EA035157B1 - Digital rights management method for media content, drm client and serving end - Google Patents

Abstract

The present invention relates to a digital rights management (DRM) method for media content, a DRM client, a DRM serving end, a terminal device and a DRM server. The digital rights management (DRM) method provides a DRM client receiving a call request from a media application and acquiring a unique identifier of media content to be played; sending a DRM authorization request to the DRM serving end to acquire a content authorization execution unit, the DRM authorization request comprising an identifier of the media content and basic information about the DRM client; and running, in a DRM client running environment, the content authorization execution unit to realize a DRM authorization function. Using the technical solution of the present invention, flexible protection can be provided for media content, thereby enhancing the degree of safety for the media content.

Description

FIELD OF THE INVENTION

The present invention relates to digital rights management (DRM) technologies, and more particularly, to a DRM method for multimedia content, a DRM client, a DRM server side, a terminal device, and a DRM server.

BACKGROUND OF THE INVENTION

Currently, smart devices, which include televisions, are used everywhere in homes and are increasingly becoming the main source of multimedia content for users in everyday life, such as audio and video materials and documents. International content providers, led by Hollywood content providers, are actively deploying ultra-high definition 4K multimedia content. The Japanese television channel NHK has reached the level of industrial production of encoding and display devices with a resolution of 8K. Major home content providers, such as CCTV and Jiangsu TV, are actively deploying the production, broadcast and operation of ultra-high definition multimedia content. To broadcast the countdown to the New Year, Jiangsu TV channel uses ultra-high definition, which confirms the onset of a new era of ultra-high definition multimedia content. Ultra-high-definition multimedia content has high production costs and costs, and is also considered the next stage of development in the media industry. Major home content providers, Hollywood content providers, etc. Pay particular attention to the protection of ultra-high definition multimedia content. To transfer ultra-high-definition multimedia content, it is necessary to comply with high requirements for protecting rights, and it is also necessary to ensure frequent replacement of content protection algorithms to increase the level of security. Therefore, it is imperative to create content protection technology to provide technical support and guarantees to build a workable ecosystem of ultra-high definition multimedia content.

As part of existing digital rights management (DRM) technology, digital multimedia content is typically encrypted and encapsulated. In accordance with business rules established by operators, information such as a content encryption key and DRM credentials (for example, permission to access content and restriction conditions) are encapsulated in a content authorization license in accordance with a specific grammar. The content authorization license is sent to the DRM client through the interaction between the DRM client and the DRM server side of the terminal device, and the DRM client decrypts and reproduces the content according to the rules set in the permission and restriction conditions specified in the content authorization license.

However, the existing system using DRM technology is not able to set a personalized content encryption algorithm, authorization rule, etc. for multimedia content, whereby the multimedia content is poorly protected. In accordance with the existing DRM technology, if necessary, make changes to the content encryption algorithm, authorization rule, etc. the DRM server-side system and the DRM client system must be updated simultaneously, and in accordance with the requirements of commercial operation and security requirements, the content encryption algorithm, authorization rule, etc. cannot flexibly change in real time, which does not contribute to the intensive protection of the security of multimedia content.

In the case of a trusted runtime, basic DRM client functions, such as decryption and decoding, must be executed in a trusted runtime. When updating the DRM client, you must also update the entire trusted runtime at the same time, which can negatively affect the normal operation of other functions in the trusted runtime that are not related to DRM.

In addition, the method of analyzing and executing permission and restriction conditions from an existing content authorization license is optional for the DRM client, so loopholes can easily appear in the execution. For example, it may be a loophole in which the DRM client does not decrypt or reproduce the content in accordance with the permission requirements and restriction conditions.

SUMMARY OF THE INVENTION

One of the objectives of the present invention is the provision of a new technical solution for digital rights management, which can solve at least one of the above technical problems.

In accordance with a first aspect of the present invention, there is provided a digital rights management (DRM) method for multimedia content running in a terminal device on which a DRM client is installed. The method comprises the following steps:

stage 1: receiving by the DRM client a call request for the multimedia application of the terminal device and retrieving the unique identifier of the multimedia content to be played from the DRM client from the call request;

- 1 035157 stage 2: the DRM client sends a DRM authorization request to the DRM server side to retrieve the content authorization execution unit, the DRM authorization request contains the multimedia content identifier and basic DRM client information and the DRM server side generates the content authorization execution unit in the following way: the DRM server side obtains a content encryption algorithm and a content encryption key used for multimedia content, and a DRM client DRM authority for multimedia content in accordance with a DRM authorization request by a request, and then it is generated according to the identifier of the multimedia content content encryption algorithm and a content encryption key applicable for multimedia content, basic DRM client information, and DRM client DRM credentials for multimedia content;

stage 3: the DRM client executes the content authorization execution unit in the DRM client executable environment, verifies that the terminal executable environment matches the DRM client DRM authority for multimedia content through the content authorization execution unit and, if the multimedia content is decrypted according to the content encryption algorithm and the key content encryption.

Optionally, a content authorization execution unit is issued to the DRM client after signing by the server side of the DRM. After retrieving the content authorization execution unit, the DRM client first verifies the signature of the content authorization execution unit, and then, if the verification result is positive, performs the content authorization execution unit.

Optionally, in step 2, the DRM client executes a data exchange execution unit in a running DRM client environment and sends a DRM authorization request to the DRM server side via the data exchange execution unit.

Optionally, between stage 1 and stage 2, the method further comprises the step of retrieving a data exchange execution unit: sending a DRM client request for a data exchange execution unit to the server side of the DRM to retrieve a data exchange execution unit. The data exchange execution unit request contains basic DRM client information. A communication execution unit is generated by the server side of the DRM in accordance with the basic information of the DRM client.

Optionally, a data exchange execution unit is issued to the DRM client after signing by the server side of the DRM. After retrieving the data exchange execution unit, the DRM client first verifies the signature of the data exchange execution unit, and then, if the verification result is positive, it performs the data exchange execution unit.

