KR20040103178A - System and Method for Securing Digital Content - Google Patents

Abstract

PURPOSE: A security system and a method for digital contents are provided to eliminate an inconvenience to connect to an authentication server at every contents usage by storing an authentication control set and using the set at following contents usages. CONSTITUTION: A security system for digital contents includes a contents producer server(10), a contents provider server(20) and an authentication server(40). The contents producer server generates a producer control set having information for classifying contents to be supplied based on a predetermined service classification criterion. The contents producer server generates and provides contents having the producer control set. When the contents and the contents producer control set are received, the contents provider server conveys the producer control set to the authentication server and provides the service corresponding to the contents. When the contents producer control set is received, the authentication server maps the contents according to the service classification criterion and provides the mapped information when the service classification information is required from a user terminal. The authentication server alternatively provides a user authentication control set having required information when a particular service group is required from the user terminal.

Description

System and Method for Securing Digital Content

The present invention relates to a digital content security system and method, and more particularly to a system and method for encrypting digital content.

Recently, with the rapid development of computers, the Internet, and storage media, various documents and contents are produced and distributed in the form of computer-readable digital data. However, due to the nature of these digital contents, not only can they easily make copies or variations of the originals, but also can be easily distributed. Therefore, the authors of digital content, which requires a lot of money, time, creativity, and labor, want thorough protection of their copyrights online or offline, but the digital content market is active due to the easy copying and distribution of digital content as described above. Has become a big obstacle.

Therefore, many technologies are used to secure digital information, such as firewalls, IDS solutions, PKI-based encryption solutions, and PC security solutions through PC media control to prevent illegal intrusion of external users in the network. Cannot be. Therefore, a new technology is required to continuously protect and manage the use rights control and control of the content along with access control-oriented security measures.

Accordingly, a digital rights management (DRM) system, which is a solution that provides a reliable distribution environment of digital information, has been provided. The DRM system encrypts various digital contents such as texts, music, images, videos, video lectures, movies, software, and games distributed through various channels, and the user terminal corresponds to the corresponding contents in order to use the encrypted digital contents. By obtaining a license to use the encrypted digital content from an authentication server, the digital content is protected from illegal copying and enables a continuous content monetization service.

The DRM system will be described in detail with reference to FIG. 1 below. 1 is a block diagram of a digital content security system according to the prior art.

The content producer 1 creates a content, contracts with a content provider, and provides the content to the content provider. The content provider server 2 generates a content frame including content provided from the content producer and license information (eg, URL of an authentication server). The content is a unit of information worth of intellectual property and is subject to protection from unauthorized users. As described above, the process of encrypting the content requiring security together with the metadata in a distributable unit is called packaging, and the packaged data is referred to as a content digital container (hereinafter referred to as DC). The content provider server 2 generates the content frame as a packaged content DC, uploads it to a site, or stores it in an external storage space 3. The content DC includes an identification number and metadata information of the content. The content provider server 2 also transmits the information about the content provided from the content producer 1 to the authentication server 4.

The user terminal is provided with an application program, and accesses a site or an external storage 3 of the content provider server 2 through a wired / wireless communication network, and then downloads the corresponding content DC to use the application program. have. The user terminal 6 needs a usage rights control set (license) issued from the authentication server 2 to control the legitimate use of the downloaded content DC. The permission control set may be provided in the form of a content DC as needed or may be provided with only the electronic signature of the authentication server attached. The application program extracts the license information (URL of the authentication server) from the input content DC, accesses the authentication server 4 according to the extracted authentication information, and acquires a license for using the content.

When the application program tries to use the encrypted content stored in the user terminal 6, the application program performs user authentication and application authentication from an authentication server 4 connected through a wired network.

The authentication server 4 receives the information on the content from the content provider server 2, and issues and manages a distribution policy and license for the content. In addition, in order to issue a license to the user terminal 6, the authentication server 4 must receive user information and payment information for the content use amount.

