CN103425908A - Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system - Google Patents
Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system Download PDFInfo
- Publication number
- CN103425908A CN103425908A CN2013104139451A CN201310413945A CN103425908A CN 103425908 A CN103425908 A CN 103425908A CN 2013104139451 A CN2013104139451 A CN 2013104139451A CN 201310413945 A CN201310413945 A CN 201310413945A CN 103425908 A CN103425908 A CN 103425908A
- Authority
- CN
- China
- Prior art keywords
- conversion
- drm
- content
- key
- translation proxy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention designs a mechanism for controlling the number of conversion times in the content conversion process in a DRM interoperation system. User terminal equipment applies for and downloads a digital content document and a corresponding license; the digital content document and the license are uploaded to a DRM interconnection intercommunication agent, and the agent is used for deciphering and re-encrypting the digital content document, analyzing a license of a source DRM standard to obtain a right certificate and generating a new license of a target DRM standard; in the conversion process, recording parameters of the number of degression times in a re-encryption algorithm of the agent are used for limiting the number of conversion times. By adopting the technical scheme of the mechanism for controlling the number of conversion times in the content conversion process in the DRM interoperation system, a right center and a content provider can safely and controllably hand over the conversion to the interconnection intercommunication agent which provides DRM standard conversion service for a user.
Description
Technical field
The present invention relates to digital copyright management (Digital Rights Management is hereinafter to be referred as DRM) technology.In brief; the present invention proposes under the mandate and supervision of believable right center and conversion and control server; allow the user freely to be shared by converted contents between the authorisation device that adopts different DRM standards; guarantee closure and the controllability of conversion simultaneously; guarantee that in transfer process, any program all can not be accessed the plaintext that is converted digital content; and the conversion times restriction within the limits prescribed; can do not abused thereby guarantee to change authority, protected the interests of user and content supplier.
Background technology
The DRM system along with digital content the wide-scale distribution on network arise at the historic moment, it the infringement that pirated disc copier and user cause content supplier and publisher because of random batch duplicating digital content occurs greatly having prevented.Yet in the actual formulation of DRM standard, for want of open and unified coordination such as relevant industries association, consumer-elcetronics devices manufacturer and content and service provider and released one after another proprietary separately DRM application solution.This makes the user buy can only to use on the equipment that adopts specific DRM standard after digital content and can't be shared between multiple devices in lawful authority, unless repeatedly bought the identical content of different DRM versions.
The problem of this DRM standard room interoperability inconvenience allows user's endurable, thereby has damaged the selling market of content supplier, finally becomes the obstruction of DRM application technology.Therefore the DRM inter-operation system produces thereupon.Current DRM bridging technology is comparatively ripe, the user shares with the demand of propagating contents and substantially is met, putting before this, how to guarantee becomes the common topic of being concerned about of content supplier and service provider in scope that the access times of digital content or period be limited in right stipulation.
The current existing scheme that is intended to solve DRM system interoperation problem that much has, but share the number of devices that can reach with digital media content for the term of life that how to limit all previous conversion, also lack detailed exercisable scheme, this need to realize by the controlling mechanism of conversion times.
Under the low-cost condition by trust calculation unit without the third party, the function that the agency controls conversion times may be used in following two kinds of scenes.
To the first scene, the equipment room sharing contents.Can establish the entitlement definition of at every turn being shared to the conversion of other equipment by source device is to one period of content fixing access time limit, be assumed to be 4 weeks, have N conversion privilege be to define source device can only in the duration in 4N week altogether, the right of content be shared with to other equipment to source device.
To the second scene, content dealer sells content.The dealer is from content supplier has obtained the selling right of content there, the content of selling is each all must be converted into the content that adapts to buyer's equipment standard through the dealer, the number of the equipment that can reach when conversion times defines dealer's distributing contents, i.e. the sale copy amount of content.
Prevent that the user from using content indefinite duration in a certain equipment, and prevent that the dealer from selling arbitrarily and propagating contents, reached the purpose of maintenance content provider interests.
Summary of the invention
The object of the invention is to propose DRM interoperability flow process and the conversion times controlling mechanism based on acting on behalf of re-encryption, realize that the user easily in the equipment room sharing contents in the extent of competence regulation, avoids abusing content owner and publisher's copyright rights whatsoever.
1, the DRM bridging technology based on acting on behalf of re-encryption, realize that the propagation of digital content between each terminal device is shared and format conversion, to adapt to the different DRM standard format requirement of these equipment to digital content file.
It is different from existing translation proxy and is characterised in that:
A, allow translation proxy in the situation that the content that off-line is uploaded source device in local domain is safely changed and downloaded on target device.Translation proxy does not need carry out authenticating device with DRM interoperability server real-time Communication for Power and obtain the conversion license.