Optionally, the DRM client DRM permissions for multimedia content indicate that when playing multimedia content, the DRM client must check the digital watermark of the multimedia content. The content authorization execution unit notifies the DRM client to execute the digital watermark execution unit. The DRM client executes the digital watermark execution unit in the DRM client's executable environment, checks the digital watermark embedded in the multimedia content during the multimedia content playback by the digital watermark execution unit, and stops the multimedia content in the case of a negative check result. A digital watermark execution unit is received from the server side of the DRM to a DRM client requesting, in accordance with the notification, a digital watermark execution unit corresponding to the multimedia content.

Optionally, the digital media watermark of the multimedia content contains information about a restriction requirement imposed by the multimedia content provider for the multimedia content playback environment. The digital watermark execution unit determines whether the executable environment of the terminal complies with the restriction requirement imposed by the multimedia content provider on the multimedia content playback environment during the playback of the multimedia content and in the event of a mismatch, stops the playback of the multimedia content.

Optionally, the DRM client DRM permissions for multimedia content indicate that the DRM client must embed a digital watermark to track multimedia content when playing multimedia content. The content authorization execution unit notifies the DRM client to execute the digital watermark execution unit. The DRM client executes a digital watermark execution unit in a DRM client runtime environment and implements a digital watermark to track multimedia content during the playback of multimedia content through a digital watermark execution unit. A digital watermark execution unit is received from the server side of the DRM to a DRM client requesting, in accordance with the notification, a digital watermark execution unit corresponding to the multimedia content.

Optionally, a digital watermark execution unit is issued to the DRM client after signing by the server side of the DRM. After retrieving the digital watermark run unit

- 2 035157 the DRM client first verifies the signature of the digital watermark execution unit, and then, if the verification result is positive, it executes the digital watermark execution unit.

An optionally running DRM client environment contains a run-time kernel and a terminal operating system adaptation module. The DRM client executes the execution unit through the execution unit kernel and adapts the execution unit core to the terminal operating system through the adaptation of the terminal operating system.

Optionally, the execution unit core provides a memory management interface, an external storage management interface, a network management interface, an encryption algorithm interface, a playback control interface, and a data output control interface for executing the execution unit. The DRM client adapts the memory management interface, the external storage management interface, the network management interface, the encryption algorithm interface, the playback control interface and the execution unit kernel data output control interface to the corresponding interfaces of the terminal operating system via the adaptation module of the terminal operating system.

The optionally executed DRM client environment further comprises a unit and control unit for execution. The DRM client plans and manages various control units through the control unit and the execution unit scheduling module, which involves adding a plan execution unit to the core regarding the execution unit to execute, add, delete, and update the execution unit.

In accordance with a second aspect of the present invention, there is provided a digital rights management (DRM) method for multimedia content running on a server side of a DRM. The method comprises the following steps:

stage 1: receiving by the DRM server side the DRM authorization request sent by the DRM client, wherein the DRM authorization request contains a unique multimedia content identifier and basic DRM client information;

stage 2: obtaining by the DRM server side the content encryption algorithm and the content encryption key used for multimedia content, and the DRM client DRM credentials for multimedia content in accordance with the DRM authorization request by request;

stage 3: the DRM server side generates a content authorization execution unit in accordance with the multimedia content identifier, the content encryption algorithm and the content encryption key used for multimedia content, basic DRM client information and DRM client DRM authority for multimedia content, while the content authorization is arranged to be executed in the DRM client executable environment in such a way as to check whether the executable environment of the terminal of the terminal device where the DRM client is located complies with the DRM client DRM authority for the multimedia content and, if so, decrypt the multimedia content in accordance with the algorithm content encryption and content encryption key;

stage 4: issuing by the server side of the DRM the generated unit for performing authorization of the content to the DRM client.

Optionally, between stage 3 and stage 4, the method further comprises the step of signing the generated content authorization execution unit by the DRM server side.

Optionally, in step 3, the server side of the DRM searches for a content authorization execution unit template corresponding to the multimedia content according to the multimedia content identifier or content encryption algorithm used for the multimedia content; or the DRM authorization request further comprises a DRM version number corresponding to the multimedia content, and the DRM server side searches for a content authorization execution unit pattern corresponding to the multimedia content according to the DRM version number corresponding to the multimedia content. The server side of the DRM generates a content authorization execution unit according to the content authorization execution unit template obtained from the search results.

Optionally, the planning stage of the digital watermark implementation unit is indicated in the content authorization execution unit template corresponding to the multimedia content. The DRM server side receives a DRM client request for a digital watermark execution unit corresponding to multimedia content. The DRM client generates a DRM client request for a digital watermark run unit corresponding to the multimedia content in accordance with the planning stage of the digital watermark run unit for the content authorization run. The server side of the DRM searches for a digital watermark implementation unit template corresponding to the multimedia content in accordance with the multimedia content identifier and generates a digital watermark implementation unit from the digital watermark implementation unit template obtained from the search results. The DRM server side issues the generated digital watermark execution unit to the DRM client.

Optionally, in stage 2, the server side of the DRM receives an encryption algorithm and a cipher key

- 3 035157 content, which are used for multimedia content, from the key management system through a request in accordance with the identifier of the multimedia content.

Optionally, in step 2, the DRM server side obtains DRM client DRM multimedia content from the operational support system by requesting in accordance with the multimedia content identifier and basic DRM client information.

