
     Registration Data  541   f    
     The registration data  541   f  shown in  FIG. 14  includes a content provider ID ( 5420 , a quality level ( 545   f ), usage condition information  547   f , connection condition information  548   f , revocation information  549   f , a revocation approval flag  552   f , and signature data  553   f . The revocation information  549   f  includes a terminal device ID ( 550   f ) and a terminal device ID ( 551   f ). 
     Here, the revocation approval flag  552   f  is “ON”, and therefore the registration data  541   f  includes the revocation information  549   f.    
     The signature data  553   f  is data generated by applying a digital signature with the signature generation algorithm S 1  to a concatenated value using the production device private key  281 . In this case, the concatenated value is a concatenation, in the following order, of the content provider ID ( 542   f ), the quality level ( 545   f ), the usage condition information  547   f , the connection condition information  548   f , the revocation information  549   f , and the revocation approval flag  552   f.    
     (11) Control Unit  506   
     The control unit  506  outputs an instruction to generate a signature to the signature unit  510 . 
     The control unit  506  causes the content registration request unit  505  to output a content registration request. 
     The control unit  506  also causes the content information registration request unit  511  to output a content information registration request. 
     2.4 Detailed Configuration of Content Distribution Device  400   
     As shown in  FIG. 15 , the content distribution device  400  includes a control unit  401 , a communications unit  402 , a content storage unit  403 , a mutual authentication unit  404 , and a display unit  405 . 
     The content distribution device  400  is a computer system composed of a CPU, memory, a secondary storage unit, a network connection unit, and the like. The content storage unit  403  is constituted by the secondary storage unit. The control unit  401  is constituted by the CPU and computer programs running on the CPU. The communications unit  402  is constituted by the network connection unit. 
     (1) Content Storage Unit  403   
     The content storage unit  403  is provided with a region for storing the content  532 . 
     (2) Communications Unit  402   
     The communications unit  402  receives a content registration request and the content  532  from the content production device  500  over the network  20 . Next, the communications unit  402  writes the received content  532  in the content storage unit  403 . 
     The communications unit  402  receives distribution request information  431 , which indicates a content distribution request, from the terminal device  300  over the network  20 . The distribution request information  431  includes, for example, a content provider ID ( 432 ) and a content ID ( 433 ), as shown in the example in  FIG. 16 . The communications unit  402  outputs the distribution request information  431  to the control unit  401 . 
     The communications unit  402  receives a content from the control unit  401  and, based on an instruction from the control unit  401 , transmits the received content to the terminal device  300  over the network  20 . 
     (3) Control Unit  401   
     The control unit  401  receives the distribution request information  431  from a distribution request reception unit  430 . Upon receiving the distribution request information  431 , the control unit  401  searches within the content storage unit  403  for the content identified by the content ID ( 433 ) included in the distribution request information  431 . Upon finding the content identified by the content ID ( 433 ), the control unit  401  reads the content from the content storage unit  403 , outputs the read content to the communications unit  402 , and instructs the communications unit  402  to transmit the content to the terminal device  300 . 
     (4) Mutual Authentication Unit  404   
     The mutual authentication unit  404  performs mutual authentication and key sharing with a connected device. Details are omitted here, as this processing is the same as processing by a mutual authentication unit  105 , described below, in the key distribution device  100 . 
     (5) Display Unit  405   
     The display unit  405  is controlled by the control unit  401  to display information. 
     2.5 Detailed Configuration of Key Distribution Device  100   
     As shown in  FIG. 17 , the key distribution device  100  includes a communications unit  101 , a revocation judgment unit  102 , a revocation file storage unit  103 , a private key certificate storage unit  104 , a mutual authentication unit  105 , a root public key storage unit  106 , an encryption/decryption unit  107 , a verification unit  108 , a content information generation unit  109 , an update unit  110 , a content information list storage unit  111 , a control unit  112 , and a display unit  113 . 
     The key distribution device  100  is a computer system composed of a CPU, memory, a secondary storage unit, a network connection unit, a liquid crystal display unit, and the like. The revocation file storage unit  103 , the private key certificate storage unit  104 , the root public key storage unit  106 , and the content information list storage unit  111  are each constituted by the secondary storage unit. The revocation judgment unit  102 , the mutual authentication unit  105 , the encryption/decryption unit  107 , the verification unit  108 , the content information generation unit  109 , the update unit  110 , and the control unit  112  are each constituted by the CPU and computer programs running on the CPU. The communications unit  101  is constituted by the network connection unit. Finally, the display unit  113  is constituted by the liquid crystal display unit. 
     Of course, the present invention is not limited to the above structure. For example, the encryption/decryption unit  107 , the mutual authentication unit  105 , and the verification unit  108  may alternatively be constituted by dedicated hardware circuits. 
     (1) Root Public Key Storage Unit  106 , Revocation File Storage Unit  103 , Private Key Certificate Storage Unit  104 , and Content Information List Storage Unit  111   
     Root Public Key Storage Unit  106   
     The root public key storage unit  106  is provided with a region for storing the root public key  232 . 
     Revocation File Storage Unit  103   
     The revocation file storage unit  103  is provided with a region for storing the revocation file  242 . 
     Private Key Certificate Storage Unit  104   
     The private key certificate storage unit  104  is provided with a region for storing the key distribution device private key  251  and the key distribution device certificate  252 . 
     Content Information List Storage Unit  111   
     The content information list storage unit  111  stores a content information list  131   c . For example, the content information list  131   c  includes a plurality of pieces of content related information, as shown in the data structure of the content information list  131   c  in  FIG. 18 . Each piece of content related information includes content information, revocation information, authentication condition information, and usage condition information. The content information includes a content provider ID, a content ID, genre information, a quality level, and a title key. 
     The revocation information, the authentication condition information, the usage condition information, the content provider ID, the content ID, the genre information, the quality level, and the title key are as described above. 
     As shown in  FIG. 18 , the content information list  131   c  includes a piece of content related information  132 , for example. The content information included in the content related information  132  includes a content provider ID ( 133 ) “01”, a content ID ( 134 ) “0001”, genre information  135  “action”, a quality level  136  “SD”, and a title key  137  “XXXX”. The revocation information  138  does not include anything. The authentication condition information  139  indicates “confirm connection once every three times”, and the usage condition information  140  indicates “playable up to 10 times”. Note that the title key  137  “XXXX” does not indicate that the title key is actually “XXXX”. From the perspective of content protection, it is not appropriate to display the title key as is, and therefore a value of “XXXX” is displayed. 
     In the content information list  131   c  shown in  FIG. 18 , the revocation information is not set within any of the pieces of content related information. 
     (2) Communications Unit  101   
     The communications unit  101  receives the root public key  232 , the revocation file  242 , the key distribution device private key  251 , and the key distribution device certificate  252  from the key issuing device  200  over the network  20 . Next, the communications unit  101  writes the received root public key  232  in the root public key storage unit  106 . The communications unit  101  also writes the received revocation file  242  in the revocation file storage unit  103 . Finally, the communications unit  101  writes the received key distribution device private key  251  and key distribution device certificate  252  in the private key certificate storage unit  104 . 
     The communications unit  101  receives the content information registration data  541  from the content production device  500  over the network  20 . Next, the communications unit  101  outputs the received registration data  541  to the update unit  110 . 
     The communications unit  101  also receives a content information transmission request from the content terminal device  300  over the network  20 . Next, the communications unit  101  outputs the content information transmission request to the control unit  112 . 
     (3) Update Unit  110   
     The update unit  110  receives the registration data  541  from the communications unit  101 . Upon receiving the registration data  541 , the update unit  110  outputs the received registration data  541  to the verification unit  108  and instructs the verification unit  108  to verify the signature data. The update unit  110  receives the verification results from the verification unit  108 . When the verification results indicate that verification failed, the update unit  110  does not use the registration data  541 . Accordingly, the registration data  541  is not processed in this case. On the other hand, when the verification results indicate that verification succeeded, or when the verification results indicate that verification of the signature data was not performed, the update unit  110  updates the content information list  131   c  stored in the content information list storage unit  111  using the received registration data  541 . 
     The update unit  110  updates the content information list  131   c  as follows. 
     The update unit  110  checks whether content related information containing the same content ID as the content ID included in the registration data  541  is included in the content information list  131   c.    
     (a) If content related information including the same content ID as the content ID included in the registration data  541  is included in the content information list  131   c , the update unit  110  adds the other items included in the registration data  541  to the content related information, or overwrites the items in the content related information with the other items included in the registration data  541 . 
     For example, when revocation information is included in the registration data  541 , the update unit  110  adds the revocation information included in the registration data  541  to the content related information, or overwrites the revocation information in the content related information with the revocation information included in the registration data  541 . The same is true for other items in the registration data  541 . If the content related information already includes an item that is the same as an item included in the registration data  541 , it is not necessary to overwrite the item in the content related information. 
     (b) If content related information including the same content ID as the content ID included in the registration data  541  is not included in the content information list  131   c , the update unit  110  generates content related information including the items included in the registration data  541 , and adds the generated content related information to the content information list  131   c.    
     Content Information List  131   a    
       FIG. 19  shows a content information list  131   a  as an example of a content information list updated in the above way. In the content information list  131   a , the revocation information  138  in the content related information  132  shown in  FIG. 18  is updated to revocation information  138   a  in the content related information  132   a . The revocation information  138   a  includes “terminal device ID: 0005, terminal device ID: 0006”. 
     The difference between the content information list  131   a  shown in  FIG. 19  and the content information list  131   c  is that “terminal device ID: 0005” and “terminal device ID: 0006” have been added to the content related information  132  as revocation information. As shown in this example, the content production device  500  identifies a content ID, allowing for addition of revocation information to a particular content. 
     Content Information List  131   b    
       FIG. 20  shows a content information list  131   b  yielded by further updating the content information list  131   a . In the content information list  131   b , the content related information  132   b  and content related information  132   c  have been updated. 
     The content information list  131   b  is yielded by updating the content information list  131   a  using the registration data  541   f  shown in  FIG. 14 . 
     The difference from the content information list  131   a  is the addition, to both the content related information  132   b  and the content related information  132   c , of “terminal device ID: 0003” and “terminal device ID: 0004” as revocation information. As shown in this example, revocation information can be added to a plurality of pieces of content related information by indicating both the content provider ID and the quality level. Here, a content provider ID of “01” and a quality level of “HD” are indicated, thereby adding revocation information of “terminal device ID: 0003” and “terminal device ID: 0004” to both the content related information  132   b  and the content related information  132   c.    
     (4) Verification Unit  108   
     The verification unit  108  receives the registration data  541  from the update unit  110 . Upon receiving the registration data  541 , the verification unit  108  determines whether the revocation approval flag is included in the registration data  541 . When the revocation approval flag is not included, the verification unit  108  does nothing with the registration data  541  and simply outputs, to the update unit  110 , verification results indicating that the signature data was not verified. 
     When the revocation approval flag is included, the verification unit  108  determines whether the revocation approval flag is “ON”. 
     When the revocation approval flag is “OFF”, the verification unit  108  does nothing with the registration data  541  and outputs, to the update unit  110 , verification results indicating that the signature data was not verified. 
     On the other hand, when the revocation approval flag is “ON”, the verification unit  108  extracts data other than the signature data from the registration data  541  and then extracts the signature data. The verification unit  108  also reads the root public key  232  from the root public key storage unit  106 . Next, the verification unit  108  verifies the digital signature by applying a signature verification algorithm V 1  to the data other than the signature data and the verification data in the registration data  541 , using the read root public key  232 . The verification unit  108  generates verification results and outputs the verification results to the update unit  110 . The verification results indicate whether verification of the digital signature succeeded or failed. 
     (5) Content Information Generation Unit  109   
     The content information generation unit  109  receives an instruction to generate content information from the control unit  112 . Upon receiving the instruction to generate content information, the content information generation unit  109  extracts the content ID from the instruction. 
     The content information generation unit  109  searches for the extracted content ID within the content information list  131   c  stored in the content information list storage unit  111 . In other words, the content information generation unit  109  determines whether content related information including the extracted content ID is located in the content information list  131   c . When not finding the extracted content ID, the content information generation unit  109  generates a message indicating that the extracted content ID was not found. The content information generation unit  109  then transmits the generated message to the other device and suspends subsequent processing. 
     On the other hand, when finding the extracted content ID, the content information generation unit  109  performs the following processing. 
     Generation of Individual Revocation List  141   
     When finding the extracted content ID, the content information generation unit  109  performs the following processing to generate an individual revocation list  141 , an example of which is shown in  FIG. 21 . 
     The content information generation unit  109  initializes the individual revocation list  141 . In this state, the individual revocation list  141  contains nothing. 
     Next, the content information generation unit  109  repeats steps (a) through (e) for the content related information in the content information list  131   c.    
     (a) Read the content related information. 
     (b) Attempt to extract revocation information from the read content related information. 
     (c) When revocation information exists, generate an entry ID. The entry ID is generated by storing the most recently generated entry ID and incrementing the stored entry ID by “1”. 
     (d) Generate individual revocation information including the generated entry ID and the revocation information. 
     (e) Add the generated individual revocation information to the individual revocation list  141 . 
