ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED UDAC IPR (Intellectual Property Rights) Oriented Access Control Commands for Optical Disk Device  "UDAC" is being registered as a trademark of Fujitsu Limited.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Requirements of Access Control Requirements Availability to set variable access conditions and enforce it for the IPR owner Network security Authentication of Users and Devices Access control over multiple domains Pre-distribution of protected contents (cache or distribution within disk ROM)

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED UDAC Architecture Feature Universal Distribution IPR Owner Content Procurer Access Control Use Encrypted Content

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Basic Access Control Model Control Hardware Environment Content IPR owner Content Procurer Use IPR Owner Area Protected Area Open Area Hardware Protection Fire-wall UDAC- VPN Feature

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED High efficiency of IP distribution Fairly payment corresponding to the usage by the service user Certain pay corresponding to the provision by the service provider Robust Access Control Universal Distribution Simultaneous realization Feature

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Features Satisfies all the access control requirements OS/Device independent Available the existing infrastructures IPR oriented Access Control of content Reflects hardware robustness Available the risk distribution to devices Feature

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Support Generic Content Content played statically (Doc., Image) Stream Content (Sound, Movie) –Encryption of a unit content for accounting Interactive Content (Program code, Presentation) –Protection of the part as movie or sound –Protection of the kernel code Feature

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Ex.: Protection from Illegal Use IPR Owner ACD Replication Content Key / Password I’d like to let only D play this content Play Content Access Control UDAC Protection Feature

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Kernel Technique (1) Device Authentication (2) Network Model (3) UDAC-ACL (Access Control List) (4) UDAC-License (5) Inter-domain Administration Satisfies all the requirements Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED (1) Device Authentication Under access control after any replications Doc.ImageData Copy Check Environment Decode Network distribution Distribution by ROM-Disk Replication ??? Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Device ID (PCSUE* ID) Tech. * PCSUE: Physical Component of a Specific Usage Environment

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED (2) Network Model Content IPR owner Content Procurer PCSUE Id Decryption Keys Content Decryption Key IPR owner area Protected area Open area PCSUE ID PCSUE 1) Protected 2) Copy / Distribute 3) 4) PCSUE ID 7) 5) License 6) 8) Tech. PCSUE Certificates PCSUE ID * PCSUE: Physical Component of a Specific Usage Environment LICENSE SERVER SYSTEMCLIENT SYSTEM Create & set access conditions Mutual authentication between IPR owner and devices

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED (3) UDAC-ACL cn=Movie1, ou=planning, o=fujitsu, c=jp Tech. To set the variable access conditions udac_acl play: ( (group = fujitsu OR group = mtfuji) AND < MSN < ) OR count < 1 ; edit: user = yuji OR user = hata OR smartCard = 1afd234fe4def458c3bae78497bbda6f ; copy: group = fujitsu OR count < 1 ; Group, members of which are able to Play Scope of MSN which must be insertedAvailable number PIN which must be inserted when the content is modified

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Account Conditions Tech. 1) Max. Number of playing 2) Max. Length of playing 3) Max. Time to be able to play 4) Payment for a unit content 5) Limitation of date and time

ＵＤＡＣ（ Universal Distribution with Access Control ） 15 Standard Format InformationProgram Reference Counter SuperdistributionCenter Redistribution of Income Charge Income Contents Provider Hardware Vendor Retailer Charge Income Usage Counter Usage Record Reference Record Tech. Copyright , FUJITSU LIMITED, 013

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED A License Server Domain Y Domain X ACL of C 1 Client (4) UDAC-License License includes: C 1 Decryption Key and Subset of ACL. Tech. udac_license read: group = soft4soft AND MSN = ; C1C1 Inter-domain licensing

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Licensing Protocol Model License Server Procurer Client PCSUE1 PCSUE2 PCSUE N PCSUEi K Ci : Shared private key for class of PCSUEi K Pi : Private key in PCSUEi. K Ci, DSN, K Si. (1) Request to use IPR- protected content (4) Send license   I Ci : Identifier of PCSUE class K Si : Session key AC i : Access condition PCSUEi can enforce K C : Content decryption key (5) Decrypt licenses in turn (6) Decrypt K C and the content I Ci {T}K X : T can be decrypted by K X Network device I C1, {K S1, hash} K P1 +  I Ci, {K Si, hash} K Pi +  I CN, {K SN, hash} K PN I C1, {PCSUE-ID 1, hash} K S1 +  I Ci, {PCSUE-IDi, hash} K Si +  I CN, {PCSUE-ID N, hash} K SN {{... {K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC 1, hash} K P1 {{...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),...AC i, hash} K Pi Risk Distribution to each device (PCSUE) Tech. (2) Send Session Key (3) Report certificates