In accordance with a third aspect of the present invention, there is provided a DRM client located in a terminal device on which an intelligent operating system is installed. The DRM client comprises a multimedia application interface, a unit of extraction unit and a content authorization unit, where the multimedia application interface is configured to receive a call request to the multimedia application of the terminal device and to extract the unique identifier of the multimedia content to be played from the call request;

the unit of execution execution unit is configured to send a DRM authorization request to the server side of the DRM to retrieve the content authorization execution unit, wherein the DRM authorization request comprises a multimedia content identifier and basic DRM client information; and the content authorization execution unit is configured to verify that the running environment of the terminal complies with the DRM authority of the DRM client for multimedia content and if the decryption of the multimedia content is consistent with the content encryption algorithm and the content encryption key, while the DRM server side generates a content authorization execution unit in the following way: the DRM server side obtains a content encryption algorithm and a content encryption key used for multimedia content, and a DRM client DRM authority for multimedia content in accordance with a DRM authorization request by a request, and then it is generated in accordance with the multimedia content identifier , a content encryption algorithm and a content encryption key applicable to multimedia content, basic DRM client information and DRM client DRM credentials for multimedia content.

Optionally, the DRM client further comprises a unit of execution signature verification module configured to verify the signature of the content authorization execution unit.

Optionally, the DRM client DRM permissions for multimedia content indicate that when playing multimedia content, the DRM client must check the digital watermark of the multimedia content. The DRM client further comprises a digital watermark execution unit. The content authorization unit is further configured to send a notification about the extraction of the digital watermark execution unit to the extraction unit. The unit of extraction of the execution unit is further configured to send a request to the implementation unit of the digital watermark corresponding to the multimedia content from the server side of the DRM in accordance with the notification. The unit of implementation of the digital watermark is configured to check the digital watermark embedded in the multimedia content during playback of the multimedia content and stop playing the multimedia content in case of a negative verification result.

Optionally, the digital media watermark of the multimedia content contains information about a restriction requirement imposed by the multimedia content provider for the multimedia content playback environment. The digital watermark execution unit is further configured to determine whether the running environment of the terminal complies with the restriction requirement imposed by the multimedia content provider on the multimedia content playback environment during multimedia content playback, and in case of discrepancy, the multimedia content is stopped.

Optionally, the DRM client DRM permissions for multimedia content indicate that the DRM client must embed a digital watermark to track multimedia content when playing multimedia content. The DRM client further comprises a digital watermark execution unit. The content authorization unit is further configured to send a notification about the extraction of the digital watermark execution unit to the extraction unit. The unit of extraction of the execution unit is further configured to send a request to the implementation unit of the digital watermark corresponding to the multimedia content from the server side of the DRM in accordance with the notification. A digital watermark implementation unit is configured to embed a digital watermark to track multimedia content during the playback of multimedia content.

Optionally, the DRM client further comprises a execution unit core and a terminal operating system adaptation module. The unit of execution unit is configured to execute the unit of execution. The adaptation module of the terminal operating system is adapted to adapt the kernel of the execution unit to the terminal operating system.

- 4 035157

Optionally, the core of the execution unit is configured to provide a memory management interface, an external storage management interface, a network management interface, an encryption algorithm interface, a playback control interface, and a data output control interface for executing the execution unit. The terminal operating system adaptation module is adapted to adapt the memory management interface, the external storage management interface, the network management interface, the encryption algorithm interface, the playback control interface and the execution unit kernel data output control interface to the corresponding terminal operating system interfaces.

Optionally, the DRM client further comprises a unit and control unit for execution. The unit of control and planning of the unit of execution is configured to plan and manage various units of execution and provides for the inclusion of a unit of execution of the plan regarding the unit of execution to execute, add, delete, and update the unit of execution.

According to a fourth aspect of the present invention, there is provided a DRM server side comprising a DRM message receiving module, a DRM information retrieval module related to multimedia content, a execution unit generating module, and a execution unit issuing module, wherein the DRM message receiving module is adapted to receive a request DRM authorization sent by the DRM client, wherein the DRM authorization request contains a unique identifier for multimedia content and basic DRM client information;

a module for extracting DRM information related to multimedia content is configured to obtain a content encryption algorithm and a content encryption key used for multimedia content, and DRM client DRM authority for multimedia content in accordance with a DRM authorization request by request;

the unit of execution unit generation is configured to generate a content authorization unit in accordance with the multimedia content identifier, the content encryption algorithm and the content encryption key used for multimedia content, basic DRM client information and DRM client DRM authority for multimedia content and in accordance with a content authorization execution unit template corresponding to multimedia content, wherein the content authorization execution unit is configured to be executed in a DRM client executable environment in such a way as to check whether the executable terminal environment of the terminal device where the DRM client is located matches the DRM client DRM authority for multimedia content, and if appropriate, decrypt the multimedia content in accordance with the content encryption algorithm and the content encryption key; and the unit of delivery of the execution unit is configured to issue the execution unit of the content authorization to the DRM client.

Optionally, the server side of the DRM further comprises an execution unit signature module configured to sign the content authorization execution unit before the execution unit issuing unit issues the content authorization execution unit.

Optionally, the server side of the DRM further includes a unit of execution template management module configured to manage a content authorization execution unit template, including adding, updating, and deleting a content authorization execution template.

Optionally, the server side of the DRM further comprises a key management interface. The DRM multimedia content information extraction module is configured to exchange data with a key management system through a key management interface and obtain a content encryption algorithm and a content encryption key that are used for multimedia content from the key management system in accordance with the multimedia content identifier by request.

Optionally, the server side of the DRM further comprises an operational support interface.

The DRM multimedia content information extraction module is further configured to exchange data with the operational support system via the operational support interface and obtain DRM client DRM authority for multimedia content from the operational support system in accordance with the multimedia content identifier and basic DRM client information by means of a request.

In accordance with a fifth aspect of the present invention, there is provided a DRM client located in a terminal device on which an intelligent operating system is installed. The DRM client contains a multimedia application interface, a unit and control unit for planning, a unit of execution unit, and an adaptation module for a terminal operating system, where the multimedia application interface is configured to receive a call request

- 5,035,157 multimedia applications of the terminal device and retrieving the unique identifier of the multimedia content to be played from the call request;

the unit of control and planning of the execution unit is configured to search for the execution unit corresponding to the multimedia content in accordance with the call request and launch the kernel of the execution unit to execute the execution unit in order to carry out DRM authorization for the multimedia content; and if the execution unit corresponding to the multimedia content is not found, send a DRM message to the server side of the DRM to retrieve the execution unit corresponding to the multimedia content, verify the signature of the extracted execution unit to determine the validity of the execution unit and then launch the kernel of the DRM execution unit to execute units of execution in order to authorize DRM for multimedia content; and the adaptation module of the terminal operating system is configured to adapt the kernel of the DRM execution unit and the terminal operating system.