     Generation of Encrypted Content Information 
     The content information generation unit  109  reads the content related information that includes the extracted content ID from the content information list  131   c . Next, the content information generation unit  109  extracts the content information, the authentication condition information, and the usage condition information from the read content related information. 
     As shown in  FIG. 21 , the content information generation unit  109  generates new content information  161  by including the extracted authentication condition information in the extracted content information. The content information generation unit  109  also extracts the entry ID corresponding to the extracted content ID from the individual revocation list  141  and generates new usage condition information  162  by including the extracted entry ID in the usage condition information, as shown in  FIG. 21 . 
     Next, the content information generation unit  109  reads the key distribution device private key  251  from the private key certificate storage unit  104 . As shown in  FIG. 21 , the content information generation unit  109  then generates a concatenated value  180  by concatenating the content information  161 , the usage condition information  162 , and the individual revocation list  141 . Next, the content information generation unit  109  generates signature data  181  by applying a digital signature with the signature generation algorithm S 1  to the concatenated value  180  using the key distribution device private key  251 . 
     The content information generation unit  109  then outputs the concatenated value  180  and the signature data  181  to the encryption/decryption unit  107 . Next, the content information generation unit  109  instructs the encryption/decryption unit  107  to encrypt the concatenated value  180  and the signature data  181  and transmit the results to the recording medium device  600 . 
     (6) Mutual Authentication Unit  105   
     As shown below, the mutual authentication unit  105  performs mutual authentication with the recording medium device  600  (or with the terminal device  300 ) and shares the same shared key with the recording medium device  600  (or with the terminal device  300 ). 
     As shown in  FIG. 22 , the mutual authentication unit  105  includes a random number generation unit A 11 , a random number comparison unit A 12 , a decryption unit A 13 , an encryption unit A 14 , a verification unit A 15 , and a key sharing unit A 16 . 
     The random number generation unit A 10  generates a random number R 1  and outputs the generated random number R 1  to the random number comparison unit A 12 . The random number generation unit A 11  also transmits the generated random number R 1  to the other device with which mutual authentication is being performed (here, the recording medium device  600  or the terminal device  300 ). 
     The decryption unit A 13  receives an encrypted random number E 3 (R 1 ) from the other device with which mutual authentication is being performed. Next, the decryption unit A 13  decrypts the received encrypted random number E 3 (R 1 ) by applying a decryption algorithm D 3 , thereby generating decrypted text R 1 ′, which equals D 3 (E 3 (R 1 )). The decryption unit A 13  then outputs the generated decrypted text R 1 ′ to the random number comparison unit A 12 . 
     The decryption algorithm D 3  is a decryption algorithm that uses a secret key cryptosystem. An example of the decryption algorithm D 3  is AES. E 3 (A) represents an encrypted text generated by applying an encryption algorithm E 3  to a plaintext A. D 3 (B) represents a decrypted text generated by applying the decryption algorithm D 3  to the encrypted text B. 
     The random number comparison unit A 12  receives the random number R 1  and the decrypted text R 1 ′. The random number comparison unit A 12  then compares the random number R 1  and the decrypted text R 1 ′. If the random number R 1  and the decrypted text R 1 ′ match, the mutual authentication unit  105  determines that the other device is authentic. If the random number R 1  and the decrypted text R 1 ′ do not match, the mutual authentication unit  105  determines that the other device with which mutual authentication is being performed is not authentic. 
     The encryption unit A 14  receives the random number R 2  from the other device. Upon receiving the random number R 2 , the encryption unit A 14  encrypts the random number R 2  by applying an encryption algorithm E 4  to generate an encrypted random number E 4 (R 2 ) and transmits the generated encrypted random number E 4 (R 2 ) to the other device. 
     The encryption algorithm E 4  is an encryption algorithm that uses a secret key cryptosystem. An example of the encryption algorithm E 4  is AES. E 4 (A) represents an encrypted text generated by applying the encryption algorithm E 4  to a plaintext A. 
     When mutual authentication is successful, the verification unit A 15  reads the key distribution device certificate  252  from the private key certificate storage unit  104 . Next, the verification unit A 15  transmits the read key distribution device certificate  252  to the other device. From the other device, the verification unit A 15  receives the public key certificate of the other device. When the other device is the recording medium device  600  (or the terminal device  300 ), the public key certificate is the recording medium device certificate  272  (or the terminal device certificate  262 ). 
     The verification unit A 15  then reads the root public key  232  from the root public key storage unit  106  and verifies the public key certificate of the other device using the read root public key  232 . 
     When verification fails, the following processing is not performed. When verification is successful, the key sharing unit A 16  calculates a shared key k by performing key sharing processing. 
     When mutual authentication with the other device is successful, the mutual authentication unit  105  outputs verification results to the control unit  112  indicating that mutual authentication was successful. 
     (7) Revocation Judgment Unit  102   
     The revocation judgment unit  102  receives the identifying information of the other device with which mutual authentication is performed from the mutual authentication unit  105 . The identifying information of the other device is included in the public key certificate of the other device. Here, the other device with which mutual authentication is being performed is the recording medium device  600  or the terminal device  300 . The identifying information of the other device is either the terminal device ID identifying the terminal device  300  or the recording medium device ID identifying the recording medium device  600 . The identifying information of the other device may instead be the model ID of the terminal device  300  or the recording medium device  600 . Alternatively, the identifying information of the other device may be identifying information identifying the public key certificate allocated to the device. 
     The revocation judgment unit  102  judges whether the identifying information of the other device is included in the revocation file  242  stored in the revocation file storage unit  103 . 
     When judging that the identifying information of the other device is included in the revocation file  242  stored in the revocation file storage unit  103 , the revocation judgment unit  102  considers the other device to be malicious, generates a message indicating that the other device is malicious, and outputs the generated message to the control unit  112 , which suspends processing and transmission with the other device. 
     (8) Encryption/Decryption Unit  107   
     When the mutual authentication unit  105  successfully performs mutual authentication with the other device, the encryption/decryption unit  107  receives the shared key k from the mutual authentication unit  105 . 
     When transmitting plaintext data to the other device, the encryption/decryption unit  107  encrypts the plaintext data to generate encrypted data by applying an encryption algorithm E 2  using the shared key k. Next, the encryption/decryption unit  107  outputs the encrypted data to the communications unit  101  and instructs the communications unit  101  to transmit the encrypted data to the other device. 
     When receiving encrypted data from the other device, the encryption/decryption unit  107  decrypts the encrypted data to generate the original plaintext data by applying a decryption algorithm D 2  using the shared key k. Next, the encryption/decryption unit  107  outputs the plaintext data to a constituent element of the key distribution device  100 . 
     The encryption algorithm E 2  is an encryption algorithm that uses a secret key cryptosystem. An example of the encryption algorithm E 2  is AES. The decryption algorithm D 2  is a decryption algorithm that uses a secret key cryptosystem. An example of the decryption algorithm D 2  is AES. The decryption algorithm D 2  decrypts encrypted text that was encrypted with the encryption algorithm E 2 . 
     The encryption/decryption unit  107  can thus protect data over the communications channel. 
     For example, the encryption/decryption unit  107  receives the concatenated value  180  and the signature data  181  from the content information generation unit  109 . Next, the encryption/decryption unit  107  encrypts the concatenated value  180  and the signature data  181  to generate an encrypted content information concatenated value by applying the encryption algorithm E 2  using the shared key k. The encryption/decryption unit  107  then instructs the communications unit  101  to transmit the generated encrypted content information concatenated value to the recording medium device  600 . 
     (9) Control Unit  112   
     The control unit  112  receives a content information transmission request from the content terminal device  300  over the network  20  via the communications unit  101 . Upon receiving the content information transmission request, the control unit  112  instructs the mutual authentication unit  105  to perform mutual authentication with the recording medium device  600 . When mutual authentication is successful, the control unit  112  instructs the revocation judgment unit  102  to confirm whether the terminal device  300  or the recording medium device  600  has been revoked. 
     The control unit  112  receives authentication results, indicating success of mutual authentication with the other device, from the mutual authentication unit  105 . Upon receiving the authentication results, the control unit  112  instructs the content information generation unit  109  to generate content information. 
     The control unit  112  controls each of the constituent elements in the key distribution device  100 . 
     (10) Display Unit  113   
     The display unit  113  is controlled by the control unit  112  to display information. 
     2.6 Detailed Configuration of Recording Medium Device  600   
     As shown in  FIG. 23 , the recording medium device  600  includes a controller  601 , a memory  602 , and an I/O unit  603 . 
     The controller  601  is tamper resistant and includes a mutual authentication unit  604 , a revocation judgment unit  605 , an encryption/decryption unit  606 , a verification unit  607 , and a control unit  608 . The memory  602  includes a private key certificate storage unit  609 , a root public key storage unit  610 , a title key storage unit  611 , a content information storage unit  612 , a usage condition information storage unit  613 , a revocation file storage unit  614 , and a content storage unit  615 . 
     The controller  601  is a computer system composed of a CPU, memory, an I/O unit, and the like. The mutual authentication unit  604 , the revocation judgment unit  605 , the encryption/decryption unit  606 , the verification unit  607 , and the control unit  608  are each constituted by the CPU and computer programs running on the CPU. Of course, the present invention is not limited to the above structure. For example, the mutual authentication unit  604 , the revocation judgment unit  605 , the encryption/decryption unit  606 , and the verification unit  607  may alternatively be constituted by dedicated hardware circuits within the controller  601 . 
     (1) Memory  602   
     Private Key Certificate Storage Unit  609   
     The private key certificate storage unit  906  is provided with a region for storing the recording medium device private key  271  and the recording medium device certificate  272 . 
     The recording medium device private key  271  and the recording medium device certificate  272  are written into the private key certificate storage unit  609  by the manufacturing device (not shown in the figures) that manufacturers the recording medium device  600 . 
     Root Public Key Storage Unit  610   
     The root public key storage unit  610  is provided with a region for storing the root public key  232 . The root public key  232  is written into the root public key storage unit  610  by the manufacturing device (not shown in the figures) that manufacturers the recording medium device  600 . 
     Title Key Storage Unit  611   
     The title key storage unit  611  is provided with a region for storing a title key  175 . The title key  175  is received from the key distribution device  100 . 
     Content Information Storage Unit  612   
     The content information storage unit  612  is provided with a region for storing the content information  161 . The content information  161  is received from the key distribution device  100 . 
     The content information storage unit  612  receives content information from the key distribution device  100 . When signature verification is successful, the content information storage unit  612  stores the content information or uses the content information for updating. 
     Usage Condition Information Storage Unit  613   
     The usage condition information storage unit  613  is provided with a region for storing the usage condition information  162 . The usage condition information  162  is received from the key distribution device  100 . 
     Revocation File Storage Unit  614   
     The revocation file storage unit  614  is provided with a region for storing the individual revocation list  141 . The individual revocation list  141  is received from the key distribution device  100 . 
     When signature verification is successful upon receipt of the individual revocation list  141  from the key distribution device  100 , the revocation file of the individual revocation list  141  in the revocation file storage unit  614  is updated, or the individual revocation list  141  is stored in the revocation file storage unit  614 . 
     Content Storage Unit  615   
     The content storage unit  615  receives a content from the terminal device  300  and stores the content. The content storage unit  615  also receives a read request from the terminal device  300  and transmits the content to the terminal device  300 . 
     (2) I/O Unit  603   
     The I/O unit  603  receives an acquisition request from the terminal device  300  and transmits the title key to the terminal device  300 . 
     The I/O unit  603  receives the encrypted content information concatenated value and outputs the received encrypted content information concatenated value to the encryption/decryption unit  606 . 
     (3) Verification Unit  607   
     The verification unit  607  receives the concatenated value  180  and the signature data  181  from the encryption/decryption unit  606 . Upon receiving the concatenated value  180  and the signature data  181 , the verification unit  607  verifies the digital signature by applying a signature verification algorithm V 1  to the concatenated value  180  and the signature data  181  using the key distribution device public key  254  included in the key distribution device certificate  252 . 
     When verification fails, the verification unit  607  generates a message indicating that verification failed, and processing terminates. 
     When verification is successful, the verification unit  607  generates a message indicating that verification succeeded. Next, the verification unit  607  extracts the title key from the concatenated value  180  and writes the extracted title key in the title key storage unit  611 . The verification unit  607  also extracts content information other than the title key from the concatenated value  180  and writes the extracted content information in the content information storage unit  612 . Furthermore, the verification unit  607  extracts the usage condition information from the concatenated value  180  and writes the extracted usage condition information in the usage condition information storage unit  613 . Finally, the verification unit  607  then extracts the individual revocation list from the concatenated value  180  and writes the extracted individual revocation list in the revocation file storage unit  614 . 
     (4) Mutual Authentication Unit  604   
     The mutual authentication unit  604  performs mutual authentication with the key distribution device  100  (or with the content distribution device  400 ) and shares a shared key with the key distribution device  100  (or with the content distribution device  400 ). 
     As shown in  FIG. 22 , the mutual authentication unit  604  includes an encryption unit B 11 , a random number generation unit B 12 , a decryption unit B 13 , a random number comparison unit B 14 , a verification unit B 15 , and a key sharing unit B 16 . 
