KR20070058287A - Method and device for transferring rights object of digital contents and drm system thereo - Google Patents

Abstract

A method and a device for transferring a rights object for digital contents and a DRM(Digital Rights Management) system thereof are provided to increase utility of contents by sharing the contents and domain rights between devices in a domain. A rights issuer issues domain rights to a device(A) that is a predetermined device of a user side. The issued domain rights are encoded domain rights. The predetermined device of the user side generates a domain key and provides the domain key to the rights issuer. The encoded domain rights are domain rights encoded by the rights issuer by using the domain key.

Description

METHOD AND DEVICE FOR TRANSFERRING RIGHTS OBJECT OF DIGITAL CONTENTS AND DRM SYSTEM THEREO}

1 is a block diagram showing a digital rights management (DRM) system,

Figure 2 is a schematic block diagram illustrating the transfer of digital content usage rights between devices in a domain in accordance with the present invention.

3 illustrates an interaction between a license issuer and device A;

4 illustrates a domain management procedure of device A;

5 is a diagram illustrating a procedure for transferring usage rights between devices in a domain.

Figure 6 is a diagram of one embodiment showing the overall operation of the DRM system according to the present invention.

Figure 7 is a diagram of another embodiment showing the overall operation of the DRM system according to the present invention.

The present invention relates to digital rights management (hereinafter referred to as DRM). In particular, the present invention relates to a method and apparatus for transferring rights of digital rights, and to a DRM system in digital rights management, which enables the transfer of rights to content between devices. It is about.

DRM is a system technology for safeguarding and systematically managing the rights to digital contents, and provides a series of protection and management systems for preventing illegal copying of contents and acquiring the right to use the contents, creating and distributing the contents, and using them. do.

1 is a block diagram illustrating a digital rights management system, and the digital rights management system controls the content provider to use the content delivered to the user as much as the usage rights granted to the user. In this case, the content provider is an entity corresponding to a content issuer (CI) and / or a right issuer (RI).

The content issuer (CI) issues protected content using a specific encryption key to protect the content from users who do not have access rights, and the rights issuer (RI) has the right to use the protected content. Issue a Rights Object (RO).

The DRM agent is mounted on a terminal to receive the protected content and the right to use, interprets the license included in the right to use, and converts the protected content into a form that can be used on the terminal. To control. Since a conventional DRM system does not define a predetermined procedure corresponding to a case where a RO issued to a specific device is transferred (or referred to as moving or forwarding) to a second or third device, a user's request for RO movement is required. There is a technical limitation that not only does not respond properly when there is an error, but also decreases the usefulness of the DRM system and digital contents.

Accordingly, an object of the present invention is to enable a transfer of a right issued to a specific device to a third device, and in particular, to provide a method, apparatus, and DRM system for transferring digital content right between devices in a predetermined domain. It is.

In order to achieve the above object, the digital content rights transfer method according to the present invention comprises the steps of: forming a domain in a first device; At least one second device in the domain is characterized in that it comprises the step of transferring the right of use (RO).

Preferably, generating a domain key; The method may further include transferring the generated domain key to at least one second device.

Advantageously, at least one second device joins a domain formed by said first device; And withdrawing the second device from the domain.

In addition, in order to achieve the above object, the device according to the present invention is a device constituting the DRM system, characterized in that it forms a predetermined domain, and transfers the right of use and domain key to at least one other device. .

In addition, in order to achieve the above object, the device according to the present invention is a device constituting the DRM system, it is characterized in that the request to join and leave the domain, and receives the domain key and usage rights.

In addition, in order to achieve the above object, the DRM system according to the present invention, the use rights issuer (RI) to issue a use right; A first device for forming a predetermined domain, managing the formed domain, and generating and transferring a domain key; And at least one second device receiving the domain key and the right to use.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

The basic idea of the present invention is to form a domain (or local group) that includes at least one or more devices, and to transfer domain rights (Domain Right objects or Domain Rights) of digital content between devices in the formed domain, The right to use digital content is shared between devices in a domain. For such an implementation of the present invention, a domain key (or group key) necessary for encrypting and decrypting the domain right is defined so that only devices subscribed to the domain can use the domain right.