Optionally, the core of the execution unit is configured to provide a memory management interface, an external storage management interface, a network management interface, an encryption algorithm interface, a playback control interface, and a data output control interface for executing the execution unit. The terminal operating system adaptation module is adapted to adapt the memory management interface, the external storage management interface, the network management interface, the encryption algorithm interface, the playback control interface and the execution unit kernel data output control interface to the corresponding terminal operating system interfaces.

In accordance with a sixth aspect of the present invention, there is provided a DRM server side comprising a DRM message processing module, a unit of execution template management module, a unit of execution template, and a unit of generating a execution unit, where the DRM message processing module is configured to receive a DRM message sent by a DRM client when this DRM message contains the identifier of the multimedia content and basic information of the DRM client; selecting an appropriate unit of execution unit in accordance with the DRM message and invoking the unit of execution unit generation to generate the unit of execution in accordance with the selected unit of execution unit, wherein the unit of execution is configured to execute on the DRM client running environment in order to authorize DRM for multimedia -content; Signing the unit of execution generated by the unit of execution of the unit of execution; and issuing the signed execution unit to the DRM client;

the unit of execution template control unit is configured to manage the unit of execution template.

Optionally, the unit of execution template contains a content authorization unit of execution template. The DRM message processing unit is configured to call a unit of execution unit generation unit to generate a content authorization unit in accordance with the multimedia content identifier, the content encryption algorithm and the content encryption key used for multimedia content, basic DRM client information, and DRM client DRM credentials for multimedia content and in accordance with the selected unit template authorization of content. The content authorization execution unit is configured to be executed in the DRM client executable environment in order to check whether the executable terminal environment of the terminal device where the DRM client is located complies with the DRM client DRM authority for multimedia content, and if appropriate, decrypt the multimedia content in according to the content encryption algorithm and the content encryption key.

Optionally, the server side of the DRM further comprises a key management interface and an operational support interface. The DRM message processing module is further configured to exchange data with the key management system through the key management interface and obtain an encryption algorithm and an encryption key for the contents corresponding to the multimedia content from the key management system in accordance with the multimedia content identifier by request. The DRM message processing module is further adapted to exchange data with the operational support system via the operational support interface and obtain DRM client DRM authority for multimedia content from the operational support system in accordance with the multimedia content identifier and basic DRM client information by means of a request.

In accordance with a seventh aspect of the present invention, there is also provided a terminal device comprising a DRM client according to any of the previous aspects.

Optionally, the DRM client runs in an intelligent operating system of a terminal device or runs in a trusted runtime of a terminal device.

In accordance with an eighth aspect of the present invention, there is also provided a DRM server with

- 6,035,157 holding the server side of the DRM according to any of the previous aspects.

In accordance with the present invention, the content authorization method through the content authorization license is changed, the DRM client requests DRM authorization for multimedia content from the server side of the DRM after receiving the call request of the multimedia application, the server side DRM generates a content authorization execution unit in accordance with the encryption algorithm and the content encryption key multimedia content, DRM authority DRM client for multimedia content, etc. and provides the content authorization execution unit to the DRM client, and the DRM client directly executes the content authorization execution unit in the DRM client runtime in order to decrypt the multimedia content. Through the use of the technical solution according to the present invention, flexible protection of multimedia content can be ensured, and thereby the degree of security of multimedia content is enhanced.

Other features and advantages of the present invention will become more apparent after reading the exemplary embodiments of the present invention described in detail with reference to the accompanying figures.

Brief Description of the Figures

The accompanying figures form part of the present description, and also illustrate embodiments of the present invention and together with the description help to state its main ideas.

In FIG. 1 is a block diagram of a multimedia content execution system in accordance with an embodiment of the present invention;

in FIG. 2 is a flow diagram of a digital rights management method in accordance with a first embodiment of the present invention;

in FIG. 3 shows a block diagram of a DRM client and server side DRM in accordance with a first embodiment of the present invention;

in FIG. 4 is a block diagram of a DRM client and server side DRM in accordance with a second embodiment of the present invention;

in FIG. 5 shows a block diagram of a DRM client and server side DRM in accordance with a fourth embodiment of the present invention; and in FIG. 6 is a block diagram of a terminal device in accordance with an embodiment of the present invention.

Detailed disclosure of the present invention

Embodiments of the present invention will now be described with reference to the accompanying figures. It should be noted that the relative arrangement of the components and stages, numerical expressions and numerical values given in the context of these embodiments do not limit the scope of the present invention, unless specifically indicated.

The following description of at least one exemplary embodiment is illustrative and in no way limits the scope of the invention, its implementation, or application.

Methods, methods and devices known to a person skilled in the technical field of the present invention can be described in General, however, where required, methods, methods and devices should be considered as part of the description.

In all examples cited herein, any specific meanings should be interpreted solely as exemplary and should not be construed as limitations. Therefore, in other examples, given as an example of embodiments, other values may appear.

It should be noted that in the figures the same numeric and letter positions denote the same elements, therefore, after the first determination in the figure, such elements will not be further described in the context of the following figures.

In accordance with the present invention, a digital rights management solution for multimedia content is provided, and it relates to a DRM server side providing a DRM service and a DRM client of a user terminal device.

A terminal device is an intelligent electronic device, such as a computer, smartphone, and tablet, with an installed smart operating system (such as Android, WINDOWS, and IOS).