     The encryption unit B 11  receives the random number R 1  from the other device (key distribution device  100 ). Upon receiving the random number R 1 , the encryption unit B 11  encrypts the random number R 1  by applying the encryption algorithm E 3  to generate the encrypted random number E 3 (R 1 ) and transmits the generated encrypted random number E 3 (R 1 ) to the other device. 
     The encryption algorithm E 3  is an encryption algorithm that uses a secret key cryptosystem. An example of the encryption algorithm E 3  is AES. E 3 (A) represents an encrypted text generated by applying the encryption algorithm E 3  to a plaintext A. 
     The random number generation unit B 10  generates a random number R 2 . The random number generation unit B 10  then outputs the generated random number R 2  to the random number comparison unit B 14 . The random number generation unit B 10  also transmits the generated random number R 2  to the other device with which mutual authentication is being performed (the key distribution device  100 ). 
     The decryption unit B 13  receives the encrypted random number E 4 (R 2 ) from the other device with which mutual authentication is being performed. Next, the decryption unit B 13  decrypts the received encrypted random number E 4 (R 2 ) by applying a decryption algorithm D 4 , thereby generating decrypted text R 2 ′, which equals D 4 (E 4 (R 2 )). The decryption unit B 13  then outputs the generated decrypted text R 2 ′ to the random number comparison unit B 14 . 
     The decryption algorithm D 4  is an encryption algorithm that uses a secret key cryptosystem. An example of the decryption algorithm D 4  is AES. E 4 (A) represents a decrypted text generated by applying the decryption algorithm D 4  to the encrypted text A. D 4 (B) represents a decrypted text generated by applying the decryption algorithm D 4  to the encrypted text B. 
     The random number comparison unit B 14  receives the random number R 2  and the decrypted text R 2 ′. The random number comparison unit B 14  then compares the random number R 2  and the decrypted text R 2 ′. If the random number R 2  and the decrypted text R 2 ′ match, the mutual authentication unit  604  determines that the other device is authentic. If the random number R 2  and the decrypted text R 2 ′ do not match, the mutual authentication unit  604  determines that the other device with which mutual authentication is being performed is not authentic. 
     When mutual authentication is successful, the verification unit B 15  reads the recording medium device certificate  272  from the private key certificate storage unit  609 . Next, the verification unit B 15  transmits the read recording medium device certificate  272  to the other device. From the other device, the verification unit B 15  receives the public key certificate of the other device. When the other device is the key distribution device  100 , the public key certificate is the key distribution device certificate  252 . The verification unit B 15  then reads the root public key  232  from the root public key storage unit  610  and verifies the public key certificate of the other device using the read root public key  232 . 
     When verification fails, the following processing is not performed. When verification is successful, the key sharing unit B 16  calculates a shared key k′ by performing key sharing processing. 
     When mutual authentication with the other device is successful, the mutual authentication unit  604  outputs verification results to the control unit  608  indicating that mutual authentication was successful. 
     (5) Revocation Judgment Unit  605   
     The revocation judgment unit  605  receives the identifying information of the other device with which mutual authentication is performed from the mutual authentication unit  604 . The identifying information of the other device is included in the public key certificate of the other device. In this case, the other device with which mutual authentication is performed is the terminal device  300 . The identifying information of the other device is the terminal device ID identifying the terminal device  300 . The identifying information of the other device may instead be the model ID of the terminal device  300 . Alternatively, the identifying information of the other device may be identifying information identifying the public key certificate allocated to the device. 
     The revocation judgment unit  605  judges whether the identifying information of the other device is included in the individual revocation information that (i) corresponds to the content ID identifying the content that is to be played back and (ii) is listed in the individual revocation list  141  stored in the revocation file storage unit  103 . 
     When the identifying information of the other device is included in the individual revocation information, the revocation judgment unit  605  considers the terminal device  300  to be malicious and generates a message indicating that the terminal device  300  is malicious. Next, the revocation judgment unit  605  outputs the generated message to the control unit  112 , which suspends processing and transmission with the terminal device  300 . 
     (6) Encryption/Decryption Unit  606   
     When data is transmitted during communication for mutual authentication between the recording medium device  600  and the key distribution device  100 , or between the recording medium device  600  and the terminal device  300 , the encryption/decryption unit  606  encrypts the data using the shared key k′ generated by the mutual authentication unit  604 . When data is received, the encryption/decryption unit  606  decrypts the data using the shared key k′. Data is thus protected over the communications channel. 
     For example, the encryption/decryption unit  606  receives the encrypted content information concatenated value from the I/O unit  603 . Upon receiving the encrypted content information concatenated value, the encryption/decryption unit  606  decrypts the encrypted content information concatenated value by applying the decryption algorithm D 2  using the shared key k′. As a result, the encryption/decryption unit  606  generates the concatenated value  180  and the signature data  181  shown in  FIG. 21 . Next, the encryption/decryption unit  606  outputs the concatenated value  180  and the signature data  181  to the verification unit  607 . 
     2.7 Detailed Configuration of Terminal Device  300   
     As shown in  FIG. 25 , the terminal device  300  includes a private key certificate storage unit  301 , root public key storage unit  302 , revocation judgment unit  303 , a mutual authentication unit  304 , an I/O unit  305 , a revocation file storage unit  306 , a extraction unit  307 , an encryption/decryption unit  308 , a communications unit  309 , a content playback unit  310 , a content decryption unit  311 , a control unit  312 , an input unit  313 , and a display unit  314 . 
     The terminal device  300  is a computer system composed of a CPU, memory, a secondary storage unit, a network connection unit, a memory card connection unit, and the like. The private key certificate storage unit  301 , the root public key storage unit  302 , and the revocation file storage unit  306  are each constituted by the secondary storage unit. The revocation judgment unit  303 , the mutual authentication unit  304 , the extraction unit  307 , the encryption/decryption unit  308 , the content playback unit  310 , the content decryption unit  311 , and the control unit  312  are each constituted by the CPU and computer programs running on the CPU. The communications unit  210  is constituted by the network connection unit. Finally, the I/O unit  305  is constituted by the memory card connection unit. 
     Of course, the present invention is not limited to the above structure. For example, the mutual authentication unit  304 , the encryption/decryption unit  308 , the content playback unit  310 , and the content decryption unit  311  may alternatively be constituted by dedicated hardware circuits. 
     (1) Private Key Certificate Storage Unit  301 , Root Public Key Storage Unit  302 , and Revocation File Storage Unit  306   
     Private Key Certificate Storage Unit  301   
     The private key certificate storage unit  301  is provided with a region for storing the terminal device private key  261  and the terminal device certificate  262 . The terminal device private key  261  and the terminal device certificate  262  are written into the private key certificate storage unit  301  by the manufacturing device that manufacturers the terminal device  300 . 
     Root Public Key Storage Unit  302   
     The root public key storage unit  302  is provided with a region for storing the root public key  232 . The root public key  232  is written into the root public key storage unit  302  by the manufacturing device (not shown in the figures) that manufacturers the terminal device  300 . 
     Revocation File Storage Unit  306   
     The revocation file storage unit  306  is provided with a region for storing the revocation file  242 . 
     The revocation file  242  is written in the revocation file storage unit  306  when verification of the signature data attached to the revocation file  242  is successful. 
     (2) Mutual Authentication Unit  304   
     The mutual authentication unit  304  performs mutual authentication with the key distribution device  100  or with the recording medium device  600  and shares a shared key with the key distribution device  100  or with the recording medium device  600 . Note that the mutual authentication unit  304  has the same configuration as the mutual authentication units  105  and  604  shown in  FIG. 22 , and thus a description thereof is omitted. 
     (3) Revocation Judgment Unit  303   
     The revocation judgment unit  303  judges whether the ID of the recording medium device  600  specified during mutual authentication, i.e. the recording medium device ID, matches information listed in the revocation file stored in the revocation file storage unit  306 . If so, the revocation judgment unit  303  considers the recording medium device  600  that is attempting to communicate to be malicious and suspends processing and communication by the mutual authentication unit  304 . If the IDs do not match, processing continues. 
     (4) Encryption/Decryption Unit  308   
     During communication between the terminal device  300  and the key distribution device  100 , or between the terminal device  300  and the recording medium device  600 , the encryption/decryption unit  308  encrypts data upon transmission and decrypts data upon reception using the shared key shared by the mutual authentication unit  304 . Data is thus protected over the communications channel. 
     The encryption/decryption unit  308  receives the revocation file in an encrypted state from the communications unit  309 . Upon receiving the revocation file in an encrypted state, the encryption/decryption unit  308  generates the revocation file by decrypting the revocation file in an encrypted state. Next, the encryption/decryption unit  308  outputs the generated revocation file to the extraction unit  307 . 
     (5) Extraction Unit  307   
     The extraction unit  307  receives the title key from the recording medium device  600  via the encryption/decryption unit  340 . 
     The extraction unit  307  receives the revocation file from the key distribution device  100  over the network  20  via the communications unit  309  and the encryption/decryption unit  308 . The extraction unit  307  performs signature verification using the signature data included in the received revocation file. When verification is successful, the extraction unit  307  writes the received revocation file in the revocation file storage unit  306 . When verification fails, the extraction unit  307  prohibits the writing of the received revocation file in the revocation file storage unit  306 . 
     (6) I/O Unit  305   
     The I/O unit  305  reads the content from the recording medium device  600 . The I/O unit  305  then outputs the read content to the content decryption unit  311 . 
     The I/O unit  305  receives the content from the communications unit  309 . Upon receiving the content, the I/O unit  305  writes the received content in the recording medium device  600 . 
     (7) Content Decryption Unit  311   
     The content decryption unit  311  receives the content from the I/O unit  305 . The content decryption unit  311  also receives the title key from the extraction unit  307 . Upon receiving the content and the title key, the content decryption unit  311  decrypts the content by applying the decryption algorithm D 1  using the title key. As a result, the content decryption unit  311  generates decrypted content and outputs the decrypted content to the content playback unit  310 . 
     (8) Content Playback Unit  310   
     The content playback unit  310  receives the decrypted content from the content decryption unit  311 . Upon receiving the decrypted content, the content playback unit  310  plays the decrypted content back, outputting the result to the display unit  314 . Note that alternatively, the content playback unit  310  may direct output to a television receiver or to a monitor or other form of display device connected to the terminal device  300 . 
     (9) Communications Unit  309   
     The communications unit  309  receives a content from the content distribution device  400 . 
     The communications unit  309  receives the revocation file from the key distribution device  100  in an encrypted state. Upon receiving the revocation file in an encrypted state, the communications unit  309  outputs the revocation file in an encrypted state to the encryption/decryption unit  340 . 
     (10) Control Unit  312   
     The control unit  312  controls each of the constituent elements in the terminal device  300 . 
     (11) Input Unit  313  and Display Unit  314   
     The input unit  313  receives input of operations and data from the user. Next, the input unit  313  outputs operation information indicating the received operations to the control unit  312 . The input unit  313  also outputs data for which input has been received to the control unit  312 . 
     The display unit  314  is controlled by the control unit  312  to display information. 
     2.8 Operations of Content Management System  10   a    
     The following describes operations of the content management system  10   a.    
     (1) Key Issuing Operations 
     The following describes key issuing operations within the content management system  10   a  with reference to the sequence diagrams in  FIGS. 26 and 27 . 
     The key pair generation unit  201  in the key issuing device  200  generates a root key pair composed of the root private key  231  and the root public key  232 . Next, the key pair generation unit  201  writes the generated root key pair in the root key pair storage unit  202  (step S 101 ). 
     Next, the key pair generation unit  201  generates a key distribution device key pair composed of the key distribution device private key  251  and the key distribution device public key  254 . The key pair generation unit  201  then writes the key distribution device key pair in the private key certificate storage unit  204 . The certificate generation unit  203  generates the key distribution device certificate  252  and writes the key distribution device certificate  252  in the private key certificate storage unit  204  (step S 102 ). 
     Next, the key pair generation unit  201  generates a terminal device key pair composed of the terminal device private key  261  and the terminal device public key  264 . The key pair generation unit  201  then writes the terminal device key pair in the private key certificate storage unit  204 . The certificate generation unit  203  generates the terminal device certificate  262  and writes the terminal device certificate  262  in the private key certificate storage unit  204  (step S 103 ). 
     Next, the key pair generation unit  201  generates a recording medium device key pair composed of the recording medium device private key  271  and the recording medium device public key  274 . The key pair generation unit  201  then writes the recording medium device key pair in the private key certificate storage unit  204 . The certificate generation unit  203  generates the recording medium device certificate  272  and writes the recording medium device certificate  272  in the private key certificate storage unit  204  (step S 104 ). 
     Next, the key pair generation unit  201  generates a production device key pair composed of the production device private key  281  and the production device public key  284 . The key pair generation unit  201  then writes the production device key pair in the private key certificate storage unit  204 . The certificate generation unit  203  generates the production device certificate  282  and writes the production device certificate  282  in the private key certificate storage unit  204  (step S 105 ). 
     By user operation, the input unit  205  receives input of revocation data, i.e. a terminal device ID that identifies a revoked terminal device and a recording medium device ID that identifies a revoked recording medium device (step S 106 ). 
     The revocation file generation unit  211  generates the revocation file  242  from the revocation data  241  stored in the revocation data storage unit  206 . The revocation file generation unit  211  then writes the generated revocation file  242  in the revocation file storage unit  208  (step S 107 ). 
