Method and system for transferring data

A transfer processing method for transferring, in addition to key data for decryption of encrypted content data, required information inclusive of conditions for using the content data, from one device to another device, the transfer processing method comprising the steps of, under control for a processing unit to control data transfer between the two devices;

• inquiring of the two devices as to transfer functions for respective internal data of the devices;
• as a result of the inquiries, prior to the data transfer between the two devices, selecting either one of a first transfer or a second transfer mode, the transfer mode being adapted to unidirectionally transfer the required information from one of the two devices to the other device, the second transfer mode under that bidirectional transfer of the required information between the two devices is possible;
• conducting mutual authentication between the two devices, and if authentication results indicate that the two devices are valid, sharing key data between the two devices;
• encrypting the required information with one of the two devices with shared key data;
• and
• transferring the required information that has been encrypted with the one of the two devices, to the other device in accordance with the selected transfer mode.

A processing method for processing, in addition to key data for decryption of encrypted content data, required information inclusive of conditions for using the content data, and transferring both the key data and the required information from one device to another device, the processing method comprising:

• (a) an authentication step for conducting mutual authentication of validity between the two devices, and if authentication results indicate that both devices are valid, sharing the key data between the two devices;
• and
• (b) a transfer step for encrypting the required information with the one of the two devices with the shared key data and transferring the encrypted required information from the one of the two devices to the other device;
• wherein:
• in authentication step (a),
• the other device transmits a certificate inclusive of the device's own public key to the one of the two devices,
• the one of the two devices verifies validity of the received certificate, generates a first challenge key that is a key for temporary symmetric-key encryption, encrypts the first challenge key with the received public key, concatenates a certificate inclusive of the device's own public key to the encrypted data generated, and transmits the concatenated data to the other device,
• the other device acquires the first challenge key by decrypting the received data with the device's own private key, generates a second challenge key that is a key for temporary symmetric-key encryption, concatenates the second challenge key and a public key embedded in the device's own information region, conducts encryption with the received public key, concatenates the list of revoked certificates recorded in the other device to the encrypted data that has been obtained, encrypts the concatenated two sets of data with the first challenge key, and transmits the encrypted data to the one of the two devices,
• the one of the two devices decrypts the received data with the first challenge key, compares issue dates contained in the lists of revoked certificates, and consequently, if the issue date of the received list of revoked certificates is newer than the issue date of the list of revoked certificates recorded in the one of the two devices, updates the list of revoked certificates recorded in the one of the two devices with the received list of revoked certificates
• in addition, the one of the two devices decrypts all decrypted data, except for the list of revoked certificates, with the device's own private key, further generates a zeroth-order first session key that is a key for temporary symmetric-key encryption, conducts encryption with the previously received public key and second challenge key of the other device, and transmits the encrypted data to the other device, and
• the other device decrypts the encrypted data that has been received with the second challenge key, then if the decrypted data includes the list of revoked certificates of the one of the two devices, updates the device's own list of revoked certificates by using the received list of revoked certificates, and acquires the zeroth-order first session key by decrypting all the decrypted data, except for the list of revoked certificates, with the private key that is embedded in the device's own information region;
• and
• in transfer step (b),
• the other device generates an nth-order second session key, encrypts the nth-order second session key by using a previously generated n−1st-order second session key and a mth-order first session key that is latest at the time of the encryption, and transmits the encrypted data to the one of the two devices,
• the one of the two devices, after receiving the encrypted data, decrypts the data by using a mth-order first session key that is latest at the time of the decryption and the n−1st-order second session key, and records in the transaction log an identifier of the required information to be transferred, the device's own role in transfer, the required information planned to be transmitted, and a recording destination address of the required information in the other device,
• in addition, the one of the two devices concatenates to the required information a parameter indicating a purpose of use thereof (i.e., including at least a purpose of any one of copying, movement, or reproduction/playback), and a check sum, conducts encryption with the nth-order second session key and the shared key, and transmits the encrypted data to the other device, and
• the other device, after receiving the encrypted data, decrypts the data by using the shared key and the nth-order second session key, and records the decrypted data in an internal storage region of the other device.