A DRM client is constituted by a running DRM client environment and a unit of execution. A unit of execution is an object generated by the DRM server side in accordance with the requirements of the DRM client, and which can be executed in the executable DRM client environment, such as a program, instruction, command, and code. The DRM client runtime should be understood as the internal runtime provided by the DRM client 100 for the runtime unit.

The execution unit is executed in the DRM client runtime and is not externally in direct contact with the DRM client, and contact with the terminal operating system is provided by the DRM client runtime.

- 7 035157

The DRM client provides reasonable authorization for multimedia content by executing a unit of execution in the DRM client's executable environment. Implementation units in accordance with the present invention include, but are not limited to, a data exchange execution unit, a content authorization execution unit, a digital watermark execution unit, and the like.

A multimedia content execution system in accordance with an embodiment of the present invention is shown in FIG. 1, and the technical result achieved by the present invention is described as a whole.

The content management system 4 sends the multimedia content to be reproduced to the content encryption system 3 for encryption. The content encryption system 3 encrypts the multimedia content, then sends the encrypted multimedia content to the operating support system 6 to wait for playback at the request of the user, sends the content encryption key to the key management system 5 for managing storage, and sends the basic multimedia content information to the DRM server 2 for storage. The basic information of the multimedia content should at least contain a unique identifier for the multimedia content and may also contain other multimedia content information such as a document name, size, duration and corresponding DRM version number. The content encryption system 3 may further send the encryption algorithm used to encrypt the multimedia content to the key management system 5 and / or to the DRM server 2 for storage. By a content encryption key in accordance with the present invention is meant a key for encrypting a content key, and encryption of multimedia content is performed using the content key.

The DRM server side 200 may generate a content authorization execution unit template using the multimedia content encryption algorithm, or the content authorization execution unit template on the DRM server side 200 may be provided to the DRM server 2 by the content encryption system 3 or the operational support system 6.

The content authorization execution unit template is configured to generate a content authorization execution unit that can be executed directly in the executable DRM client environment. The content authorization execution unit can transmit DRM client authorization information to the IF operator, which determines whether the running environment of the terminal complies with the DRM authorization rule, for example, it is necessary to check the local certificate of the terminal device and the multimedia content will be decrypted and played back only if the verification result is positive, and t .P. The content authorization execution unit template may be defined by a person skilled in the art of the present invention in various ways that will not be described herein. The DRM server side 200 may further comprise other types of execution unit templates, such as a data exchange execution unit template and a digital watermark execution unit template. New types of templates can be defined according to operational needs.

The intelligent operating system 11, the multimedia application 12, and the DRM client 100 are executed in the terminal device 1. The multimedia application 11, for example, is a multimedia player or multimedia application. The user can play multimedia content on demand using the multimedia application 11. In addition, the user can also buy or download multimedia content through the multimedia application 11. The multimedia application 11 extracts multimedia content using the operating support system 6 and provides multimedia content to the user. .

When a user requests multimedia content through the multimedia application 11 in the operating support system 6, the multimedia application 11 retrieves a unique identifier of the multimedia content from the operating support system 6 and can also extract information such as a DRM version number corresponding to the multimedia content and the server address parties to DRM. The multimedia application 11 then calls the DRM client 100 to perform operations such as DRM authorization for the multimedia content in order to play the multimedia content.

After calling the multimedia application 11, the DRM client 100 sends a DRM message to the server side 200 DRM. After receiving the DRM message, the DRM server side 200 selects, in accordance with the DRM message, the corresponding unit of execution unit to generate the unit of execution and issues the unit of execution to the DRM client 100. The DRM client 100 executes the execution unit in the executable environment of the DRM client and authorizes the multimedia content by executing the execution unit. A DRM message in accordance with the present invention contains, inter alia, a DRM authorization request, and may also be a request for a communication execution unit, etc.

The server side 200 DRM can replace the unit of execution template in accordance with operational needs. The unit of execution generated in accordance with the unit of execution template can be executed directly in the DRM client runtime after

- 8,035,157 changes to the client 100 DRM. If you need to add a new DRM function or a new authorization rule, you only need to add a new unit of execution unit on the server side 2 DRM.

The DRM client 100 can be executed in the intelligent operating system of the terminal device 1 and can also be executed in the trusted runtime of the terminal device 1. When the DRM client 100 is executed in the trusted runtime of the terminal, if it is necessary to update the content encryption algorithm and the like, it is only necessary to generate a new content authorization execution pattern on the DRM server side 200, the DRM server side 200 generates a content authorization execution unit in accordance with the new content authorization execution pattern, and then sends the content authorization execution unit to the DRM client 100 for execution, thereby avoiding problems associated with frequent 100 DRM client upgrade.

First Embodiment

The digital rights management method, DRM client 100 and DRM server side 200 provided in accordance with the first embodiment of the present invention are shown in FIG. 2 and 3. DRM client 100 comprises a multimedia application interface 101, a unit of execution unit extraction module 108, a unit of execution signature verification module 109, a unit of execution unit 106, and a terminal operating system adaptation module 107 and a unit of control and planning for the execution unit (not shown in the figures ) The DRM server side 200 includes an operational support interface 205, a key management interface 206, a DRM message receiving module 207, a multimedia content DRM information extraction module 208, a execution unit generation module 204, a execution unit signing module 210, a execution unit issuing module 209 and unit 203 template execution unit.

Step S101 comprises receiving, by the DRM client 100, a call request for a multimedia application of the terminal device through the multimedia application interface 101 and retrieving the DRM client 100 of the basic multimedia content information to be reproduced from the call request. The basic information of the multimedia content should at least contain a unique identifier for the multimedia content and may also contain other information of the multimedia content, such as the document name, size, duration and corresponding DRM version number.

Step S102 involves sending a DRM authorization request by the DRM client 100 to the DRM server side 200 via the execution unit extraction module 108, wherein the DRM authorization request should at least contain media identifier and basic information of the DRM client 100 and may also contain information about DRM version number corresponding to multimedia content. The basic information of the DRM client 100 should at least contain the identifier of the DRM client 100 and may also contain other information of the DRM client 100, such as address information, version number, and certificate.

