KR20070023710A - Privacy-preserving information distributing system - Google Patents

Abstract

In an information distribution system, a system, device, and method are disclosed that maintain the identity of a user while managing a request for information. User Identity The identity of a user associated with a device is kept secret by the continued use of anonymous and temporary anonymous. The process of disseminating information is enhanced by the use of licenses and certificates, and users acquire licenses and certificates by representing themselves permanently and anonymously. When accessing the requested information, the user is represented by temporary anonymity.

Privacy, Anonymous, System, Public Key, Smart Card

Description

Information distribution system for privacy protection {PRIVACY-PRESERVING INFORMATION DISTRIBUTING SYSTEM}

The present invention relates to an information distribution system that allows a user to request digital information, and more particularly, to an information distribution system that protects user information.

Currently, an individual is required to show his identity if it is related to a wide range of activities. Generally, when an individual uses a credit card, makes a phone call, pays taxes, subscribes to a magazine, or purchases something over the Internet using a credit or debit card, an identifiable record of each transaction is generated and a computer database Is written somewhere. In order to obtain or purchase a service using anything other than cash, the agency requires that the individual be identified as the individual.

Consumer polls repeatedly show that an individual values his privacy and is concerned about the fact that personal information is typically stored in computer databases out of control. Protecting an individual's identity is compatible with the option to maintain anonymity, the core of privacy. On the other hand, advances in information and communication technologies are promoting the ability of institutions to store enormous amounts of personal information, but this is increasingly threatening the privacy of individuals from whom information has been collected. In an increasingly privacy world, the leakage of personal information and the possibility of user tracking can create numerous privacy concerns on the user side. As a result, perhaps, increased hatred on these users' side is directed to new technologies that are a privacy violation.

This is clearly seen as opposed to the benefit of the service provider or information distributor. This is because the service provider or information distributor wants to know more about the user as much as possible to protect them against fraud, etc., to carry out direct marketing promotion as much as possible, or the like. As a precaution, users who abuse the system should be excluded from future systems.

In many information distribution systems, it is relatively easy to learn the habits of different users, for example by eavesdropping on communication within the system. This information may later be abused for spam. Today, this problem is partially solved, for example, by forcing users to pay special attention to how to store, for example, secret codes used in the system, or by protecting valuable information with a high degree of security. US 2003/0200468 describes a method of protecting a customer's identity with an online transaction by storing the user's identity on a trusted website.

However, in the systems mentioned above, the use of secure websites is likely to be compromised. If you succeed in attacking a website you trust, you have the knowledge of which key corresponds to which user identity. Thus, an attacker can use this information to map any user's habits in a less defensive information distribution system.

It is an object of the present invention to obviate or at least alleviate the described problem of providing privacy for a user of an information distribution system. This object is achieved by the method and the device according to the attached claims 1, 10 and 17. Preferred embodiments are defined in the dependent claims.

The present invention makes it possible to obtain an information distribution system by providing two anonyms to a user and continuously updating one of these anonyms, where a relationship between the information requested by the user and the actual identity of the user is obtained. Based on the lack of insight. Moreover, such an information distribution system may be secure, for example, as a normal information distribution system operating in accordance with DRM rules. The term "user's real identity" as used herein refers to the physical identity of a user or data that may be associated with a physical user, such as a telephone number, address, social security or insurance number, bank account number, credit card number, organization number, etc. do. Moreover, "anonymous" or additional identity as used herein is any data that is sufficiently anonymous to prevent linking to the actual identity of the individual. The combination of data packets and acknowledgments avoids ambiguity. In other words, this means that there is no association between the user's actual identity and the information requested by the user, and there is no clear way to reconstruct which information the actual user requests. This is because, for example, there is no database that stores the information that enables this reconstruction.

Thus, according to a first aspect of the present invention, the present invention provides a method in which a user requests information from an information distributing device, when represented by persistent anonymity. Using this persistent anonymous user identity device, the user presents himself to the information distribution system. The information distribution system at the identity management device proves that persistent anonymity is trusted. Then, if the proof succeeds, temporary anonymity is associated with the user identity device. Finally, when accessing the requested information obtained from the information distributing device, the user is represented by the temporary anonymity.