     The communications unit  210  transmits the root public key  232 , the revocation file  242 , the key distribution device private key  251 , and the key distribution device certificate  252  to the key distribution device  100  (step S 108 ). The communications unit  101  in the key distribution device  100  writes the root public key  232  in the root public key storage unit  106  (step S 109 ), writes the revocation file  242  in the revocation file storage unit  103  (step S 110 ), and writes the key distribution device private key  251  and the key distribution device certificate  252  in the private key certificate storage unit  104  (step S 111 ). 
     The manufacturing device (not shown in the figures) that manufactures the terminal device  300  receives the terminal device private key  261  and the terminal device certificate  262  from the key issuing device  200  (step S 112 ) and writes the terminal device private key  261  and the terminal device certificate  262  in the private key certificate storage unit  301  in the terminal device  300  (step S 113 ). 
     The manufacturing device (not shown in the figures) that manufactures the recording medium device  600  receives the recording medium device private key  271  and the recording medium device certificate  272  from the key issuing device  200  (step S 114 ) and writes the recording medium device private key  271  and the recording medium device certificate  272  in the private key certificate storage unit  609  in the recording medium device  600  (step S 115 ). 
     The communications unit  210  in the key issuing device  200  transmits the production device private key  281  and the production device certificate  282  to the content production device  500  (step S 116 ). 
     The communications unit  515  in the content production device  500  writes the production device private key  281  and the production device certificate  282  in the private key certificate storage unit  509  (step S 117 ). 
     (2) Operations for Content Production and Content Registration 
     The following describes operations for content production and content registration within the content management system  10   a  with reference to the sequence diagrams in  FIGS. 28 and 29 . 
     The content production device  500  acquires material such as video and audio for a movie or the like and stores the acquired material in the material storage unit  501  (step S 131 ). 
     By user operation, the editing unit  502  reads the material stored in the material storage unit  501  and edits the read material to generate the plaintext content  531  (step S 132 ). 
     The title key generation unit  507  generates the title key  533  and writes the generated title key  533  in the title key storage unit  508  (step S 133 ). 
     The encryption unit  503  encrypts the plaintext content  531  using the title key  533  to generate the content  532  and writes the content  532  in the content storage unit  504  (step S 134 ). 
     The content registration request unit  505  generates the content registration request (step S 135 ) and then reads the content  532  from the content storage unit  504  (step S 136 ). 
     The communications unit  515  transmits the content registration request and the content  532  to the content distribution device  400  over the network  20  (step S 137 ). 
     The communications unit  402  in the content distribution device  400  receives the content registration request and the content  532  from the content production device  500  over the network  20  (step S 137 ). Next, the communications unit  402  writes the received content  532  in the content storage unit  403  (step S 138 ). 
     Subsequently, the input unit  513  in the content production device  500  receives input of a content provider ID, a content ID, a quality level, genre information, usage condition information, authentication condition information, one or more revoked device IDs, and revocation approval and generates the content information registration data  541  that includes the content provider ID, the content ID, the quality level, the genre information, the usage condition information, the authentication condition information, the one or more revoked device IDs, and a revocation approval flag (step S 139 ). 
     The content information registration request unit  511  adds the title key  533  to the registration data  541  (step S 140 ). 
     The signature unit  510  generates signature data by applying a digital signature to the registration data  541  using the production device private key  281 . Next, the signature unit  510  adds the generated signature data to the registration data  541  (step S 141 ). 
     The content information registration request unit  511  generates a registration request to register registration data for the content information (step S 142 ). Next, the content information registration request unit  511  reads the registration data  541  from the registration data storage unit  512  (step S 143 ), and the communications unit  515  transmits the registration request and the registration data  541  to the key distribution device  100  (step S 144 ). Processing then terminates. 
     When the revocation approval flag is not included in the registration data  541 , or the revocation approval flag is “OFF” (step S 145 ), the verification unit  108  in the key distribution device  100  shifts control to step S 150 . 
     On the other hand, when the revocation approval flag is “ON” (step S 145 ), the verification unit  108  verifies the signature data in the registration data  541  (step S 146 ). When verification fails (“failure” in step S 147 ), the verification unit  108  generates a message indicating failure of verification (step S 148 ) and displays the generated message (step S 149 ). Processing then terminates. 
     On the other hand, when verification is successful (“success” in step S 147 ), or when the verification results indicate that verification of the signature data was not performed (“OFF” or “none” in step S 145 ), the update unit  110  updates the content information list  131   c  stored in the content information list storage unit  111  using the registration data  541  (step S 150 ). Processing then terminates. 
     (3) Content Distribution Operations 
     The following describes content distribution operations within the content management system  10   a  with reference to the sequence diagrams in  FIGS. 30 through 34 . 
     The input unit  313  in the terminal device  300  receives a content ID identifying a content and an operation indicating acquisition of a content from the user (step S 161 ). 
     Next, the mutual authentication unit  304  in the terminal device  300  and the mutual authentication unit  404  in the content distribution device  400  perform mutual authentication and key sharing (step S 162 ). The mutual authentication and key sharing between the terminal device  300  and the content distribution device  400  is the same as the mutual authentication and key sharing between the key distribution device  100  and the recording medium device  600  described below, and thus a description thereof is omitted. 
     When authentication by the mutual authentication unit  304  fails (“failure” in step S 163 ), the control unit  312  generates a message indicating failure of authentication (step S 164 ), the display unit  314  displays the generated message (step S 165 ), and processing by the terminal device  300  terminates. 
     When authentication by the mutual authentication unit  404  fails (“failure” in step S 166 ), the control unit  401  generates a message indicating failure of authentication (step S 167 ), the display unit  405  displays the generated message (step S 168 ), and processing by the content distribution device  400  terminates. 
     When authentication by the mutual authentication unit  304  succeeds (“success” in step S 163 ), the control unit  312  generates distribution request information (step S 169 ). Next, the control unit  312  transmits the distribution request information to the content distribution device  400  over the network  20  via the communications unit  309  (step S 170 ). 
     When authentication by the mutual authentication unit  404  succeeds (“success” in step S 166 ), the control unit  401  receives the distribution request information over the network  20  via the communications unit  402  (step S 170 ). 
     The control unit  401  searches in the content storage unit  403  for the content identified by the content ID (step S 171 ). Upon not finding the content (step S 172 ; “NO”), the control unit  401  generates a message indicating that the content was not found (step S 184 ). Next, the control unit  401  transmits the generated message to the terminal device  300  over the network  20  via the communications unit  402  (step S 185 ) and then terminates processing. The display unit  405  in the terminal device  300  displays the message (step S 186 ) and then terminates processing. 
     When finding the content (step S 172 : “YES”), the mutual authentication unit  604  in the recording medium device  600  and the mutual authentication unit  404  in the content distribution device  400  perform mutual authentication and key sharing (step S 173 ). The mutual authentication and key sharing between the recording medium device  600  and the content distribution device  400  is the same as the mutual authentication and key sharing between the key distribution device  100  and the recording medium device  600  described below, and thus a description thereof is omitted. 
     When authentication by the mutual authentication unit  604  fails (“failure” in step S 176 ), the control unit  608  generates a message indicating failure of authentication (step S 177 ). Next, the control unit  608  outputs the message to the terminal device  300  via the I/O unit  603  (step S 178 ) and then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 179 ) and then terminates processing. 
     When authentication by the mutual authentication unit  404  fails (“failure” in step S 174 ), the control unit  401  generates a message indicating failure of authentication (step S 175 ). Next, the control unit  401  transmits the generated message to the terminal device  300  over the network  20  via the communications unit  402  (step S 185 ) and then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 186 ) and then terminates processing. 
     When authentication by the mutual authentication unit  404  succeeds (“success” in step S 174 ), the control unit  401  reads the content  532  from the content storage unit  403  (step S 180 ). Next, the control unit  401  transmits the read content  532  to the recording medium device  600  over the network  20  via the communications unit  402  and the terminal device  300  (steps S 181  and  182 ). 
     When authentication by the mutual authentication unit  604  succeeds (“success” in step S 176 ), the I/O unit  603  writes the received content  532  in the content storage unit  615  (step S 183 ). 
     Next, the control unit  312  in the terminal device  300  generates a content information transmission request (step S 187 ). The control unit  312  then transmits the generated content information transmission request to the key distribution device  100  over the network  20  via the communications unit  309  (step S 188 ). 
     The mutual authentication unit  604  in the recording medium device  600  and the mutual authentication unit  105  in the key distribution device  100  then perform mutual authentication and key sharing (step S 189 ). 
     When authentication by the mutual authentication unit  604  fails (“failure” in step S 190 ), the control unit  608  generates a message indicating failure of authentication (step S 191 ). Next, the control unit  608  outputs the message to the terminal device  300  via the I/O unit  603  (step S 192 ) and then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 193 ) and then terminates processing. 
     When authentication by the mutual authentication unit  105  fails (“failure” in step S 194 ), the control unit  112  generates a message indicating failure of authentication (step S 195 ), performs control for display of the generated message (step S 196 ), and then terminates processing. 
     When authentication by the mutual authentication unit  105  succeeds (“success” in step S 194 ), the revocation judgment unit  102  checks whether the terminal device ID has been revoked (step S 197 ). When the terminal device ID exists in the revocation file  242 , i.e. when the terminal device ID has been revoked (“YES” in step S 198 ), the control unit  112  generates a message indicating that the terminal device ID has been revoked (step S 199 ). Next, the control unit  112  transmits the generated message to the terminal device  300  over the network  20  via the communications unit  101  (step S 200 ). The control unit  112  then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 201 ), and the terminal device  300  then terminates processing. 
     When the terminal device ID is not located in the revocation file  242 , i.e. when the terminal device ID has not been revoked (“NO” in step S 198 ), the revocation judgment unit  102  checks whether the recording medium device ID has been revoked (step S 201 ). When the recording medium device ID is located in the revocation file  242 , i.e. when the recording medium device ID has been revoked (“YES” in step S 203 ), the control unit  112  generates a message indicating that the recording medium device ID has been revoked (step S 205 ). Next, the control unit  112  transmits the generated message to the terminal device  300  over the network  20  via the communications unit  101  (step S 205 ). The control unit  112  then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 206 ), and the terminal device  300  then terminates processing. 
     When the recording medium device ID is not located in the revocation file  242 , i.e. when the recording medium device ID has not been revoked (“NO” in step S 203 ), the content information generation unit  109  searches for the requested content related information in the content information list  131   c  stored in the content information list storage unit  111  (step S 207 ). 
     When the content related information is not located in the content information list  131   c  (“not present” in step S 208 ), the content information generation unit  109  transmits a message indicating that the content related information was not found to the terminal device  300  over the network  20  via the communications unit  101  (step S 209 ). Processing then terminates. The display unit  314  in the terminal device  300  displays the message (step S 210 ) and then terminates processing. 
     When the content related information is located in the content information list  131   c  (“present” in step S 208 ), the content information generation unit  109  generates the individual revocation list  141  (step S 211 ), reads the content related information (step S 212 ), and generates and attaches signature data (step S 213 ). The encryption/decryption unit  107  encrypts the concatenated value and the signature data (step S 214 ) and transmits the encrypted content information concatenated value to the recording medium device  600  over the network  20  via the communications unit  101  and the terminal device  300  (step S 215 ). 
     The encryption/decryption unit  606  in the recording medium device  600  decrypts the encrypted content information concatenated value (step S 216 ). 
     The verification unit  607  verifies the signature data (step S 217 ). When verification fails (“failure” in step S 218 ), the control unit  608  generates a message indicating failure (step S 219 ). Next, the control unit  608  outputs the generated message to the terminal device  300  via the I/O unit  603  (step S 220 ) and then terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 221 ) and then terminates processing. 
     When verification is successful (“success” in step S 218 ), the verification unit  607  writes the content information in the content information storage unit  612  (step S 222 ). Next, the verification unit  607  writes the title key in the title key storage unit  611  (step S 223 ). The verification unit  607  then writes the usage condition information in the usage condition information storage unit  613  (step S 224 ) and writes the individual revocation list  141  in the revocation file storage unit  614  (step S 225 ). The verification unit  607  then terminates processing. 
     (4) Mutual Authentication and Key Sharing Operations 
     The following describes mutual authentication and key sharing operations between the key distribution device  100  and the recording medium device  600  within the content management system  10   a  with reference to the sequence diagrams in  FIGS. 35 and 36 . 
     The random number generation unit A 10  generates the random number R 1  (step S 251 ). The random number generation unit A 10  then transmits the generated random number R 1  to the recording medium device  600  (step S 252 ). 
     The encryption unit B 11  receives the random number R 1  from the key distribution device  100  (step S 252 ). Next, the encryption unit B 11  encrypts the random number R 1  by applying the encryption algorithm E 3  to generate the encrypted random number E 3 (R 1 ) (step S 253 ) and transmits the generated encrypted random number E 3 (R 1 ) to the key distribution device  100  (step S 254 ). 
     The decryption unit A 13  receives the encrypted random number E 3 (R 1 ) from the recording medium device  600  (step S 254 ). Next, the decryption unit A 13  decrypts the received encrypted random number E 3 (R 1 ) by applying a decryption algorithm D 3 , thereby generating decrypted text R 1 ′, which equals D 3 (E 3 (R 1 )) (step S 255 ). 