The conventional digital content security system described above has the following disadvantages.

First, in order to obtain a license, a user terminal needs to access a user authentication server for each use of a content, so it takes a long time to use content and is cumbersome.

Second, since the technology for providing an offline service to the user terminal 6 is not implemented so far, the authentication server 4 has a problem that it is difficult to provide a service to the offline terminal.

Third, since the authentication server 4 issues only a license corresponding to the already produced content, the reservation service for the content being produced cannot be applied.

Fourth, because the content is provided separately, it is not possible to provide a service grouped according to the nature of the content.

Accordingly, an object of the present invention for solving the above problems is to provide a digital content security system and method for encrypting digital content.

Another object of the present invention is to provide a digital content security system and method that eliminates the need to connect to an authentication server each time to use encrypted digital content, and shortens user authentication time.

It is another object of the present invention to provide a digital content security system and method applicable to an offline terminal.

It is another object of the present invention to provide a digital content security system and method capable of making a reservation service for content.

Another object of the present invention is to provide a digital content security system and method for providing a service grouped according to the nature of the content.

An embodiment of the present invention for achieving the above object is a method for providing digital content to a user terminal through a communication network, the content creator is to provide information for classifying the content to be provided according to a predetermined service classification criteria Generating a producer control set including the content control server, and when the content provider server providing the content service receives the content and the producer control set, transfers the producer control set to an authentication server and provides a service for the content. And, when the authentication server receives the producer control set, mapping the content according to the service classification criteria, and the authentication server provides the mapped information when service classification information is requested from the user terminal. A specific service group is requested from the user terminal. The method provides a digital content security method comprising generating and providing a usage right control set with the requested information when requested.

Another embodiment of the present invention for achieving the above object is a producer for providing digital content to a user terminal through a communication network, the producer including information for distinguishing the content to be provided according to a predetermined service classification criteria A content producer server for generating a control set, a content provider server for transmitting the producer control set to an authentication server upon receiving the content and the producer control set, and providing a service for the content, and receiving the producer control set Map the content according to the service classification criteria, provide the mapped information when service classification information is requested from the user terminal, and use the requested information when a specific service group is requested from the user terminal. Create and provide a set of permission controls It provides digital content security system comprising a server.

1 is a block diagram of a digital content security system according to the prior art.

Figure 2 is a block diagram of a digital content security system according to an embodiment of the present invention.

3 is a format of a producer control set according to an embodiment of the present invention.

4 is a service configuration diagram according to an embodiment of the present invention.

5 is a format of a usage right control set according to an embodiment of the present invention.

6 is a flowchart illustrating a service registration step of a digital content security method according to an embodiment of the present invention.

7 is a flowchart illustrating a service using step of a digital content security method according to an embodiment of the present invention.

Hereinafter, the detailed operation and structure of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that reference numerals and like elements among the drawings are denoted by the same reference numerals and symbols as much as possible even though they are shown in different drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

First, the present invention will be briefly described to aid understanding, and the producer, the content provider server, and the authentication server determine service classification criteria and service levels, and accordingly, the producer includes service types and levels corresponding to the produced contents. A set of author controls. The content provider server provides the user terminal with a content DC consisting of the content and the producer control set. The authentication server provides the user terminal with classification / gathering information according to the service type and level of the plurality of contents received from the content provider server, and selects the service type and service level from the user according to a request for generating a user control set of the user terminal. It receives the information and the user information to generate a user control set and provide it to the user terminal. Then, the user terminal stores the user control set received from the authentication server, and uses the content according to the comparison result of the producer control set of the content DC downloaded from the content provider server and the stored user control set.

Hereinafter, the present invention will be described in detail with reference to FIGS. 2 to 7B. 2 is a block diagram of a digital content security system according to an embodiment of the present invention.

