Patent Description:
Conventionally, security measures have been applied to map data used in a navigation system.

For example, Patent Document <NUM> discloses a map update system that can prohibit the unauthorized use of map data. In Patent Document <NUM>, a user records map data distributed from a distribution center in a recording medium and updates the map data of a navigation apparatus by connecting the recording medium to the navigation apparatus. In the recording medium used for updating the map data, a unique individual ID assigned to the navigation apparatus is recorded in advance. When the user sets the recording medium in a personal computer, the personal computer transmits the individual ID stored in the recording medium to the distribution center. The distribution center adds the individual ID as attribute data to the map data for update and distributes the map data for update. The map data for update is written in the recording medium set in the personal computer.

When the recording medium is removed from the personal computer and set in the navigation apparatus, the device determines whether the individual ID added to the map data on the recording medium matches the individual ID of the device. If they match each other, the map data on the recording medium is copied to the hard disk; otherwise, the copying is prohibited. This makes it possible to effectively prevent the unauthorized use of the map data for update.

According to the technique disclosed in Patent Document <NUM>, when the individual ID of a navigation apparatus whose map data is desired to be updated is read in advance, map data for update can be illegally used.

An object of the present invention is to provide a technique for ensuring the proper use of a map or other contents duplicated to a recording medium.

A production method according to a first disclosure according to an exemplary embodiment of the present invention is a method for producing a recording medium having a recording area in which content information indicating a content and security information for the security of the content information are recorded. In the recording area, medium specifying information for uniquely identifying the recording medium itself is recorded in advance.

The method includes steps of (a) writing temporary security information and the content information in the recording area, the temporary security information including given information different from the medium specifying information, (b) reading the medium specifying information and the temporary security information from the recording area, (c) replacing the given information in the temporary security information with the medium specifying information, (d) encrypting the temporary security information in which the given information is replaced with the medium specifying information to generate the security information, and (e) causing the security information generated in the step (d) to be recorded in the recording area.

A production method according to a second disclosure further includes, in the first disclosure, the step (f) copying the temporary security information and the content information from a host recording medium in which original copies of the temporary security information and the content information are recorded to a recording medium different from the recording medium. In the method, the step (a) is performed after the step (f).

A production method according to a third disclosure further includes, in the second disclosure, a step (g) verifying whether the temporary security information written in the step (a) matches an original copy of the temporary security information and verifying whether the content information written in the step (a) matches the original copy.

According to a production method according to a fourth disclosure, in the third disclosure, an error is notified when at least one of the verification results in the step (g) indicates a mismatch.

According to a production method according to a fifth disclosure, in the fourth disclosure, when the error is notified, the step (g) is retried.

According to a production method according to a sixth disclosure, in the third disclosure, when both verification results in the step (g) indicate matches, the steps (b) to (e) are performed.

A production method according to a seventh disclosure further includes, in any one of the first to sixth disclosures, a step (h) reading the security information from the recording area of the recording medium and verifying whether or not the medium specifying information in the read security information matches the medium specifying information encrypted in the step (d). In the method, the step (h) is performed after the step (e).

A production method according to an eighth disclosure is the production method according to the seventh disclosure. When the verification result in step (h) indicates a mismatch, an error is notified.

A production method according to a ninth disclosure is the production method according to the eighth disclosure. When the error is notified, the step (h) is retried.

A production method according to a 10th disclosure is the production method according to any one of the first to ninth disclosures. The content information is map information indicating a map as the content.

A production method according to a 11th disclosure is the production method according to the 10th disclosure. The temporary security information written in the step (a) further includes vehicle specifying information for specifying a vehicle in which the map information is used and version information indicating the version of the map information. In the step (d), the vehicle specifying information and the version information are encrypted.

A production method according to a 12th disclosure is the production method according to the 11th disclosure. The temporary security information is encrypted in advance. The method further includes a step (i) decrypting the encrypted temporary security information. In the method, the step (i) is performed after the step (b), and the step (c) is performed after the step (i).

A production method according to a 13th disclosure is the production method according any one of the first to 12th disclosures. The recording medium is an SD memory card. The recording area includes a user area in which the user can rewrite data and a non-user area in which the user cannot rewrite data. The medium specifying information is recorded in advance in the non-user area. In the step (a), the temporary security information and the content information are written in the user area. In the step (b), a read command for reading the medium specifying information from the non-user area is transmitted to the recording medium, the medium specifying information transmitted from the recording medium in response to the read command is acquired to read the medium specifying information, and the temporary security information is read from the user area.

A production method according to a 14th disclosure, in any one of the first to 13th disclosures, further includes a step (j) receiving a notification indicating that preparation of the recording medium as a recording target has been completed. The method performs the step (a) after receiving the notification.

A production method according to a 15th disclosure is the production method according to the 14th disclosure. The notification received in the step (j) is a signal indicating that preparation of a plurality of the recording media is completed.

A production method according to a 16th disclosure is the production method according any one of the fourth, fifth, eighth, and ninth disclosures. There are a plurality of the recording media. The error notification includes information specifying the recording medium, among the plurality of recording media, in which the verification result indicates a mismatch.

An apparatus according to a 17th disclosure according to an exemplary embodiment of the present invention includes a communications interface that communicates with an external device, a storage device, and an arithmetic circuit, and executes the production method according to any one of the first to 16th disclosures by using the arithmetic circuit. The storage device stores the content information and the temporary security information including the given information.