Step S103 includes receiving, by the DRM server side 200, a DRM authorization request via the DRM message receiving unit 207; obtaining, by the module 208, extracting DRM information related to the multimedia content, the content encryption algorithm and the content encryption key used for the multimedia content, and the DRM authority of the DRM client 100 for multimedia content in accordance with the DRM authorization request; generating a unit of execution unit 204 generating a content authorization unit 104 in accordance with the multimedia content identifier, the content encryption algorithm and the content encryption key used for multimedia content, basic information of the DRM client 100 and DRM authority of the DRM client 100 for multimedia content; and finally, the issuance by the issuing unit 209 of the execution unit of the generated content authorization execution unit 104 to the DRM client 100.

Step S104 involves receiving, by the DRM client 100, a content authorization execution unit 104 via the execution unit extraction module 108, executing the content authorization execution unit 104 in the DRM client runtime environment, verifying the compliance of the terminal runtime environment with the DRM authority of the DRM client 100 for multimedia content through the unit 104 performing content authorization and, if appropriate, decrypting multimedia content in accordance with the content encryption algorithm and the content encryption key, and controlling the playback of multimedia content. For example, the DRM authority of the DRM client 100 for multimedia content assumes that between 20:00 and 12:00 the DRM client can only decrypt and play multimedia content, the content authorization execution unit 104 will determine if the terminal's executable environment is in the interval between 20:00 and 12:00, and if the running environment of the terminal meets the limiting condition from 20:00 to 12:00, the content authorization execution unit 104 decrypts the multimedia content and controls the playback of the multimedia content.

To further enhance the security of multimedia content in step S103, after the content authorization execution unit is generated by the generating unit 204, the execution unit signing module 210 first signs the authorization execution unit

- 9 035157 content, and then the execution unit issuing module 209 issues a signed content authorization execution unit to the DRM client. In step S104, after the content authorization execution unit 104 is retrieved, the DRM client first verifies the signature of the content authorization execution unit 104, and then, if the verification result is positive, performs the content authorization executing unit 104 in the DRM client runtime.

The unit of execution unit 204 may search for an authorization unit of content authorization unit corresponding to the multimedia content in accordance with the multimedia content identifier and / or content encryption algorithm applicable to the multimedia content and / or DRM version number corresponding to the multimedia content, and generates a content authorization execution unit 104 according to a template of a content authorization execution unit obtained from the search results.

DRM client unit 100 retrieval unit 108 may also be a data exchange execution unit. After retrieving the call request of the multimedia application, the DRM client 100 sends a data exchange execution unit request to the DRM server side 200. The request for the data exchange execution unit should at least contain the basic information of the DRM client 100 and may also contain the identifier of the multimedia content and the DRM version number information corresponding to the multimedia content. Upon receipt by the DRM message receiving unit 207 of the DRM client 100 request for a data exchange execution unit, the execution unit generating module 204 searches for a data exchange execution unit template in accordance with the request of the data exchange execution unit and generates a data exchange execution unit in accordance with the data exchange execution unit obtained from the search results. The execution unit signature module 210 signs the data exchange execution unit generated by the execution unit generating unit 204. Unit 209 issue of the unit of execution issues a signed unit of the execution of the data exchange client 100 DRM. After receiving the data exchange execution unit, the DRM client 100 first verifies the signature of the data exchange execution unit, and then, in the case of a positive verification result, executes the data exchange execution unit in the running DRM client environment. The unit of execution unit 204 may search for the exchange unit of operation unit template in accordance with the multimedia content identifier and / or DRM version number corresponding to the multimedia content and / or basic information of the DRM client.

The DRM server side 200 may further comprise a unit of execution unit template 203 for managing the unit of execution unit, by downloading, adding, updating, and deleting the unit of execution unit.

Module 208 for extracting DRM information related to multimedia content is configured to exchange data with a key management system via a key management interface 206 and obtain an encryption algorithm and a content encryption key used for multimedia content from a key management system in accordance with the multimedia content identifier by a request, or the DRM information extraction module 208 associated with the multimedia content, obtains an encryption algorithm for the multimedia content from the storage area of the DRM server 2.

Multimedia content-related DRM information extraction module 208 communicates with the operational support system via the operational support interface 205 and receives DRM client DRM multimedia content from the operational support system in accordance with the multimedia content identifier and basic DRM client information by request.

The DRM client runtime includes a execution unit kernel 106, an operating system adaptation module 107, and a execution unit management and planning module. The DRM client 100 schedules and manages various control units through the control unit and the execution unit scheduling module, which involves adding a plan execution unit to the kernel 106 regarding the execution unit to execute, add, delete, and update the execution unit. The DRM client 100 adapts the execution unit core 106 to the terminal operating system through the terminal operating system adaptation module 107. The unit of execution unit 106 further comprises a memory management interface, an external storage management interface, a network management interface, an encryption algorithm interface, a playback control interface and a data output control interface for executing the execution unit. The terminal operating system adaptation module 107 adapts the memory management interface, the external storage management interface, the network management interface, the encryption algorithm interface, the playback control interface, and the execution unit kernel output control interface 106 to the corresponding interfaces of the terminal operating system.

Second Embodiment

The digital rights management method, DRM client 100 and DRM server side 200 provided in accordance with the second embodiment of the present invention are shown in

- 10 035157 FIG. 4. According to the second embodiment, a digital watermark function is added based on the first embodiment. More specifically, if a digital watermark is embedded in the multimedia content to be reproduced, the DRM authority of the DRM client 100 for multimedia content provides that the DRM client 100 should check the digital watermark of the multimedia content when playing the multimedia content. The planning stage of the digital watermark implementation unit is indicated in the content authorization execution unit template corresponding to the multimedia content.