The content producer server 10 includes a digital content producer 11 for generating / managing digital content and the producer control set generator 12. The producer control set generation unit 11 generates a producer control set in a specific format that specifies corresponding content information, usage rules, and a list of services that can use the content according to a contract with a content provider, and attaches a signature of the producer. The content provider server 20 is provided with the content. The creator control set refers to data in which conditions that a user needs to meet in order to use the corresponding content are listed, and will be described in detail with reference to FIG. 3.

3 is a format of a producer control set according to an embodiment of the present invention. The producer control set is composed of content information, usage rules, service list, and producer signature, and each content is determined according to a contract between the content producer and the service provider.

The content information includes a content ID and a content hash value, and the content ID uses a value assigned from an authentication server as a content unique identifier. The content hash value sets the correspondence between the content to be used and the user control set, and is used as a data for detecting the modulation of the content.

The usage rules specify the qualifications and scope to use the contents, and describe user information, Pay-Per-Usage (hereinafter referred to as PPU) or Pay-Per-View (hereinafter referred to as PPV). ) Consists of service information. The user information is information about a user who can use the corresponding content. The user information may include a user age, a user region, and a user ID when provided only to specific users. The user age indicates a minimum age at which the content can be used, and the user area indicates a region where the content can be used and region information that cannot be used. The user ID indicates an ID of a specific user or user group who can use the corresponding content. The user ID is not specified for general content that is not content for a specific user. The PPU or PPV service indicates whether the corresponding content is available as a PPU or PPV service.

The service list indicates the type of service that will include the corresponding content classified by the contract between the service provider and the content owner. That is, one content may be provided included in one or more types of services. Each service consists of a service ID and a service level. The service ID is an identifier for identifying a service provided by service providers, and is composed of a service provider ID assigned to each service provider by the authentication server 40 and an ID assigned to the service provided by each service provider. The service level includes a service level for using the corresponding content, and refers to information for controlling the range (viewing, listening, copying, editing, etc.) of using the content included in the service.

Referring back to FIG. 2, the content provider server 20 generates a content DC composed of the content received from the content producer server 10 and a corresponding creator control set to the request of the user terminal 60. Download along. To this end, the content producer server 20 includes a content DC generator 21, an authentication server manager 22, a user interface 23, and a database (hereinafter referred to as DB) 24. The content DC generator 21 generates a content DC that is packaged into the content provided from the content producer server 10 and the creator control set. The generated content DC is stored in the internal DB 24 or the external DB 30. The authentication server manager 22 transmits newly created or updated service information to the authentication server 40, and serves as an interface for receiving a content ID from the authentication server 40 and delivering the content ID to the content producer. The user service control unit 23 uploads the content DC to the Internet site, and downloads the content DC in response to requests from the plurality of user terminals 60.

The authentication server 40 includes a content information providing unit 41, a usage right control set generating unit 42, and a DB 43. The content information providing unit 41 includes the content provider information managed by the user, and classifies / collects the content information received from the content providers to provide the user terminal 60 with the service information as shown in FIG. 4. . Referring to FIG. 4, a service list including a plurality of service types and levels is shown. In other words, it means not to distribute individual content but to distribute content in service units. Here, the service may be variously configured according to the nature of the content. For example, a group or channel service that bundles several pieces of content and provides a single service, a theme and level service provided according to the theme of the content, and specific group members. There may be a membership service provided only to the user. In another example, service control through age, region, etc. may be possible. The service level refers to a range in which the user can use the content. For example, as shown in FIG. 4, the level 1 enables 'real time viewing, storage, editing, and copying' of the content, and the level 2 In the case of 'Save, Edit, Copy' is possible.

When new content information is received from the content provider server 20, the authentication server 40 adds the information about the received content to the list of FIG. 4. For example, the content (# 821, # 822) produced by the content creator is a service type and level determined according to a contract with a service provider, and the content # 821 is a 'real time viewing, storage, Level 1 for editing and copying, and Level for real-time viewing and storage are assigned, and content # 822 is assigned to Level 8 for real time viewing, storage, and editing.