     The random number comparison unit A 12  compares the random number R 1  and the decrypted text R 1 ′ (step S 256 ). When the random number R 1  and the decrypted text R 1 ′ do not match (“do not match” in step S 256 ), the mutual authentication unit  105  determines that the recording medium device  600  is not authentic, outputs the results of authentication, and terminates authentication processing. 
     The random number generation unit B 10  generates the random number R 2  (step S 257 ). The random number generation unit B 10  then transmits the generated random number R 2  to the key distribution device  100  (step S 258 ). 
     On the other hand, if the random number R 1  and the decrypted text R 1 ′ match (“match” in step S 256 ), the mutual authentication unit  105  determines that the other device is authentic. The encryption unit A 14  receives the random number R 2  from the other device (step S 258 ). The encryption unit A 14  encrypts the random number R 2  by applying the encryption algorithm E 4  to generate the encrypted random number E 4 (R 2 ) (step S 259 ) and transmits the generated encrypted random number E 4 (R 2 ) to the recording medium device  600  (step S 260 ). 
     The decryption unit B 13  receives the encrypted random number E 4 (R 2 ) from the key distribution device  100  (step S 260 ). Next, the decryption unit B 13  decrypts the received encrypted random number E 4 (R 2 ) by applying the decryption algorithm D 4 , thereby generating decrypted text R 2 ′, which equals D 4 (E 4 (R 2 )) (step S 261 ). 
     The random number comparison unit B 14  compares the random number R 2  and the decrypted text R 2 ′ (step S 261 ). If the random number R 2  and the decrypted text R 2 ′ do not match (“do not match” in step S 262 ), the mutual authentication unit  604  determines that the key distribution device  100  is not authentic and outputs results indicating that authentication failed. 
     On the other hand, if the random number R 2  and the decrypted text R 2 ′ match (“match” in step S 262 ), the mutual authentication unit  604  determines that the other device is authentic and outputs results indicating that authentication was successful. 
     When mutual authentication is successful, the verification unit A 15  reads the key distribution device certificate  252  from the private key certificate storage unit  104  (step S 263 ). Next, the verification unit A 15  transmits the read key distribution device certificate  252  to the recording medium device  600  (step S 264 ). 
     When mutual authentication is successful, the verification unit B 15  reads the recording medium device certificate  272  from the private key certificate storage unit  609  (step S 265 ). Next, the verification unit B 15  transmits the read recording medium device certificate  272  to the key distribution device  100  (step S 266 ). 
     Next, the verification unit B 15  reads the root public key  232  from the root public key storage unit  610  (step S 273 ) and verifies the key distribution device certificate using the read root public key  232  (step S 274 ). 
     When verification fails (“failure” in step S 275 ), the verification unit B 15  generates a message indicating failure (step S 276 ). Next, the verification unit B 15  outputs the generated message to the terminal device  300  (step S 277 ) and terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 272 ) and terminates processing. 
     Next, the verification unit A 15  reads the root public key  232  from the root public key storage unit  106  (step S 267 ). The verification unit A 15  then verifies the recording medium device certificate using the read root public key  232  (step S 268 ). 
     When verification fails (“failure” in step S 269 ), the verification unit A 15  generates a message indicating failure (step S 270 ). Next, the verification unit A 15  transmits the generated message to the terminal device  300  (step S 271 ) and terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 272 ) and terminates processing. 
     When verification is successful (“success” in step S 269 ), the key sharing unit A 16  sets xA (step S 281 ). Next, the key sharing unit A 16  calculates YA=xA*G (step S 282 ). Here, G is a point on an elliptic curve. The key sharing unit A 16  then transmits YA to the recording medium device  600  (step S 283 ). 
     When verification is successful (“success” in step S 275 ), the key sharing unit B 16  sets xB (step S 284 ). Next, the key sharing unit B 16  calculates YB=xB*G (step S 285 ). The key sharing unit B 16  then transmits YB to the key distribution device  100  (step S 286 ). 
     The key sharing unit A 16  calculates the shared key k=xA*YB (step S 287 ). 
     The key sharing unit B 16  calculates the shared key k′=xB*YA (step S 288 ). 
     Here, the shared key 
                   k   =       ⁢     xA   *   YB                 =       ⁢     xA   ×     (     xB   *   G     )                   =       ⁢     xB   ×     (     xA   *   G     )                   =       ⁢     xB   *   YA                 =       ⁢     shared   ⁢           ⁢   key   ⁢           ⁢     k   ′                   
(5) Operations for Generation of Individual Revocation List  141 
 
     The following describes operations of the key distribution device  100  for generation of the individual revocation list  141  with reference to the flowchart in  FIG. 37 . 
     The content information generation unit  109  initializes the individual revocation list  141  (step S 300 ). 
     Next, the content information generation unit  109  repeats steps S 302  through S 307  for every piece of content related information in the content information list  131   c  (steps S 301  through S 308 ). 
     The content information generation unit  109  reads the content related information (step S 302 ). Next, the content information generation unit  109  attempts to extract revocation information from the read content related information (step S 303 ). When revocation information exists (YES in step S 304 ), the content information generation unit  109  generates an entry ID (step S 305 ). Next, the content information generation unit  109  generates individual revocation information including the generated ID and the revocation information (step S 306 ) and adds the generated individual revocation information to the individual revocation list  141  (step S 307 ). 
     (6) Content Playback Operations 
     The following describes content playback operations within the content management system  10   a  with reference to the sequence diagrams in  FIGS. 38 through 39 . 
     The input unit  313  in the terminal device  300  receives a content ID identifying a content and an operation indicating playback of a content from the user (step S 331 ). 
     The control unit  312  generates playback request information that indicates a request to play back content and includes the content ID (step S 332 ). Next, the control unit  312  outputs the playback request information to the recording medium device  600  via the I/O unit  305  (step S 333 ). 
     The mutual authentication unit  604  in the recording medium device  600  and the mutual authentication unit  304  in the terminal device  300  then perform mutual authentication and key sharing (step S 334 ). The mutual authentication and key sharing between the recording medium device  600  and the terminal device  300  is the same as the mutual authentication and key sharing between the key distribution device  100  and the recording medium device  600  described above, and thus a description thereof is omitted. 
     When authentication by the mutual authentication unit  604  fails (“failure” in step S 335 ), the control unit  608  generates a message indicating failure of authentication (step S 336 ) and outputs the message to the terminal device  300  (step S 337 ), and the recording medium device  600  terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 340 ), and processing in the terminal device  300  terminates. 
     When authentication by the mutual authentication unit  304  fails (“failure” in step S 338 ), the control unit  312  generates a message indicating failure of authentication (step S 339 ), the display unit  314  displays the generated message (step S 340 ), and processing by the terminal device  300  terminates. 
     When authentication by the mutual authentication unit  604  is successful (“success” in step S 335 ), the revocation judgment unit  605  reads the individual revocation information corresponding to the content ID (step S 341 ) and judges whether the terminal device ID is located within the read individual revocation information (step S 342 ). When the terminal device ID is located within the read individual revocation information (“present” in step S 343 ), the control unit  608  generates a message indicating the presence of the terminal device ID (step S 344 ) and outputs the message to the terminal device  300  (step S 345 ), and the recording medium device  600  terminates processing. The display unit  314  in the terminal device  300  displays the message (step S 349 ), and processing in the terminal device  300  terminates. 
     When authentication by the mutual authentication unit  304  succeeds (“success” in step S 338 ), the revocation judgment unit  303  checks whether the recording medium device ID is located within the revocation file  242  (step S 346 ). When the recording medium device ID is located within the revocation file  242  (“present” in step S 347 ), the control unit  312  generates a message indicating the presence of the recording medium device ID (step S 348 ), the display unit  314  displays the generated message (step S 349 ), and processing by the terminal device  300  terminates. 
     When the terminal device ID is not located in the individual revocation information (“not present” in step S 343 ), the encryption/decryption unit  308  reads the title key (step S 350 ), encrypts the read title key (step S 351 ), and outputs the encrypted title key to the terminal device  300  via the I/O unit  603  (step S 352 ). 
     When the recording medium device ID is not located in the revocation file  242  (“not present” in step S 347 ), the I/O unit  305  receives the encrypted title key (step S 352 ), and the encryption/decryption unit  308  decrypts the encrypted title key (step S 353 ). 
     Next, the I/O unit  603  reads the content  532  from the content storage unit  615  (step S 354 ) and outputs the read content  532  to the terminal device  300  (step S 355 ). 
     The I/O unit  305  receives the content  532  (step S 355 ), the content decryption unit  311  decrypts the content using the title key (step S 356 ), and the content playback unit  310  plays back the decrypted content (step S 357 ). Processing then terminates. 
     2.9 Modification to Key Issuing Device  200   
     The key issuing device  200  may also be structured as follows. The following describes a key issuing device  200   a  as a modification to the key issuing device  200 . 
     As shown in  FIG. 40 , the key issuing device  200   a  includes a root key pair generation unit  201   a   1 , a root key pair storage unit  202   a , a root public key transmission unit  210   a   1 , a key distribution device key pair generation unit  201   a   2 , a certificate generation unit  203   a   2 , a key distribution device private key certificate storage unit  204   a   2 , a key distribution device private key certificate transmission unit  210   a   2 , a terminal device key pair generation unit  201   a   3 , a certificate generation unit  203   a   3 , a terminal device private key certificate storage unit  204   a   3 , a terminal device private key certificate transmission unit  210   a   3 , a recording medium device key pair generation unit  201   a   4 , a certificate generation unit  203   a   4 , a recording medium device private key certificate storage unit  204   a   4 , a recording medium device private key certificate transmission unit  210   a   4 , a production device key pair generation unit  201   a   5 , a certificate generation unit  203   a   5 , a production device private key certificate storage unit  204   a   5 , a production device private key certificate transmission unit  210   a   5 , an input unit  205   a , a signature unit  207   a , a revocation file storage unit  204   a   6 , and a revocation file transmission unit  210   a   6 . 
     The root key pair generation unit  201   a   1  generates a key pair composed of the root private key  231  and the root public key  232  of the key issuing device  200 . 
     The root key pair storage unit  202   a  stores the key pair composed of the root private key  231  and the root public key  232  generated by the root key pair generation unit  201   a   1 . 
     The root public key transmission unit  210   a   1  transmits the root public key  232  stored by the root key pair storage unit  202   a  to the key distribution device  100 , the terminal device  300 , and the recording medium device  600 . 
     The key distribution device key pair generation unit  201   a   2  generates a key distribution device key pair composed of the key distribution device private key  251  and the key distribution device public key  254  allocated to the key distribution device  100 . 
     The certificate generation unit  203   a   2  generates signature data for the key distribution device public key  254 , generated by the key distribution device key pair generation unit  201   a   2 , using the root private key  231  stored in the root key pair storage unit  202   a . Next, the certificate generation unit  203   a   2  generates the key distribution device certificate  252  by attaching the generated signature data. 
     The key distribution device private key certificate storage unit  204   a   2  stores the pair of the key distribution device private key  251  generated by the key distribution device key pair generation unit  201   a   2  and the key distribution device certificate  252  generated by the certificate generation unit  203   a   2 . 
     The key distribution device private key certificate transmission unit  210   a   2  transmits the pair of the key distribution device private key  251  and the key distribution device certificate  252  stored in the key distribution device private key certificate storage unit  204   a   2  to the key distribution device  100 . 
     The terminal device key pair generation unit  201   a   3  generates a terminal device key pair composed of the terminal device private key  261  and the terminal device public key  264  allocated to the terminal device  300 . 
     The certificate generation unit  203   a   3  generates signature data for the terminal device public key  264 , generated by the terminal device key pair generation unit  201   a   3 , using the root private key  231  stored in the root key pair storage unit  202   a . Next, the certificate generation unit  203   a   3  generates the terminal device certificate  262  by attaching the generated signature data. 
     The terminal device private key certificate storage unit  204   a   3  stores the pair of the terminal device private key  261  generated by the terminal device key pair generation unit  201   a   3  and the terminal device certificate  262  generated by the certificate generation unit  203   a   3 . 
     The terminal device private key certificate transmission unit  210   a   3  transmits the pair of the terminal device private key  261  and the terminal device certificate  262  stored in the terminal device private key certificate storage unit  204   a   3  to the terminal device  300 . 
     The recording medium device key pair generation unit  201   a   4  generates a recording medium device key pair composed of the recording medium device private key  271  and the recording medium device public key  274  allocated to the recording medium device  600 . 
     The certificate generation unit  203   a   4  generates signature data for the recording medium device public key  274 , generated by the recording medium device key pair generation unit  201   a   4 , using the root private key  231  stored in the root key pair storage unit  202   a . Next, the certificate generation unit  203   a   4  generates the recording medium device certificate  272  by attaching the generated signature data. 
     The recording medium device private key certificate storage unit  204   a   4  stores the pair of the recording medium device private key  271  generated by the recording device key pair generation unit  201   a   4  and the recording medium device certificate  272  generated by the certificate generation unit  203   a   4 . 
