CN102523232A - Method for granting display license based on participation of digital content providers - Google Patents

Abstract

A method for issuing broadcast license certificates based on the participation of digital content providers provides integrity and confidentiality protection for the process of issuing broadcast license certificates. When a user needs to watch a certain program, the first step is that the UE needs to connect to SN-T and initiate a service request, and the UE then connects to SN-C and perform follow-up actions; the second step is that UE connects to SN-C and initiates a service request, and then SN-C contacts Portal to obtain the streaming media CS server information; the third step, SN-C selects the appropriate CS server to obtain the first streaming media content fragment; the fourth step, between SN-C and the DRM server A secure communication link is established, and the header of the streaming media file is sent to the DRM server; the fifth step, the DRM server sends the generated license to SN-C; the sixth step, after SN-C contacts and receives the playback license, Interact with the UE's home SN-C to deduct the user fee, encrypt the playback license certificate, and send it to the UE.

Description

A Method for Issuing Playing Licenses Based on the Participation of Digital Content Providers

technical field

The present invention is a play license issue scheme based on the participation of digital content providers. It is mainly used to solve the security problem of broadcast license issuance in digital copyright protection, and belongs to the field of software technology.

Background technique

The public key infrastructure PKI based on the public key cryptography system is an effective infrastructure for secure e-commerce, e-government, and public information security exchange, and an effective technology for information confidentiality, authentication, integrity, and non-repudiation. The core of PKI is the authoritative certification authority CA, which is responsible for the issuance and management of certificates—a data structure that binds entity identities and public keys. Among them, the request and issuance of certificates is one of the important links of certificate management. Ensuring the security, integrity and authenticity of the certificate issuance process is the key to ensure the validity of certificates and the effectiveness of the process. Generally, there are two methods for certificate request and issuance: one is "centralized mechanism", which does not require initial authentication of CA/RA and online authentication request, and the key pair can be generated at RA/CA (centralized generation), Information transmission does not need to be confirmed; the other is the basic authentication mechanism, which authenticates each link of initialization, request and confirmation. The public network (Internet/Intranet) is full of various potential threats and attacks, and there may be attackers at any time Interception and tampering of key information. For example, if the user certificate request information or the certificate issued by RA/CA is intercepted and tampered with, the certificate will lose its validity.

Contents of the invention

Technical problem: The purpose of this invention is to provide a method for issuing broadcast license certificates based on the participation of digital content providers, and to introduce the deployment of digital content providers in the process of issuing broadcast license certificates. The nodes participate in the issuance process of the playback license certificate, and provide integrity and confidentiality protection by establishing a secure communication link with the digital copyright protection server.

Technical solution: The broadcasting license issuance method based on the participation of digital content providers in the present invention is a license issuance scheme that introduces the participation of digital content providers in the digital copyright protection broadcasting license issuance process. , establish a secure communication link between the SN-C node digital copyright protection servers, and provide integrity and confidentiality protection to ensure the security of the broadcast license issuance process.

Each user has a different name, and a trusted certification center assigns a unique name to each user and issues a certificate containing the name and the user's public key.

If A and B communicate, he must first obtain B's certificate from the database, and then verify it, and B also needs to verify A's certificate, so that the identities of both parties can be confirmed. After the verification is completed, the holder A transmits digital information to the holder B. In order to ensure the authenticity, integrity and non-repudiation of the information transmission, it is necessary to digitally encrypt and digitally sign the information to be transmitted. The transmission process is as follows:

(1) Using the principle of digital certificates, A generates a summary of the information to be sent.

(2) A digitally signs the abstract, that is, encrypts the abstract with his private key, and sends the encrypted abstract to Party B. If B can decrypt the encrypted abstract with A’s public key, A cannot deny This digest was sent by him, which resolves the non-repudiation of the information.

(3) A randomly generates a symmetric key, and uses this key to encrypt the information to be sent (same as the information to be sent before), and generates ciphertext after encryption.

(4) A uses B's public key to encrypt the randomly generated symmetric key, and sends the encrypted key and ciphertext to Party B. Since A encrypts the symmetric key with B's public key, only B can decrypt it with his private key, and then decrypt the ciphertext with the decrypted symmetric key, thus ensuring the confidentiality of the information.

(5) After B decrypts the ciphertext, he also uses digital certificate technology to generate a summary of the decrypted information, and compares the newly generated summary with the summary sent to him by A. If the two summaries are the same, it means that B The information received has not been modified so that the integrity of the information can be verified.

