CN111601117B - Digital copyright management method and system - Google Patents

Digital copyright management method and system Download PDF

Info

Publication number
CN111601117B
CN111601117B CN202010391956.4A CN202010391956A CN111601117B CN 111601117 B CN111601117 B CN 111601117B CN 202010391956 A CN202010391956 A CN 202010391956A CN 111601117 B CN111601117 B CN 111601117B
Authority
CN
China
Prior art keywords
content
iptv terminal
encrypted
session key
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202010391956.4A
Other languages
Chinese (zh)
Other versions
CN111601117A (en
Inventor
张海永
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhian Entertainment Nanjing Technology Co ltd
Original Assignee
Zhian Entertainment Nanjing Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhian Entertainment Nanjing Technology Co ltd filed Critical Zhian Entertainment Nanjing Technology Co ltd
Priority to CN202010391956.4A priority Critical patent/CN111601117B/en
Publication of CN111601117A publication Critical patent/CN111601117A/en
Application granted granted Critical
Publication of CN111601117B publication Critical patent/CN111601117B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/234—Processing of video elementary streams, e.g. splicing of video streams, manipulating MPEG-4 scene graphs
    • H04N21/2347—Processing of video elementary streams, e.g. splicing of video streams, manipulating MPEG-4 scene graphs involving video stream encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/239—Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests
    • H04N21/2393—Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests involving handling client requests
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/254—Management at additional data server, e.g. shopping server, rights management server
    • H04N21/2541—Rights Management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/266—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel
    • H04N21/26606—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4623—Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key
    • H04N21/63345—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key by transmitting keys

Abstract

The embodiment of the application discloses a digital copyright management method and a system, wherein the method comprises the following steps: receiving a video content playing request sent by an IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using the session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key and the information encrypted by the session key are packaged in the content authorization license, and the information encrypted by the session key is the information encrypted by the session key to the content encryption key; and sending the content authorization permission and the encrypted video content to the IPTV terminal. The video content requested to be played is subjected to multi-layer encryption processing, then each layer of encrypted information is packaged in the content authorization permission and sent to the IPTV terminal, and the encrypted video content can be played only after each layer of encrypted information in the content authorization permission is successfully decrypted by the IPTV terminal, so that the video content is ensured to be safely transmitted from the server side to the IPTV terminal.