The present invention proposes different embodiments depending on the subjects forming a given domain and the subjects generating a domain key. In particular, the present invention proposes each embodiment by distinguishing between a license issuer (RI) and a specific device as a subject forming a domain.

Hereinafter, as used in the description of the embodiment of the present invention, the device (Device) is any terminal (for example, user equipment (UE), mobile phone, cellular phone, DMB phone, DVB-H phone, PDA) Phone, PTT phone, etc.), digital TV, GPS navigation, handheld game consoles, MP3 and other consumer electronics, and so forth, including all devices capable of utilizing DRM content. Domain refers to a collection of devices. Devices belonging to (ie, joined to) a domain are called domain members, and each domain member is a common domain key. Share) The domain key is also used to decrypt domain rights. In addition, a domain right is a type of usage rights (RO) shared between devices in a domain, and is a usage rights (RO) issued by a usage rights issuer (RI) and a usage right (RO) including status information. However, the state information included in the domain right will be described below.

2 is a schematic block diagram illustrating the transfer of digital content usage rights between devices in a domain according to the present invention. 2 is an embodiment in which a device on the user side (ie, device A in FIG. 2) generates a domain and a domain key and manages the domain.

As shown in FIG. 2, a rights issuer (RI) issues domain rights to a predetermined device on the user side, that is, device A. FIG. In this case, the issued domain right corresponds to an encrypted domain right. Specifically, the issued domain right is encrypted by the RI using a domain key generated by a specific device (that is, device A in FIG. 2) provided to the RI. One domain right. Meanwhile, it is assumed that mutual authentication of a public key infrastructure (PKI) is completed between the RI and the device A. This PKI-based mutual authentication procedure corresponds to a procedure in which the device A joins the RI.

As shown in Fig. 2, device A, device B, device C and device D are devices belonging to the same domain. Here, the domain is referred to as a local group because the device A manages it rather than the RI manages the domain, and the domain A is referred to as a domain authority in that the device A manages the domain. A particular device (i.e., device B, device C and device D in Figure 2) obtains a domain key by joining a domain managed by device A. In this case, in order for a specific device (for example, device D in FIG. 2) to subscribe to device A, as described above, the domain joining process must be preceded by a PKI-based mutual authentication procedure. In addition, when a specific device belonging to the domain leaves (or cancels) the domain, the specific device removes the obtained domain key.

Device A may transfer (or move to, transfer) domain rights to a particular device (ie, at least one of device B or device C or device D) belonging to the domain. In addition, when the device A transfers the domain right, if the domain right is a stateful domain right, the device A moves with the state information. Devices within a domain are free to move domain rights and their domain rights status information. Meanwhile, the domain right may be transferred directly to a specific device (that is, at least one of device B or device C or device D) by RI rather than device A. In addition, the movement of digital content as well as domain rights is free between the devices within the domain (e.g., device C and device D in FIG. 2). Thus, domain rights or digital content may be shared between devices in the domain.

If a given domain member (i.e. any device in the domain) cannot move the domain right to a given device outside the domain (i.e. a device that does not own a domain key). Even if a device outside the domain intercepts the domain right, the device cannot decrypt the intercepted domain right because there is no domain key, and cannot use the related content.

On the other hand, although not shown in Figure 2, in the present invention, the digital content is issued from the content issuer (CI) to the device A, and then copied to the device B, the device C to interpret the associated domain rights, and then a certain constraint (Constraint) Used under In addition, the digital content may be directly issued by the CI to the domain member (that is, at least one device of the device B or the device C or the device D) without passing through the device A.