In response to reception of the signal, the arithmetic circuit reads the content information and the temporary security information from the storage device, transmits the content information and the temporary security information to a function inspection device via the communications interface, causes the function inspection device to execute the steps (a) and (b), receives the medium specifying information and the temporary security information from the function inspection device via the communications interface, executes the step (d), transmits the security information generated by executing the step (d) to the function inspection device via the communications interface, and causes the function inspection device to execute the step (e).

A computer program according to an 18th disclosure according to an exemplary embodiment of the present invention is configured to cause the arithmetic circuit of the apparatus according to the 17th disclosure to execute a process of reading the content information and the temporary security information from the storage device, a process of causing the function inspection device to transmit the content information and the temporary security information via the communications interface, a process of causing the function inspection device to transmit a command for executing the steps (a) and (b), a process of receiving the medium specifying information and the temporary security information from the function inspection device via the communications interface, a process of executing the step (d), a process of causing the function inspection device to transmit the security information generated by executing the step (d) via the communications interface, and a process of causing the function inspection device to transmit a command for executing the step (e).

According to an exemplary embodiment of the present invention, it is possible to provide a technique for ensuring the proper use of a map or other contents duplicated to a recording medium.

Embodiments will be described in detail below with reference to the accompanying drawings as appropriate. However, detailed descriptions more than necessary may be omitted. For example, detailed description of an already well-known matter and a duplicate description of substantially the same configuration may be omitted. This is to avoid unnecessary redundancy of the following description and to facilitate the understanding of those skilled in the art.

It should be noted that the present inventors provide the accompanying drawings and the following description in order to allow those skilled in the art to fully understand the present disclosure and does not intend to make them limit the subject matter described in the claims.

First, the background of completing the present invention by the present inventors will be described, and thereafter, a method and an apparatus and the like for producing a recording medium constituting the present invention will be described.

The present inventors have conducted development assuming an application of updating existing map information used by a car navigation apparatus using a secure digital (SD) memory card. The SD memory card stores map information for update in advance, and the user loads the SD memory card into the car navigation apparatus to update the existing map information. The present inventors have studied measures for making map information for update unusable even when the map information is duplicated by a person other than a map provider. Hereinafter, the measures will be specifically described.

Note that map information is not necessarily for update. Therefore, in the following description, information indicating a map will be described as "map information " regardless of whether it is for update. The map referred to herein may be, for example, a map of any country or region in the world, a map of a part of the country or region, or a map for updating only a region changed after a predetermined time. In addition, an SD memory card will be described below as an example, but the SD memory card is not essential, and any recording medium can be adopted.

[Configuration of SD Memory Card] The measure studied by the present inventors uses information uniquely assigned to each SD memory card and recorded in the SD memory card. Therefore, first, the structure of the SD memory card will be described with reference to <FIG>. Hereinafter, the term "interface" is referred to as "I/F".

An SD memory card <NUM> includes a pin I/F <NUM>, an I/F driver <NUM>, an I/F controller <NUM>, a power-on detector <NUM>, a register group <NUM>, a flash memory controller <NUM>, and a flash memory <NUM>.

The pin I/F <NUM> includes <NUM> pins. The nine pins include, for example, a data input/output pin, a card detection pin, a ground pin, a power supply pin, and a clock signal pin. In order to avoid direct contact of the user's finger with the pins, each of the nine pins is partitioned by a guard (not shown).

The I/F driver <NUM> receives a command or an instruction and data from the host device in which SD memory card <NUM> is used and converts the command or the instruction and the data into an appropriate data format. The host device is a device loaded with the SD memory card <NUM>, for example, a car navigation apparatus or a PC. The I/F driver <NUM> reads data in the flash memory <NUM> and information in a register, converts the data into an appropriate data format, and transmits the data to the host device via the pin group <NUM>. Note that data is transmitted and received between the SD memory card <NUM> and the host device in synchronization with a clock signal supplied from the host device.

The I/F controller <NUM> is connected to various elements constituting the SD memory card <NUM>. The I/F controller <NUM> is connected to, for example, the I/F driver <NUM> and gives a command to the I/F driver <NUM> so that the I/F driver <NUM> performs the above-described operation. The I/F controller <NUM> is also connected to the register group <NUM>, the power-on detector <NUM>, and the flash memory controller <NUM>, and can communicate with each of them.

The power-on detector <NUM> determines whether the SD memory card <NUM> is connected to the host device and the power is turned on upon being attached to the host device.

The register group <NUM> includes a plurality of registers. For example, the register group <NUM> includes a card identification (CID) register <NUM> a. Information that can uniquely identify any SD memory card is stored in advance in the CID register <NUM> a. Such information is referred to as "CID" or "medium specifying information" in the present specification. Note that "in advance" means at a point of time when the manufacturer of the SD memory card <NUM> completes the manufacturing. In relation to the present embodiment, the CID is already stored in the SD memory card <NUM> at the time when the map information is recorded in the SD memory card <NUM> by the map vendor who is the sales supplier of the map information. Hereinafter, the manufacturer of the SD memory card <NUM> will be simply referred to as the "manufacturer".

The CID is a set of various pieces of information. For example, the CID includes an identification (ID) for identifying the manufacturer of the SD memory card <NUM> and the information of the name, revision, serial number, and manufacturing date of the product. The CID is no longer changed after being written to each SD memory card <NUM> by the manufacturer and is only read out. The host device can read the CID by transmitting a special command to the SD memory card <NUM>.

The flash memory controller <NUM> performs control to write data to the flash memory <NUM> and performs control to read data from the flash memory <NUM>.