     The recording medium device private key certificate transmission unit  210   a   4  transmits the pair of the recording medium device private key  271  and the recording medium device certificate  272  stored in the recording medium device private key certificate storage unit  204   a   4  to the recording medium device  600 . 
     The production device key pair generation unit  201   a   5  generates a production device key pair composed of the production device private key  281  and the production device public key  284  allocated to the content production device  500 . 
     The certificate generation unit  203   a   5  generates signature data for the production device public key  284 , generated by the production device key pair generation unit  201   a   5 , using the root private key  231  stored in the root key pair storage unit  202   a . Next, the certificate generation unit  203   a   5  generates the production device certificate  282  by attaching the generated signature data. 
     The production device private key certificate storage unit  204   a   5  stores the pair of the production device private key  281  generated by the production device key pair generation unit  201   a   5  and the production device certificate  282  generated by the certificate generation unit  203   a   5 . 
     The production device private key certificate transmission unit  210   a   5  transmits the pair of the production device private key  281  and the production device certificate  282  stored in the production device private key certificate storage unit  204   a   5  to the content production device  500 . 
     The input unit  205   a  accepts input of revocation data  241  that includes a terminal device ID and a recording medium device ID that are to be revoked. 
     The signature unit  207   a  generates signature data for the revocation data  241  which includes the terminal device ID and the recording medium device ID input into the input unit  205   a . Next, the signature unit  207   a  generates the revocation file  242  by attaching the generated signature data. 
     The revocation file storage unit  204   a   6  stores the revocation file  242 . 
     The revocation file transmission unit  210   a   6  transmits the revocation file  242  stored in the revocation file storage unit  204   a   6  to the key distribution device  100 . 
     3. Embodiment 3 
     As Embodiment 3 of the present invention, a content management system  10   b  is described with reference to the drawings. 
     3.1 Overall Configuration of Content Management System  10   b    
     As illustrated in  FIG. 41 , the content management system  10   b  includes a server device  400   b  and a terminal device  300   b . The server device  400   b  and the terminal device  300   b  are connected via a network  20   b.    
     A content provider  500   b  provides the server device  400   b  with a content and with key data, as well as with notification data for users. In order to protect the content from being disclosed without authorization, digitalized video data and audio data are encrypted. The key data is a key used to decrypt the encrypted digitalized video data and audio data. The notification data includes messages of which users are to be notified. 
     The content provider  500   b  may be a content providing device. The content management system  10   b  may be composed of a plurality of devices, such as a content providing device, a key distribution device, a notification data providing device, and the like. 
     The server device  400   b  receives, from the content provider  500   b , a content, key data, and notification data and stores the received content, key data, and notification data. 
     The terminal device  300   b  receives, from a user, a request for use of content. In this context, use of content refers to streaming playback of content, downloading and storage of content, playback of recorded content, movement or copying of recorded content to another recording medium, and the like. Next, when connection to the server device  400   b  is required based on the received request, the terminal device  300   b  transmits the request from the user to the server device  400   b . Next, the terminal device  300   b  receives the desired data (some or all of the content, the key data, and the notification data). The terminal device  300   b  then does either or both of the following: displays the received notification data, and uses the content. 
     The following describes details on the server device  400   b  and the terminal device  300   b.    
     3.2 Structure of Server Device  400   b    
     As illustrated in  FIG. 42 , the server device  400   b  includes a notification data receiving unit  401   b , a notification data storage unit  402   b , a content receiving unit  403   b , a content storage unit  404   b , a key data storage unit  405   b , a judgment unit  406   b , a transmission/reception unit  407   b , a management data storage unit  408   b , and a control unit  409   b.    
     Note that the server device  400   b  is a computer system constituted by a CPU, a memory, a secondary storage unit, a network connection unit, a keyboard, and the like. The notification data storage unit  402   b , the content storage unit  404   b , the key data storage unit  405   b , and the management data storage unit  408   b  are each constituted by the secondary storage unit. The judgment unit  406   b  and the control unit  409   b  are each constituted by the CPU and computer programs running on the CPU. The transmission/reception unit  407   b  is constituted by the network connection unit. Furthermore, the notification data receiving unit  401   b  and the content receiving unit  403   b  are each constituted by the keyboard. 
     The function blocks of the server device  400   b , such as the notification data storage unit  402   b , the content storage unit  404   b , the key data storage unit  405   b , the judgment unit  406   b , the transmission/reception unit  407   b , the management data storage unit  408   b , and the control unit  409   b  are typically implemented as an LSI, which is a type of integrated circuit. Each unit may be separately integrated into a single chip, or a single chip may include a plurality of units or a portion of each unit. Each function block may be implemented by software, or by a combination of an LSI and software. The software may be tamper resistant. 
     (1) Notification Data Receiving unit  401   b  and Notification Data Storage Unit  402   b    
     The notification data receiving unit  401   b  receives input of notification data provided by the content provider  500   b . The notification data storage unit  402   b  stores the notification data. 
       FIGS. 44 and 45  illustrate an example of the notification data. 
     Notification data  331   b  illustrated in  FIG. 44  is notification data for the case when the content provider is a movie company A. In this example, the user is shown the following notification: “Movie company A has determined that this terminal device is unauthorized. Use of content is therefore not permitted. Please call 03-XXXX-XXXX (telephone number for movie company A)”. 
     Making it clear to whom the user should direct inquiries prevents the user from complaining to or contacting the manufacturer of the terminal device. Rather, the user can direct inquiries to the content provider. 
     Notification data  332   b  illustrated in  FIG. 45  is notification data for the case when the content provider is a movie company B. In this example, the user is shown the following notification: “Movie company B has determined that this terminal device is unauthorized. Use of content is therefore not permitted. In order to use the content, you must update your software. Do you wish to update?” 
     This notification makes it possible to encourage the user to correct unauthorized software (or an unauthorized terminal device  300   b ). 
     (2) Content Receiving Unit  403   b , Content Storage Unit  404   b , and Key Data Storage Unit  405   b    
     The content receiving unit  403   b  receives a content and key data provided by the content provider  500   b . The content storage unit  404   b  and the key data storage unit  405   b  each store content and key data. 
     Here, it is not required that the content and the key data be stored on one server device for transmission to the terminal device. The content and the key data may be stored on separate server devices and transmitted from the respective server devices to the terminal device. The content may be recorded on a recording medium, and the recording medium may be distributed, with only the key data being transmitted from the server device. Alternatively, the key data may be recorded on a recording medium, and the recording medium may be distributed, with only the content being transmitted from the server device. 
     (3) Judgment Unit  406   b , Transmission/Reception Unit  407   b , and Management Data Storage Unit  408   b    
     (Management Data Storage Unit  408   b ) 
     The management data storage unit  408   b  includes, for example, a management data table  370   b  as illustrated in  FIG. 48 . 
     The management data table  370   b  includes a plurality of pieces of management data. Each piece of management data includes a content provider and a set of one or more pieces of notification data. In other words, a set of notification data exists for each content provider. Each set of notification data includes one or more terminal device identifiers and one or more notification data types. 
     The content provider is information indicating the supplier or the like, such as a movie company, who provides the content. The terminal device identifier is identifying information on a terminal device. 
     The terminal identifiers “0x20 . . . 011 to 0x20 . . . F20” in the management data  370   b  represent the 3856 terminal device identifiers included in the range from “0x20 . . . 011” to “0x20 . . . F20”. Note that the character string following “0x” is represented in hexadecimal. 
     The notification data type indicates the type of the notification data. Here, the notification data type is either “type 1” or “type 2”.  FIG. 49  illustrates an example of “type 1” of the notification data. As illustrated in  FIG. 49 , “type 1” of the notification data includes a message indicating who to contact with inquiries when use of content is not permitted. On the other hand,  FIG. 50  illustrates an example of “type 2” of the notification data. As illustrated in  FIG. 50 , “type 2” of the notification data includes a message requesting a software update for use of content when use of content is not permitted. 
     (Transmission/Reception Unit  407   b ) 
     The transmission/reception unit  407   b  receives requests from the terminal device  300   b.    
       FIGS. 46 and 47  illustrate examples of requests received from the terminal device  300   b.    
     The request  350   b  illustrated in  FIG. 46  is an example of when a terminal device identified by a terminal device identifier  353   b  “0x20 . . . 011” requests use of the content identified by a movie title  352   b  “PPP in QP” provided by the content provider ( 351   b ) “Movie company A”. As illustrated in  FIG. 46 , the request  350   b  includes request data  354   b . The request data  354   b  includes the content provider ( 351   b ) “Movie company A”, the movie title  352   b  “PPT in QT”, and the terminal device identifier  353   b  “0x20 . . . 011”. 
     The request  360   b  illustrated in  FIG. 47  is an example of when a terminal device identified by a terminal device identifier  363   b  “0x20 . . . 011” requests use of the content identified by a movie title  362   b  “1234 to BCG” provided by the content provider ( 361   b ) “Movie company B”. As illustrated in  FIG. 47 , the request  360   b  includes request data  364 . The request data  364  includes the content provider ( 361   b ) “Movie company B”, the movie title  362   b  “1234 to BCG”, and the terminal device identifier  363   b  “0x20 . . . 011”. 
     The request transmitted by the terminal device  300   b  may include either or both of an identifier uniquely identifying the terminal device  300   b  (terminal device identifier) and an identifier uniquely identifying the recording unit, such as an internal memory, a memory card, a hard disk, or the like, in the terminal device  300   b  on which the content is recorded (recording medium identifier). 
     The transmission/reception unit  407   b  receives the content, the key data, or the notification data from the judgment unit  406   b  and transmits the received content, key data, or notification data to the terminal device  300   b.    
     (Judgment Unit  406   b ) 
     Based on the request for content use from the terminal device  300   b  received by the transmission/reception unit  407   b , the judgment unit  406   b  judges whether to transmit the notification data, or whether to transmit the content and the key data, to the terminal device  300   b  based on the management data stored by the management data storage unit  408   b.    
     This judgment is made as follows. 
     The judgment unit  406   b  extracts the content provider and the terminal device identifier from the request received from the terminal device  300   b . Next, the judgment unit  406   b  determines whether the management data that includes the extracted content provider and the terminal device identifier is located within the management data table  370   b.    
     When the management data that includes the extracted content provider and the terminal device identifier is not located within the management data table  370   b , the judgment unit  406   b  determines that the content and the key data are to be transmitted. 
     When the management data that includes the extracted content provider and the terminal device identifier is located within the management data table  370   b , the judgment unit  406   b  determines that the notification data is to be transmitted. The judgment unit  406   b  reads the management data that includes the extracted content provider and the terminal device identifier from the management data table  370   b  and extracts the notification data type from the read management data. Next, the judgment unit  406   b  determines the type of notification data based on the extracted notification data type. 
     When the notification data type is “type 1”, the judgment unit  406   b  reads, for example, the notification data  333   b  illustrated in  FIG. 49 . On the other hand, when the notification data type is “type 2”, the judgment unit  406   b  reads, for example, the notification data  334   b  illustrated in  FIG. 50 . Next, the judgment unit  406   b  fills the name of the content provider and the contact number for the content provider into the read notification data. 
     For a request from the terminal device having a terminal identifier not recorded in the management data table  370   b , the judgment unit  406   b  transmits the content and the key data, without transmitting the notification data. 
     Next, the judgment unit  406   b  outputs the content and the key data or the notification data to the transmission/reception unit  407   b.    
     Note that mutual authentication and key sharing processing may be performed in order to establish a secure communication channel between the server device  400   b  and the terminal device  300   b . Well-known technology is used during mutual authentication and key sharing processing, such as ECDS (an Elliptic Curve Digital Signature Algorithm) or other digital signature technology and ECDH (Elliptic curve Diffie-Hellman) or other key sharing technology. A description thereof is thus omitted here. 
     (4) Control Unit  409   b    
     The control unit  409   b  manages and controls the notification data receiving unit  401   b , the notification data storage unit  402   b , the content receiving unit  403   b , the content storage unit  404   b , the key data storage unit  405   b , the judgment unit  406   b , the transmission/reception unit  407   b , and the management data storage unit  408   b  and achieves the transmission of appropriate data in response to a request received from the terminal device  300   b.    
     3.3 Structure of Terminal Device  300   b    
     The following describes the structure of the terminal device  300   b  in detail. 
     As illustrated in  FIG. 43 , the terminal device  300   b  includes a transmission/reception unit  301   b , a receiving unit  302   b , a display unit  303   b , a content storage unit  304   b , an update unit  305   b , a decryption unit  306   b , a content playback unit  307   b , and a control unit  308   b.    
     The terminal device  300   b  is a computer system composed of a CPU, memory, a secondary storage unit, a network connection unit, a keyboard, a liquid crystal display unit, and the like. The content storage unit  304   b  is constituted by the secondary storage unit. The content playback unit  307   b , the update unit  305   b , the decryption unit  306   b  and the control unit  308   b  are each constituted by the CPU and computer programs running on the CPU. The transmission/reception unit  301   b  is constituted by the network connection unit. The receiving unit  302   b  is constituted by the keyboard. Finally, the display unit  303   b  is constituted by the liquid crystal display unit. 