Description

Digital copyright management method and system
Technical Field
The present application relates to the field of digital copyright protection technologies, and in particular, to a digital copyright management method and system.
Background
The IPTV, i.e. the interactive network television, is a brand-new technology that integrates various technologies such as internet, multimedia, communication, etc. into a whole by using a broadband cable television network, and provides various interactive services including digital television for home users. Adding sufficient copyright protection in their networks is a necessary means for copyright owners and pay tv operators to maintain their own interests.
In the prior art, IPTV digital rights protection is mainly performed based on a digital watermark technology, for example, when a first IPTV terminal acquires digital video content from a server, a user identification watermark is inserted into the digital video content, and video content containing the user identification watermark is obtained and stored; after that, when the first IPTV terminal sends the video content to another IPTV terminal, the operator may monitor whether the video content played by the other IPTV terminal is legal by tracking the user identifier watermark.
Therefore, the prior art can only ensure that the transmission of the video content between the IPTV terminals is safe, but cannot ensure the safe transmission of the video content before reaching the IPTV terminals.
Disclosure of Invention
The method and the device solve the problem that safe transmission of the video content before reaching the IPTV terminal cannot be guaranteed in the prior art.
In a first aspect, an embodiment of the present application provides a digital rights management method, including: receiving a video content playing request sent by an IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key; and sending the content authorization permission and the encrypted video content to the IPTV terminal.
Preferably, the content license further includes a session key usage rule and a content encryption key usage rule.
Preferably, the method further comprises:
sending an encrypted message authentication code for verifying the integrity of the content license.
Preferably, the content authorization license further includes a digital signature for determining whether the IPTV terminal is an authorized object.
Preferably, the video content playing request further includes: the unique equipment identification of the IPTV terminal;
judging whether a device list comprises the unique device identification of the IPTV terminal, wherein the device list is used for storing the effective unique device identification of the IPTV terminal;
and if the equipment list comprises the unique equipment identifier of the IPTV terminal, sending content authorization permission and encrypted video content to the IPTV terminal.
In a second aspect, an embodiment of the present application provides a digital rights management method, including: receiving encrypted content authorization permission and encrypted video content, wherein the encrypted content authorization permission comprises a session key and information encrypted by the session key, and the information encrypted by the session key is the information encrypted by the session key for the content encryption key; decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key; and decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, and decrypting the encrypted video content by using the content encryption key.
Preferably, before decrypting the encrypted content license using the asymmetric key, the method further includes: receiving an encrypted message authentication code for verifying the integrity of the content license.
Preferably, the encrypted content authorization license further includes a session key usage rule; and decrypting the information encrypted by the session key by using the session key according to the session key use rule.
Preferably, the encrypted content authorization license further includes a content encryption key usage rule; decrypting the encrypted video content using the content encryption key according to the content encryption key usage rule.
In a third aspect, an embodiment of the present application further provides a digital rights management system, including a server and an IPTV terminal;
the server is used for receiving a video content playing request sent by the IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key; transmitting a content authorization license and encrypted video content to the IPTV terminal;
the IPTV terminal is used for receiving encrypted content authorization permission and encrypted video content, the encrypted content authorization permission comprises a session key and information encrypted by the session key, and the information encrypted by the session key is the information encrypted by the content encryption key by the session key; decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key; and decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, and decrypting the encrypted video content by using the content encryption key.
According to the digital copyright management method and system, the video content requested to be played is subjected to multilayer encryption processing, then each layer of encrypted information is packaged in the content authorization license and is sent to the IPTV terminal, and the encrypted video content can be played only after each layer of encrypted information in the content authorization license is successfully decrypted by the IPTV terminal, so that the video content is safely transmitted from the server side to the IPTV terminal.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and those skilled in the art can also obtain other drawings according to the drawings without creative efforts.
Fig. 1 is a schematic workflow diagram of a digital rights management method according to an embodiment of the present application;
fig. 2 is a schematic workflow diagram of another digital rights management method according to an embodiment of the present application;
fig. 3 is a schematic structural diagram of a security trust mechanism provided in an embodiment of the present application;
fig. 4 is a schematic workflow diagram of another digital rights management method according to an embodiment of the present application;
fig. 5 is a schematic data interaction diagram of a digital rights management system according to an embodiment of the present application.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention.
In some of the flows described in the present specification and claims and in the above figures, a number of operations are included which occur in a particular order, but it should be clearly understood that these operations may be performed out of order or in parallel as they occur herein, the order of the operations being numbered 11, 12, etc. merely to distinguish between various operations, the order of which does not represent any order of performance by itself. Additionally, the flows may include more or fewer operations, and the operations may be performed sequentially or in parallel.
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Example one
Fig. 1 is a schematic workflow diagram of a digital rights management method according to an embodiment of the present application.
As shown in fig. 1, the method is executed by a server, and the method mainly includes a step of encrypting video content, and specifically may include the following steps:
and step 11, receiving a video content playing request sent by the IPTV terminal.
In the embodiment of the application, the service end refers to one end of a pay television operator, and the IPTV terminal refers to a client installed in a set-top box.
The video content in the embodiment of the present application may include video or audio content on demand or live.
And step 12, encrypting the video content by using the content encryption key.
The content encryption key is a key for encrypting video content, and a video content may have one or more content encryption keys, which is not limited in this application.
And step 13, encrypting the content key by using the session key.
The session key is a generated temporary key, and the session key is a key for encrypting the encryption-protected content.