The usage right control set generation unit 42 may input usage information including the service type and level selected by the user according to the usage right control set request from the user terminal that has reviewed the content information as shown in FIG. 4. The control set input format is provided to the user terminal 60. The usage right control set generation unit 42 generates a usage right control set according to the information input from the user terminal 60 and attaches the electronic signature of the authentication server 40 to the user terminal 60.

Hereinafter, the user rights control set will be described in detail with reference to FIG. 5. 5 is a format of a usage right control set according to an embodiment of the present invention, wherein the usage right control set includes a user information, a content usage right list, and an authentication server signature.

The user information includes information for authenticating a user who uses the service. The user information is compared with the user information included in the usage rule of the producer control set. That is, only the user who satisfies all the contents specified in the user information can use the contents. The user ID is a user identifier provided by the authentication server and may include a user ID and a group ID of users according to an ID generation policy. The content usage right list consists of a list of services requested by a user.

Each service item of the service list is composed of an identifier assigned to the service and a service selected by the user from a list of services selected by a service provider who can use the service, and a right to use the content of the service or the service.

Referring back to FIG. 2, the user terminal 60 may access the content server 20, the DB 30, and the authentication server 40 to download the digital DC. To this end, the user terminal 60 first accesses the content provider server 20, downloads an application program using the active access control, and installs a new or upgraded program.

The user terminal 60 downloads the content DC selected by the user from the content provider server 20 and stores it in an internal storage space. The internal storage space is a file system, which is a concept including file names, logically indicating where to place them for storage or retrieval, and the like, including some operating systems.

The user terminal 60 accesses the authentication server 40, selects a service type and level desired to be provided, acquires / stores a set of permission to use, and accesses the content provider server 20 to download the desired content DC. . Then, the application program of the user terminal 60 does not access the authentication server 40 as in the related art to obtain the permission control set, and compares the stored permission control set with the producer control set included in the content DC. In addition, it supports to use the content according to the comparison result.

Hereinafter, the digital content security method on the system configured as described above will be described with reference to FIGS. 6 and 7.

6 is a flowchart illustrating a service registration step of a digital content security method according to an embodiment of the present invention.

Prior to the service registration step, the producer, service provider, authentication server, and user generate a (private key, public key) pair and receive a public key certificate generated by the authentication server.

The content creator enters into a contract with the service provider in step 100. However, since the contract process does not correspond to the gist of the present invention, it will not be described in detail.

The service provider server 20 requests the content ID from the authentication server 40 in step 110 and correspondingly receives the content ID in step 120. In operation 130, the service provider server 20 provides the content producer server 10 with content classification information (content ID and service list) according to the contract content.

In step 140, the producer control set generation unit 12 generates the above-described producer control set described in detail with reference to FIG. 3, and transmits the producer control set and the digital content produced in step 150 to the content provider server 20. . Then, the content DC generation unit 21 of the content provider server 20 generates a content DC by packaging the content frame including the transmitted producer control set and the digital content, and generates the content DC, and the DB 24 therein. Me stored / managed in the external DB (30).

The content provider server 20 generates a content service according to a contract with the content producer in step 170 and then transmits the information about the service generated in step 180 to the authentication server 40. The authentication server 40 collects information on the service received from the content provider server, classifies the service type and service level, and generates a service list as shown in FIG. 5 to notify the users.

The user terminal 60 accesses the authentication server 20, reviews the service list provided by the authentication server 20, and then selects a desired service from the desired service list in step 190 to request the corresponding service. At this time, the authentication server 40 transmits an input format for generating a user control set to the user terminal 60 according to the service request of the user terminal 60. On the other hand, the user terminal 60 inputs user information constituting the user control set as shown in FIG. 5 and information on service type and level of content. In this case, payment information such as credit card information may be input from the user, and the user may support automatic payment of the use amount of content within the service and level selected by the user. In addition, a discount service or the like may be provided with respect to the amount of use for the content authenticated through the use authority control set. Then, the authentication server 40 stores the information input from the user terminal 60 in step 200, generates a corresponding user control set as shown in FIG. 5 and transmits it to the user terminal 60. .