Although FIG. 2 schematically illustrates a procedure for transferring domain rights between devices of a DRM system (ie, RI and devices in a domain), the signal for transferring domain rights between devices is described below with reference to the accompanying drawings. The flow is described in more detail.

3 illustrates an interaction between a user right issuer and device A. FIG.

As shown in FIG. 3, in all the illustrated embodiments, the RI issues domain rights to device A in common. In addition, as described above in FIG. 2, PKI-based mutual authentication and algorithm negotiation have already been completed between the RI and the device A. FIG. Therefore, since the certificate has already been exchanged in PKI mutual authentication, RI and device A know each other's public key.

3 also distinguishes an embodiment according to the subject of domain key generation and domain formation (ie, either RI or device A). Accordingly, as shown in FIG. 3, three embodiments may be distinguished in the interaction between the RI and the device A. FIG.

In the first embodiment, the RI generates a domain key. That is, the RI generates a domain key and encrypts the domain right with the generated domain key, thereby creating an encrypted domain right. RI then issues the domain key and encrypted domain rights to device A. However, the domain key generated and issued by the RI is transmitted by being encrypted with the public key of the device A. Device A then decrypts the domain key using a private key, and the decrypted domain key is used to decrypt the encrypted domain right.

In a second embodiment, device A is the subject generating a domain key. That is, device A generates a domain key and forwards it to the RI. The RI encrypts and generates a domain right with the received domain key, and issues the encrypted domain right to device A. However, the domain key is encrypted and transmitted with the public key of the RI. RI decrypts the domain key encrypted with its private key. RI encrypts a domain right using the decrypted domain key and issues it to device A.

The third embodiment is common to the above embodiments in that RI issues domain rights to device A. However, the difference from the above embodiments is that device A may generate a domain key and domain rights in advance, or may be generated when another device requests device A to join a domain for the first time.

Meanwhile, domain rights issued by the RI are expressed in Rights Expression Language (REL), and a permission is inserted in the domain rights. Here, the permission refers to the ability of a predetermined device (eg, device A) to create a domain in an interaction between RI and device A. Thus, if device A receives the ability to create a domain (i.e. permission) through domain rights (i.e. domain rights issued by RI), device A not only forms a domain but also generates a domain key and RI Based on the contents of the domain rights issued from the domain right, an encrypted domain right can be generated using the domain key. Device A may generate domain formation and domain key generation, and domain rights (i.e., domain rights to move to domain members within a domain) only with the permission from the RI.

The permission that expresses the ability to create a domain has several constraints under it. Examples of such constraints include constraints on which device in the domain will act as device A (i.e., a device capable of managing domain members within the domain), and a list of devices that may be included in the domain (i.e. Constraints on the list of devices (that is, the Black List) that should not be included in the domain, and, in addition, the maximum number of transfers of domain rights within the domain, domain rights within the domain. Constraints such as the time at which they can be transferred are included. On the other hand, the above-described constraints, that is, the number of transfers between devices of the domain right, the time at which the domain right first transfers between devices, and the like are stored and managed in state information. In addition, which device in the domain will act as the device A is expressed by the ID of the device among the constraints, and only a specific device that performs the same role as the device A (that is, a domain authority) manages the domain. do. Therefore, in order to prevent devices receiving domain rights from RI from continuing to form their own domains, there is always a constraint indicating which device in the domain will serve as Device A in accordance with the present invention. It is preferable.

In the above, the contents of the device A having been issued a domain right including permission from the RI to form and manage the domain have been described. Hereinafter, the process of the device A managing the domain will be described in detail.

4 is a diagram illustrating a domain management procedure of the device A;

As shown in Figure 4, device A may join (or referred to as joining) a domain by passing the domain key to domain members (i.e., device B, device C, and device D). 4 shows only the apparatus A and the apparatus B for the sake of brevity of the description of the present invention. Therefore, the embodiment of FIG. 4 is equally applicable to domain members not shown in FIG.