The flash memory <NUM> has, for example, a large-capacity recordable area of <NUM> GB (gigabyte) and stores content information. The "content" may be a map, music, or video. In a case where the SD memory card <NUM> is used in a car navigation apparatus, the content may include latest installation position data of ORBIS(TM), and update data of an operation system (OS) that controls the operation of the car navigation apparatus or a system of an automobile. In this specification, such information indicating a content is described as "content information". Note that, in the present specification, map information will be described as an example for convenience of understanding.

A recording area <NUM> of the SD memory card <NUM> is illustrated in <FIG>. The recording area <NUM> can be roughly divided into a non-user area <NUM> and a user area <NUM>. Further, the non-user area <NUM> includes a firmware area 121a and a management area 121b.

Information unrewritable by the user is recorded in the non-user area <NUM>, and information rewritable by the user is recorded in the user area <NUM>. Unlike the illustrated aspect, in reality, the recording area <NUM> need not be provided as a continuous memory space. The recording area in which the non-rewritable information is recorded is merely conceptually referred to as the "non-user area <NUM>", and the recording area in which the rewritable information is recorded is merely conceptually referred to as the "user area <NUM>". After it is confirmed that the SD memory card <NUM> properly operates in the factory of the manufacturer, the recording area <NUM> illustrated in <FIG> is formed in the SD memory card <NUM>.

Firmware is recorded in the firmware area 121a of the non-user area <NUM>. The firmware is a program for operating the flash memory controller <NUM>. Various management information is recorded in the management area 121b. The management information includes information recorded in various registers constituting the register group <NUM>. That is, the various registers constitute the management area 121b. The CID described above is an example of the management information.

The user area <NUM> is an area secured in the flash memory <NUM>. In the user area <NUM>, map information and the like are recorded in a readable/writable manner.

The host device connected to the SD memory card <NUM> can read data in the user area <NUM> at any time but cannot normally access non-user area <NUM>. Only the host device in which a command for reading the management information recorded in the management area 121b in the non-user area <NUM> is implemented can access the non-user area <NUM>. For example, the manufacturer of the SD memory card <NUM> owns a PC which is a host device in which such a command is implemented.

Now, as an aspect of distributing the map information through a regular distribution route, it is considered that a map vendor sells the SD memory card <NUM> in which the map information is recorded. Since the map information is recorded in the user area <NUM> of the SD memory card <NUM>, the map information can be technically easily copied to another SD memory card by using a PC or the like. It is necessary to prevent such copied map information from being illegally used. The present inventors have studied a method of associating map information with the SD memory card <NUM> in which the map information is recorded. The use of the map information read from the SD memory card <NUM> associated with each other is permitted, and the use of non-associated map information is restricted. A mechanism for guaranteeing such operation is required.

Therefore, the present inventors have introduced a mechanism of generating security information obtained by encrypting the CID and the like of each SD memory card <NUM> in which the map information is recorded and determining whether or not to permit the use of the map information using the security information. In the car navigation apparatus, a command to read the CID of the loaded recording medium is implemented, and it is determined whether the CID read using the command matches the CID encrypted in the map information. Then, the car navigation apparatus permits the use of the map information only when both the pieces of information coincide with each other.

Although the above measures seem to be easily implemented at a glance, there is actually a large problem. The problem is that the map vendor cannot read the CIDs of many SD memory cards to be distributed and hence cannot create security information by encrypting the CIDs and the like by itself.

In order to avoid the above problem, the present inventors adopted the following measures.

The temporary security information may further include vehicle specifying information for specifying a vehicle in which the map information is used and version information indicating the version of the map information. Note that, in a situation where the SD memory card <NUM> is not sold, there may be a case where it is difficult to specify a vehicle in which the map information is actually used, that is, a case where it is difficult to determine the vehicle specifying information. In such a case, the vehicle specifying information common to all SD memory cards <NUM> may be allocated. Such common vehicle specifying information may be rewritten to vehicle specifying information that uniquely specifies the vehicle at a predetermined timing after the vehicle is used for the vehicle of each user after sale.

In the process (<NUM>), the manufacturer needs to encrypt the CID of each SD memory card <NUM>. For a map vendor, since the encryption method is fundamental to security, it is desirable to avoid disclosing a specific encryption method to the outside of the company as much as possible. In addition, it is desirable to avoid disclosing the method for decrypting the encrypted CID to the outside of the company as much as possible. Therefore, the map vendor provides the manufacturer with software or a library for performing encryption without disclosing a specific specification. Since a specific encryption process performed by the library usually cannot be easily known, a map vendor can avoid specific disclosure of an encryption method to be held. In the process (<NUM>), even when decoding is necessary, software or a library for performing decoding may be similarly provided to the manufacturer.

On the other hand, the manufacturer can also avoid disclosing the CID itself of each SD memory card <NUM> or a command for reading the CID to the outside of the company. This makes it possible to encrypt the CIDs of the individual SD memory cards <NUM> while considering both businesses.

By introducing the above-described mechanism, even if the security information created in the process (<NUM>) is stolen and leaked to the outside, the unauthorized use of the map information recorded in another SD memory card <NUM> can be avoided. This is because even if the leaked security information is used, the CID in the security information does not match the CIDs of other SD memory cards, and the map information cannot be used by any SD memory card <NUM>. In addition, a command for reading the CID and an encryption method for creating new security information using the CID are not generally available. Therefore, valid security information cannot be written in arbitrary SD memory card <NUM>.

By the above method, it is possible to provide a mechanism for preventing the unauthorized use of the map information recorded and distributed in the SD memory card <NUM>.

Hereinafter, exemplary embodiments of the present invention will be described.

Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the accompanying drawings.