The user terminal 60 stores the usage right control set, and accesses the service provider server 20 to download desired content in step 210. The application installed in the user terminal 60 determines whether the content is available when a content, a digital content container, a usage right control set, and a method for the user to use the content are input. Such criteria and method will be described in detail with reference to FIG. 7 below.

7 is a flowchart illustrating a process of determining whether a corresponding content is available in a user terminal according to an exemplary embodiment of the present invention.

In operation 310, the application program installed in the user terminal 20 extracts a producer control set included in the content DC. In step 330, the application program verifies the producer signature included in the producer control set and the signature of the authentication server included in the usage right control set. As a result of the verification in step 330, if an abnormality is found, the application program reports an error state through the display means of the user terminal 60 in step 340, and terminates the use of content in step 350.

If no abnormality is found in step 330, the application program calculates the content hash value input in step 360, and compares the calculated result with the hash value included in the producer control set in step 370. As a result of the comparison in step 370, if there is a difference between the two compared values, the application goes to steps 340 and 350 described above, notifies the difference between the two values compared through the display means of the user terminal and ends the process. do.

As a result of the comparison in step 370, if there is no difference between the two compared values, the application program in step 380 the service ID of the content usage rights list of the user permission control set and the service ID of the service list of the producer control set In operation 390, the controller determines whether a service right is held by checking whether there is a matching service item. That is, referring to FIG. 4, if the user selects service 8-level 2 through the authentication server, the user may receive level 1 and 2 services for the content # 821, and level 1 and 2 for the content # 822. , 3 services are available. If 'Service 8, Level 2' is set in the service information included in the author's control set included in the Content DC of Content # 822, 'Service 8, Level 3' is set in the service information of the permission control set. If set, the user application that receives the two informations allows the content # 822 to be used by applying the level 2 usage rule. That is, the service level is applied as the smaller value between the information of the producer and the control set and the value of the permission control set.

As a result of the determination in step 390, if there is no matching service item, the application program outputs a message inquiring whether the user uses the PPU service through the display means of the user terminal in step 400, and then receives a result from the user. . That is, when the user terminal does not apply for the service type or service level corresponding to the content to be used, it is to determine whether the user has applied for the PPU service, and to separately charge the use amount for the corresponding content. In addition, the use amount of the PPU service may be different from the content use amount corresponding to the service type and service level applied for in the use amount discount. If the PPU service use request information is not input from the user in step 400, the application program proceeds to steps 340 and 350 to output through the display means of the user terminal that there is no right to use the corresponding service and terminates the process.

When the PPU service use application information is input from the user in step 400, the application program checks the PPU fee information set in the service-level to be used in step 410, and compares it with the amount of tokens held by the current user. As a result of the comparison of step 410, if the amount of tokens held is less than the fee, the application goes to steps 340 and 350, indicating that the amount of tokens held by the display means of the user terminal is insufficient and terminates the process.

If the amount of tokens held in step 410 is sufficient, the application program sets the corresponding content as the PPU service in step 420.

As a result of the comparison in step 390, if the same service ID item exists in the permission control set and the producer control set or in step 420, the user determines that the PPU service is set, the application in step 430 user information of the permission control set In step 440, the user's age, region, and group information are compared to determine whether the user can use the content. If it is not suitable for use, go to steps 340 and 350 to inform the user of this and end all processes.

However, when it is determined in step 440 that the user is able to use the content, the application checks the content usage menu, the creator control set, the permission control set, or the PPU setting information selected by the user in step 450 and in step 460. Check if the selected menu is justified. If the result of the check in step 460 is not a legitimate use menu, the application goes to steps 340 and 350 to notify the user of the corresponding item and ends all processes.