In order for the device B to join the domain, PKI mutual authentication must be performed between the device A and the device B (S401). This allows validating certificates between mutual devices and obtaining public keys for both parties.

The procedure of managing the domain by the device A may be broadly divided into steps of joining the domain (S401 and S410), issuing a domain key (S420), and leaving the domain (S430). First, when the device B joins the domain managed by the device A (S410), the device A invites the device B to join the domain (Join Domain Trigger) and the device B requests the device A to join the domain. It can be divided into (Join Domain).

First, device A invites device B to join a domain. That is, the device A sends a signal (ie, Join Domain Trigger) to the other device (device B) to join the group (S411). However, step S411 is performed only when the user of the device A intends to join the device B.

Second, device B requests device A to join a domain. That is, the device B transmits a signal (that is, Join Domain) to the device A to join the domain (S412).

In operation S412, the user of device A determines user subscription of device B after user confirmation of the user of device B (S421). If the user of the device A has allowed the subscription of the device B in the step (S421), the device A transmits the domain key to the corresponding device (S422). If the user of the device A does not allow the device B to join in step S421, a failure signal indicating that the user cannot join the domain is transmitted (but not shown in FIG. 4).

Meanwhile, in step S422, the domain key is encrypted and transmitted with the public key of the device B. Device B then decrypts the delivered domain key using the private key.

Hereinafter, step S430 in which the device B leaves the domain managed by the device A will be described. Device B may leave the domain managed by device A at the will of the user of device B or the user of device A. When device B leaves the domain, it returns the domain rights to device A. The process is as follows.

That is, device A sends a signal to the device B to leave the domain (Leave Group Trigger) (S431). However, step S431 is performed only when the user of device A intends to exclude device B from the local group.

In contrast to the step S431, the device B transmits a signal to the device A to leave the domain (Leave Domain) (S432). In this case, when the device B has a domain right and the domain right is stateful, the device B also transmits state information of the domain right (but corresponding to the case where the domain right is stateful). On the other hand, if a domain right exists in device A and is only disabled, the ID of the domain right may be transferred instead of returning the domain right. Device A stores or enables the received domain rights and status information (S433).

If the steps S431 to S433 are successful, the device A transmits a signal (ie, an OK signal) indicating the success to the device B (S434). However, if the above steps (S431-S433) had a problem, the device A transmits a signal indicating the failure to the device B.

If a signal indicating a success is transmitted to the device B in step S434, the device B deletes the domain key, the domain right, and state information related to the domain right (S435).

As described above with reference to FIG. 4, when another device (for example, device B in FIG. 4) joins the domain created and managed by the device A, the device joined to the domain shares the domain key. Therefore, since the domain rights can be moved between devices in the domain, and the domain rights can be decrypted and interpreted with the domain key, the domain rights can be used to decrypt and render the content associated with the domain rights. have.

Hereinafter, the transfer (trasfer or move) of domain rights between devices in the domain will be described.

5 is a diagram illustrating a domain right transfer procedure between devices in a domain. As shown in Figure 5, a typical example of any device X in a domain transfers domain rights to any other device Y in the domain. The domain right is also referred to as a domain domain right because it is a domain right that is transferred within the domain. In addition, the device X may be a device A for generating a domain and generating a domain key, and also manages a domain, or may be a specific device in a domain.

The device X may use the content using the domain right and then move the content and the domain right to the device Y by a user request of the user of the device X or the user of the device Y (S501).

The device X copies the content to the device Y using the conventional technology, Super Distribution (S502). However, the device Y may receive the content from RI or CI.

When the user of the device Y requests the transfer of the domain right, when a request signal (Get domain right) is transmitted from the device Y to move the domain right from the device Y (S503), the user of the device X confirms this (S504). .

When the device X approves the request in step S504 or when the user of the device X wants to transfer the domain right existing in the device X to the device Y, the device X together with the domain right state information of the domain right. (However, if the stateful of the domain rights) is transferred to the device Y (S505).