B, translation proxy can extensively be distributed in each local Transformation Domain, and reaching half believable level of security gets final product, only require built-in working procedure and intermediate variable to resist and distort, and complete deciphering and re-encryption operation without trust calculation unit with sealing.
C, coordinate terminal half believable translation proxy program, in the mode of synchronous counting, realize the control to conversion times.
2, the DRM interoperability switch technology based on acting on behalf of re-encryption according to claim 1, is characterized in that, steps A further takes following sub-step to carry out content and right conversion:
A1, source device user A be download digital content buy licence and play right, by terminal translation proxy program, signs in to inter-operation system.If digital content is expressly M, the content after the encapsulation that A has is:
Encapsulation format and the cryptographic algorithm of this content-adaptive device A institute DRM standard.K wherein
MFor contents encryption key, SE
O() is unified content symmetric encipherment algorithm, K
AFor the symmetric cryptographic key of device A,
For the symmetric encipherment algorithm of device A institute DRM standard,
Content packaging algorithm for device A institute DRM standard.The right information comprised in the licence that A has, wherein key K
AAnd K
MThe preservation form be, AE
1(K
A, PK
Br), AE
2(K
M, PK
A).PK wherein
BrFor the PKI of translation proxy, PK
AFor the PKI of device A, AE
1() is the one-level asymmetric encryption, AE
2() is the secondary asymmetric encryption
A2, translation proxy obtain after content file after the encapsulation that device A uploads and licence the private key SK with oneself
BrSecret key decryption in licence is obtained to K
A, and then content is unpacked and deciphers acquisition SE
O(M, K
M).The DRM standard weight adopted according to target device B is subsequently encrypted and is beaten again the bag content and obtains
PKI PK with B
BThe symmetric cryptographic key of encryption device B obtains AE
1(K
B, PK
B) and be placed in new permit, use transition key rk
A → BSecondary to contents encryption key is encrypted ciphertext AE
2(K
M, PK
A) re-encryption acquisition AE
1(K
M, PK
B) and be placed in new permit.
A3, target device B download digital content file and the new permit converted, and obtain content and the key of wherein re-encryption,
AE
1(K
B, PK
B), AE
1(K
M, PK
B), deciphering, unpack and obtain key K successively
B, K
MAnd plaintext M.
3, the DRM interoperability switch technology based on acting on behalf of re-encryption according to claim 1, is characterized in that, step C further takes following sub-step to carry out conversion times control:
Before C1, source device A change first to target device B, translation proxy is to DRM interoperability server request conversion license.The conversion times that server is buied according to user A is issued the conversion license to translation proxy, comprises the transition key rk of source device A to source device B
A → B=g
b/a, with conversion times upper limit N, act on behalf of private key SK
P=(π 2
N, π); Simultaneously, server sends the proxy authentication PKI to conversion source equipment
Key K in C2, continuation interpretation procedure A1
MThe preservation form, source device A calculates AE
2(K
M, PK
A) detailed step be: if send conversion application to translation proxy first, utilize agency's authentication PKI to calculate
After this each conversion application is calculated before sending
While changing for the n time,
Calculate g
Ak=(g
a)
k,
Obtain ciphertext
Be
AE
2(K
M, PK
A), the PKI PK of A wherein
APart is by g
aForm the random number that the source translation proxy program that k is A generates.
C3, translation proxy obtain AE
2(K
M, PK
A) afterwards, before each re-encryption, with 2 inverse element (first component of private key is carried out
) being the power operation of index: while changing for the n time, agency's private key becomes SK
P=(π 2
N-n, π), then first component of ciphertext is done to bilinear operation:
Finally obtain the ciphertext after re-encryption
Be AE
1(K
M, PK
B).When conversion arrives the N time, SK
P=(π 2
N-N, former and later two components of π)=(π, π) are identical, and Alice uses up to this change-over period number of times of Bob, and the conversion license was lost efficacy, and the agency deletes the transition key in database.Such conversion can be carried out N time, thereby reaches the purpose of controlling conversion times.
If in the converse routine of the translation proxy program of terminal one when certain is changed, skip to private key with 2 inverse element (
) be the power operation of index, cause the random component k ' difference in the index of two components in ciphertext, recipient Bob can not correctly decipher ciphertext, and it is invalid to change.
Adopt technical scheme of the present invention, not only can make the user use protected digit content on different media devices, also guaranteed that digital content can not leak the third party, thereby protected the interests of content supplier, promoted the benign development of DRM technology.