However, if it is determined that the user menu requested by the user is legitimate as a result of the checking in step 460, the application program determines whether the subscriber uses the corresponding content as the PPU service in step 470. As a result of the determination in step 470, if the subscriber determines that the content is used as the PPU service, the application deducts the user's token in step 480 and permits the use of the content to store the usage record in step 490, and in step 500 Use content.

However, as a result of the determination in step 470, if the subscriber does not use the content as a PPU service, the application program allows the use of the content without deducting the token, stores the usage record in step 490, and uses the content in step 500.

Step 490 of storing the usage record is for counting the number of times the content is used. If the number of times of using the specific content exceeds the number of times input when the user terminal accesses the authentication server and selects a service, the content is not used. I can't.

As described above, according to the present invention, since the user terminal acquires and stores the use right control set and uses the authentication information of the downloaded content, there is no need to access the authentication server every time the content is used. In addition, since the connection with the authentication server is required once to obtain the use authority control set, it is applicable to the offline terminal. If the creator control set of the content being produced and the permission control set stored in the user terminal are identical, the stored permission control set may be used as authentication information without having to access the authentication server again after the production of the content is completed. It can also be used as a reservation service for content. In addition, the present invention can be applied to various content services including Internet broadcasting services as well as individual content services.

Claims (10)

In the method for providing digital content to the user terminal via a communication network, The content producer generates a producer control set including information for identifying content to be provided according to a predetermined service classification criterion, and generates and provides a content including the producer control set. A content provider server providing a content service, when receiving the content and the producer control set, transferring the producer control set to an authentication server, and providing a service for the content; When the authentication server receives the producer control set, mapping the content according to the service classification criteria; The authentication server provides the mapped information when service classification information is requested from the user terminal, and generates and provides a usage right control set with the requested information when a specific service group is requested from the user terminal. Digital content security method comprising a. The method of claim 1, Receiving and storing, by the user terminal, a permission set provided from the authentication server; The user terminal accesses the content provider server and receives a specific content, and when a service request for the content is requested, extracts a producer control set from the content, compares it with the usage right control set, and accordingly, Digital content security method further comprises the step of determining availability. The method of claim 2, wherein the producer control set and the permission control set, Digital content security method characterized in that it includes service level information that is available information on the content, such as viewing or listening or copying or editing. The method of claim 2, The user terminal accesses a content provider server or an authentication server, etc., receives and stores a token which is a content payment means, and when the service classification information does not match as a result of the comparison between the control sets, payment of the fee using the token. And separately determining whether to separately pay and use the content individually. The method of claim 2, wherein the producer control set and the permission control set, The method of claim 1, further comprising minimum age information for using the content, area information for using the content, or identifier information for a specific user or a group of users who can use the content. A system for providing digital content to a user terminal through a communication network, A content producer server generating a producer control set including information for classifying content to be provided according to a predetermined service classification criterion, and generating and providing content including the producer control set; Receiving the content and the producer control set, transferring the producer control set to an authentication server and providing a service for the content; Upon receipt of the producer control set, the content is mapped according to the service classification criteria, the service information is provided when service classification information is requested from the user terminal, and the request is requested when a specific service group is requested from the user terminal. And an authentication server for generating and providing a set of permission control using the collected information. The method of claim 6, wherein the user terminal, Receives and stores a usage right control set provided from the authentication server, receives a specific content from a content provider server, extracts a producer control set from the content, and compares the usage right control set when requesting a service for the content. And determining whether to use the content according to the result. The method of claim 7, wherein the producer control set and the permission control set, Digital content security system, characterized in that it includes service level information that is available information on the content, such as viewing or listening or copying or editing. The user terminal accesses a content provider server or an authentication server, etc., receives and stores a token which is a content payment means, and when the service classification information does not match as a result of the comparison between the control sets, payment of the fee using the token. And separately determining whether to separately pay and use the content individually. The method of claim 7, wherein the producer control set and the permission control set, The digital content security system, characterized in that it further comprises the minimum age information that can use the content, local information that can use the content or identifier information of a specific user or user group that can use the content.