After confirming the user of the device Y, the device Y stores the domain right and the state information of the domain right that have been transferred from the device X (S506). If the step S506 is successful, the device Y transmits a signal indicating the success to the device X (S507). However, if step S506 was not successful, device Y sends a signal to device X indicating failure.

If a signal indicating success has arrived in step S507, the device X removes or disables the domain right (S508). In addition, only when the domain right is stateful, state information related to the domain right is also deleted (S509).

When the user of the device Y desires, in step S506, the user of the device Y can decrypt and interpret the domain right stored in the device Y with the domain key, and again use the content protected by the decrypted domain right under the constraint. There is (S510).

The embodiment of the present invention has been described by separating the interaction between the CI and the device A in FIG. 3, the domain management of the device A in FIG. 4, and the movement of domain rights between devices in the domain in FIG. 5.

Hereinafter, an embodiment of the overall operation procedure of the DRM system according to the present invention will be described with reference to FIGS. 6 and 7. However, referring to the difference between the embodiment of FIG. 6 and the embodiment of FIG. 7, the RI of FIG. 6 generates and issues a domain key, whereas FIG. 7 shows that a specific device (for example, device A) The difference is that a domain key is generated and issued.

6 is a diagram illustrating an overall operation procedure of a DRM system according to the present invention. RI generates a domain key and a domain right and issues the same to the device A, and the device A issues the group key to predetermined devices (for example, FIG. 2 is an example of a system configured to transfer to device B and device C and device D, but only device B in FIG. 6 to form a domain and to transfer domain rights to device B. FIG. However, it is assumed that the PKI-based mutual authentication procedure between the RI and the device A is already completed in FIG. 6. Therefore, the RI and the device A can mutually validate the certificate and obtain both public keys.

Referring to FIG. 6, the RI issues a domain key and a domain right to the device A (S601). In this case, the domain key corresponds to a domain key encrypted with the public key of the device A, and the domain right issued by the RI is a domain right encrypted with the domain key. On the other hand, although the domain key and domain rights have been issued in step S601, they may be issued simultaneously, and the domain rights may be issued at any time before and after issuing the domain key.

Device A decrypts the domain key (i.e., the domain key encrypted with the public key) issued by the RI using its secret key, and then decrypts the domain right (i.e., the domain key with the decrypted domain key). The domain right) is decrypted and interpreted, and the content associated with the domain right is used (S602). Here, the content may be directly issued from the CI, or may be issued from the RI. In addition, the issued time may be before or after the domain right is issued. In addition, as described above, the permission to express the ability to create a domain is inserted in the domain right issued by the device A.

Device A forms a domain and generates a domain key based on the constraints of the permissions contained in the issued domain rights. When the device B requests to join the domain created and managed by the device A (S603), if the user of the device A confirms and approves it, the device B transmits the domain key to the device B in response to the approval (S604). However, if the user of device A rejects the request for subscription of device B, the rejection intention is forwarded to device B and the user of device B can confirm it. On the other hand, the user of the device A and the user of the device B may or may not be the same person.

The content existing in the device A is copied to the device B (S605). However, the step (S605) may occur at any time of the present invention, it is performed by the super distribution (Super Distribution) of the prior art.

Device B requests device A to transfer domain rights (Get domain rights) (S606). Then, the device A copies the domain right (that is, the original domain right) existing to it, and then transfers the copied domain right (ie, the copy domain right) to the device B (S607). In this case, if the domain right is a state-based domain right, state information of the domain right is also transmitted.

The domain right (that is, the copy domain right) and the state information transferred in the step S607 are stored in the device B, and a signal (that is, an OK signal) that the transfer was successful is transmitted from the device B to the device A (S608). ).

If the transfer of the domain right and status information was successful in step S608, the device A deactivates or deletes the domain right (that is, the original domain right) remaining in the device, and also deletes the status information of the domain right. (S609).