When the content authorization execution unit 104 is executed in the DRM client's executable environment and notifies the DRM client 100 that the digital watermark execution unit is to be started, the execution unit extraction unit 108 requests the DRM server side 200 for the digital watermark execution unit corresponding to the multimedia content, in accordance with the notice. A request for a digital watermark implementation unit may comprise a multimedia content identifier and basic DRM client information 100.

After receiving the DRM client 100 request by the server side 200 DRM per digital watermark execution unit corresponding to the multimedia content, the execution unit generating module 204 searches for the digital watermark execution unit pattern corresponding to the multimedia content according to the multimedia content identifier and generates a execution unit digital watermark in accordance with the template unit of implementation of the digital watermark corresponding to the multimedia content. Then, the execution unit signature module 210 signs the implementation unit of the digital watermark. The execution unit issuing unit 209 issues a signed digital watermark execution unit 105 to the DRM client 100.

Upon receipt by the client 100 of the DRM of the digital watermark execution unit 105, the execution unit signature verification module 109 first verifies the signature of the digital watermark execution unit 105. In the case of a positive verification result, the digital watermark execution unit 105 is executed in the executable DRM client environment. The digital watermark execution unit 105 verifies the digital watermark embedded in the multimedia contents during the playback of the multimedia contents and stops the playback of the multimedia contents in case of a negative verification result.

In addition, if the digital media watermark contains information about the media provider restriction requirement for the multimedia playback medium, the digital watermark execution unit 105 determines whether the terminal environment being executed matches the media provider restriction requirement for the multimedia media playback environment during playback multimedia content and in case of discrepancy stops playing multimedia content. The content provider in accordance with the present invention may be the original content provider. For example, if a film company is responsible for filming a film, the film company is the original content provider and may make special demands on the playback environment of the film it has shot. For example, if a film company requires the film to be played on smart TVs, not smartphones, the film company can embed a digital watermark in the film containing information about the restriction requirement for the playback environment. The operator provides the film to users after purchasing the authority to demonstrate the film. Before watching a movie, users can decrypt and play the movie only if they fulfill the requirements of the film company for the playback environment, as well as fulfill the requirements of the DRM operator that he puts forward for the film.

Third Embodiment

The digital rights management method, DRM client 100 and DRM server side 200 provided in accordance with the third embodiment of the present invention are shown in FIG. 4. According to the third embodiment, a digital watermark function is added based on the first embodiment. More specifically, the DRM client DRM authority for multimedia content indicates that the DRM client must implement a digital watermark to track multimedia content when playing multimedia content. The planning stage of the digital watermark implementation unit is indicated in the content authorization execution unit template corresponding to the multimedia content.

When the content authorization execution unit 104 is executed in the DRM client's executable environment and notifies the DRM client 100 that the digital watermark execution unit is to be started, the execution unit extraction unit 108 requests the DRM server side 200 for the digital watermark execution unit corresponding to the multimedia content, in accordance with the notice. A request for a digital watermark implementation unit may comprise a multimedia content identifier and basic DRM client information 100.

After receiving the DRM client 100 request by the server side 200 DRM per digital watermark execution unit corresponding to the multimedia content, the execution unit generating module 204 searches for a digital watermark execution unit template corresponding to

- 11 035157 corresponding to multimedia content, in accordance with the identifier of the multimedia content, and generates a unit of implementation of the digital watermark in accordance with the template unit of implementation of the digital watermark corresponding to the multimedia content. Then, the execution unit signature module 210 signs the implementation unit of the digital watermark. The execution unit issuing unit 209 issues a signed digital watermark execution unit 105 to the DRM client 100.

Upon receipt by the client 100 of the DRM of the digital watermark execution unit 105, the execution unit signature verification module 109 first verifies the signature of the digital watermark execution unit 105. Then, in the case of a positive verification result, the digital watermark execution unit 105 is executed in the executable environment of the DRM client. A digital watermark execution unit 105 implements a digital watermark for tracking multimedia content during the playback of multimedia content.

According to other embodiments, when the content authorization execution unit 104 notifies the DRM client 100 that the digital watermark execution unit is to be started, the notification may comprise basic information of the digital watermark execution unit. The basic information of a digital watermark implementation unit in accordance with the present invention, at least contains a digital watermark implementation unit identifier, and may also include information such as a digital watermark version number. In this case, when the execution unit extraction unit 108 sends a request for a digital watermark execution unit corresponding to the multimedia content from the server side 200 DRM, the request for a digital watermark execution unit may comprise basic information of a digital watermark execution unit and basic client information 100 DRM. After the DRM client side 200 receives the DRM client 100 request for a digital watermark execution unit corresponding to the multimedia content, the execution unit generating module 204 searches for a digital watermark implementation unit template in accordance with the basic information of the digital watermark implementation unit and generates a digital execution unit watermark in accordance with the found unit of digital watermark.

Fourth Embodiment

The digital rights management method, DRM client 100, and DRM server side 200 provided in accordance with the fourth embodiment of the present invention are shown in FIG. 5. The DRM client 100 comprises a multimedia application interface 1001, a execution unit management and planning module 1002, a execution unit core 1006, and a terminal operating system adaptation module 1007. The DRM server side 200 comprises an operational support interface 2005, a key management interface 2006, a DRM message scheduling module 2001, a DRM message processing module 2002, a execution unit generating module 2004, and a execution unit template management module 2003.

Step S201 comprises receiving a DRM client 100 requesting a call to a multimedia application of a terminal device through the multimedia application interface 101 and extracting the DRM client 100 basic information of the multimedia content to be reproduced from the call request. The basic information of the multimedia content should at least contain a unique identifier for the multimedia content and may also contain other information of the multimedia content, such as the document name, size, duration and corresponding DRM version number.