According to a second aspect of the present invention, the present invention provides a user identity device for use in an information distribution system in which a user's identity is kept secret. The device includes means for belonging to the persistent anonymity and the information distribution system and arranged for transmitting the persistent anonymity to an identity management device. Moreover, the device belongs to the information distribution system and includes means arranged for transmitting the temporary anonymity to the accessing device.

According to a third aspect of the invention, the invention provides an information distribution system that keeps a user's identity confidential. The system includes an information distributing device arranged as described in relation to the second aspect of the present invention. Moreover, the system is arranged to receive data indicative of persistent anonymity and includes an identity management device associated with the user identity device. The identity device is further arranged to prove that persistent anonymity is reliable, and finally to generate temporary anonymity if the proof is successful.

The information distribution system further includes means for associating the user identity device with data indicative of the temporary anonymity. Finally, the system comprises an accessing device arranged to receive the data indicative of the temporary anonymity, and to provide the user with access to the requested information if the proof is successful.

One advantage of the three aspects mentioned above is that the user does not need to disclose any personal information about himself or herself to any part of the system. Instead, the user uses his persistence or temporary anonymity while the user is in contact with the system, in accordance with the present invention. This ensures that even if the system is attacked, such information is not stored in the system, so that important user information may not be abused. Another advantage is that there is no link between the actual user and the information the user requests. Thus, the user's privacy is maintained since the user's actual identity is not associated with an identifier in the system. As a result, monitoring of user behavior in the information distribution system is prevented. The third advantage is that the information system protects the privacy of the user, making the information system easier to accommodate by potential users. Another advantage is that in order to protect the stored information relating to the user's actual identity, the security measures taken in conventional information distribution systems can be mitigated in accordance with the present invention. This is because there is no database to store important information about users.

A number of advantages associated with other embodiments of the present invention are listed below. Common to these advantages is that the described method keeps the user's identity secret in the system.

As defined in claim 2, the method of sending the temporary anonymous as a certificate has the advantage of non-replicating to the accessing device and providing security to the system. Because the accessing device will check whether the certificate is signed by a trusted party.

As defined in claim 3, the method of generating proof data using the temporary anonymity and encrypting the temporary anonymity with the persistent anonymous has the advantage of allowing the accessing device to authenticate the temporary anonymous authentication. Encryption and attestation data also provide integrity and confidentiality to the user.

As defined in claims 4-9, a method of generating a license available for obtaining access to the requested information provides security to the information provider without revealing the user's identity to the system.

The method of exchanging a certificate between the user identity device and the accessing device has the advantage of providing security to an information provider.

As defined in claims 7 and 9, by managing the license, the user identity device can prove that the device being accessed and the data transmitted by the identity device are correct.

Some of the advantages obtained by the embodiment of the method have been described above. As defined in the dependent claims for the respective systems and devices, similar advantages may also be achieved by corresponding embodiments of the information distribution system.

Furthermore, advantageously, as defined in claim 8, if the temporary anonymity is randomly generated, the anonymity is generated independently of the information distribution system. As a result, it is not possible to associate randomly occurring anonymity with any other behavior within the information distribution system.

Advantageously, persistent anonymity is a public key that allows the information distribution system to encrypt information for a user identity device, using the persistent anonymity. Thus, confidentiality is provided to the system.

Moreover, advantageously, the user identity device is a smart card that aids in the coupling of data to the user identity device.

Even more advantageously, access of the data is performed in accordance with Digital Right Management (DRM) rules, which provide a protocol for distributing information.

The basic idea behind the present invention is that instead of preventing abuse of user information by improving security around the device where the information is stored, the user's privacy is provided so that the information is stored in the first location or never used. to be. Thus, even if the information distribution system is attacked, the attacker cannot obtain a complete list of all the information accessed by the user. As mentioned above, a user may use permanent anonymity, for example when requesting information and temporary anonymity, when later accessing this requested information.

  The above and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter.

1 diagrammatically illustrates an embodiment of the invention.

