Information processing apparatus and information processing method for determining access permission

An information processing apparatus, comprising

• a data processor operable to execute content reproduction processing, the data processor being further operable to:
• execute authentication processing on a memory card in which content is stored, wherein the memory card is divided into a general purpose area and a protected area composed of a plurality of divisions, wherein the authentication processing comprises determining, based on a certificate received from an external apparatus, whether or not to permit access to the protected area, the certificate comprising information corresponding to read permitted divisions and write permitted divisions among the plurality of divisions of the protected area;
• read out, from the memory card on which the authentication processing succeeds, an encrypted title key applied to encrypt the content, and calculate a hash value of the encrypted title key;
• and
• execute matching between the calculated hash value and a hash value for matching that is acquired from the memory card, and determine, based on a result of the matching, whether or not to permit reproduction of the content.

A server apparatus configured to execute content provision processing with respect to a memory card, the server apparatus comprising:

• a data processor operable to:
• generate encrypted content encrypted with a title key, a binding key being an encryption key for the title key, an encrypted title key obtained by encrypting the title key with the binding key, and a hash value of the encrypted title key;
• output the generated encrypted content, binding key, encrypted title key, and hash value to the memory card to be recorded in the memory card;
• and
• output a request for access to a protected area within the memory card along with a certificate to record the hash value in the protected area based on access permission by the memory card in response to the request for access, wherein the certificate comprises information corresponding to read permitted divisions and write permitted divisions among a plurality of divisions of the protected area.

An information processing system, comprising:

• a content providing server operable to generate:
• encrypted content encrypted with a title key,
• a binding key being an encryption key for the title key,
• an encrypted title key obtained by encrypting the title key with the binding key, and
• a hash value of the encrypted title key;
• and
• a memory card operable to store content provided by the content providing server, the memory card comprising a storage divided into a protected area to which access is limited and a general purpose area, wherein the protected area comprises a plurality of division areas, the memory card being further operable to:
• store in the general purpose area, the encrypted content and the encrypted title key,
• store in the protected area, the binding key and the hash value of the encrypted title key, and
• verify, in response to a request for access to the protected area from the content providing server, a certificate provided by the content providing server, and
• determine, based on the certificate, whether or not to permit the access, wherein the certificate comprises information corresponding to read permitted divisions and write permitted divisions among the plurality of division areas of the protected area, the content providing server being configured to output the generated encrypted content, binding key, encrypted title key, and hash value to the memory card.

An information processing method comprising:

• in an information processing apparatus including a data processor and a storage unit comprising a protected area to which access is limited and a general purpose area:
• executing access permission determination processing, in which, in response to a request for access to the protected area along with a certificate from an external apparatus, whether or not to permit the access is determined, and the access to the protected area is permitted only when access permission determination is made, wherein the protected area comprises a plurality of divisions, and wherein the certificate comprises information corresponding to read permitted divisions and write permitted divisions among the plurality of divisions of the protected area;
• and
• storing, when the access permission determination is made, in the general purpose area:
• encrypted content, and
• an encrypted title key to be applied to decrypt the encrypted content, the encrypted content and the encrypted title key being data provided by the external apparatus, and
• in the access protected area:
• a binding key applied to encrypt the title key, and
• a hash value of the encrypted title key, the binding key and the hash value being data provided by the external apparatus.

An information processing method of executing content reproduction processing in an information processing apparatus, the method comprising:

• performing authentication processing on a memory card having a protected area comprising a plurality of divisions and a general purpose area in which content is stored, wherein the authentication processing comprises determining, based on a certificate received from an external apparatus, whether or not to permit access to the protected area, the certificate comprising information corresponding to read permitted divisions and write permitted divisions among the plurality of divisions of the protected area;
• reading out, from the memory card on which the authentication processing succeeds, an encrypted title key obtained by encrypting a title key applied to encrypt encrypted content, and calculating a hash value of the encrypted title key;
• and
• executing matching between the calculated hash value and a hash value for matching that is acquired from the memory card, and determining, based on a result of the matching, whether or not to permit reproduction of the content.

A non-transitory computer-readable storage medium having stored thereon, a computer program having at least one code section for communication, the at least one code section being executable by a computer for causing the computer to perform steps to execute a process comprising:

• execute access permission determination processing, in which in response to a request for access to a protected area of a storage unit along with a certificate from an external apparatus, whether or not to permit the access is determined, and the access to the protected area is permitted only when access permission determination is made, wherein the protected area comprises a plurality of divisions, and wherein the certificate comprises information corresponding to read permitted divisions and write permitted divisions among the plurality of divisions of the protected area;
• and
• store, when the access permission determination is made in the access permission determination processing, in the access protected area:
• a binding key applied to encrypt the title key, and
• a hash value of the encrypted title key, the binding key and the hash value being data provided by the external apparatus, and
• in the general purpose area:
• encrypted content, and
• an encrypted title key to be applied to decrypt the encrypted content, the encrypted content and the encrypted title key being data provided by the external apparatus.

A non-transitory computer-readable storage medium having stored thereon, a computer program having at least one code section for communication, the at least one code section being executable by a computer for causing the computer to perform steps to execute a process comprising:

• generate encrypted content encrypted with a title key, a binding key being an encrypted key of the title key, an encrypted title key obtained by encrypting the title key with the binding key, and a hash value of the encrypted title key;
• output the generated encrypted content, binding key, encrypted title key, and hash value to the memory card to be recorded in the memory card;
• and
• output a request for access to a protected area within the memory card along with a certificate to record the hash value in the protected area based on access permission by the memory card in response to the request for access, wherein the protected area comprises a plurality of divisions, and wherein the certificate comprises information corresponding to read permitted divisions and write permitted divisions among the plurality of divisions of the protected area.