Embodiment
The invention provides a kind of subscribing digital periodical method and system with copyright protection; for protecting in subscription and distribution process digital periodical content and controlling; avoid by the problem arbitrarily forwarded in digital journals distribution process, and use during multiple hardware devices that a license file is registered booking reader can be supported.
Below in conjunction with drawings and Examples, the present invention is described in detail.
(the first execution mode)
Fig. 1 is the structural representation of the subscribing digital periodical system of band copyright protection according to first embodiment of the invention.As shown in Figure 1, this system comprises: server 11 and multiple client 12A, multiple client 12B (and more client 12C, 12D ... not shown), wherein multiple client 12A belongs to same booking reader A, and multiple client 12B belongs to same booking reader B.Below, for being described alternately between client 12A and server 11.
Fig. 2 is the flow chart of the subscribing digital periodical method of band copyright protection according to first embodiment of the invention.As shown in Figure 2, the method comprises the following steps:
Step S201, booking reader's registration and subscription step
In this step, booking reader in its client to server registration and subscription digital periodical, log-on message and subscription information are sent to server by client, the hardware information of described log-on message client device and corresponding information thereof, described subscription information comprise booking reader's information, subscription journal title and subscribe to the start-stop phase.Server receives log-on message and the subscription information of multiple clients that booking reader registers.
Specifically, in the first execution mode of the present invention, booking reader A registers respectively and subscription digital periodical on multiple client 12A, comprises information of registered users, selectes the journal title of subscription and subscribe to the start-stop phase etc.Then, these client 12A extract the device name of client 12A (such as, computer name) as its corresponding information, and its hardware information is sent to server 11 with corresponding information as log-on message together with subscription information, as mentioned above, subscription information comprise booking reader's information, subscription journal title and subscribe to the start-stop phase.Or, user also can be allowed to input a name and to be referred to as the information corresponding to the hardware information of each client 12A.In order to make information corresponding one by one to the hardware information of each client 12A, if the information of registration repeats, such as device name repeats, then allow booking reader A to revise information, that is, re-enter a unduplicated title.
Step S203, server for encrypting and authorisation step
In this step; server by utilizing Protective Key is encrypted the digital journals content of subscribing to; and for the booking reader of issue date within its subscription start-stop phase; generate license file according to Protective Key with from the hardware information the log-on message that its client receives and corresponding information thereof, then the digital journals content of license file and encryption is pushed to the client of this booking reader.
Specifically, in the issue date of digital journals, server 11 uses key schedule, such as random key algorithm generates Protective Key, and utilize this Protective Key to be encrypted digital periodical content, then each booking reader is checked, if the current issue date subscribes within the start-stop phase at it, then generate license file according to Protective Key with from the hardware information the log-on message that multiple clients of this booking reader receive and corresponding information thereof, then the digital journals content of license file and encryption is pushed to multiple clients of this booking reader.Wherein, the step of server generation license file comprises further:
Utilize the hardware information of each client 12A of registration to generate encryption key to be encrypted Protective Key, form an enciphered message, wherein, the hardware information of Message Digest 5 to client can be utilized to convert, and the information obtained after utilizing conversion generate encryption key;
This enciphered message and corresponding information thereof are generated an authorization together;
The multiple authorizations generated are merged generation license file.
Step S205, client decrypts step
In this step, the client 12A receiving the digital journals content of license file and encryption is decrypted the digital journals content of encrypting according to the hardware information used when this license file and registration and corresponding information thereof.Specifically, this step comprises the following steps:
Information according to using during registration finds corresponding authorization in license file;
The hardware information generating solution decryption key of this client 12A is utilized to be decrypted the enciphered message in the authorization found, obtain Protective Key, wherein, when server 11 utilizes Message Digest 5 that the conversion of the hardware information of multiple client 12A is obtained encryption key, client 12A correspondingly utilizes Message Digest 5 to convert its hardware information, the information generating solution decryption key obtained after utilizing conversion;
The digital journals content of Protective Key to encryption utilizing deciphering to obtain is decrypted.
By this method for subscribing, booking reader regularly can receive the digital journals content of license file and band copyright protection on its multiple client devices of specifying, thus has not only ensured the interests of Periodical Press, but also can realize the control to hardware device.When booking reader needs to access digital periodical content at every turn; its client utilizes other name information of device name or the input used during registration from license file, to find corresponding authorization as information; and utilize the hardware information generating solution decryption key of this client device; enciphered message in this authorization is decrypted; thus acquisition Protective Key, then utilize this Protective Key to be decrypted digital periodical content.After deciphering, booking reader can use by off-line immediately, substantially increases the convenient degree that booking reader uses.