     The function blocks of the terminal device  300   b , such as the transmission/reception unit  301   b , the content playback unit  307   b , the update unit  305   b , the decryption unit  306   b , the content storage unit  304   b , and the control unit  308   b  are typically implemented as an LSI, which is a type of integrated circuit. Each unit may be separately integrated into a single chip, or a single chip may include one or more units or a portion of each unit. In addition, the method for assembling integrated circuits is not limited to LSI, and a dedicated communication circuit or a general-purpose processor may be used. An FPGA (Field Programmable Gate Array), which is programmable after the LSI is manufactured, or a reconfigurable processor, which allows reconfiguration of the connection and setting of circuit cells inside the LSI, may be used. Each function block may be implemented by software, or by a combination of an LSI and software. The software may be tamper resistant. 
     (1) Content Storage Unit  304   b    
     The content storage unit  304   b  is provided with a region for storing the content and the key data received by the transmission/reception unit  301   b.    
     (2) Transmission/Reception Unit  301   b , Receiving Unit  302   b , and Display Unit  303   b    
     The receiving unit  302   b  receives input of a request for content from the user. Examples of such a request are as illustrated in  FIGS. 46 and 47 . 
     The receiving unit  302   b  also receives an operation by the user for updating of software. Upon receiving the operation for updating software, the receiving unit  302   b  outputs an instruction indicating to perform an update to the update unit  305   b.    
     The transmission/reception unit  301   b  transmits the request for content from the user received by the receiving unit  302   b  to the server device  400   b . The transmission/reception unit  301   b  also transmits the content and the key data or the notification data from the server device  400   b.    
     Upon receiving the content and the key data, the transmission/reception unit  301   b  writes the received content and key data in the content storage unit  304   b.    
     Upon receiving the notification data, the transmission/reception unit  301   b  outputs the received notification data to the display unit  303   b.    
     The display unit  303   b  receives notification data from the transmission/reception unit  301   b . Upon receiving the notification data, the display unit  303   b  displays the received notification data. 
     (3) Decryption Unit  306   b  and Content Playback Unit  307   b    
     The decryption unit  306   b  reads the key data and the content from the content storage unit  304   b  and uses the read key data to decrypt the read content, thereby generating decrypted content. Next, the decryption unit  306   b  outputs the decrypted content to the content playback unit  307   b.    
     The content playback unit  307   b  receives the decrypted content and plays back the received decrypted content. 
     (4) Update Unit  305   b    
     When type 2 notification data is received from the transmission/reception unit  301   b , the received notification data is displayed on the display unit  303   b . The user is thus encouraged to update the software. At this point, as described above, the receiving unit  302   b  receives an operation by the user for updating of software. In this case, the update unit  305   b  receives instruction to perform a software update from the receiving unit  302   b.    
     Upon receiving the instruction, the update unit  305   b  performs a software update. Specifically, the update unit  305   b  accesses a software distribution server device (not illustrated in the figures) on which software for use in updating has been prepared. Next, the update unit  305   b  downloads the software for use in updating and uses the downloaded software in order to update the non-updated software. Since software updating is well-known technology, a description thereof is omitted. 
     (5) Control Unit  308   b    
     The control unit  308   b  manages and controls the transmission/reception unit  301   b , the receiving unit  302   b , the display unit  303   b , the content playback unit  307   b , the update unit  305   b , the decryption unit  306   b , and the content storage unit  304   b . The control unit  308   b  transmits a user request to the server device  400   b , and based on data received from the server device  400   b , implements functions such as displaying the notification data and storing or playing back the content. 
     4. Other Modifications 
     While embodiments of the present invention have been described, aspects of the present invention are of course not limited to these embodiments. The present invention also includes cases such as the following. 
     (1) In Embodiment 2, it is assumed that key information is a key pair formed by the private key and the public key, and authentication is based on the private key and the public key. Authentication is not limited in this way, however, and may instead be based on Media Key Block (MKB) technology. Alternatively, authentication technology based on a different encryption scheme may be used. 
     (2) In Embodiment 2, the recording medium device is assumed to be a memory card such as an SD card, but aspects of the present invention are not limited in this way. A device that incorporates a control LSI into a storage device, such as an HDD, may be used instead. Furthermore, instead of a removable component such as a memory card, a control LSI may be incorporated into an internal memory device in a cellular phone, eBook, NetBook, or the like. 
     (3) In Embodiment 3, a request for use of content from a user is a request for acquisition of content from a server device. The acquired content is then stored and played back. The present invention is not, however, limited to this structure. 
     For example, when playing back pre-stored content that is recorded on a recording medium, such as an internal memory, a memory card, a hard disk, or the like, a connection may be established with the server device based on control data corresponding to the content stored in the terminal device (or stored on the recording medium). 
     In this case, the terminal device further includes a control data storage unit and a judgment unit. 
     The control data storage unit stores, for example, a control data table  341   b  illustrated in  FIG. 51 . 
     The control data table  341   b  includes a plurality of pieces of control data, as illustrated in  FIG. 51 . Each piece of control data includes a movie title, a content provider, a server connection requirement, a resolution, and a window. 
     Here, the movie title is a name identifying the content. The content provider is a name identifying the provider of the content. The server connection requirement indicates conditions for connection from the terminal device to the server device. For example, the server connection requirement is one of “continuous connection required”, “connection required once every three times”, or “no connection required”. “Continuous connection required” is a requirement that the terminal device and the server device be continually connected over a network. “Connection required once every three times” is a requirement that every three times the terminal device uses the content, the terminal device and the server device must be connected over a network. “No connection required” means that the terminal device and the server device are not required to be connected over a network. The resolution indicates the resolution of the content. The window indicates the time period (term) during which the content is provided to the user. A video window indicates the time period (term) during which the content is stored on a recording medium, such as a DVD, and released to the market. An early window refers to the short time period (term) from when a movie is no longer shown in theaters until when the movie is stored on a recording medium, such as a DVD, and distributed. During this early window, content is distributed over a network, for example. 
     When the user issues an instruction for playback of content that is stored on the terminal device, provided by the content provider “Movie company A”, and identified by the movie title “PPP in QP”, the judgment unit obeys the control indicated by the control data  342   b  in the control data table  341   b . This is because the content provider and the movie title contained in the user instruction match the content provider and the movie title included in the control data  342   b  in the control data table  341   b . In this case, the terminal device confirms the requirement for connection to the server device and then connects to the server device. When the server device transmits notification data, the terminal device displays the notification data. 
     (4) The terminal device may also include a notification data storage unit that stores the notification data and a control data storage unit storing a control data table  381   b  for determining whether display of the notification data is required. 
       FIG. 52  illustrates an example of the control data table  381   b.    
     The control data table  381   b  includes a plurality of pieces of control data, as illustrated in  FIG. 52 . Each piece of control data includes a movie title, a content provider, a server connection requirement, an acquisition method, a notification data display requirement, playback permission, a resolution, and a window. The movie title, content provider, server connection requirement, resolution, and window are as described above. 
     The acquisition method indicates the method of acquiring the content. For example, acquisition methods are “digital copy”, “distribution service V”, and “distribution service N”. “Digital copy” indicates acquisition of content by copying. “Distribution service V” and “distribution service N” represent acquisition of content by respective content distribution services. The notification data display requirement indicates whether or not display of notification data is required. The playback permission indicates whether or not playback is permitted. 
     When the user issues an instruction for playback of content that is stored on the terminal device, provided by the content provider “Movie company B”, and identified by the movie title “1234”, the judgment unit confirms the conditions of the requirement for connection to the server connection device, the notification data display requirement, and the playback permission. The content provider “Movie company B” and the movie title “1234” in the instruction are included in the control data  382   b  included in the control data table  381 . Therefore, in accordance with the control data  382   b , the terminal device does not connect to the server device, but rather starts playback of content after displaying the notification data. 
     In this way, the terminal device may store control data listing conditions such as a requirement for connection to the server device, a notification data display requirement, and playback permission, and the terminal device may control use of the content and display of the notification data based on the control data. 
     (5) In modifications (3) and (4), the terminal device controls playback of content stored therein. The present invention is not, however, limited to these structures. 
     For example, when the content stored by the terminal device (or the recording medium) is moved or copied to another terminal device (or recording medium), the terminal device may store control data listing conditions such as a requirement for connection to the server device, a notification data display requirement, move information, and copy permission, and the terminal device may control use of the content and display of the notification data based on the control data. 
     (6) In modifications (3) through (5), the control data used for judgment by the judgment unit is managed based on movie titles. The present invention is not, however, limited to these structures. 
     For example, notification data may be displayed for every content provided by a particular content provider. 
     Furthermore, notification data may be displayed for every early window content provided by a particular content provider. Here, an early window content is a content whose provision is highly valued during the early window. 
     Furthermore, notification data may be displayed for every content with a resolution of full HD (FHD) provided by a particular content provider. 
     Alternatively, notification data may be displayed for every content provided by a particular content provider depending on the path by which the content is obtained (obtained by a distribution service, obtained by copying packaged media, or obtained by recording a broadcasted program). 
     Use of content may be controlled and notification data may be displayed in this way based on instructions from the content provider or control data created by the content provider. 
     (7) In Embodiment 3, the server device determines whether to transmit data, such as notification data, based on the terminal device identifier received from the terminal device. The present invention is not, however, limited to this structure. 
     For example, the data transmitted to the terminal device may be controlled based on a recording medium identifier uniquely identifying the recording medium, such as an internal memory, a memory card, or a hard disk, on which the content is stored. 
     Alternatively, the data transmitted to this terminal device may be controlled based on both the terminal device identifier and the recording medium identifier. 
     (8) In Embodiment 3, the server device determines whether to transmit data, such as notification data, based on the terminal device identifier received from the terminal device. The present invention is not, however, limited to this structure. 
     For example, the server device may transmit, to the terminal device, a program that can confirm the security level of the terminal device, such as the version of the software stored on the terminal device, the installation state of an update program, whether or not a virus checker is installed, etc. This program may confirm the security level of the terminal device and, based on the security level of the terminal device, determine whether to display the notification data. The program may also be configured to control recording, playback, movement, copying, etc. of the content based on the security level of the terminal device. 
     (9) The server device of Embodiment 3 may include an analysis unit that analyzes the notification data display requirement, the number of times that display is required, or the like as indicated by the content provider for each terminal device or for each manufacturer of terminal devices. 
     Such an analysis unit can rank terminal device manufacturers. This allows for permission to use content and for control in accordance with the rank of each terminal device manufacturer. 
     (10) In addition to Embodiment 3, in the case of content with a high value, such as early window content, the target of recording onto the terminal device (or the recording medium device) may be restricted to encrypted content. At this time, the terminal device may access the server device to acquire the key data for decrypting the content each time the content is played back on the terminal device. 
     In this case as well, when the server device does not accept playback on the terminal device (or the recording medium device) and does not transmit key data, the server device transmits notification data to the terminal device and displays notification that termination is at the content provider&#39;s request. 
     (11) In Embodiment 3, the content and the key data are transmitted by the server device. The present invention is not, however, limited to this structure. 
     For example, the content may be copied from packaged media, with only the key data being transmitted by the server device. 
     Conversely, the key data may be copied from packaged media, with only the content being transmitted by the server device. 
     Furthermore, notification data stored by a notification data storage unit and control data stored by a control data storage unit in the terminal device may be received via packaged media. 
     (12) In Embodiment 3, the control unit of the terminal device controls communication with the server device, recording of content, playback, and the like. The present invention is not, however, limited to this structure. 
     The following structure may be adopted. 
     As illustrated in  FIG. 53 , a content management system  10   c  of the present modification may include a server device  400   c  and a terminal device  300   c . The server device  400   c  and the terminal device  300   c  are connected via a network  20   c.    
     The server device  400   c  includes a communication control system  407   c  and a management information control system  409   c  and stores content management information  410   c  and terminal device management information  411   c.    
     The terminal device  300   c  includes a communication control device  301   c , a content playback unit  307   c , a content display unit  309   c , and an internal memory  310   c . A portable, detachable memory card  315   c  is inserted into the terminal device  300   c.    
     The internal memory  310   c  includes a controller  311   c  with a copyright protection function and a flash memory  312   c . The flash memory  312   c  includes an area for storing content management information  313   c  and a content  314   c.    
     The internal memory  310   c  may include a hard disk instead of the flash memory  312   c.    
     The memory card  315   c  includes a controller  316   c  with a copyright protection function and a flash memory  317   c . The flash memory  317   c  includes an area for storing content management information  318   c  and a content  319   c.    
     The flash memory  312   c  in the internal memory  310   c  and the flash memory  317   c  in the memory card  315   c  inserted into the terminal device  300   c  store content management information  313   c  and  318   c  and contents  314   c  and  319   c . The controllers  311   c  and  316   c  (hereinafter, control units) with a copyright protection function in the internal memory and the memory card, respectively, may control use (playback, movement, copying, and the like) of the contents  314   c  and  319   c.    
     In the example illustrated in  FIG. 53 , the contents  314   c  and  319   c  have already been recorded on the terminal device  300   c  or the memory card  315   c.    
     At this point, control by each of the control units causes communication with the server device  400   c  (a request for use of content) to be performed via a communication control unit  301   c  in the terminal device  300   c.    