1 diagrammatically illustrates an embodiment of the invention. For example, a user who wants to access information belonging to a content provider (CP) 120, such as a database connected to the Internet, may not be able to reveal his or her real identity to the information system 100, but instead may be able to access the smart card (SC) 110. By using it, access is possible. This smart card is determined according to the present invention. If a user wants to purchase a right to access some content, he is in contact with the content provider 120 by an anonymous channel requesting the right. After anonymity payment is done, the user sends (1) his public key (PP) 112 to the content provider 120. At this time, a right for this content, that is, a license 121, is generated (2). In a preferred embodiment, the content is encrypted by the content provider with a symmetric key (SYM) and sent with the license 121. Preferably, the format of the license is {PP [SYM // Right // contentID]} _signCP , or {PP [SYM // Right / contentID], H (Rights), H (contentID)} _signCP , where The PP encrypts the mixed value [SYM // Right / contentID]. Rights represent rights acquired by the user. For example, a right indicates how many times a user is entitled to listen to the whole song or only the introduction, or the user song. The contentID identifies the content related to the right, and signCP becomes the signature of the content provider 120 on the license 121. In this embodiment, H () is a one-way hash function. If checked, the license 121 does not reveal the public key (PP) 112 or the content identifier or rights. Thus, it protects the user's privacy with respect to content and rights ownership. Therefore, if license 121 is found in the user's storage device, this does not compromise the user's privacy. During this purchase process, the content provider 120 described above knows the relationship between the public key (PP) 112, the contentID, the right and the symmetric key, but does not know the identity of the actual user due to the anonymity channel.

In general, in order for a user to securely access content on a device (AD) 140 that is being accessed, a compliance certificate 132 for the smart card 110 must be presented to the accessing device 140. However, this compliance certificate 132 does not contain a public key (PP; 112), but is issued with a modifiable SC anonymous or temporary anonymous 131. To obtain the compliance certificate 132 for the SC 110, the user / SC is anonymously in contact with the compliance certificate issuer for the smart card (CA-SC), and his own public key (PP) 112 is used. Send and request certificate 132 (4). It is assumed that the smart card issuer tracks the behavior of the smart card by the revocation list as the public key of the hacked smart card 110. The compliance certificate issuer for smart card (CA-SC; 130) checks with the smart card issuer whether the private key (PP) 112 belongs to the revocation list. If it does not belong to the revocation list, it generates a temporary anonymity 131 for a smart card (CA-SC) 130, for example a random number (RAN) and issues the next compliance certificate 132, which is the smart card. 6 is transmitted to 110: namely {H (RAN), PP [RAN]} _signCA-SC . In an embodiment of the invention, H () is a one-way hash function, PP 112 encrypts the RAN, and signCA-SC becomes the CA-SC's signature for the certificate.

When examined, the certificate 132 also does not leak the public key (PP) 112 and the temporary anonymous (RAN) 131 of the smart card 110. In addition, the only entity capable of obtaining the RAN 131 from the certificate 132 is the smart card 110. This is accomplished through decryption with a private key (PK) 113. Thus, the value RAN 131 may be checked by the authenticator via a hash value in the certificate. The use of Anonymous (RAN) 131 allows the authenticator to check the verification of the smart card 110 without having to know the public key (PP) 112 of the card. Moreover, the anonymous (RAN) 131 can be changed as often as required (every time the smart card (SC) 110 obtains a new compliance certificate 132), thus associating the compliance certificate with a given smart card 110. The possibility of a prover to do so can be minimized. During the procedure described above, the compliance certificate issuer for the smart card (CA-SC) 130 knows the association between the public key 112 and the RAN 131, but does not know the identity of the actual user due to the anonymity channel. can not do it.

Now, the user can access the content corresponding to the license he has, which can only be performed on the accessing device AD 140. In general, the accessing device 140 will act in accordance with the DRM rules. In order to access the content, the user must either carry the content and the license he uses himself (for example in the form of an optical disc) or store the content and the license anywhere on the network. In either case, the content + license must first be delivered to the accessing device AD 140. In addition, since the user is in front of the device AD 140 that is physically accessing at this time, his actual identity may be "public" to the AD 140. The accessing device (AD) 140 may, for example, be equipped with a camera that takes a picture of the user, which may then be used to track the identity of the user. Thus, in order to prevent disclosure of the relationship between the user's actual identity and the public key (PP), to anyone other than the user, the public key (PP) 112 should not be leaked to the accessing device upon accessing the content. This is the reason why the compliance certificate 132 for the smart card (SC) 110 is issued with a modifiable anonymous (RAN) 131. Upon checking this certificate 131, the accessing device 140 knows the RAN but does not know the public key (PP) 112. The content access procedure is described below.