First, the configuration of a production system <NUM> that produces a recording medium will be described with reference to <FIG>.

The production system <NUM> includes a PC <NUM>, a display <NUM>, a function inspection device <NUM>, and an indicator <NUM>.

The PC <NUM> is a computer system that executes processing described in a flowchart to be described later. The specific configuration of the PC <NUM> will be described later with reference to <FIG>. The PC <NUM> may be a computer in another form, for example, a workstation or a tablet terminal. A universal serial bus (USB) dongle <NUM> to be described later can be connected to the PC <NUM>. In the present embodiment, an encryption program executed by the PC <NUM> is recorded in the USB dongle <NUM>. The display <NUM> is connected to the PC <NUM> and displays video information output from the PC <NUM>.

The function inspection device <NUM> is connected to the PC <NUM> and used to inspect the SD memory card <NUM> together with the PC <NUM>. The function inspection device <NUM> includes a central board <NUM>, a tester base <NUM>, and an SD tester <NUM>. The central board <NUM> and the SD tester <NUM> are disposed on the tester base <NUM>.

The central board <NUM> of the function inspection device <NUM> is connected to the PC <NUM> and the indicator <NUM> and inspects the function of the SD memory card <NUM> loaded in the SD tester <NUM> according to a command from the PC <NUM>. The central board <NUM> and the PC <NUM> are connected via, for example, a USB cable <NUM>. The central board <NUM> and the indicator <NUM> are connected via, for example, an RJ-<NUM> cable <NUM>. Further, the indicator <NUM> and the PC <NUM> are connected via, for example, a USB cable <NUM>.

The SD tester <NUM> of the function inspection device <NUM> is provided with a plurality of terminals. When the SD memory card <NUM> is loaded into the SD tester <NUM>, each terminal of the SD tester <NUM> is communicably connected to each pin of the pin I/F <NUM> (<FIG>).

An outline of the function inspection of the SD memory card <NUM> is as follows. First, when the SD memory card <NUM> is loaded, the central board <NUM> of the function inspection device <NUM> transmits a notification indicating that the preparation of the recording medium is completed to the PC <NUM> automatically upon detecting the loading or by a user operation. The PC <NUM> having received the notification transmits a write command or a read command to the central board <NUM>. In response to the content of the command, the central board <NUM> writes information to the SD memory card <NUM> or reads information written to the SD memory card <NUM> via each terminal of the SD tester <NUM> and each pin of the SD memory card <NUM>. The central board <NUM> sends the read information to the PC <NUM>. The PC <NUM> verifies whether or not the information received from the SD tester <NUM> matches the information instructed to be written. When the verification result indicates a match, the recording of the information in the SD memory card <NUM> and the reading of the information from the SD memory card <NUM> are correctly performed. In contrast to this, when the verification result indicates a mismatch, at least one of recording and reading of information in SD memory card <NUM> is not correctly performed. Such a verification operation is referred to as operation verification of the SD memory card <NUM>.

In the present embodiment, the SD tester <NUM> has an arrangement frame (not illustrated) for loading a plurality of SD memory cards <NUM>. For example, a total of <NUM> SD memory cards <NUM> of <NUM> rows × <NUM> columns are loaded in the arrangement frame of the SD tester <NUM>, and the above-described operation verification can be independently performed for each SD memory card <NUM>. As a result of the operation verification of each SD memory card <NUM>, when there is the SD memory card <NUM> whose verification result indicates a mismatch, the PC <NUM> or the function inspection device <NUM> notifies an error using the indicator <NUM>.

The indicator <NUM> is a board-like device having a plurality of point light sources <NUM>. Each point light source <NUM> is, for example, a light emitting diode (LED) or an incandescent light bulb. As illustrated in <FIG>, the plurality of point light sources <NUM> are arranged in the same numbers of rows and columns as the numbers of rows and columns of the arrangement frame of the SD tester <NUM>. The indicator <NUM> notifies the user of the production system <NUM> of an error by turning on the point light source <NUM> at a position corresponding to the position of the SD memory card <NUM> whose verification result described above indicates a mismatch. For example, when the verification result of the SD memory card <NUM> loaded in the second row and the third column of the arrangement frame of the SD tester <NUM> indicates a mismatch, the indicator <NUM> turns on the point light source <NUM> in the second row and the third column by a signal from the PC <NUM> or the function inspection device <NUM>. A method of lighting the point light source <NUM> is arbitrary. For example, the point light source <NUM> may be changed from the turn-off state to the turn-on state or may blink.

Next, the configuration of the PC <NUM> will be described with reference to <FIG>.

As illustrated in <FIG>, the PC <NUM> includes an arithmetic circuit <NUM>, a storage device <NUM>, and a communications I/F <NUM>. The arithmetic circuit <NUM> is a computer mounted on the PC <NUM> and is a semiconductor integrated circuit called a CPU. Hereinafter, the arithmetic circuit <NUM> will be referred to as the "CPU <NUM>". The communications I/F <NUM> is a terminal for performing communication conforming to a communications standard such as USB (registered trademark) and/or Ethernet (registered trademark). <FIG> illustrates the USB dongle <NUM> connected to a USB terminal which is the communications I/F <NUM> and the USB cables <NUM> and <NUM>. The PC <NUM> may perform wireless communication conforming to, for example, the IEEE <NUM> standard. In that case, the communications I/F <NUM> may be a wireless communications circuit.

For convenience of description, it will be described below that the PC <NUM> or the CPU <NUM> exchanges information with an external device such as the function inspection device <NUM> and the indicator <NUM>. However, the CPU <NUM> actually transmits information to the external device and instructs the communications I/F <NUM> or controls the communications I/F <NUM> to receive information from the external device.