The device B decrypts and interprets the domain right received from the device A (where the domain right is the domain right encrypted with the domain key) using the domain key issued in step S604, and then decrypts the domain right. Using the content (that is, protected digital content) using (S610).

On the other hand, when the device B sends a signal to leave the domain managed by the device A (ie, Leave Domain) (S611), the device B has its own domain rights and status information (but the status information is a domain). Only when the right is Stateful), together with the device A (S612). If the device A has deactivated the domain right in step S612, only the ID of the domain right is transmitted in the transfer of the domain right, and the device A activates the deactivated domain right and also stores the state information ( S613).

If the steps S612 and S613 are successful, the device A sends a signal indicating the success to the device B (that is, an OK signal) (S614), and the device B deletes the domain key, the domain right, and its status information (S615). ).

The device A uses the related content by using the domain right re-activated in the step S613 (S616).

Summarizing the embodiment of FIG. 6 described above, the ability of the device A to form a domain and form a domain key through RI and PKI mutual authentication is issued a domain right to join at least one or more other devices to the domain. By using the associated DRM digital content by sharing (or transferring) the domain right by sharing a domain key with other subscribed devices.

7 is another embodiment showing the overall operation sequence of the DRM system according to the present invention. The embodiment illustrated in FIG. 7 differs from the embodiment of FIG. 6 in that a specific device (eg, device A in FIG. 7) generates a domain key and RI generates a domain right.

Hereinafter, the embodiment shown in FIG. 7 will be described in more detail. However, as in the embodiment of FIG. 6, it is assumed that a PKI-based mutual authentication procedure between the RI and the device A has already been completed. Therefore, the RI and the device A can mutually validate the certificate and obtain both public keys. 7 illustrates only the steps compared with the above-described embodiment. Thus, although not shown in FIG. 7, the common contents of FIGS. 2 to 6 described above are included. For example, it includes a series of processes according to the above-described PKI mutual authentication between devices and the movement of domain rights in FIG.

Referring to FIG. 7, device A generates a domain key (S701). In this case, the domain key is a domain key encrypted using a public key of RI. The device A transfers the generated domain key to the RI (S702).

The RI generates a domain right (that is, a domain domain right) by using the domain key received in the step S702 (S703). In other words, the RI decrypts the received domain key with its secret key and encrypts the domain right using the decrypted domain key.

The RI transmits the generated domain right (that is, the domain right encrypted with the domain key) to the device A (S704). The device A may use the related content by decrypting the received domain right by using a domain key. In addition, as described above, the permission of the ability of the device A to form a domain is inserted in the domain right issued by the RI.

Meanwhile, when at least one specific device (that is, a device to be a domain member, device C in FIG. 7) requests to join a domain formed by device A, the domain key is passed after the specific device user has been verified, and then the domain key is delivered. S705). That is, device A shares a domain key with at least one domain member (eg, device C in FIG. 7). In this way, the specific device is joined to the domain formed by the device A by sharing the domain key.

If the device C (ie, domain member) requests the domain right, the device A delivers the domain right (S706). In this case, the domain right is a domain right encrypted with a domain key. On the other hand, the device C may be issued to the domain rights by directly requesting the RI rather than the device A.

The device C, which is a domain member, decrypts the domain right with the received domain key (here, the domain key decrypted with the device C's private key), and decrypts and uses (or consumes) the digital content using the decrypted domain right. <Consume>) (S707).

Meanwhile, in step S705, the domain key may be delivered to the domain member device at any time after the device A generates the domain key. Thus, the transfer of domain keys may occur before or after the transfer of domain rights.

In addition, the device A, as the administrator of the domain, when the domain key is leaked to a third party other than the domain member device, regenerates another domain key and reissues the domain right according to the above-described procedure.