     The server device  400   c  determines whether to respond to the request by permitting use (playback, movement, copying, and the like) of content based on the stored content management information  410   c  or terminal device management information  411   c . The server device  400   c  also determines whether to transmit notification data. 
     The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. 
     An example of the content management information  410   c  and the terminal device management information  411   c  stored by the server device  400   c  is the management data table  370   b  illustrated in  FIG. 48 . 
     In the example illustrated in  FIG. 48 , information is managed as one management data table, but the content management information  410   c  and the terminal device management information  411   c  may be managed as separate management data tables. 
     Furthermore, the terminal device management information  411   c  need not include only identifiers uniquely identifying terminal devices, but may also include identifiers identifying the manufacturer of the terminal device or the type or model of the terminal device. Alternatively, identifiers may be included to identify the controller with a copyright protection function in the internal memory and memory card, and identifiers may be included to uniquely identify the flash memory. Similarly, identifiers may be included to identify the manufacturer of the internal memory, the manufacturer of the memory card, or the model and production unit of the internal memory and the memory card. 
     The content management information  410   c  stored by the terminal device is, for example, the control data table  341   b  illustrated in  FIG. 51 . 
     (13) In (12), the terminal device  300   c  already stores the content (content has already been recorded), but the present invention is not limited to this structure. 
     The following structure may be adopted. 
     As illustrated in  FIG. 54 , a content management system  10   d  of the present modification may include the server device  400   c , a recording device  700   d , and a terminal device  300   c . The server device  400   c , the recording device  700   d , and the terminal device  300   c  are connected via a network  20   d.    
     The server device  400   c  and the terminal device  300   c  of the content management system  10   d  respectively have the same structure as the server device  400   c  and the terminal device  300   c  of the content management system  10   c.    
     The recording device  700   d  includes a communication control unit  701   d  and a content recording control unit  702   d  and stores content management information  703   d  and a content  704   d.    
     The recording device  700   d  already stores the content  704   d . With permission from the server device  400   c , the recording device  700   d  may move or copy the content  704   d  to the internal memory  310   c  of the terminal device  300   c  or to the memory card  315   c.    
     In the content management system  10   d , the recording device  700   d  transmits, to the server device  400   c , a request to move or copy the content. The server device  400   c  determines whether to respond to the request from the recording device  700   d  by permitting recording or copying of the content  704   d  based on the stored content management information  410   c  or terminal device management information  411   c . The server device  400   c  also determines whether to transmit notification data. The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. 
     Furthermore, when playing back the content  314   c  or  319   c  moved or copied to the internal memory  310   c  of the terminal device  300   c  or to the memory card  315   c , a request may be issued again to the server device  400   c  for permission to play back the content  314   c  or  319   c . In this case, permission may be requested upon every playback. Alternatively, a structure may be adopted whereby permission is only requested at the first playback, i.e. only once. The server device  400   c  determines whether to respond to the request from the recording device  700   d  by permitting movement or copying of the content  704   d  based on the stored content management information  410   c  or terminal device management information  411   c . The server device  400   c  also determines whether to transmit notification data. The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. 
     (14) The following structure may be adopted. 
     As illustrated in  FIG. 55 , a content management system  10   e  of the present modification may include the server device  400   c , the recording device  700   d , and the terminal device  300   c . The recording device  700   d  acquires a content from a packaged media  800  and records the content internally. In this context, the packaged media is a distributed disc on which the content is recorded. The server device  400   c , the recording device  700   d , and the terminal device  300   c  are connected via the network  20   d.    
     The server device  400   c , the recording device  700   d , and the terminal device  300   c  of the content management system  10   e  respectively have the same structure as the server device  400   c , the recording device  700   d , and the terminal device  300   c  of the content management system  10   d.    
     In this case, the recording device  700   d  transmits a request to the server device  400   c  to internally store the content recorded on the packaged media  800 . The server device  400   c  determines whether to respond to the request from the recording device  700   d  by permitting storing of the content based on the stored content management information  410   c  or terminal device management information  411   c . The server device  400   c  also determines whether to transmit notification data. The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. Playback of the content  314   c  or  319   c  by the terminal device  300   c  is as described in Embodiments 2 and 3 and in other modifications. 
     (15) The following structure may be adopted. 
     As illustrated in  FIG. 56 , a content management system  10   f  of the present modification may include the server device  400   c , a content distribution server device  400   f , the recording device  700   d , and the terminal device  300   c . The server device  400   c , the content distribution server device  400   f , the recording device  700   d , and the terminal device  300   c  are connected via the network  20   d.    
     The server device  400   c , the recording device  700   d , and the terminal device  300   c  of the content management system  10   f  respectively have the same structure as the server device  400   c , the recording device  700   d , and the terminal device  300   c  of the content management system  10   e.    
     As illustrated in  FIG. 56 , the recording device  700   d  may acquire a content from the content distribution server device  400   f  and record the acquired content internally as the content  704   d.    
     In this case, the recording device  700   d  transmits a request to the server device  400   c  to record the content internally. The server device  400   c  determines whether to respond to the request from the recording device  700   d  by permitting recording of the content based on the stored content management information  410   c  or terminal device management information  411   c . The server device  400   c  also determines whether to transmit notification data. The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. 
     Playback of the content  314   c  or  319   c  by the terminal device  300   c  is as described in Embodiments 2 and 3 and in other modifications. 
     Here, the server device  400   c  and the content distribution server device  400   f  may communicate with each other to maintain the content management information and the terminal device management information in the most recent state, i.e. to share these pieces of information with each other. Furthermore, when transmitting a request to the server device  400   d  to record the content  704   d , the recording device  700   d  may also transmit a request to the content distribution server device  400   f  to transmit the content  704   d . Upon receiving the request, the content distribution server device  400   f  may determine whether to permit transmission of the content. 
     Alternatively, upon receiving the request, the content distribution server device  400   f  may inquire of the server device  400   d  as to whether transmission of the content is to be permitted. At this point, the content distribution server device  400   f  receives a response to the inquiry from the server device  400   d . Next, the content distribution server device  400   f  outputs the response to the inquiry to the recording device  700   d.    
     The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. Playback of content by the terminal device  300   c  is as described in Embodiments 2 and 3 and in other modifications. 
     (16) The following structure may be adopted. 
     A time during which the content is usable (either an absolute time or a relative time) may be included in the content management information stored by the terminal device. In this case, when the terminal device transmits a request to the server device for permission to record content, the terminal device may also transmit the information on the time during which the content is usable as listed in the content management information. The terminal device acquires time information from the server device. The control unit of the terminal device, the controller with a copyright protection function in the internal memory, and the controller with a copyright protection function in the memory card determine whether to play back the content using the acquired time information. The control unit and the controllers thus control playback of the content. Based on the results of determination, the server device transmits the time information and permission information or the notification data to the terminal device. The method of determination and the notification data are as described in Embodiments 2 and 3 and in other modifications. 
     During playback of content, the terminal device may again transmit a request for continued playback to the server device. At this point, when permission for playback of the content is not obtained from the server device, the terminal device may suspend playback and display notification data from the content provider. When this terminal device cannot connect to the server device, the terminal device may display notification data from the content provider that was previously received along with the content and recorded. The terminal device thus suspends playback of the content. This structure allows for services such as rental of content. 
     (17) The following structure may be adopted. 
     An aspect of the present invention is a distribution device that manages content information. The distribution device stores a content/apparatus correspondence list that allows for management of a list of revoked apparatuses for each content. When an apparatus issues a request to the distribution device for access to the content, the distribution device determines whether the accessing apparatus is revoked by checking the content/apparatus correspondence list. 
     Another aspect of the present invention is a recording medium storing a content thereon. The recording medium further stores a content/apparatus correspondence list that allows for management of a list of revoked apparatuses for each content. When an apparatus attempts to access the content on the recording medium, the recording medium determines whether the accessing apparatus is revoked by checking the content/apparatus correspondence list. 
     The distribution device may transmit the content/apparatus correspondence list to the recording medium. 
     Another aspect of the present invention is a distribution system including a distribution device, an apparatus, and a recording medium. The distribution system stores a content/apparatus correspondence list that allows for management of a list of revoked apparatuses for each content. When an apparatus attempts to access the content, the distribution system determines whether the accessing apparatus is revoked by checking the content/apparatus correspondence list and transmits the content/apparatus correspondence list to the recording medium. The recording medium stores the received content/apparatus correspondence list. When an apparatus attempts to access the content on the recording medium, the recording medium determines whether the accessing apparatus is revoked by checking the content/apparatus correspondence list. 
     Another aspect of the present invention is a management server that manages use of a content. The management server comprises a notification data storage unit storing notification data determined in advance by a content provider; a management data storage unit storing management data for a terminal device that uses the content; and a judgment unit configured to judge whether to transmit permission for use of the content or to transmit the notification data in response to a request from the terminal device. 
     Another aspect of the present invention is a terminal device that uses a content. The terminal device comprises a reception unit configured to receive permission for use of the content or notification data; a storage unit storing content management information; a display unit configured to display the notification data; and a control unit configured to control use of the content. When the notification data is received, the control unit causes the notification data to be displayed and controls whether to prevent use of the content based on the content management information. 
     The control unit of the terminal device may be a controller provided in an internal memory. 
     Another aspect of the present invention is a memory card for insertion into the terminal device. The memory card comprises a controller having a function equivalent to the control unit of the terminal device. 
     Another aspect of the present invention is a content use management system including a management server that manages use of a content and a terminal device that uses a content. The management server comprises a notification data storage unit storing notification data determined in advance by a content provider; a management data storage unit storing management data for a terminal device that uses the content; and a judgment unit configured to judge whether to transmit permission for use of the content or to transmit the notification data in response to a request from the terminal device. The terminal device comprises a reception unit configured to receive permission for use of the content or notification data; a storage unit storing content management information; a display unit configured to display the notification data; and a control unit configured to control use of the content. When the notification data is received, the control unit causes the notification data to be displayed and controls whether to prevent use of the content based on the content management information. 
     (17) The following structure may be adopted. 
     An aspect of the present invention is a recording medium device including a storage unit and a tamper-resistant controller. The storage unit stores a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. 
     The controller includes an acquisition circuit configured to acquire an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; a judgment circuit configured to judge whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and a control circuit configured to control to prohibit output of the content to the apparatus when the judgment unit judges that the apparatus identifier and the revocation identifier match. 
     An aspect of the present invention is a recording medium device including a storage unit and a tamper-resistant controller. The storage unit stores a content and a revocation list including a revocation identifier that is associated with the content and identifies a revoked public key certificate of an apparatus related to use of the content. The controller is provided with a memory unit storing a computer program composed of a combination of a plurality of computer instructions and a processor configured to fetch the computer instructions one at a time from the computer program stored in the memory unit, decode each computer instruction, and operate in accordance with the result of decoding. The controller is a computer, and the computer program causes the computer to perform the steps of acquiring an acquisition request for the content from the apparatus into which the recording medium device is loaded and to acquire an apparatus identifier identifying a public key certificate allocated to the apparatus; judging whether the acquired apparatus identifier matches the revocation identifier associated with the content for which the acquisition request is acquired; and controlling to prohibit output of the content to the apparatus when the apparatus identifier and the revocation identifier are judged to match. 
     (18) In the above embodiments and modifications, one device has a plurality of functions (constituent elements). The present invention is not, however, limited to the structure. The same functions and advantageous effects may be achieved by distributing the plurality of functions (constituent elements) among a plurality of devices that operate in coordination. 
     (19) In the above embodiments and modification, a portion or all of the structural elements composing each device may be constituted by an IC card, or an individual module, that is removable from the device. The IC card/module is a computer system that includes a microprocessor, ROM, RAM, etc. The IC card or the module may include an ultra-multifunctional LSI. The microprocessor operates according to computer programs, and the IC card or the module thereby accomplishes its functions. The IC card/module may be tamper resistant. 
     (20) Aspects of the present invention may be control methods for controlling the devices in the above embodiments and modifications thereto. An aspect of the present invention may also be a computer program that achieves the control methods with a computer or may be a digital signal comprising the computer program. 
     An aspect of the present invention may also be a computer-readable recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray Disc), or semiconductor memory, on which the above computer program or digital signal is recorded. The present invention may also be the digital signal recorded on such a recording medium. 
     An aspect of the present invention may also be the computer program or digital signal to be transmitted via networks, of which telecommunications networks, wire/wireless communications networks, and the Internet are representative, or via data broadcasting, for example. 
     An aspect of the present invention may also be a computer system provided with a microprocessor and memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program. 
     Also, another independent computer system may execute the computer program or digital signal after the computer program or digital signal is transferred by being recorded on the recording medium or by being transferred over a network or the like. 
     (21) The above embodiments and modifications may be combined with one another. 
     INDUSTRIAL APPLICABILITY 
     A recording medium device according to the present invention prevents unauthorized output of content from the recording medium device and is useful as a recording medium device for recording content. 
     REFERENCE SIGNS LIST 
     
         
         
           
               10   g  content management system 
               300   g  apparatus 
               500   g  revocation list generation device 
               600   g  recording medium device 
               10   a  content management system 
               100  key distribution device 
               200  key issuing device 
               300  terminal device 
               400  content distribution device 
               500  content production device 
               600  recording medium device 
               10   b  content management system 
               300   b  terminal device 
               400   b  server device