The encryption of the video content in step 12 and the encryption of the content key in step 13 are both encrypted using a symmetric cryptographic algorithm.
And step 14, encrypting the information encrypted by the session key by using the asymmetric key.
After receiving a video content playing request sent by the IPTV terminal, the server side encrypts the video content in advance in order to ensure that the video content can be safely transmitted to the IPTV terminal. The server side encrypts the video content in a multi-layer encryption manner, as described in the above step 12 to step 14.
And step 15, encapsulating the session key and the information encrypted by the session key in the content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key to the content encryption key.
And step 16, sending the content authorization permission and the encrypted video content to the IPTV terminal.
After the video content is encrypted in multiple layers, the session key and the information encrypted by the session key are packaged in the content authorization license and sent to the IPTV terminal, and the IPTV terminal needs to decrypt the encryption key layer by layer of the received content authorization license, and only can obtain the video content requested to be played after the decryption is successful.
The server and the IPTV terminal have respective asymmetric key pairs, namely the server and the IPTV terminal both comprise own public keys, and the server and the IPTV terminal respectively protect own private keys safely. In step 14, the service end encrypts the information encrypted by the session key with the IPTV terminal public key, and the IPTV terminal can decrypt the encrypted content license using the IPTV terminal private key based on the asymmetric cryptographic algorithm.
The digital rights management method provided by the embodiment of the application comprises the steps of firstly, after a video content playing request sent by an IPTV terminal is received, encrypting the video content by using a content encryption key; encrypting the content key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; and finally, sending a content authorization license and the encrypted video content to the IPTV terminal, wherein the content authorization license comprises a session key and information encrypted by the session key. In the embodiment of the application, the video content requested to be played is encrypted in multiple layers, then each layer of encrypted information is packaged in the content authorization license and is sent to the IPTV terminal, and the encrypted video content can be played only after each layer of encrypted information in the content authorization license is successfully decrypted by the IPTV terminal, so that the safe transmission of the video content from the server to the IPTV terminal is ensured.
Further, the content license also includes a session key usage rule and a content encryption key usage rule.
Each level of key may have a corresponding key usage rule, and the current key can only be decrypted under the condition specified by the key usage rule of the upper level, where the key used to encrypt the current key is referred to as the upper level key, for example, the session key is the upper level key of the content encryption key, and the asymmetric key is the upper level key of the session key. It should be further noted that the key usage rules corresponding to the keys of each hierarchy may be the same or different; the key usage rule corresponding to each level of keys may include one key usage rule or may include a plurality of key usage rules, which is not limited in this application.
The session key usage rule and the content encryption key usage rule in the embodiment of the present application may employ one or more of the following key usage rules.
The first key usage rule mainly specifies the usage time of the key, and specifically may include: at least one of a start time, an expiration time, and a time period of the key is used.
The starting time of the key is that the key is allowed to be used for decryption after a specified time; the expiration time of using the key means that the key is allowed to be used for decryption before a specified time; the time period for which the key is used means that the key is allowed to be decrypted within a certain time period after the first use.
The second key usage rule is mainly to specify the cumulative playing time of the video content. The accumulated playing time is the accumulation of the time from playing to stopping of the IPTV terminal player. If the time accumulation of the multiple times of playing to stop exceeds the preset accumulated playing time of the video content, the decryption by using the key is not allowed. The second key usage rule is generally used for previewing a scene, for example, a movie duration is 90min, and the cumulative allowable preview playing duration is 10min (that is, the preset cumulative playing time of the video content is 10min), the user may select to play the content at any position of the movie, but the cumulative playing duration cannot exceed 10 min. If the accumulated playing time exceeds 10min, the decryption using the key is not allowed any more.
The third key usage rule mainly specifies the number of times of key usage. And counting the times of decryption by using the key, and if the counted times exceed the preset times of use of the key, not allowing the decryption by using the key any more.
For example, the content encryption key usage rule is a third key usage rule, and the preset number of usage times of the content encryption key is three. After the IPTV terminal successfully completes decryption once by using the content encryption key, counting the times of using the content encryption key, and if the times of using the content encryption key exceeds three times, not allowing the key to be used for decryption.
The fourth key usage rule is mainly defined for the output of the decrypted video content. Specifically, the fourth key usage rule includes: an output range and an output mode of video content decrypted by using the content encryption key are specified. That is, using the fourth key usage rule, it is possible to define whether or not the decrypted video content can be output to other devices, and the output range and output manner. Therefore, the safe transmission of the video content before reaching the IPTV terminal can be ensured, and the safe transmission between the IPTV terminals can also be ensured.
The fifth key usage rule mainly considers the security level of the IPTV terminal, and the IPTV terminal can successfully decrypt the key only when the security level of the IPTV terminal is equal to or higher than the IPTV terminal security level requirement specified in the key usage rule. The IPTV terminal security level is divided into a software security level, a hardware security level and an enhanced hardware security level, and the IPTV terminal security level is stored in an IPTV terminal security level certificate.
After the session key and the content encryption key adopt the one or more usage rules, the server encapsulates the session key usage rule corresponding to the session key and the content encryption key usage rule corresponding to the content encryption key into the content authorization license, and sends the content authorization license to the IPTV terminal. In the embodiment of the application, the use of the key is limited, so that the safe transmission of the video content can be further ensured.
It should be noted that, if there is no corresponding key usage rule in the content license, there is no restriction on the usage of the key.
In order to verify the integrity of the content license, the embodiment of the present application may further include the following steps:
and step 17, sending an encrypted message verification code, wherein the message verification code is used for verifying the integrity of the content authorization license.
The message authentication code may prompt the IPTV terminal as to which content is included in the transmitted content license. For example: the message verification code displays a content list included in the content authorization license, and the IPTV terminal can verify the received content authorization license according to the content list to confirm whether the received content authorization license is complete.