Before the smart card 110 and the accessing device 140 interact with each other, they do mutual compliance checking. The compliance of the accessing device 140 is proved by the compliance certificate 151 of the accessing device, which is issued by the compliance certificate issuer for the accessing device (CA-AD) 150, and the smart card. It is presented at 110 (10). In order to be able to prove the compliance certificate 151 of the accessing device, the smart card 110 is provided as a public key of CA-AD. If this key is changed on a regular basis, this key should cause the AD to periodically renew its compliance certificate. In addition, this means that the smart card (SC) 110 updates its key regularly, and at the same time it can be achieved that the smart card (SC) 110 obtains its compliance certificate from the CA-SC.

The luxury of the smart card 110 is provided by an anonymous compliance certificate 132, which is presented to the accessing device 10. As described above, the smart card 110 obtains the value RAN from the certificate 132 by decrypting the certificate with a private key (PK) 113 and sends this value to the accessing device 140. Access device 140 checks this value via function H (RAN) in the certificate. Since the accessing device may be provided with a clock, the compliance certificate 132 of the smart card may have an issue time attached to the certificate, which causes the smart card 110 to periodically renew when the certificate is old. Also, to minimize the connectivity described above, it is of interest to have smart cards renew their compliance credentials too often.

After this mutual compliance check described above, the accessing device 140 sends the function PP [SYM // Right / contentID] from the license to the smart card 110, and the smart card decrypts this function and accesses the device 140. In step 13, the SYM, Right, and contentID values 123 are transmitted again. Thus, the accessing device 140 can use SYM to decrypt the content and, according to Right, provide the user with access to this content.

During the procedure described above, the accessing device knows the relationship between the RAN and content, rights and SYM, respectively, and can know the identity of the actual user. Thus, under the control of the accessing device, an attacker can gain the identity of the actual user (e.g., the user's photo), the temporary anonymous (RAN) of his SC, as well as the specific content and accompanying rights accessed by the user during this transaction. have. However, this fact only compromises the privacy of the user regarding the specific content and rights involved in this transaction. This type of attack is really hard to avoid. As often changed, with respect to the value RAN, the user can only track a limited number of transactions.

In the second embodiment, this embodiment is the same as the above-described embodiment except for a few steps. One of which is that the license further includes attestation data for the Rights and contentID, and the other is that the user identity device can prove that the data received by the user identification device cannot be tampered with. In this second embodiment, the accessing device 140 transmits a function PP [PSM // Right / contentID] along with H (Right) and H (contentID) from the license to the smart card 110, where the smart card is Decrypts the value in term PP [PSM // Right / contentID], encrypts the decrypted values of Right and contentID with one-way hash function H () with H (contentID) 'and H (Right)', and H (contentID) Proving that 'and H (Right)' are the same as received H (Right) and H (contentID), respectively, the values 123 are SYM, Right and contentID 13 are SYM, Right and contentID Send back to the device 140 to access. The proof ensures a value in the function PP [SYM // Right / contentID].

With respect to the security requirements of the DRM system, the resolution scheme still suggests compulsory compliance checking between the smart card and the accessing device in the transaction of content access, which protects the user's privacy by anonymity of the SC.

The idea behind the present invention is that a user acquires a smart card in such a way that the information distribution system cannot track who the user is. This can be accomplished, for example, by having the user pull out his smartcard from the same "visible" card pile. In one embodiment, each smart card has a different secret public / private key pair PP / PK and an unset PIN in the card (generally, all PINs are initially set to 0000). SCI ensures that the public key of this particular card is not leaked to any party and is not a set of PINs until the user or someone else interacts with the card for the first time. Thus, as the first mutually responsive party, the user may know the public key, thus becoming the only entity that knows the relationship between the real user and the public anonymous. The user also becomes the person who sets the PIN used to activate this card.

A brief overview of what is known to other parts of the system is described below.

The issuer of the smart card does not know any relationship between the identity of the user and the content / rights, and the CP (content provider) knows the relationship between the public key (PP) 112 and the content, rights and SYM.

The CA-SC knows the relationship between the public key (PP) 112 and the temporary key (RAN) 131.

The accessing device 140 knows the temporary anonymous (RAN) 131 and the relationship between content, rights and SYM.