The storage device <NUM> is a secondary storage device such as a random access memory (RAM), a read only memory (ROM), and/or a hard disk drive. The storage device <NUM> stores a computer program 204a. For example, the ROM which is the storage device <NUM> stores the computer program 204a. The computer program 204a is read by the CPU <NUM> and developed in the RAM that is also the storage device <NUM>. Thus, the CPU <NUM> can execute the computer program 204a. The operation of the PC <NUM> described below is implemented by the computer program 204a installed and executed in the PC <NUM>.

The storage device <NUM> also stores map information and security information to be described later. The map information is an example of content information and is stored and distributed in the SD memory card <NUM>. The security information is information used to determine whether to permit the use of the map information and is generated by encrypting at least the CID of the specific SD memory card <NUM> by a predetermined encryption method. In the present embodiment, in addition to the CID, the security information includes the initial value of the vehicle specifying information and encrypted version information indicating the version of the map information. A specific description of the encryption process will be given later.

Note that the "vehicle specifying information " is information for specifying a vehicle in which the map information is used and for example, a chassis number, a vehicle identification number (VIN), the manufacturing number of a device mounted on the vehicle, or the like can be used. However, at the time of shipment of the SD memory card <NUM>, in which vehicle each SD memory card <NUM> is used cannot be determined. That is, the map vendor and the manufacturer cannot determine vehicle specifying information. Therefore, the initial value of predetermined vehicle specifying information is written in security information. The initial value is rewritten to the vehicle specifying information of a specific vehicle after the specific vehicle starts to be used in the future. The vehicle specifying information, the CID, and the version information are written in the SD memory card <NUM> as one encrypted file. The file may also be referred to as a "vehicle specifying file".

[Production Processing of Golden Sample in Map Vendor] Next, processing performed by a map vendor that is a sales supplier of map information will be described with reference to <FIG>.

The map vendor sends map information indicating a map and security information used to determine whether to permit the use of the map to a manufacturer. The processing performed by the map vendor and the procedure of the processing are illustrated in <FIG>.

First, the map vendor prepares a specific SD memory card whose CID is known. <FIG> illustrates the SD memory card as an SD memory card <NUM> in which a known CID-G <NUM> is recorded. Such SD memory card <NUM> can be, for example, the SD memory card <NUM> specifically provided by the manufacturer to the map vendor with information indicating the CID <NUM>.

Process (<NUM>) in <FIG> shows a state in which the CID-G <NUM> is input to the PC <NUM> of the map vendor. Process (<NUM>) also shows that vehicle specifying information <NUM>, map version information <NUM>, and map information <NUM> are input to the PC <NUM> of the map vendor. As described above, the vehicle specifying information <NUM> is a predetermined initial value. Note that the hardware configuration of the PC <NUM> of the map vendor is the same as that in <FIG> and hence is not illustrated.

In process (<NUM>) in <FIG>, the PC <NUM> of the map vendor encrypts the CID-G <NUM>, the vehicle specifying information <NUM>, and the map version information <NUM> by a predetermined encryption method. As the encryption method, for example, a reversible encryption method using a prepared private key, a reversible encryption method using a public encryption key acquired in advance from a manufacturer, and an irreversible encryption method using a hash function can be adopted. The private key and hash function prepared in advance are shared in advance between the map vendor and the manufacturer. The private key may also be referred to as a common key. Note that it is not essential to encrypt the CID-G <NUM>, the vehicle specifying information <NUM>, and the map version information <NUM>.

Temporary security information <NUM> is generated by encryption processing. The temporary security information <NUM> includes encrypted CID-G 308a, vehicle specifying information 308b, and map version information 308c. In the drawings of <FIG> and <FIG> and subsequent Figs, "*" is added to the name of information to indicate that the information is encrypted.

Next, the PC <NUM> of the map vendor executes process (<NUM>). In process (<NUM>), the PC <NUM> of the map vendor duplicates the map information <NUM> and the generated temporary security information <NUM> to the user area <NUM> (<FIG>) of the SD memory card <NUM>. As a result, in addition to the map information <NUM>, the CID-G <NUM> for uniquely identifying itself and the temporary security information <NUM> are recorded in the SD memory card <NUM>. At this point, since the CID-G <NUM> and the CID-G 308a in the temporary security information <NUM> match, it can be said that the SD memory card <NUM> is a valid SD memory card. The SD memory card <NUM> obtained by process (<NUM>) is also referred to as a "golden sample". In addition, in the present specification, the memory card <NUM> may be referred to as a "host recording medium".

The word "golden sample" as used in the manufacturing industry refers to a sample of a final product made by the manufacturer of the product. On the other hand, the "golden sample" as used in this specification is not strictly a sample of the final product. This is because the contents of the SD memory card <NUM> are not directly distributed to consumers as described later. In each SD memory card <NUM> sold to each consumer, the encrypted CID-G 308a in the security information <NUM> is rewritten and distributed using each CID.

In view of such circumstances, it is not essential that the CID-G 308a is included in the temporary security information <NUM> included in the golden sample, and any dummy data may be included. It is also not essential that it is encrypted. For example, any data having the same number of bits as the number of bits of the CID-G <NUM> of the SD memory card <NUM> may be used. This is because it is sufficient that the CID recorded in the non-user area and the encrypted CID in the security information correspond to each other on the SD memory card <NUM> at the time of distribution to the consumer.

Finally, in process (<NUM>), the map vendor sends the obtained SD memory card <NUM> to the manufacturer.