The accompanying drawing explanation
Fig. 1 is that in specific implementation method of the present invention, digital content and licence carry out flow path switch figure by translation proxy between source device and target device.
Fig. 2 is the process flow diagram that in specific implementation method of the present invention, the variation by acting on behalf of parameter in the re-encryption computing of source device and translation proxy and contrast verification are realized the conversion times controlling mechanism.
Embodiment
Further illustrate technical scheme of the present invention below in conjunction with accompanying drawing and by embodiment.
The user registers the equipment newly added in Transformation Domain, and the switching center server is known the public and private key of equipment.
Terminal device proposes the conversion request to the DRM translation proxy, and translation proxy is asked for the transition key sequence to change server.Total N transition key in the transition key sequence, can be for source device to carrying out N conversion between certain target device.The private key part of each transition key is by the public key encryption protection of all switch target equipment in territory, and this part can only be obtained by target device.
After translation proxy obtains the content and licence of uploading, conversion starts.At first translation proxy extracts document of title corresponding with content in licence, wherein contents encryption key K
mPKI secondary by source device is encrypted.Translation proxy is chosen transition key to contents encryption key K
mThe re-encryption of secondary ciphertext, obtain the ciphertext that one-level is encrypted, for generating new document of title.After converting, target device is uploaded licence, by translation proxy, inserts therein new document of title.Last translation proxy passes to target device after one-level being encrypted to the public key encryption of decrypted private key with target device of ciphertext.
1, Fig. 1 is that in specific implementation method of the present invention, digital content and licence carry out flow path switch figure by translation proxy between source device and target device.As shown in Figure 1, the flow path switch of content and licence comprises the following steps:
Step 101, source device propose the conversion application to the DRM translation proxy, to it, submit oneself ID and PKI (with other authenticating identity information etc.), the ID of content to be converted to.
If step 102 is changed first, the DRM translation proxy is transmitted to the switching center server by this conversion application, by authenticating rear center's server according to the conversion times permission build transition key sequence of source device and returning to translation proxy.Above two steps form the transition key acquisition process.
Step 103, source device are issued translation proxy by packaged content and licence
Step 104, translation proxy divide two lines to carry out re-encryption to content and licence.Content is unpacked to the rear symmetric key K that uses
ADeciphering obtains the content ciphertext SE that Standard Symmetric Multivariate is encrypted
O(m, K
m), then to its re-encryption of symmetric encipherment algorithm according to the standard code of target device B packing.The re-encryption of re-encryption algorithm, the transition key sequence that re-encrypted private key provides from DRM switching center server are acted on behalf of in key use to Standard Encryption.
Step 105, translation proxy send to target device by the content generated after conversion and the licence that contains new rights object.
2, Fig. 2 is the flow process that in specific implementation method of the present invention, the variation by acting on behalf of parameter in the re-encryption computing of source device and translation proxy and contrast verification are realized the conversion times controlling mechanism.As shown in the figure, the conversion times control flow comprises the following steps:
Step 201, source device A is to switching center server application and obtain the conversion authority, and determines that the conversion times of target device B is N, and the private key of A and the PKI T.G Grammar key rk of B are called in believable right center
A → B=g
b/a
Step 202, right center be random to be generated and acts on behalf of private key SK with times N
P=(π 2
N, π) with the proxy authentication PKI
Source device A downloads this authentication PKI to local
After step 203, translation proxy agency receive the conversion request of A, at first in the database of inquiry oneself, whether the transition key of A to B is arranged.If conversion first, transition key does not exist, the conversion license of agency to right center requests A to B, and obtain rk
A → B=g
b/aWith act on behalf of private key SK
P=(π 2
N, π) deposit in database.
Step 204, A change front calculating first
Before each conversion, calculate from now on
While changing for the n time,
Calculate g
Ak=(g
a)
k,
Obtain ciphertext
Before step 205, the each re-encryption of translation proxy to first component of private key carry out with
Power operation for index: while changing for the n time, agency's private key becomes SK
P=(π 2
N-n, π), then first component of ciphertext is done to bilinear operation:
Finally obtain the ciphertext after re-encryption
Step 206, target device B utilize the private key b of oneself to (Z
Bk ', MZ
K ') do following computing and be decrypted:
Obtain plaintext M.
The above; be only the present invention's embodiment preferably, but protection scope of the present invention is not limited to this, anyly is familiar with the people of this technology in the disclosed technical scope of the present invention; the variation that can expect easily or replacement, within all should being encompassed in protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection domain of claim.