Further, the content authorization license may further include a digital signature for determining whether the IPTV terminal is an authorized object.
In a specific embodiment, if the received video content playing request further includes a unique device identifier of the IPTV terminal, as shown in fig. 2, the following steps are performed:
step 101, judging whether a device list includes the unique device identifier of the IPTV terminal, where the device list is used to store the valid unique device identifier of the IPTV terminal.
In the embodiment of the application, a safety trust mechanism is established for the server and the IPTV terminal based on a PKI system, the server and the IPTV terminal both apply for obtaining a digital certificate as a certificate of their identity from the authentication center, and the trust relationship between the server and the IPTV terminal is based on the validity of the digital certificate. And if the certificate of the IPTV terminal is verified to be valid by the server, the server trusts the IPTV terminal.
Digital certificates are the basis for establishing secure trust mechanisms. In order to accurately judge the validity of the IPTV terminal, in an implementation manner, the digital certificate should include a unique device identifier of the IPTV terminal, and the unique device identifier may be loaded in an appropriate field of the digital certificate of the IPTV terminal. The unique device identifier is not limited in the present application, and for example, the unique device identifier of the IPTV terminal may be a MAC address. The server stores all valid unique device identifiers of the IPTV terminal, and after receiving the unique device identifiers of the IPTV terminal, the server inquires whether the unique device identifiers exist in a device list of the server.
The trust chain of the security trust mechanism established in this embodiment of the application may be as shown in fig. 3, and includes a root authentication Authority (CA) Certificate, a service terminal CA Certificate, an IPTV terminal sub-CA Certificate, a service terminal Certificate, an IPTV terminal Certificate, and an Online Certificate Status Protocol (OCSP) server Certificate.
After the trust chain is established, the server side safely stores the server side certificate and the private key, the OCSP server certificate, the service side CA certificate and the root CA certificate; the IPTV terminal safely stores an IPTV terminal certificate and a private key, an IPTV terminal sub CA certificate and a root CA certificate.
In an implementation manner, the server may determine the validity of the IPTV terminal certificate based on the IPTV terminal certificate CRL list, and the IPTV terminal may determine the validity of the server certificate based on the OCSP response.
And 102, if the device list comprises the unique device identifier of the IPTV terminal, sending a content authorization license and encrypted video content to the IPTV terminal.
If the device list comprises the unique device identifier of the IPTV terminal, the IPTV terminal is proved to be a valid legal IPTV terminal, so that the service end is ensured to transmit the content authorization permission and the encrypted video content to the valid legal IPTV terminal.
Step 103, if the device list does not include the unique device identifier of the IPTV terminal, recording the unique device identifier of the IPTV terminal.
If the device list does not include the unique device identifier of the IPTV terminal, the IPTV terminal is proved not to be a legal IPTV terminal, so that data transmission between the server and the illegal IPTV terminal can be cut off in time, and the server is prevented from sending content authorization permission and encrypted video content to the illegal IPTV terminal to cause loss. Meanwhile, the service end can record and store the unique equipment identifier of the IPTV terminal.
And step 104, if the recorded times of the unique device identifier of the IPTV terminal exceed the preset times, setting the IPTV terminal as a blacklist user.
If the IPTV terminal is marked as a blacklisted user by the service end, the service end may restrict that the IPTV terminal does not obtain any video content of the service end.
In another implementation manner, the server may also adjust the security level of the IPTV terminal according to the number of times that the unique device identifier of the IPTV terminal is recorded. For example, if the unique device identifier of the IPTV terminal is recorded for 2 times, the security level of the IPTV terminal is lowered by one level; and if the unique equipment identification of the IPTV terminal is recorded for 3 times, reducing the security level of the IPTV terminal by two levels until the IPTV terminal is marked as a blacklisted user.
Example two
Fig. 4 is a schematic workflow diagram of a digital rights management method according to an embodiment of the present application.
As shown in fig. 4, the method is executed by an IPTV terminal, and the method mainly includes a step of decrypting video content, and specifically may include the following steps:
step 21, receiving an encrypted content authorization license and an encrypted video content, where the encrypted content authorization license includes a session key and information encrypted by the session key, and the information encrypted by the session key refers to information encrypted by the session key for a content encryption key.
After sending a video content playing request to the server, the IPTV terminal receives an encrypted content authorization license and encrypted video content sent by the server, where the content authorization license includes hierarchical keys for encrypting the video content, and the IPTV terminal can successfully play the video content only after decrypting the encrypted content authorization license.
And step 22, decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key.
And step 23, decrypting the information encrypted by the session key by using the session key to obtain a content encryption key.
And step 24, decrypting the encrypted video content by using the content encryption key.
The IPTV terminal can decrypt the encrypted content authorization permission by using a private key to obtain a session key after decryption; then, the decrypted session key is used for carrying out confidentiality on the information encrypted by the session key, and a content encryption key is obtained after decryption; and then, the encrypted video content is decrypted by using the decrypted content encryption key, and the video content which can be played is obtained after decryption.
The video content decryption method provided by the embodiment of the application comprises the steps of firstly receiving encrypted content authorization permission and encrypted video content, then decrypting the encrypted content authorization permission by using an asymmetric key to obtain a session key, decrypting information encrypted by using the session key to obtain a content encryption key, and finally decrypting the encrypted video content by using the content encryption key. In the embodiment of the application, the IPTV terminal can play the encrypted video content after successfully decrypting each layer of encrypted information in the content authorization license, so that the secure transmission of the video content from the server to the IPTV terminal is ensured.
In order to ensure the integrity of the content license, before decrypting the encrypted content license using the asymmetric key in step 22, the method further comprises the steps of:
step 25, receiving an encrypted message authentication code, said message authentication code being used to verify the integrity of said content license.
The message authentication code may prompt the IPTV terminal as to which content is included in the transmitted content license. For example: the message verification code displays a content list included in the content authorization license, and the IPTV terminal can verify the received content authorization license according to the content list to confirm whether the received content authorization license is complete. If the content authorization permission is verified to be complete based on the message authentication code, then the above step 22 is further performed; if the content authorization permission is not completely verified according to the message verification code, the IPTV terminal can resend the request to the server side to request the server side to resend the content authorization permission.