Therefore, even by the collision of the content provider (CP) 120, the CA-SC 130, and the accessing device 140, the actual identity of the user is not leaked. This is because only the user knows the relationship between the user's actual identity and the public key (PP) 112. Moreover, if an attacker can obtain relevant information from the accessing device 140, after the content access transaction has occurred, the user's actual identity and content, Rights and SYM, as well as the relationship between the user's actual identity and temporary anonymity The relationship between each is known to the attacker. However, since the temporary anonymity (RAN) 131 changes regularly and only one portion of the content is associated with the user's actual identity, privacy compromise is minimal. Since the attacker's public key (PP) 112 cannot be known from the accessing device, the attacker cannot generate a complete log of the user's ownership of the content and the pattern of the content usage.

As a result, as described above, the present invention provides anonymity access and checking rights to content as well as anonymity purchases of content and rights in such a way that no individual party in the system knows the user's actual identity individually or together. to provide. For this application, in particular with respect to the appended claims, the term "comprising" does not exclude other components or steps, singular components do not exclude multiple components, and a single processor or unit is a function of several means. It should be noted that at least some of the means may be implemented in hardware or software, which will be apparent to those of ordinary skill in the art.

As described above, the present invention relates to an information distribution system in which a user can request digital information, and can be used for an information distribution system that protects user information.

Claims (26)