To: Introduce nodes deployed by digital content providers in the process of issuing license certificates to participate in the process of issuing license certificates, and provide integrity and confidentiality protection by establishing a secure communication link with the digital copyright protection server, The specific nodes that need to be deployed include the core super node SN-C, the cache server CS, and the entry server portal:

Core super node SN-C: a node used to provide signaling services in the core network;

Cache server CS: responsible for transferring content and sending stream data to user UE;

Entrance server portal: Provides a list of live channels and on-demand programs, and provides retrieval services to users.

The specific steps of the broadcast license issuance process based on the participation of digital content providers are as follows:

1) The client initiates a service request to the core supernode SN-C, and the core supernode SN-C selects an appropriate cache server CS to obtain the first streaming media content segment, including the header of the packaged file;

2) The playback client checks whether there is a playback license for the streaming media file locally, if it has a playback license that has not expired or has a number of times to play, it will play directly; otherwise, continue to step 3);

3) The playback client sends the customized service type and streaming media file header to the core super node SN-C;

4) The core super node SN-C interacts with the entrance server portal, determines the address of the digital rights protection server DRM, and establishes a communication link with the digital rights protection server DRM to provide confidentiality and integrity protection, and the user Customize the service type and stream media file header and send it to the digital rights protection server DRM;

5) The digital rights protection server DRM uses the public key of the packager to verify the signature of the file header, query the decryption key, and generate a playback license. The information contained in the certificate includes streaming media decryption password, streaming media decryption technology, playback times, License expiration time, etc.; then generate the encryption key of the playback license and encrypt it;

6) The digital rights protection server DRM transmits the encrypted playback license to the core supernode SN-C, and the core supernode SN-C performs the following operations in turn:

a) first use the user IP multimedia private identification IMPI number to encrypt the streaming media decryption key;

b) use the session key to encrypt the playback license;

c) Then interact with the user's home core super node SN-C to deduct user fees;

d) finally issue the playback license to the playback client;

7) The client decrypts the playback license and the streaming media decryption key to obtain information related to streaming media decryption;

So far, the client has completed the process of obtaining the playback license. After that, the playback client continues to request the streaming media content from the streaming media server, and decrypt and play it.

Beneficial effects: the present invention proposes a broadcasting license issuance scheme based on the participation of digital content providers, which is characterized in that the scheme introduces nodes deployed by digital content providers to participate in the issuance of broadcasting licenses in the process of issuing broadcasting licenses process, and provide integrity and confidentiality protection by establishing a secure communication link with the digital copyright protection server to ensure the integrity and validity of the entire process of certificate application and issuance.

This solution effectively guarantees the information security requirements in the certificate application:

(1) Confidentiality: The request information submitted by the user, the response information returned by the certificate, and the user's confirmation information are all encapsulated in a digital envelope to ensure the confidentiality of the transmitted information. Although the certificate is finally made public, it may not be desirable for information to be leaked before it is officially approved for release (for example, the application information may involve formal certificates that do not include personal privacy).

(2) Authentication: including authentication of certificates and authentication of end users with private keys. The user adds a private key signature to the certificate request information, and the certificate can verify that the requester has a valid private key. The user disassembles the digital envelope and signs the confirmation information with the private key, indicating that the certificate has been correctly obtained by the user, because only those who have a valid private key can disassemble the certificate response information, obtain the certificate signature in the certificate, and sign the certificate signature with the user's private key.

(3) Integrity: In each process of the session, digital signatures are used to ensure the integrity of the information, and tampering or transmission errors in the transmission process can be found.

(4) Non-repudiation: The response information issued by the certificate with the private key and the confirmation information issued by the user are all non-repudiable, ensuring the reliability of the certificate source and the non-repudiation of the certificate obtained and confirmed by the user (the user's non-repudiation comes from others Really own the private key), there is no legal scope involved here.

(5) This authentication transmission process can effectively prevent man-in-the-middle attacks. First of all, it can ensure the validity of the public key certificate obtained by the end user (through public media and public hash value); the final signature certificate guarantees the validity of the certificate issuance, and tampering by the middleman at any stage of the agreement will lead to the failure of the whole process.

Description of drawings

Figure 1 is the overall structure of the digital copyright protection mechanism,

Figure 2 is the scene setting of the digital copyright protection mechanism.

Figure 3 is the process of issuing licenses.

Detailed ways

The present invention is a license issuing scheme that introduces digital content providers to participate in the issuing process of digital copyright protection playing licenses. In the issuing process of playing licenses, a secure communication link is established between digital copyright protection servers of SN-C nodes and provide integrity and confidentiality protection to ensure the security of the broadcast license issuance process. The specific plan is:

First, the UE needs to connect with SN-T and initiate a service request, then SN-T determines the suitable SN-C through the resource query of the portal, and then tells the UE the address of SN-C, and the UE connects to SN-C and proceeds follow-up action;

Secondly, UE connects to SN-C and initiates a service request, and then SN-C contacts Portal to obtain streaming media CS server information;

Next, the SN-C selects an appropriate CS server to obtain the first streaming media content segment (including the header of the packaged file).