When decrypting each level key in the content authorization license, if each level key also corresponds to a key usage rule, decrypting the corresponding level key according to the respective key usage rule. For example, if the received encrypted content authorization license further includes a content encryption key usage rule, in step 24, the encrypted video content needs to be decrypted by using the content encryption key according to the content encryption key usage rule.
For another example, if the received encrypted content license further includes a session key usage rule, in step 23, it is necessary to obtain a content encryption key by decrypting information encrypted with the session key using the session key according to the session key usage rule.
In the embodiment of the present application, the type and number of the key usage rules are not limited, and the key usage rule corresponding to the key of each hierarchy may be one key usage rule or a plurality of key usage rules. For the type of the key usage rule, reference may be made to the description of the first embodiment, and details are not described in this embodiment.
If the key usage rule corresponding to the current key includes a plurality of key usage rules, the current key can be decrypted only on the premise that all the usage rules of the current key are satisfied. For example, if the content encryption key usage rule employs the first type of key usage rule and the fifth type of key usage rule, the encrypted video content can be decrypted using the content encryption key when the first type of key usage rule and the fifth type of key usage rule are satisfied at the same time. For example, the security level of the current IPTV terminal is equal to or higher than the client security level requirement specified in the content encryption key usage rule, and the current decryption time satisfies the content encryption key usage time specified in the first type of key usage rule.
It should be noted that, the content authorization license may only include the content encryption key usage rule or the session key usage rule, or may also include both the content encryption key usage rule and the session key usage rule.
It should be further noted that, in the embodiment of the present application, a precondition for being able to receive the encrypted content authorization permission and the encrypted video content is that the server confirms that the current IPTV terminal is a valid IPTV terminal.
The service end mainly confirms whether the current IPTV terminal is a legal IPTV terminal or not based on the digital certificate, namely, the IPTV terminal and the service end both apply for obtaining a digital certificate to the authentication center as a certificate of own identity, the trust relationship between the IPTV terminal and the service end is based on the validity of the digital certificate, if the certificate of the IPTV terminal is verified to be valid by the service end, the service end trusts the IPTV terminal, wherein each IPTV terminal at least carries one digital certificate. Therefore, when the IPTV terminal sends a video content playing request to the server, the digital certificate of the IPTV terminal may be sent to the server at the same time, and the digital certificate should include the unique device identifier of the IPTV terminal, for example, the unique device identifier may be loaded in an appropriate field of the digital certificate of the IPTV terminal. Specifically, the server determines whether the current IPTV terminal is a valid IPTV terminal according to the unique device identifier. The unique device identifier is not limited in the present application, and for example, the unique device identifier of the IPTV terminal may be a MAC address.
EXAMPLE III
Fig. 5 is a schematic data interaction diagram of a digital rights management system according to an embodiment of the present application.
As shown in fig. 5, the system includes a service end and an IPTV terminal; the server is used for receiving a video content playing request sent by the IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key; and sending the content authorization permission and the encrypted video content to the IPTV terminal. (ii) a The IPTV terminal is used for receiving encrypted content authorization permission and encrypted video content, the encrypted content authorization permission comprises a session key and information encrypted by the session key, and the information encrypted by the session key is the information encrypted by the content encryption key by the session key; decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key; and decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, and decrypting the encrypted video content by using the content encryption key.
The digital copyright management system provided by the embodiment of the application can safely transmit the video content, wherein the server side is responsible for encrypting the video content, and then the IPTV terminal on the set top box carries out real-time decryption to ensure that the video content safely reaches the set top box.
The system provided by the embodiment of the application can be suitable for encrypting ultra high definition live video/on-demand video, wherein ultra high definition refers to a formal name of information display of '4K resolution (3840 × 2160 pixels)' newly approved by the International telecommunication Union, and is also suitable for '8K resolution (7680 × 4320 pixels)'. The ultra-high source-clearing capacity is huge, and 18 minutes of uncompressed video can reach 3.5 TB.
It should be further noted that the set top box in the embodiment of the present application may be an inventory set top box, which is not limited in the present application.
With regard to the system in the above embodiment, the specific manner in which the service end and the IPTV terminal execute operations has been described in detail in the embodiment of the related method, and will not be elaborated herein. The embodiments of the present application may be referred to one another.
In one possible design, the server includes a processor and a memory, where the memory is configured to store one or more computer instructions, where the one or more computer instructions are invoked for execution by the processor; the processor is configured to: receiving a video content playing request sent by an IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key; and sending the content authorization permission and the encrypted video content to the IPTV terminal.
Embodiments of the present invention provide a computer storage medium having one or more computer instructions stored thereon, which, when executed, implement a video content encryption method.
In one possible design, the IPTV terminal includes a processor and a memory, where the memory is configured to store one or more computer instructions, and the one or more computer instructions are invoked for execution by the processor; the processor is configured to: receiving encrypted content authorization permission and encrypted video content, wherein the encrypted content authorization permission comprises a session key and information encrypted by the session key, and the information encrypted by the session key is the information encrypted by the session key for the content encryption key; decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key; and decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, and decrypting the encrypted video content by using the content encryption key.
An embodiment of the present invention further provides a computer storage medium, where one or more computer instructions are stored, and when executed, the computer instructions implement a video content decryption method.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
It will be understood that the invention is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.