Next, following process (<NUM>) by the map vendor, processes (<NUM>) to (<NUM>) on the manufacturer side that has received the golden sample from the map vendor will be described with reference to <FIG>. The manufacturer copies the map information to many and unspecified SD memory cards <NUM> using the PC <NUM> illustrated in <FIG>, records the security information obtained by encrypting the CID of each SD memory card <NUM>, and produces an SD memory card as a final product.

In process (<NUM>), the PC <NUM> of the manufacturer reads the map information <NUM> and the temporary security information <NUM> from the SD memory card <NUM> obtained from the map vendor and stores the map information <NUM> and the temporary security information <NUM> in the storage device <NUM>. That is, the PC <NUM> copies the map information <NUM> and the temporary security information <NUM> from the SD memory card <NUM> which is a host recording medium to the storage device <NUM> which is a recording medium different from an SD memory card 100A to be described later.

In process (<NUM>), the PC <NUM> copies the map information <NUM> and the temporary security information <NUM> stored in the PC <NUM> to the new SD memory card 100A prepared by the manufacturer. A CID-A <NUM> of the SD memory card 100A is recorded in the management area 121b of the SD memory card 100A. At this point, the encrypted CID-G 308a, the vehicle specifying information 308b, and the map version information 308c are present in the temporary security information <NUM>.

The SD memory card 100A is loaded in the SD tester <NUM> of the function inspection device <NUM> (<FIG>). The operation of writing and/or reading information to and from the SD memory card 100A by the PC <NUM> is performed via the central board <NUM>. In order to simplify the description, the description of being performed via the central board <NUM> will be omitted, and the PC <NUM> will be described as reading and writing information.

In process (<NUM>), the PC <NUM> decrypts the temporary security information <NUM> stored in the SD memory card 100A. As a result, the decrypted CID-G 308a, vehicle specifying information 308b, and map version information 308c are obtained.

Next, in process (<NUM>), the PC <NUM> reads the CID-A <NUM> from the SD memory card 100A. Specifically, the PC <NUM> transmits a command for reading the CID known to the PC <NUM> to the SD memory card 100A to acquire the CID-A <NUM>. Then, the decrypted CID-G 308a obtained in process (<NUM>) is replaced with the read CID-A <NUM>. As a result, security information <NUM> including CID-A <NUM>, the vehicle specifying information 308b, and the map version information 308c is obtained.

The processing of generating the security information <NUM> from the security information <NUM> will be described more specifically with reference to <FIG>.

In the case of the SD memory card <NUM> and the SD memory card 100A manufactured by the same manufacturer, it can be assumed that the CID-G <NUM> and the CID-A <NUM> are expressed by numerical strings of the same number of bits. Therefore, when the head bit of the read CID-A <NUM> is arranged at the head bit position of the CID-G 308a in the decrypted security information <NUM>, and the CID-G 308a is subsequently replaced with the CID-A <NUM>, the CID-G 308a can be replaced with the CID-A <NUM> without shifting from the original CID-G 308a by <NUM> bit. When the CID-G 308a of the temporary security information <NUM> is rewritten to the CID-A <NUM>, the security information <NUM> unique to the SD memory card 100A is obtained.

Note that, in the above description, an example has been described in which the security information <NUM> is decrypted, but the security information can be rewritten even in an encrypted state. For example, in the encrypted temporary security information <NUM>, the CID-G <NUM>, the vehicle specifying information 308b, and the map version information 308c are separably present, and the head bit position and the data length of each are fixed. The CID-A <NUM> is read and encrypted in advance. The PC <NUM> may write the encrypted CID-A <NUM> from the head bit position of the CID-G 308a. However, at this time, the data lengths of the encrypted CID-G <NUM> and CID-A <NUM> also need to match. Also with such process, it is possible to rewrite the encrypted CID-G 308a to the encrypted CID-A 322a without shifting from the encrypted CID-G 308a even by <NUM> bit. When the encrypted CID-G 308a of the security information <NUM> is rewritten to the encrypted CID-A 322a, the security information <NUM> is obtained.

In process (<NUM>), the PC <NUM> encrypts the security information <NUM> by the encryption method designated by the map vendor. For example, the map vendor provides the manufacturer with the USB dongle <NUM> storing software or a library for performing encryption by a predetermined encryption method. When the PC <NUM> inputs the security information <NUM> to the software or library, the encrypted security information <NUM> is output as a result of the processing. The PC <NUM> rewrites the temporary security information <NUM> already existing in the SD memory card 100A to the encrypted security information <NUM>. The map information <NUM> is maintained as it is, and the CID-A <NUM> recorded in the non-rewritable non-user area <NUM> is also maintained as it is. The map information <NUM> is maintained as it is, and the CID-A <NUM> recorded in the non-rewritable non-user area <NUM> is also maintained as it is. As a result, the CID-A <NUM>, the map information <NUM>, and the encrypted security information <NUM> are recorded in the SD memory card 100A.

By the operation of the PC <NUM> described above, the security information <NUM> of the SD memory card 100A newly prepared on the manufacturer side includes the CID-A <NUM> of the SD memory card 100A. As a result, it is possible to implement a mechanism for permitting the use of the map information <NUM> only when the CID of the SD memory card is encrypted and included in the security information. Even if the map information <NUM> is duplicated or the like, the unauthorized use of the map information <NUM> can be avoided.