The present invention has been described above with reference to the embodiments shown in the drawings of the present invention, but this is merely exemplary and various modifications and equivalent other embodiments may be made by those skilled in the art. Will understand. For example, in the above-described embodiment, PKI-based mutual authentication has been described as an example, but it is obvious that mutual authentication by other encryption algorithms may be applied. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the present invention, a user who has received a specific right from a content issuer (CI) can transfer a right of use among various devices within a desired range of the user, so that the user can conveniently use the content in the device of his or her desired device. There is. In addition, the content and domain rights can be shared between the devices in the domain has the effect of increasing the utilization of the content.

Claims (63)

The first device forming a domain; And at least one second device in the domain transfers the right to use. The method of claim 1, further comprising: generating a domain key; And transferring the generated domain key to at least one second device. The method of claim 2, wherein the domain key And the first device generates the rights to use digital content. The method of claim 2, wherein the domain key Digital content rights transfer method, characterized in that generated by a specific entity. The method of claim 4, wherein the specific entity is A digital content rights transfer method comprising a rights issuer (RI). The method of claim 2, wherein the domain key A method for transferring rights of digital content, characterized by being used to encrypt a right of use. The method of claim 2, wherein the domain key And the domain key is encrypted with a public key of a second receiving device. 8. The method of claim 7, wherein the encrypted public key is And decrypting the secret key of the second device. The method of claim 2, wherein the domain key A method of transferring a digital content right, characterized in that shared by at least one device joined to the domain. The method of claim 2, wherein the domain key Digital content rights transfer method, which is issued from the first device to the second device at the intention of the first device or at the request of the second device. The method of claim 9, wherein the at least one device joined to the domain includes: And upon withdrawal from the domain, the domain key is deleted from the device. The method of claim 2, wherein the second device The digital content use rights transfer method, characterized in that joined to the domain by receiving the domain key. The method of claim 12, wherein an encryption algorithm based mutual authentication is performed between the first device and the second device to join the domain. 14. The method of claim 13, wherein the mutual authentication based on the encryption algorithm is A digital content usage rights transfer method, characterized in that the mutual authentication by a PKI-based algorithm. The method of claim 2, wherein the transfer of the domain key is The method of claim 1, wherein the right to use the device is available at any time before or after the right to be transferred to the second device. The method of claim 1, wherein the predetermined domain is And at least one device sharing a domain key. The method of claim 1, wherein the domain forming capability of the first device is Rights issuer The digital content use rights transfer method, characterized in that included in the permission (premission) inserted in the right to issue to the first device. The method of claim 17, wherein the permission is And a capability for the first device to generate a domain key and generate a usage right encrypted with the generated domain key. The method of claim 17, wherein the permission is A method of transferring a digital content right, characterized by having at least one constraint below. The method of claim 19, wherein the constraint is And at least the maximum number of movements of the right within the domain, and the time at which the right of use can be transferred within the domain. The method of claim 1, wherein the right to use A method of transferring digital content rights, which is a domain right and is encrypted with a domain key. The method of claim 1, wherein the usage right is a state-based right. Digital content usage rights transfer method, characterized in that for transferring the state information of the usage right together. The method of claim 1, wherein the right to use And the second device can be decrypted with a domain key issued from the second device. The method of claim 1, wherein the right to use And a second device received from the issuer of the right to use the digital content. The method of claim 1, wherein the right to use And transferring the first content to the second device. 27. The method of claim 25, wherein the first device transfers the right to use to the second device. And deactivating or deleting the transferred domain right by the first device. 27. The method of claim 26, wherein the right to use is state-based right. Digital content usage rights transfer method, characterized in that for deleting the status information of the usage rights. The method of claim 1, further comprising: at least one second device joining a domain formed by the first device; And withdrawing the second device from the domain. 29. The method of claim 28 wherein a second device joins the domain. And mutual authentication of an encryption algorithm between the first device and the second device is performed. 