Requesting (1) information from the information distributing device in the information distributing system under a persistent anonymous name associated with the user identity device; Sending (4) data to reconfigure the persistent anonymous to an identity management device; At the identity management device, verifying the data to ensure that the persistent anonymity is reliable; Creating at least one temporary anonymous; Upon successful verification, transmitting (6) the at least one temporary anonymity to the user identity device; And Upon access to the requested anonymous, reconfiguring the user by the at least one temporary anonymous (11) How to keep the identity of the user containing a secret. The method of claim 1, Receiving (4) at the identity management device from the user identity device a request for a compliance certificate and the persistence anonymity; If the persistent anonymity is deemed reliable in the step of authenticating the data, further comprising the step (5) of generating the compliance certificate including the temporary anonymity, wherein at least one temporary anonymous Transmitting to the identity device comprises transmitting (6) the compliance certificate to the user identity device. The method of claim 2, The step (5) of generating the certificate, At the identity management device, encrypting the temporary anonymity using the persistent anonymity; If attesting to the encrypted temporary anonymization decryption, using the temporary anonymity, generating attestation data for which attestation data is available by the user identity device; And And including both the encrypted temporary anonymous and the attestation data in the compliance certificate. The method according to any one of claims 1 to 3, Generating (2) a license for the requested information upon receipt of the request for information at the information distributing device; Transmitting (3) the license to the user identity device while encrypting the requested information and transmitting this information to information storage means. The method of claim 4, wherein At the accessing device, obtaining (3) the license and the encrypted information; Exchanging a compliance certificate between the accessing device and the user identity device (10,11), wherein the user is represented by the temporary anonymity and performs cross-certification of the certificate (10). , 11); Upon successful verification of the certificate, providing the user identity device with access to the information. The method according to claim 4 or 5, In the step of encrypting the requested information, when encrypting the requested information, using a symmetric key; In the step of generating a license, encrypting an identifier of the requested information, a right associated with the persistence anonymity, a value representing the symmetric key, and using the persistent anonymity; And Generating (2) the license comprising the password, wherein the user's identity is kept confidential. The method of claim 6, Using a first hash function to generate a first set of data representing an encrypted value of the right associated with the persistence anonymity; Using the first hash function to generate a second set of data representing an encrypted value of the identifier of the requested information; And Including the first set and second set of data in the license. 8. The method of claim 6 or 7, wherein providing the user with access to the requested information comprises: At the accessing device, proving the license; Transmitting (12) the password contained in the license from the accessing device to the user identity device; Decrypting, at the user identity device, the cryptogram received from the accessing device into a value representing the identifier of the requested information and the rights associated with the persistent anonymity, the symmetric key; Sending (13) the decrypted value from the user identity device to the accessing device; At the accessing device, when received from the user identity device, decrypting the encrypted and requested information using the symmetric key; Providing the user with access to the requested information that matches the rights received from the user identity device. The method of claim 8, Decrypting the cryptogram received from the accessing device into a value representing the identifier of the requested information, the rights associated with the persistence anonymity, and the symmetric key, Obtaining the first and second sets of data from the license; Encrypting, by the hash function, the decrypted value representing the right associated with the persistence anonymity; Encrypting, by the hash function, the identifier of the requested information; And Verifying the decrypted value by comparing the encrypted value of the right with the first set of data and by comparing the encrypted value of the identifier with the second set of data. To keep your identity secret. The method according to any one of claims 1 to 9, The temporary anonymity is randomly generated (5) to keep the user's identity secret. The method according to any one of claims 1 to 10, Wherein said accessing is performed in accordance with Digital Rights Management (DRM) rules to maintain the confidentiality of the user's identity. As a user identity device for use in the information distribution system 100 in which a user's identity is kept secret, Persistent anonymous 112; Means (111) arranged for receiving and storing temporary anonymity (131); Means arranged for sending the persistent anonymous to the identity management device (130) of the information distribution system; And Means arranged for transmitting the temporary anonymity to the accessing device (140) of the information distribution system. The method of claim 12, The means arranged to receive a temporary anonymous 131 is further arranged to receive a compliance certificate 132 including proof data available for the temporary anonymous proof and the temporary anonymous password by the persistent anonymous. User identity devices. The method according to claim 12 or 13, Means arranged for receiving and storing a license 121 from an information distributing device 120 in the information distributing system 100, wherein the license is associated with an identifier of the requested information and the persistence anonymity, a symmetric key Means for including an encrypted value (122) indicative of; And Means for providing said license (121) to said accessing device (140). The method according to any one of claims 12 to 14, Means arranged for receiving from said accessing device an encrypted (122) value representing a right, a symmetric key associated with said persistent anonymous and said requested anonymous identifier; Means arranged to decrypt the encrypted value; And Means for transmitting to said accessing device 140 said means for transmitting said persistent value and said decrypted value 123 indicative of said right, symmetric key associated with said identifier of said requested information. . The method of claim 15, Receive the decoded value 123 by receiving a first set and a second set of data, each encoded by a hash function, and comparing the first and second sets of data with the decoded value 123. A user identity device further arranged to attest. The method according to any one of claims 12 to 16, And information storage means arranged to receive and store information from the information distributing device (120) and to provide the information to the accessing device. The method according to any one of claims 12 to 17, The temporary anonymous 131 is a random number user identity device. The method according to any one of claims 12 to 18, The persistent anonymous 112 is a public key user identity device. An information distribution system that keeps a user's identity confidential. An information distributing device (120) containing information requested by the user; A user identity device (110) of claim 12; An identity management device 130 arranged to receive data indicative of persistent anonymity 112 associated with the user identity device, to prove that the persistent anonymity is reliable, and to generate a temporary anonymity 131 upon successful authentication. ); Means for associating data representing the temporary anonymity with the user identity device; Accessing device 140 arranged to receive the data indicative of the temporary anonymity, and to further provide the user access to the requested information upon successful verification. Information distribution system comprising a. The method of claim 20, The identity management device 110 is used by the user identity device when proof data proves the encrypted temporary anonymous decryption to encrypt the temporary anonymous 131 using the persistent anonymous 112. An information distribution system arranged to generate proof data using the temporary anonymity possible, and to contain both the encrypted temporary anonymity and the attestation data within a compliance certificate (132). The method of claim 20 or 21, The information distribution system 100 includes information storage means arranged for receiving encrypted information from the information distribution device, wherein the information distribution device requests the request to generate a license 121 for the requested information. And transmit the license to the information storage means for transmitting the license to the user identity device (110) to encrypt the information. The method of claim 22, The accessing device 140 is arranged to receive and store the license 121, to receive the encrypted information, and to verify the received compliance certificate 132 from the user identity device 110. , The user identity device is arranged to prove a certificate 151 from the accessing device, The accessing device is arranged to provide the user with access to the requested information upon successful verification of the certificate. The method of claim 23, The information distributing device 120 uses a symmetric key to encrypt the requested information with a value 122 representing an identifier of the requested information and a right associated with the persistence anonymity, a symmetric key, and the license 121 Information array, further arranged to include the encrypted value. The method of claim 24, The accessing device 140 is arranged to prove the license 121 and to transmit the cryptographic 122 included in the license to the user identity device 110, The user identity device is arranged according to claim 14, The accessing device uses the symmetric key received from the user identity device to decrypt the encrypted and requested information, and to grant access to the requested information in accordance with the right received from the user identity device. Information distribution system arranged to provide to the user. The method according to any one of claims 20 to 25, The accessing device (140) is arranged according to the Digital Rights Management (DRM) rule.

Images