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Structure of License {{... {K C, AC N, hash} K PN, AC N-1, hash} K P(N-1), AC i, hash} K Pi, AC 1, hash} K P1 Access Condition Enforceable in PCSUE i Private key in PCSUE i Content Decryption Key Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Inter-PCSUE Licensing PCSUE i+1 PCSUE i PCSUE i-1 K Pi : K Ci, DSN or K Si. : Licenser in the view point of PCSUEi : Licensee in the view point of PCSUEi {{...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1), AC i, hash} K Pi {...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1) Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Ex. - Applying to Current PC PCSUE i+1 PCSUE i PCSUE i-1 Pass through Tech. Procurer Client (Host) {{...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1), AC i, hash} K Pi {...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1) Pass through Licenser Licensee Licensing Relation Licenser Licensee Licensing Relation

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Ex. - Applying to STB / DTV PCSUE i+1 PCSUE i PCSUE i-1 Procurer Client (Host) {{...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1), AC i, hash} K Pi {...{K C, AC N, hash} K PN, AC N-1, hash} K P(N-1),... AC i-1, hash} K P(i-1) Tech. (Logical Unit) License Server

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Commands to Disk Device a) SEND KEY (Session Key) b) REPORT KEY (Certificates) c) SEND KEY (Optical Disk Device License) d) REPORT KEY (The Next Device License) I CL, {RN, K S, hash} K P {RN, DSN [, MSN], hash} K S {, AC, hash} K P {, hash} K S Procurer Client (Host) Optical disk device (Logical Unit) : PCSUE i I CL I CL : Identifier of device class K CL : Shared private key for device class of the device. DSN: Device Serial Number. MSN: Medium Serial Number. AC: Access condition the device can enforce. Such as MSN K P : Private key for the device. K CL, DSN or K S {T} K X : T can be decrypted by K X [ ]: Optional support RN: Random Number Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED State Diagram of Disk Device Initial State SEND KEY (Session Key) Session Key Shared Mutually Authenticated REPORT KEY (Certificates) No Grants Available License Authorized SEND KEY (Optical Disk License) Error, Authentication Failed / Algorithm Not Supported Begin Sequence REPORT KEY (Request AGID) Region Code Errors(s) from REPORT KEY Command REPORT KEY (The Next Device License) Tech.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Applications Variable and Robust IPR-protection Each Device Authentication Enforcement of Variable Account Conditions Availability of each LSI Authentication ROM-Disk Distribution Broadcast Distribution Network (Internet) Distribution Mobile Content Distribution Appl.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Protected Disk Device & Player In the case of medium oriented accounting Medium DSN Storage Device MSN : protected {{AC,K C }K PD, MSN}DSN 1) Send UDAC-license Player Device LICENSE SERVER SYSTEM {X}K : X can be decrypted by K {AC,K C }K PD 3) Send Player-license AL K C K PD DSN MSN K PD {Content}K C AC,K C Content 4) Check AC & decrypt content AC : Access Conditions 2) Check MSN Appl.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Profiles for Disk Device Medium DSN MSN {{AC,K C }K PD, [MSN] } K P UDAC-license LICENSE SERVER SYSTEM ACL K C : X is optional [X] K S : Session key temporally created in a session. K CL : Key shared by a device class. Appl.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Medium base Guard Simple Content Guard without Network Only to set “Play rights with MSN condition for EVERYONE” Distribution together with: Medium (in which the followings are recorded) Encrypted Content License (with MSN) Appl.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED Pre-paid in Smart Card K SC {{{K C, AC PD }K PD, AC SC } K SC, MSN}DSN Player Device LICENSE SERVER {K C, AC PD }K PD ACL K C Storage Device Smart card Card Device {{K C, AC PD }K PD, AC SC } K SC K PD Account Information : Account Condition AC X Appl.

ＵＤＡＣ（ Universal Distribution with Access Control ） 99/05/03All Rights Reserved, Copyright (c) FUJITSU LIMITED For Any Distribution / Player Digital Appliances : DigitalTV, Set Top Box, PC,... Secure ＨＤ／ＯＤ ) Satelite Radio/TV Tower PBX CATV Digital Information Super Highway Cheap delivery through Magazine Channel Cheap delivery through Magazine Channel Using Media Channel Personal HyperKnowledgeBase Processing PCPC Personal Computing DigitalTV Appl.