Claims (3)

1. A digital copyright management method is applied to a server side and comprises the following steps:
receiving a video content playing request sent by an IPTV terminal, wherein the playing request comprises a unique device identifier of the IPTV terminal;
encrypting the video content using a content encryption key;
encrypting the content encryption key using a session key;
encrypting the information encrypted by the session key by using an asymmetric key;
the session key encrypted by the asymmetric key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key;
judging whether a device list comprises the unique device identification of the IPTV terminal, wherein the device list is used for storing the effective unique device identification of the IPTV terminal;
if the device list comprises the unique device identifier of the IPTV terminal, sending a content authorization license, encrypted video content and an encrypted message verification code to the IPTV terminal, wherein the message verification code is used for verifying the integrity of the content authorization license, and the content authorization license further comprises a digital signature, a session key usage rule and a content encryption key usage rule, wherein the digital signature is used for determining whether the IPTV terminal is an authorized object, and the session key usage rule and the content encryption key usage rule comprise a usage time rule, a cumulative play time rule and an IPTV terminal security level rule;
if the unique device identifier of the IPTV terminal is not included in the device list, recording the unique device identifier of the IPTV terminal;
and adjusting the security level of the IPTV terminal according to the recorded times of the unique equipment identifier of the IPTV terminal.
2. A digital copyright management method is applied to an IPTV terminal and comprises the following steps:
receiving an encrypted content authorization license, encrypted video content and an encrypted message verification code, wherein the message verification code is used for verifying the integrity of the content authorization license, the encrypted content authorization license comprises a digital signature, a session key and information encrypted by the session key, the information encrypted by the session key is the information encrypted by the session key for the content encryption key, and the digital signature is used for determining whether the IPTV terminal is an authorized object;
decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key;
if the current IPTV terminal meets all session key use rules, decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, wherein the session key use rules comprise a use time rule, an accumulated play time rule and an IPTV terminal security level rule;
and if the current IPTV terminal meets all content encryption key use rules, decrypting the encrypted video content by using the content encryption key, wherein the content encryption key use rules comprise a use time rule, an accumulated play time rule and an IPTV terminal security level rule.
3. A digital copyright management system is characterized by comprising a server and an IPTV terminal;
the server is used for receiving a video content playing request sent by an IPTV terminal, wherein the playing request comprises a unique device identifier of the IPTV terminal; encrypting the video content using a content encryption key; encrypting the content encryption key using a session key; encrypting the information encrypted by the session key by using an asymmetric key; the session key encrypted by the asymmetric key and the information encrypted by the session key are packaged in a content authorization license, wherein the information encrypted by the session key is the information encrypted by the session key for the content encryption key; judging whether a device list comprises the unique device identification of the IPTV terminal, wherein the device list is used for storing the effective unique device identification of the IPTV terminal; if the device list comprises the unique device identifier of the IPTV terminal, sending a content authorization license, encrypted video content and an encrypted message verification code to the IPTV terminal, wherein the message verification code is used for verifying the integrity of the content authorization license, and the content authorization license further comprises a digital signature, a session key usage rule and a content encryption key usage rule, wherein the digital signature is used for determining whether the IPTV terminal is an authorized object, and the session key usage rule and the content encryption key usage rule comprise a usage time rule, a cumulative play time rule and an IPTV terminal security level rule; adjusting the security level of the IPTV terminal according to the recorded times of the unique equipment identifier of the IPTV terminal;
the IPTV terminal is configured to receive an encrypted content license, an encrypted video content, and an encrypted message authentication code, where the message authentication code is used to verify the integrity of the content license, the encrypted content license includes a digital signature, a session key, and information encrypted by the session key, and the information encrypted by the session key refers to information obtained by encrypting a content encryption key by the session key, where the digital signature is used to determine whether the IPTV terminal is an authorized object; decrypting the encrypted content authorization permission by using the asymmetric key to obtain a session key; if the current IPTV terminal meets all session key use rules, decrypting the information encrypted by the session key by using the session key to obtain a content encryption key, wherein the session key use rules comprise a use time rule, an accumulated play time rule and an IPTV terminal security level rule; and if the current IPTV terminal meets all content encryption key use rules, decrypting the encrypted video content by using the content encryption key, wherein the content encryption key use rules comprise a use time rule, an accumulated playing time rule and an IPTV terminal security level rule.
CN202010391956.4A 2020-05-11 2020-05-11 Digital copyright management method and system Active CN111601117B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010391956.4A CN111601117B (en) 2020-05-11 2020-05-11 Digital copyright management method and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010391956.4A CN111601117B (en) 2020-05-11 2020-05-11 Digital copyright management method and system