Claims (3)
1.DRM in inter-operation system, content flow path switch and the design of number of times controlling mechanism, realize that the propagation of digital content between each terminal device is shared and format conversion, to adapt to the different DRM standard format requirement of these equipment to digital content file.
It is different from existing translation proxy and is characterised in that:
A, allow translation proxy in the situation that the content that off-line is uploaded source device in local domain is safely changed and downloaded on target device.Translation proxy does not need carry out authenticating device with DRM interoperability server real-time Communication for Power and obtain the conversion license.
B, translation proxy can extensively be distributed in each local Transformation Domain, and reaching half believable level of security gets final product, only require built-in working procedure and intermediate variable to resist and distort, and complete deciphering and re-encryption operation without trust calculation unit with sealing.
C, coordinate terminal half believable translation proxy program, in the mode of synchronous counting, realize the control to conversion times.
2. the DRM based on the acting on behalf of re-encryption according to claim 1 translation proxy technology that interconnects, is characterized in that, steps A further takes following sub-step to carry out content and right conversion:
A1, source device user A be download digital content buy licence and play right, by terminal translation proxy program, signs in to translation proxy.If digital content is expressly M, the content after the encapsulation that A has is:
Encapsulation format and the cryptographic algorithm of this content-adaptive device A institute DRM standard.K wherein
MFor contents encryption key, SE
O() is unified content symmetric encipherment algorithm, K
AFor the symmetric cryptographic key of device A,
For the symmetric encipherment algorithm of device A institute DRM standard,
Content packaging algorithm for device A institute DRM standard.The right information comprised in the licence that A has, wherein key K
AAnd K
MThe preservation form be, AE
1(K
A, PK
Br), AE
2(K
M, PK
A).PK wherein
BrFor the PKI of translation proxy, PK
AFor the PKI of device A, AE
1() is the one-level asymmetric encryption, AE
2() is the secondary asymmetric encryption.
After A2, translation proxy obtain the content file and licence after the encapsulation that device A uploads, with the private key SK of oneself
BrSecret key decryption in licence is obtained to K
A, and then content is unpacked and deciphers acquisition SE
O(M, K
M).The DRM standard weight adopted according to target device B is subsequently encrypted and is beaten again the bag content and obtains
PKI PK with B
BThe symmetric cryptographic key of encryption device B obtains AE
1(K
B, PK
B) and be placed in new permit, use transition key rk
A → BSecondary to contents encryption key is encrypted ciphertext AE
2(K
M, PK
A) re-encryption acquisition AE
1(K
M, PK
B) and be placed in new permit.
A3, target device B download digital content file and the new permit converted, and obtain content and the key of wherein re-encryption,
AE
1(K
B, PK
B), AE
1(K
M, PK
B), deciphering, unpack and obtain key K successively
B, K
MAnd plaintext M.
3. the DRM based on the acting on behalf of re-encryption according to claim 1 translation proxy technology that interconnects, is characterized in that, step C further takes following sub-step to carry out conversion times control:
Before C1, source device A change first to target device B, translation proxy is to the DRM server request conversion license of interconnecting.The conversion times that server is buied according to user A is issued the conversion license to translation proxy, comprises the transition key rk of source device A to source device B
A → B=g
b/a, with conversion times upper limit N, act on behalf of private key SK
P=(π 2
N, π); Simultaneously, server sends the proxy authentication PKI to conversion source equipment
Key K in C2, continuation interpretation procedure A1
MThe preservation form, source device A calculates AE
2(K
M, PK
A) detailed step be: if send conversion application to translation proxy first, utilize agency's authentication PKI to calculate
After this each conversion application is calculated before sending
While changing for the n time,
Calculate g
Ak=(g
a)
k,
Obtain ciphertext
Be AE
2(K
M, PK
A), the PKI PK of A wherein
APart is by g
aForm the random number that the source translation proxy program that k is A generates.
C3, translation proxy obtain AE
2(K
M, PK
A) afterwards, before each re-encryption, with 2 inverse element (first component of private key is carried out
) being the power operation of index: while changing for the n time, agency's private key becomes SK
P=(π 2
N-n, π), then first component of ciphertext is done to bilinear operation:
Finally obtain the ciphertext after re-encryption
Be AE
1(K
M, PK
B).When conversion arrives the N time, SK
P=(π 2
N-N, former and later two components of π)=(π, π) are identical, and Alice uses up to this change-over period number of times of Bob, and the conversion license was lost efficacy, and the agency deletes the transition key in database.Such conversion can be carried out N time, thereby reaches the purpose of controlling conversion times.