The solution resending application is all needed compared to each subscribed content that obtains, the present invention adopts subscription scheme, do not need to initiate request by client when waiting until distribution digital journals at every turn, but directly initiatively generate license file by server, and license file is pushed to multiple clients of booking reader's restriction, thus, the problem of Replay Attack can be avoided.
In addition, not only limit according to the license file of the present invention's generation on the several client devices only formulated booking reader and use, and this license file can be shared on this multiple client device, and each client need not be respectively generate multiple license file.Therefore, booking reader can obtain digital journals very simply and easily.
Fig. 3 and Fig. 4 is the concrete structure figure of the server and client side realizing method shown in Fig. 2 respectively.
As shown in Figure 3, server 11 specifically comprises: subscribe to processing unit 31, for receiving log-on message and subscription information from client, and log-on message and subscription information is sent to periodical to encrypt and granted unit 32; Periodical encryption and granted unit 32, for utilizing Protective Key, digital periodical content is encrypted, and for the booking reader of issue date within its subscription start-stop phase, generate license file according to Protective Key with from the hardware information the log-on message that its client receives and corresponding information thereof; With push unit 33, for the digital journals content of license file and encryption is pushed to client.
Wherein, periodical encryption and granted unit 32 comprise further: periodical content unit 321, for utilizing Protective Key to be encrypted digital periodical content, and Protective Key is sent to encryption key element 322, the digital journals content of encryption is sent to push unit 33; Encryption key element 322, for utilizing the hardware information generation encryption key from subscribing to processing unit 31 reception, the Protective Key received from periodical content unit 321 is encrypted, form an enciphered message, and this enciphered message is sent to license file generation unit 324, encryption key is sent to and subscribes to client-side information unit 323; Subscribe to client-side information unit 323, for generating the corresponding relation from subscribing to processing unit 31 information received and the encryption key received from encryption key element 322; License file generation unit 324, for utilizing from the corresponding relation of subscribing to the reception of client-side information unit 323, from subscribing to the information of processing unit 31 reception and generating an authorization from the enciphered message that encryption key element 322 receives, and the multiple authorizations generated are merged generation license file, then this license file is sent to push unit 33.Then, the digital journals content of license file and encryption is pushed to multiple client 12A of booking reader A by push unit 33.
As shown in Figure 4, client 12A specifically comprises: collecting unit 40, gathers the hardware information of this client 12A self and corresponding information thereof, and this hardware information and information are sent to registering unit 41 as a log-on message; Registering unit 41, subscription information and log-on message by this registering unit registration also subscription digital periodical, and are sent to server 11 by booking reader; Receiving element 42, for receiving the digital journals content of license file and the encryption pushed from server 11, and sends to Protective Key unit 43 by license file, the digital journals content of encryption is sent to decrypting digital periodical unit 44; Protective Key unit 43, for finding corresponding authorization in license file according to the information used during registration, and utilize the hardware information generating solution decryption key of this client 12A to be decrypted the enciphered message in this authorization, obtain Protective Key, and this Protective Key is sent to decrypting digital periodical unit 44; With deciphering digital journals unit 44, the digital journals content of Protective Key to the encryption received from receiving element 42 received from Protective Key unit 43 is utilized to be decrypted.
Wherein, Protective Key unit 43 comprises further: licence extraction unit 431, for finding corresponding authorization according to the information used during registration from the license file that receiving element 42 receives, from this authorization, obtain corresponding enciphered message, and this enciphered message is sent to deciphering Protective Key unit 432; Deciphering Protective Key unit 432, utilizes the hardware information generating solution decryption key of this client 12A to be decrypted the enciphered message received from licence extraction unit 431, obtains Protective Key.
Describe method for subscribing according to first embodiment of the invention and system referring to figs. 1 to Fig. 4 above, but should be appreciated that, the inventive method is not limited in step and unit disclosed in this execution mode, also can comprise other prioritization schemes.
Such as, in order to increase fail safe, client 12A, when sending log-on message and subscription information to server 11, can be encrypted transmission to log-on message and subscription information, and first server 11 will utilize corresponding decryption method to be decrypted it after receiving log-on message and subscription information.And booking reader A also can only carry out subscribing to and registering on a client 12A, other client 12A only registers, and need not subscribe to again.