Publications (2)

Publication Number Publication Date
CN111601117A CN111601117A (en) 2020-08-28
CN111601117B true CN111601117B (en) 2021-04-02

Family

ID=72189350

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010391956.4A Active CN111601117B (en) 2020-05-11 2020-05-11 Digital copyright management method and system

Country Status (1)

Country Link
CN (1) CN111601117B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114726647B (en) * 2022-05-12 2022-08-12 知安视娱(北京)科技有限公司 Safe distribution method and system of 4K film content and safe projection system

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1811784A (en) * 2005-01-25 2006-08-02 王晓芸 Digital copyright managing device and method
CN1843034A (en) * 2004-01-29 2006-10-04 松下电器产业株式会社 Transmission apparatus, content reproduction apparatus and license distribution system
CN1864383A (en) * 2003-11-07 2006-11-15 松下电器产业株式会社 System and method for time based digital content access
CN1961306A (en) * 2004-05-31 2007-05-09 三星电子株式会社 Apparatus and method for sending and receiving digital rights objects in converted format
CN101065925A (en) * 2004-11-18 2007-10-31 三星电子株式会社 Method of receiving session key in home network and method of reproducing content using the same
CN101350917A (en) * 2007-12-14 2009-01-21 北京中企开源信息技术有限公司 Method and system for managing digital video copyright
CN101431415A (en) * 2008-12-12 2009-05-13 天柏宽带网络科技（北京）有限公司 Bidirectional authentication method
WO2010124446A1 (en) * 2009-04-27 2010-11-04 华为技术有限公司 Method, device and system for issuing license
CN102546609A (en) * 2010-12-15 2012-07-04 微软公司 Stream transmission with encrypted content
KR20190069759A (en) * 2017-12-12 2019-06-20 주식회사 디지캡 Method for managing and distributing content cryptographic keys in blockchain