Note that processes (<NUM>) to (<NUM>) of creating the security information <NUM> described above each are an example, and various modifications can be considered. For example, the PC <NUM> extracts the vehicle specifying information 308b and the map version information 308c from the security information <NUM> obtained by process (<NUM>). The PC <NUM> creates the security information <NUM> by arranging the CID-A <NUM>, the vehicle specifying information 308b, and the map version information 308c on the memory, for example, in the order illustrated in <FIG>. Then, the PC <NUM> may encrypt the security information <NUM> and rewrite the security information <NUM> in the SD memory card 100A to the encrypted security information <NUM>.

In conclusion, according to the above-described process and the modification thereof, it can be said that the encrypted temporary security information <NUM> in the SD memory card 100A obtained by process (<NUM>) is rewritten to the encrypted security information <NUM>. Even if a method other than the above-described processing is adopted, it is within the scope of the present invention in a case where the encrypted temporary security information <NUM> is rewritten to the encrypted security information <NUM>.

The above processing has been described using only one SD memory card for convenience. The function inspection device <NUM> can be loaded with a plurality of SD memory cards <NUM>, and information can be written and read independently and in parallel to each of the SD memory cards. For example, <FIG> illustrates an arrangement example of a plurality of SD memory cards 100A to 100Z loaded in the SD tester <NUM>. Further, the transition of information recorded in each of the SD memory cards 100A to 100Z is illustrated in <FIG>.

The SD memory cards 100A to 100Z are in a state in which there is no information in each user area <NUM>, that is, in a blank state <NUM>. Through the above processing, the common map information <NUM> and the temporary security information <NUM> are recorded in the user areas <NUM> of the SD memory cards 100A to 100Z. As a result, the SD memory cards 100A to 100Z transition to a state <NUM> in which the golden sample is simply duplicated. Thereafter, the temporary security information <NUM> of each of the SD memory cards 100A to 100Z is rewritten to a corresponding one of pieces of security information <NUM>, <NUM>,•••, and <NUM> respectively corresponding to the CIDs of the SD memory cards 100A to 100Z. As a result, the state transitions to a state <NUM> in which each of the pieces of security information <NUM>, <NUM>, •••, and <NUM> of the SD memory cards 100A to 100Z is recorded.

In this manner, all the SD memory cards loaded in the SD tester <NUM> each can be rewritten to the security information corresponding to each CID.

Next, the processing of the PC <NUM> described above will be described with reference to <FIG>. Hereinafter, the CID will be described as "medium specifying information", and an SD memory card will be simply described as a "card".

In step S10, the CPU <NUM> of the PC <NUM> receives a signal indicating that the preparation of all the cards is completed from the function inspection device <NUM>. In next step S11, the CPU <NUM> transmits the content information of the golden sample and the temporary security information to the function inspection device <NUM>.

In step S12, the CPU <NUM> transmits a command to the function inspection device <NUM> to write the content information of the golden sample and the temporary security information in the user area of each card. More specific processing in this step will be described later.

In step S13, the CPU <NUM> transmits a command for requesting the function inspection device <NUM> to read the temporary security information and the medium specifying information. As a result, the CPU <NUM> causes the function inspection device <NUM> to read the temporary security information from the user area of each card, read the medium specifying information from the non-user area, and transmit each piece of temporary security information and the medium specifying information to the PC <NUM>. In step S14, the CPU <NUM> receives the temporary security information and the medium specifying information from the function inspection device <NUM>.

In step S15, the CPU <NUM> decrypts the received temporary security information, generates security information by replacing the medium specifying information of the golden sample in the temporary security information with each piece of medium specifying information, and encrypts the security information. As described above, the encryption uses software or a library for encryption provided by a map vendor.

In step S16, the CPU <NUM> transmits the command and the encrypted security information to the function inspection device <NUM> and rewrites the temporary security information recorded in each card with the encrypted security information.

Through the above processing, the PC <NUM> can record the map information <NUM> and the each of the pieces of security information <NUM>, <NUM>, and <NUM> rewritten according to the medium specifying information of each SD memory card <NUM> in each SD memory card <NUM> loaded in the function inspection device <NUM>. Note that although it is preferable that step S10 described above is actually performed, it is not essential and can be omitted.

Next, details of the processing in steps S12 and S16 will be described. Both steps are processes for verifying that writing to the card has been appropriately performed.

First, details of step S12 will be described with reference to <FIG>.

In step S121, the CPU <NUM> of the PC <NUM> transmits, to the function inspection device <NUM>, a command to write to the user area <NUM> of each card, the map information <NUM> to be written, and the security information <NUM> of the golden sample.

In step S122, the CPU <NUM> receives a notification of completion of writing from the function inspection device <NUM>.

Subsequent step S123 and subsequent steps are the processing of verifying whether information to be written has been correctly written. In step S123, the CPU <NUM> transmits, to the function inspection device <NUM>, a command to read the map information and the security information written in the user area <NUM> of each card. The read command includes a command to transmit the read information to the CPU <NUM>.

In step S124, the CPU <NUM> receives the map information and the security information read from the user area <NUM> of each card from the function inspection device <NUM>.

In step S125, the CPU <NUM> verifies whether or not the map information <NUM> transmitted to the function inspection device <NUM> matches the map information received from the function inspection device <NUM> for all the cards. Similarly, the CPU <NUM> verifies whether the security information <NUM> transmitted to the function inspection device <NUM> and the security information received from the function inspection device <NUM> match or mismatch for all the cards.

In step S126, the CPU <NUM> determines whether the verification results of all the cards indicate matches. If YES in step S126, the CPU <NUM> ends the processing in step S12 and proceeds to the processing in step S13 in <FIG>. In contrast to this, if even one verification result indicates a mismatch, the process proceeds to step S127.