Again such as, when booking reader A subscription digital periodical, can according to different subscription conditions, such as, different expenses standards obtains different use rights, comprise the right of the operation such as forwarding, download, duplicating, printing to the digital journals content of deciphering, and the quantity of registered client 12A can be limited according to different expenses standards.Correspondingly, in each authorization in license file, except enciphered message disclosed in the first execution mode and corresponding information thereof, also should comprise these subscription conditions and use right.
Again such as, except the propelling movement mode adopted in the first execution mode, license file also only can be pushed in the issue date multiple client 12A that booking reader A registers by server 11.In this case, first the client 12A receiving license file downloads the digital journals content of encryption from server 11 according to this license file, and the digital journals content to the encryption of downloading is decrypted according to this license file and log-on message.Because digital journals content is encrypted, so download for user by any channel, such as, publicly or issue the digital journals content of encryption in modes such as specific cryptosystems.In addition; server 11 also can get out random Protective Key and license file according to the log-on message received and subscription information in advance; after each issue digital journals content production completes; this random Protective Key is utilized to be encrypted it; then regularly license file etc. is pushed to the client 12A of registration by (such as, closing on the date in issue date or other).Or the digital journals content of license file and encryption also can be merged into a file by server, is then regularly pushed to the client of this booking reader.
(the second execution mode)
In this second embodiment, be with the difference of the first execution mode, not register on each client 12A of booking reader A respectively, but only carry out registering and subscribing on an one client 12A, gather the hardware information of all client devices that booking reader A registers and the information corresponding to these hardware informations by this client 12A.Concrete acquisition method can be connected by network, other interface connects or send or copy on the client device that just carries out registering after Information Monitoring encryption in the machine.
Fig. 5 is the schematic diagram of the system realizing above method.As shown in Figure 5, booking reader A by registering unit 41 register and subscription digital periodical time, collecting unit 40 gathers the hardware information of other client device that the hardware information of himself equipment and booking reader A register and the information corresponding to these hardware informations, and these hardware informations and information are sent to registering unit 41 as a log-on message.
By this execution mode, booking reader A only needs in an one client (such as, computer) on carry out registering and subscribing to, just can in other client of this user (such as, mobile phone) above directly receive and viewing digital journals, and do not need to re-register on the other clients.
(specific embodiment)
Below will be further detailed the present invention by a specific embodiment.
In this embodiment; suppose; first phase publishes the subscription that row unit needs to carry out being with to a monthly magazine monthly issued for 1st copyright protection; a booking reader Zhang San have subscribed this periodical; subscribing to the start-stop phase is from January, 2009 in December, 2009, and needs to receive and read this part of periodical on N platform computer (or mobile phone, handheld device).
First, Zhang San pays to server registration user in an one client, and on N platform computer (or mobile phone, handheld device) respectively to server registration hardware information HINFOi (i=1 ... N) (as mainboard number, No. CPU, the hard disk number of PC, the equipment unique number that the handheld device of Windows Mobile is got by GetDeviceUniqueID ()), and extract corresponding computer name CNAMEi (i=1 respectively ... N) as information, such as, GetComputerName () function can be used to obtain computer name at windows platform, computer name is obtained at Linux platform sys_gethostname () function, in Windows Mobile platform (Pocket PC and SmartPhone), use System.Net.Dns.GetHostName () attribute to obtain related names, on hand-held mobile reading equipment can by being connected with computer time device driver obtain the title of equipment.Then, the hardware information HINFOi (i=1 will got ... and computer name CNAMEi (i=1 N) ... N) as log-on message and subscription information (comprise booking reader's information, subscription journal title with subscribe to the start-stop phase) together be sent to server end.When sending log-on message and subscription information, hardware information and computer name is transmitted by encryption, such as, use server public key K, respectively HINFOi and CNAMEi is encrypted, and is connected in series K (HINFOi)+K (CNAMEi) together and sends (series-mounting can be undertaken by the way of increase separator as " || space || ") as parameter.
Then, server is decrypted by the private key P corresponding to PKI K; Monthly 1 day, first get out the digital journals content file CF of this monthly magazine, then use random key generator to produce a random key as Protective Key KC, the content file KC (CF) that symmetric cryptography obtains encryption is carried out to content file CF.Server is checked through Zhang San and have subscribed this periodical; so obtain Hash (HINFOi) (i=1 after converting with the hardware information of Message Digest 5 Hash () to the N platform equipment of Zhang San ... N) as encryption key; for encipherment protection key K C, obtain enciphered message KHi (i=1 ... N).(namely server adds enciphered message in the authorization corresponding to this equipment; the Protective Key encrypted) KHi (i=1 ... and decipher the information of this enciphered message N); that is, the corresponding relation of corresponding enciphered message and information.