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101527818B (en) * 2009-04-23 2011-04-20 天柏宽带网络科技（北京）有限公司 Licence managing method of internet protocol television copyright management system
EP2388724A1 (en) * 2010-05-17 2011-11-23 ST-Ericsson SA Method and device for communicating digital content

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1864383A (en) * 2003-11-07 2006-11-15 松下电器产业株式会社 System and method for time based digital content access
CN1843034A (en) * 2004-01-29 2006-10-04 松下电器产业株式会社 Transmission apparatus, content reproduction apparatus and license distribution system
CN1961306A (en) * 2004-05-31 2007-05-09 三星电子株式会社 Apparatus and method for sending and receiving digital rights objects in converted format
CN101065925A (en) * 2004-11-18 2007-10-31 三星电子株式会社 Method of receiving session key in home network and method of reproducing content using the same
CN1811784A (en) * 2005-01-25 2006-08-02 王晓芸 Digital copyright managing device and method
CN101350917A (en) * 2007-12-14 2009-01-21 北京中企开源信息技术有限公司 Method and system for managing digital video copyright
CN101431415A (en) * 2008-12-12 2009-05-13 天柏宽带网络科技（北京）有限公司 Bidirectional authentication method
WO2010124446A1 (en) * 2009-04-27 2010-11-04 华为技术有限公司 Method, device and system for issuing license
CN102546609A (en) * 2010-12-15 2012-07-04 微软公司 Stream transmission with encrypted content
KR20190069759A (en) * 2017-12-12 2019-06-20 주식회사 디지캡 Method for managing and distributing content cryptographic keys in blockchain

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
一种适用于IPTV的数字权限管理系统;李新国等;《西安电子科技大学学报》;20061220(第6期);943-948 *

Also Published As

Publication number Publication date
CN111601117A (en) 2020-08-28

Similar Documents

Publication Publication Date Title
US10848806B2 (en) Technique for securely communicating programming content
US20200302031A1 (en) Streamlined Digital Rights Management
US9438584B2 (en) Provisioning DRM credentials on a client device using an update server
KR100724935B1 (en) Apparatus and method of interlock between entities for protecting contents, and the system thereof
US8510824B2 (en) Method, system, subscriber equipment and multi-media server for digital copyright protection
KR100945650B1 (en) Digital cable system and method for protection of secure micro program
JP2008527833A (en) Authentication method, encryption method, decryption method, encryption system, and recording medium
US9330250B2 (en) Authorization of media content transfer between home media server and client device
KR20090002227A (en) Method and system for transmitting data through checking revocation of contents device and data server thereof
US20230132485A1 (en) System for Thin Client Devices in Hybrid Edge Cloud Systems
US9722992B2 (en) Secure installation of software in a device for accessing protected content
KR100978162B1 (en) Method for verifying validity of domestic digital network key
CN111601117B (en) Digital copyright management method and system
CN109005427B (en) Encrypted video playing method, device and equipment and storage medium
Inamura et al. IMPLEMENTATION AND EVALUATION OF NEW ILLEGAL COPY PROTECTION

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
PE01 Entry into force of the registration of the contract for pledge of patent right
PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: A digital copyright management method and system

Effective date of registration: 20211126

Granted publication date: 20210402

Pledgee: China Construction Bank Corporation Nanjing Qinhuai sub branch

Pledgor: Zhian Entertainment (Nanjing) Technology Co.,Ltd.

Registration number: Y2021980013384

PC01 Cancellation of the registration of the contract for pledge of patent right

Date of cancellation: 20221212

Granted publication date: 20210402

Pledgee: China Construction Bank Corporation Nanjing Qinhuai sub branch

Pledgor: Zhian Entertainment (Nanjing) Technology Co.,Ltd.

Registration number: Y2021980013384

PC01 Cancellation of the registration of the contract for pledge of patent right
PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: A digital rights management method and system

Effective date of registration: 20230109

Granted publication date: 20210402

Pledgee: China Construction Bank Corporation Nanjing Qinhuai sub branch

Pledgor: Zhian Entertainment (Nanjing) Technology Co.,Ltd.

Registration number: Y2023980030694

PE01 Entry into force of the registration of the contract for pledge of patent right
PC01 Cancellation of the registration of the contract for pledge of patent right

Granted publication date: 20210402

Pledgee: China Construction Bank Corporation Nanjing Qinhuai sub branch

Pledgor: Zhian Entertainment (Nanjing) Technology Co.,Ltd.

Registration number: Y2023980030694

PC01 Cancellation of the registration of the contract for pledge of patent right