29. The method of claim 28, wherein joining to the domain is And the request of the first device or the request of the second device. 29. The method of claim 28, wherein joining to the domain is And after issuing the user of the second device, issuing a domain key to the second device. The method of claim 28, wherein the withdrawal from the domain is And the request of the first device or the request of the second device. The method of claim 28, wherein the second device leaves the domain. And transmitting the usage right received from the second device to the first device and deleting the usage right. 34. The method of claim 33, wherein the usage right is a state-based right. And the second device deletes the status information of the right to use. 34. The device of claim 33, wherein the first device is Digital content usage rights transfer method, characterized in that for activating the use rights received from the second device. The method of claim 1, wherein the right to use And decrypting the associated digital content encrypted with the decrypted right, after decrypting with the domain key. As one device constituting a DRM system, A device, comprising: forming a predetermined domain and transferring a right of use and a domain key to at least one other device. 38. The apparatus of claim 37, wherein the device is And sharing a domain key with the other device. 38. The apparatus of claim 37, wherein the device is A device comprising at least a mobile communication terminal capable of using DRM, a digital TV, navigation, a portable game machine, an MP3, and other home appliances. 38. The method of claim 37, wherein the right to use Device comprising domain rights. 38. The apparatus of claim 37, wherein the device is And at least a domain generation capability, a domain key generation capability, and an ability to manage the generated domain from a rights issuer. 42. The method of claim 41 wherein the capability is A device, characterized in that it is inserted into a permission of a right issued by the rights issuer to the device. 38. The method of claim 37, wherein the domain key is And the device is used to decrypt the right to use. 38. The apparatus of claim 37, wherein the device is And at least one other device joins and leaves the domain. 38. The apparatus of claim 37, wherein the device is And copying and transferring the right to use to the second device and deactivating or deleting the original right to use. 38. The apparatus of claim 37, wherein the device is And encrypting with the public key of the other device to be transferred to the other device. As one device constituting a DRM system, Request to join or leave a given domain and receive a domain key and domain rights; 48. The device of claim 47, wherein the device is And receiving the domain right from the device forming the predetermined domain. 48. The device of claim 47, wherein the device is And receiving the domain right from a rights issuer (RI). 48. The device of claim 47, wherein the device is And decrypting the domain key with its own secret key and decrypting the domain right using the decrypted domain key. 48. The device of claim 47, wherein the device is And share at least one of the domain key, domain rights, and digital content with at least one other device in the domain. 48. The device of claim 47, wherein the device is When the user withdraws from the domain, the domain right and the domain information of the domain right is transmitted to the device for managing the domain, characterized in that for deleting the domain rights and the domain rights of the owned device . A license issuer (RI) for issuing a license; A first device for forming a predetermined domain, managing the formed domain, and generating and transferring a domain key; And At least one second device receiving the domain key and domain rights. 54. The method of claim 53, wherein the issuer of the right to use And issue the domain right to either or both of the first device and the second device. 54. The method of claim 53, wherein the issuer of the right to use And generate a domain key and issue it to the first device. 56. The method of claim 55, wherein the right issuer And issue a domain right encrypted with the domain key to the first device. 54. The method of claim 53, wherein the issuer of the right to use DRM system, characterized in that for performing the PKI-based mutual authentication with the first device. 54. The method of claim 53, wherein the issuer of the right to use Receiving a domain key generated by the first device, encrypting a domain right with the domain key, and transmitting the encrypted domain right to the first device;  54. The method of claim 53, wherein the issuer of the right to use  At least a domain is inserted, the domain management capability, and the domain key generation capability, into a permission in a domain right and delivered to the first device. 54. The method of claim 53, wherein the first device is Delivering a domain key to the second device and sharing a domain key. 54. The method of claim 53, wherein between the first device and the second device DRM system, characterized in that the PKI-based mutual authentication is performed. 54. The DRM system of claim 53, wherein the first device deactivates or deletes the original right of use after the first device copies the original domain right and transfers the copy domain right to the second device. 54. The DRM system of claim 53 wherein the first device and the second device share domain rights.

Images