Fig. 6 is the schematic diagram of the license file FLic generated in this embodiment.As shown in Figure 6; " zhangsanPC " information in <Permission> label in ClientName attribute is information; the information of " akeo832mj294bkjhk " in <info> label is enciphered message; that is, the Protective Key of encryption.
Then, the license file FLic of generation together with the digital journals content file KC (CF) encrypted, is sent in the mailbox of Zhang San by email by server.
After Zhang San gets the mail, the N platform client device of Zhang San opens license file FLic, after first client obtains the device name information CNAMEi of the machine, the Permission node that ClientName and CNAMEi is identical is found in license file, obtain its enciphered message, that is, the information in <info> node.Then; the hardware information HINFOi of this equipment is utilized to obtain decruption key after Message Digest 5 Hash (HINFOi) converts; decrypt the Protective Key KC of digital journals content; and with this Protective Key KC decrypting digital periodical content file KC (CF), thus obtain this final digital monthly magazine content CF.
(the 3rd execution mode)
3rd execution mode, compared with above execution mode, adds the equipment allowing Delete superfluous and the function increasing new equipment.
In some cases (as device losses, damage or separately do its with), booking reader needs to delete the unnecessary equipment do not re-used.Following methods Delete superfluous equipment can be adopted: booking reader A sends the request of Delete superfluous equipment 12A ' from any one its chartered multiple client 12A to server 11, can comprise following relevant parameter in this removal request: send the hardware information HINFOn of the equipment 12A of removal request and the information CNAMEm of corresponding information CNAMEn and equipment 12A ' to be deleted thereof.It is equipment to be deleted that this method does not limit the equipment of filing an application, even if can ensure that certain equipment is loss like this, still on other device registration, can send removal request to server, thus the unit deletion that this is loss.
In addition, in order to strengthen the fail safe of sweep equipment process, the PKI K of server 11 can be used to be encrypted removal request, and to carry out being connected in series K (HINFOn)+K (CNAMEn)+K (CNAMEm) to send as parameter (series-mounting can be undertaken by the way of increase separator as " || space || ").
Server 11 is after receiving removal request; the hardware information of equipment 12A ' to be deleted and corresponding information thereof is deleted from original log-on message; thus obtain the log-on message of renewal, and utilize the log-on message and Protective Key generation license file that upgrade.Then, the digital journals content of this license file and encryption is pushed to the registered client 12A (now, not comprising deleted client 12A ') of booking reader A.
About the function increasing equipment, realize by following methods: booking reader A can send the request increasing device A m from any one its chartered multiple client 12A to server 11, this increase request comprises the hardware information HINFOm of hardware information HINFOn and the corresponding information CNAMEn and device A m to be increased thereof sending the equipment 12A increasing request and corresponding information CNAMEm thereof, wherein, the hardware information HINFOm of device A m to be increased and corresponding information CNAMEm thereof gathers by sending the equipment 12A increasing request.As mentioned above, concrete acquisition method can be connected by network, other interfaces connect or on the machine Am Information Monitoring encryption after send or copy to just carry out increase registration client 12A on.The same with sweep equipment process, in order to strengthen the fail safe increasing device procedures, use the PKI K of server 11 to be encrypted increase request, and carry out being connected in series K (HINFOm)+K (CNAMEm)+K (HINFOn)+K (CNAMEn) sending as parameter (series-mounting can be undertaken by the way of increase separator as " || space || ").
Server 11 is after receiving increase request; the hardware information of device A m to be increased and corresponding information thereof is increased in original log-on message; thus obtain the log-on message of renewal; and utilize the log-on message and Protective Key generation license file that upgrade; then, the digital journals content of this license file and encryption is pushed to registered client 12A and the Am of booking reader A.
(the 4th execution mode)
The difference of the 4th execution mode and above execution mode is, add the adaptive functional that part hardware configuration in hardware device is changed, namely, when the fractional hardware in hardware device configures (such as, mainboard, CPU, hard disk etc.) when changing (comprising replacing, deletion, increase etc.), still can normally use the license file of generation to obtain the digital journals content of encryption.