In step S127, the CPU <NUM> acquires a notification of the position of the card indicating the mismatch from the function inspection device <NUM>. The CPU <NUM> turns on the point light source <NUM> at the position corresponding to the position of the card indicating the notified mismatch in the indicator <NUM> to notify the user of the error.

In step S128, the CPU <NUM> determines whether or not the error notification is the first time. In a case where the error notification is performed for the first time, that is, in a case where the error is notified for the first time, the process is retried from step S121. At this time, the manufacturer checks, for example, whether there is a contact failure between each terminal of the SD tester <NUM> and each pin of the card. Empirically, it has been found that a write error associated with a contact failure often occurs. Therefore, when the process is started again from step S121 after the contact failure is confirmed, the verification result indicates a match in many cases.

In contrast to this, in a case where the error notification has been performed before and this is the second time the notification has been performed, the CPU <NUM> determines that an error is present in the card and stops the process.

Next, the details of step S16 in <FIG> will be described with reference to <FIG>.

In step S161, the CPU <NUM> of the PC <NUM> transmits, to the function inspection device <NUM>, an information rewrite command and encrypted security information of each card used for rewriting. In response to the rewrite command, the function inspection device <NUM> rewrites the temporary security information <NUM> to the encrypted security information <NUM> for each card. In step S162, the CPU <NUM> receives a notification of completion of rewriting from the function inspection device <NUM>.

In step S163, the CPU <NUM> transmits a command to read the security information of each card to the function inspection device <NUM>. In response to the read command, the function inspection device <NUM> reads the security information of each card. In step S164, the CPU <NUM> receives the security information read from each card from the function inspection device <NUM>.

In step S165, after transmitting information of all the cards to the function inspection device <NUM>, the CPU <NUM> verifies whether or not the encrypted security information that has been held matches the security information received from the function inspection device <NUM>.

The processing in steps S166, S167, and S168 is the same as the processing in steps S126, S127, and S128 in <FIG>, respectively.

In step S166, the CPU <NUM> determines whether or not the verification result indicates a match. If the verification result indicates a match, the CPU <NUM> ends the processing in step S16. That is, the process in <FIG> is also ended. In contrast to this, in a case where even one verification result indicates a mismatch, the process proceeds to step S167.

In step S167, the CPU <NUM> acquires a notification of the position of the card indicating the mismatch from the function inspection device <NUM>. The CPU <NUM> turns on the point light source <NUM> at the position corresponding to the position of the card indicating the notified mismatch in the indicator <NUM> to notify the user of the error.

In step S168, the CPU <NUM> determines whether or not the error notification is the first time. In a case where the error notification is performed for the first time, that is, in a case where the error notification is performed for the first time, the process is retried from step S161. At this time, the manufacturer checks, for example, whether there is a contact failure between each terminal of the SD tester <NUM> and each pin of the card.

The map information and the security information are recorded in the user area <NUM> of the SD memory card <NUM> produced by the above processing. The security information includes the version information, the CID of each SD memory card <NUM>, and the vehicle specifying information in an encrypted manner. When the map information is copied to another SD memory card together with the security information or without the security information, the car navigation apparatus does not permit the use of the map information. This is because there is no security information including the CID of the SD memory card as the copy destination. Accordingly, even if the map information is distributed using SD memory cards, only the user who has properly purchased the map information from the map vendor can use the map information in the car navigation apparatus.

In the above-described example of the SD memory card <NUM>, it has been described that the CID of the SD memory card <NUM> is recorded in the management area <NUM> b in the non-user area <NUM>. Since the user cannot rewrite the data of the non-user area <NUM>, when the CID is recorded in the management area 121b, falsification of the CID can be prevented, and security can be further maintained. However, a memory card may be configured such that such that the CID is stored in the memory card provided with only the user area in which the non-user area <NUM> does not exist and the user can rewrite the security information based on the CID.

In the above description, the temporary security information recorded in SD memory card <NUM> is overwritten with the encrypted security information. However, the rewriting process by overwriting is not essential. For example, the temporary security information <NUM> is moved from SD memory card 100A to a memory or another recording medium of PC <NUM>, and the temporary security information <NUM> is temporarily erased from the SD memory card <NUM>. Thereafter, the security information <NUM> generated by the PC <NUM> may be written in the recording area of the SD memory card 100A. Alternatively, the security information <NUM> generated by the PC <NUM> may be additionally written while the temporary security information <NUM> is left on the SD memory card 100A. In short, the security information <NUM> may be finally recorded on the SD memory card 100A.

The embodiments of the present invention have been described above. The present invention is not limited to the above-described embodiments, and other embodiments in which changes, replacements, additions, omissions, and the like are appropriately made are also within the scope of the present invention. For example, whether to permit the use of the map information recorded in an SD memory card is determined using the CID of the SD memory card in the security information. Therefore, the security information only needs to include at least the CID of an SD memory card and does not necessarily include the version information of a map and/or vehicle specifying information.

Claim 1:
A method for producing a recording medium having a recording area in which content information indicating a content and security information for security for the content information are recorded,
in the recording area, medium specifying information for uniquely identifying the recording medium itself being recorded in advance,
the method comprising steps of:
(a) writing temporary security information and the content information in the recording area, the temporary security information including given information different from the medium specifying information;
(b) reading the medium specifying information and the temporary security information from the recording area;
(c) replacing the given information in the temporary security information with the medium specifying information;
(d) encrypting the temporary security information in which the given information is replaced with the medium specifying information to generate the security information; and
(e) causing the security information generated in the step (d) to be recorded in the recording area.