At this point, the client checks whether the user already has a playback license. If there is no playback license or the playback license has expired, the client sends the streaming media file header to the SN-C, and the SN-C node interacts with the Portal node to obtain the DRM server address, and then the SN-C communicates with the A secure communication link is established between the DRM servers to provide confidentiality and integrity protection, and the user-defined service type and stream media file header are sent to the DRM server; the DRM server sends the generated license to the SN-C; After the SN-C contacts and receives the playback license, it interacts with the UE's SN-C to deduct the user fee, encrypts the playback license certificate, and sends it to the UE. The detailed process is described as follows:

(1) The client initiates a service request to the SN-C, and the SN-C selects an appropriate CS server to obtain the first streaming media content segment (including the header of the packaged file).

(2) The play client checks whether there is a play license for the streaming media file locally, if it has a play license that has not expired or has a number of play times, it will play directly; otherwise, continue to step (3).

(3) The playback client sends the customized service type, stream media file header, etc. to the SN-C node.

(4) The SN-C node interacts with the portal node, determines the address of the DRM server, and establishes a communication link with the DRM server to provide confidentiality and integrity protection, and customize the service type and stream media file header of the user not sent to the DRM server.

(5) The DRM server uses the public key of the packager to verify the signature of the file header, query the decryption key, and generate a playback license (streaming media decryption password, streaming media decryption technology, playback times, license expiration time, etc.); generate Play license encryption key, encrypt play license.

(6) The DRM server transmits the playing license to the SN-C, and the SN-C performs the following operations in turn:

1) First use the user's IMPI number to encrypt the streaming media decryption key;

2) Use the session key to encrypt the playback license;

3) Then interact with the home SN-C of the UE to deduct the user fee;

4) Finally, the playback license is issued to the playback client.

(7) The client side decrypts the playback license and the streaming media decryption key to obtain information related to streaming media decryption.

So far, the client has completed the process of obtaining the playback license. Thereafter, the playback client continues to request the streaming media content from the streaming server, and decrypts and plays it.

Claims (1)

1. broadcast license passport distribution method of participating in based on digital content provider; It is characterized in that this method node that the introducing digital content provider is disposed in the process of playing the license passport granting; Participate in the distribution process of playing license passport; And integrality and Confidentiality protection are provided through setting up secure communications links with the digital copyright protecting server, the node that specifically needs to dispose comprises core super node SN-C, caching server CS, portal server portal:

Core super node SN-C: be the node that is used to provide the signaling service in the core net;

Caching server CS: be responsible for the transfer of content and send flow data to user UE;

Portal server portal: live channel list and the rendition list of program request are provided, and retrieval service are provided to the user;

The concrete steps of the broadcast license passport distribution process of participating in based on digital content provider are:

1) client is initiated service request to core super node SN-C, and core super node SN-C selects suitable caching server CS to obtain first streaming medium content burst, comprises the head of packaging file;

2) the local broadcast licence that whether has this files in stream media of client end of playing back inspection as having not out of date or the broadcast licence of broadcasting time still being arranged, is then play-overed; Otherwise, continue the 3rd) and the step;

3) client end of playing back sends to core super node SN-C with customize services type, files in stream media head;

4) core super node SN-C and portal server portal carry out alternately; Confirm the address of digital copyright protecting server DRM; And and digital copyright protecting server DRM between set up a communication link; The confidentiality and integrity protection is provided, user customized service type, files in stream media head are sent to digital copyright protecting server DRM;

5) digital copyright protecting server DRM verifies the signature of file header with the PKI of packing device; The inquiry decruption key; Generate and play licence, the information that comprises in the certificate has Streaming Media clear crytpographic key, Streaming Media decryption technology, broadcasting time, licence expired time etc.; Generate the encryption key of this broadcast licence then, it is carried out encryption;

6) the broadcast licence that will encrypt of digital copyright protecting server DRM sends core super node SN-C to, and this core super node SN-C operates successively as follows:

A) at first use user's IP multimedia private identity IMPI encryption stream medium decruption key;

B) re-use session key and play licence;

C) deduct customer charge alternately with user's homing core super node SN-C then;

D) will play license issuance at last and give client end of playing back;

7) licence is play in the client deciphering, the Streaming Media decruption key obtains Streaming Media deciphering relevant information;

Hereto, client has been accomplished and has been obtained the process of playing licence, and after this, client end of playing back continues to streaming media server request streaming medium content, and deciphers broadcast.

Images