For this function, the present invention adopts the method (Chinese patent being 200410004751.7 see the patent No. " has the digital content of hardware adaptive mechanism and the method for hardware binding ") of the digital content and hardware binding with hardware adaptive mechanism to realize.In this approach, mainly adopt secret sharing scheme, the hardware configuration situation in conjunction with the client of booking reader realizes hardware adaptive mechanism, thus makes the change of the hardware configuration in certain limit in hardware device, can not affect the legal use of digital content.Specifically, the Protective Key of digital journals is divided into n shared sub-key, and generates respectively to n the encryption key that this n shared sub-key is encrypted according to the multiple hardware configuration in client device.When have in this client device be less than n-t hardware configuration occur to change time, namely, when having t in this client device and above hardware configuration is remained valid, still normally can obtain the digital content of encryption by occupancy permit file, otherwise cannot continue to use digital content.In that patent, define threshold schemes (t, n) coming and realize above method, wherein, t is the threshold value of the quantity of effective sub-key (hardware configuration corresponding to remaining valid).
In the present invention, when booking reader A registers on client 12A, when the first execution mode, the collecting unit 40 of the client 12A registered gathers the characteristic information of n the related hardware configuration of this hardware device self (such as, numbering), comprising n non-existent on this client device
0the characteristic information of individual related hardware configuration; When employing the second execution mode, the collecting unit 40 of the client 12A registered gathers the characteristic information of the related hardware configuration of whole client device 12A that booking reader A registers, and the characteristic information that each client device gathers n related hardware configuration (comprises non-existent n on this client device
0the characteristic information of individual related hardware configuration).Now, client 12A comprises these characteristic informations gathered by collecting unit 40 to the hardware information that server 11 sends.
After server 11 receives such hardware information, generate license file according to following steps:
According to the hardware information received, select the value of the threshold parameter t in (t, n) threshold schemes:
The Protective Key of digital journals is divided into n shared sub-key;
For each client device, the hardware configuration of this n shared sub-key and this equipment is bound, namely the characteristic information of n hardware configuration of this equipment of reception is utilized to generate n encryption key, be respectively used to be encrypted n bit string after n shared sub-key or this n shared sub-key convert one by one, generate the validity check information of each shared sub-key simultaneously; The shared sub-key of the value of threshold parameter t, encryption and validity check information thereof are formed an enciphered message; This enciphered message and corresponding information thereof are generated an authorization together;
The multiple authorizations generated are merged generation license file.
After client 12A receives license file, perform following decryption step:
The information used when registering according to client 12A finds corresponding authorization in license file;
Extract the characteristic information of n the related hardware configuration of this client 12A, and utilize these characteristic informations to generate n decruption key, be respectively used to be decrypted the n in the enciphered message in this authorization shared sub-key;
According to validity check information and the (t of each shared sub-key; n) threshold schemes; validity check is carried out to each shared sub-key; if there is t and above effectively shared sub-key; the Protective Key of digital journals content is then recovered according to these effective sub-keys; and utilize the digital journals content of this Protective Key to encryption to be decrypted, otherwise key recovery failure.
By this execution mode, the hardware configuration in hardware device in certain limit changes the legal use that can not affect digital journals, and the license file of generation still can continue normal use, and does not need again to apply for, greatly facilitates user.
In addition, preferably, also out of Memory can be comprised in the enciphered message formed, such as, cryptography information etc., namely, the shared sub-key of the value of threshold parameter t, encryption and validity check information thereof and out of Memory (such as, cryptography information) are formed an enciphered message.In addition, in license file, also can comprise the information of other needs, such as license file integrity check information etc.Now, client, after receiving license file, first needs to verify the completeness and efficiency of license file.
Can find out from above embodiment, according to method for subscribing of the present invention, booking reader regularly can receive license file on its multiple client devices of specifying, then be decrypted according to the digital journals content of this license file to encryption, thus not only avoid the problem of Replay Attack, but also the control to hardware device can be realized.In addition, a licence can use on multiple equipment of booking reader, and need not generate respectively and send, and when the fractional hardware configuration in hardware device occurs to change, still can normal occupancy permit file, thus greatly facilitates user.In addition, booking reader can delete or increase equipment in chartered client, improves the flexibility of subscribing digital periodical.
The present invention is described in detail above with reference to drawings and Examples.But; it should be appreciated by those skilled in the art; the present invention is not limited to disclosed specific embodiment, and the similar amendment that any those of ordinary skill in the art can expect on this basis, replacement and distortion all should be included in protection scope of the present invention.