If in the converse routine of the translation proxy program of terminal or translation proxy one when certain is changed, skip to private key with 2 inverse element (
) be the power operation of index, cause the random component k ' difference in the index of two components in ciphertext, recipient Bob can not correctly decipher ciphertext, and it is invalid to change.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN2013104139451A CN103425908A (en) | 2013-09-12 | 2013-09-12 | Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN2013104139451A CN103425908A (en) | 2013-09-12 | 2013-09-12 | Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system |
Publications (1)
Publication Number | Publication Date |
---|---|
CN103425908A true CN103425908A (en) | 2013-12-04 |
Family
ID=49650635
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN2013104139451A Pending CN103425908A (en) | 2013-09-12 | 2013-09-12 | Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN103425908A (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111512592A (en) * | 2017-12-28 | 2020-08-07 | 三菱电机株式会社 | Conversion key generation device, ciphertext conversion device, secret information processing system, conversion key generation method, conversion key generation program, ciphertext conversion method, and ciphertext conversion program |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102622540A (en) * | 2011-12-15 | 2012-08-01 | 北京邮电大学 | Proxy re-encryption based secure DRM (digital rights management) interoperation architecture |
-
2013
- 2013-09-12 CN CN2013104139451A patent/CN103425908A/en active Pending
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102622540A (en) * | 2011-12-15 | 2012-08-01 | 北京邮电大学 | Proxy re-encryption based secure DRM (digital rights management) interoperation architecture |
Non-Patent Citations (2)
Title |
---|
LIHAO SU等: ""A DRM Interoperabiiity Architecture Based on Local Conversion Bridge with Proxy Re-Cryptography"", 《2ND INTERNATIONAL CONFERENCE ON MECHANICAL PROPERTIES OF MATERIALS AND INFORMATION TECHNOLOGY, ICMPMIT 2013》 * |
闫玺玺: ""开放网络环境下敏感数据安全与防泄密关键技术研究"", 《中国博士学位论文全文数据库(电子期刊)信息科技辑》 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111512592A (en) * | 2017-12-28 | 2020-08-07 | 三菱电机株式会社 | Conversion key generation device, ciphertext conversion device, secret information processing system, conversion key generation method, conversion key generation program, ciphertext conversion method, and ciphertext conversion program |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP6949972B2 (en) | Digital rights management based on blockchain | |
CN102655508B (en) | Method for protecting privacy data of users in cloud environment | |
CN101938468B (en) | Digital content protecting system | |
CN102333236B (en) | Video content encryption and decryption system | |
CN103957109B (en) | A kind of cloud data-privacy protects safe re-encryption method | |
CN111541678A (en) | Block chain-based proxy re-encryption method, system and storage medium | |
US20040019801A1 (en) | Secure content sharing in digital rights management | |
CN102316378B (en) | Digital copyright protection method based on set-top box and system | |
CN103366102A (en) | Digital rights management system for transfer of content and distribution | |
CN101610148B (en) | Protection method of digital copyrights of peer-to-peer Internet network | |
CA2808369A1 (en) | System for protecting an encrypted information unit | |
CN104994068A (en) | Multimedia content protection and safe distribution method in cloud environment | |
US8417937B2 (en) | System and method for securely transfering content from set-top box to personal media player | |
CN104221023A (en) | Digital rights management | |
US20120221847A1 (en) | Sanctioned client device and methods for use therewith | |
US8391497B2 (en) | Method for importing rights object and rights issuer | |
CN101521668B (en) | Method for authorizing multimedia broadcasting content | |
CN103425908A (en) | Mechanism designed for controlling content conversion process and number of conversion times in DRM interoperation system | |
KR102385328B1 (en) | Method and System of Digital Rights Management | |
CN101325486A (en) | Method and apparatus for encapsulating field permission cryptographic key | |
Patriciu et al. | A generalized drm architectural framework | |
CN103473485A (en) | Transfer method for digital license authorization certificate among terminal equipment | |
CN102622540B (en) | Safe DRM mutual operation methods based on proxy re-encryption | |
KR20090114075A (en) | DRM security mechanism for the personal home domain | |
CN104994411A (en) | Digital copyright protection system for high-definition videos of mobile Internet |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C41 | Transfer of patent application or patent right or utility model | ||
TA01 | Transfer of patent application right |
Effective date of registration: 20160316 Address after: 100876 Beijing city Haidian District Xitucheng Road No. 10 Applicant after: Beijing University of Posts and Telecommunications Applicant after: China News publishing research institute Address before: 100876 Beijing city Haidian District Xitucheng Road No. 10 Applicant before: Beijing University of Posts and Telecommunications |
|
RJ01 | Rejection of invention patent application after publication | ||
RJ01 | Rejection of invention patent application after publication |
Application publication date: 20131204 |