Step S202 involves sending a request to the execution unit scheduling unit 1002 to determine if there is an available data exchange execution unit 1003 according to the media identifier and / or DRM version number corresponding to the media content, and if there is a scheduling of execution by the kernel 1006 DRM runtime units

Step S203 involves sending a DRM authorization request data exchange unit 1003 to the server side DRM 200, wherein the DRM authorization request should at least contain media identifier and basic DRM client information 100, and may also contain DRM version number information corresponding to multimedia content. The basic information of the DRM client 100 should at least contain the identifier of the DRM client 100 and may also contain other information of the DRM client 100, such as address information, version number, and certificate.

Step S204 provides for the DRM message scheduling unit 2001 of the DRM server side 200 to determine a specific DRM message processing unit 2002 to process a DRM authorization request after receiving a DRM authorization request.

Stage S205 provides for sending a request by the DRM message processing module 2002 to the encryption algorithm and the encryption key of the content corresponding to the multimedia content in the key management system in accordance with the multimedia content identifier via

- 12 035157 key management interface 2006, sending a request for DRM client 100 DRM for multimedia content from the operational support system in accordance with the multimedia content identifier and basic information of the DRM client 100 through the 2005 operational support interface, and sending a request for the corresponding unit template performing content authorization on the DRM runtime unit management module 2003 according to the identifier of the multimedia content.

Step S206 comprises sending a DRM message processing module 2002 for a multimedia content identifier, a content encryption algorithm and a content encryption key used for multimedia content, basic DRM client information 100, DRM client DRM credentials for multimedia content, and a found content authorization execution unit template , to the DRM runtime unit generating unit 2004.

Step S207 involves generating a DRM execution unit 2004 of the corresponding content authorization execution unit in accordance with the found content authorization execution unit template and in accordance with the multimedia content identifier, content encryption algorithm and content encryption key used for multimedia content, basic client information 100 DRM and DRM authority 100 DRM client for multimedia content.

Step S208 provides for the DRM message processing module 2002 to sign the generated content authorization execution unit and issuing the signed content authorization execution unit to the DRM client 100.

Step S209 comprises receiving a DRM client 100 for a content authorization execution unit 1004 via a data exchange executing unit 1003 and sending a notification to the data exchange executing unit 1003 to the control and planning unit 1002 of the execution unit after receiving the content authorization execution unit.

Step S210 first involves checking by the control and planning unit 1002 of the validity unit of the signature of the content authorization execution unit 1004, and if the result of checking the planning of the execution of the content authorization execution unit 1004 by the core of the execution unit 1006 is positive.

Step S211 involves determining and verifying, using the content authorization unit 1004, the compliance of the terminal environment being executed with DRM DRM client permissions for multimedia content, and if the encryption key is decrypted to obtain the content key, the multimedia content is decrypted in accordance with the content key and the encryption algorithm content and playback controls.

In step S202, if the execution unit management and planning unit 1002 does not find a corresponding data exchange execution unit, the execution unit management and planning unit 1002 requests the data exchange execution unit from the server side 200 DRM. After receiving the request, the DRM server side polls the data exchange execution unit template, generates the data exchange execution unit in accordance with the basic information of the DRM client and, in accordance with the data exchange execution unit template, signs the data exchange execution unit and sends the signed data exchange execution unit to the DRM client 100 . After the DRM client 100 receives a data exchange execution unit, the execution unit management and planning unit 1002 first checks the validity of the signature of the data exchange execution unit, saves the data exchange execution unit after receiving a successful verification result, and interacts with the server side 200 DRM to execute the data exchange execution unit data using the execution unit kernel to retrieve other execution units, such as a content authorization execution unit.

In FIG. 5, the DRM client 100 further comprises a digital watermark execution unit 1005. The principle and functions of the digital watermark execution unit 1005 may be similar to the second and third embodiments. The planning stage of the digital watermark implementation unit is indicated in the content authorization execution unit template corresponding to the multimedia content. The DRM client 100 generates a request for a digital watermark run unit in accordance with the run of the content authorization run unit 1004. The DRM server side 200 searches for a digital watermark execution unit template corresponding to the multimedia content, generates a digital watermark execution unit 1005 in accordance with the template, and provides a digital watermark execution unit 1005 to the DRM client 100.

Unit 100 management and planning of the unit of execution is responsible for planning and managing the download, verification, installation, updating, sending requests, execution and completion of the unit of execution and installs and executes the unit of execution, starting the kernel 1006 units of execution.

In accordance with the above embodiments, the present invention also provides a terminal device with the DRM client described above, a DRM server with the described

- 13 035157 above the server side of the DRM.

A terminal device 1 in accordance with embodiments of the present invention is shown in FIG. 6. The terminal device 1 comprises a memory 3020 and a processor 3010. The memory 3020 is configured to store instructions for monitoring the processor 3010 to perform an appropriate operation to implement a digital rights management method for multimedia content according to the present invention.

The terminal device 1 further comprises an interface device 3030, a communication device 3040, a display device 3050, an input device 3060, a speaker 3070, a microphone 3080, and the like.

Processor 3010, for example, may be a central processing unit (CPU), microprocessor (MP), and the like. The memory 3020, for example, may be a ROM (read-only memory), RAM (random access memory), volatile memory, such as a hard disk. Interface device 3030, for example, includes a USB interface, a headphone jack, and the like. The communication device 3040, for example, may be configured to make a wired or wireless connection. The display device 3050, for example, is a liquid crystal display, a touch display, or the like. An input device 3060, for example, may include a touch screen, keyboard, and the like. The user can enter and output voice information through the speaker 3070 and microphone 3080.

The terminal device shown in FIG. 6 is provided by way of example only and in no way limits the present invention and its scope in connection with that of FIG. 6 shows several devices, some of them can be used only in the present invention. One of ordinary skill in the art of the present invention may develop a team in accordance with the technical solution of the present invention. Controlling a processor for team work is well known in the art of the present invention, and therefore is not described in detail in this document.

In the present invention, a method for authorizing content through a content authorization license is changed. The DRM client requests DRM authorization for multimedia content from the server side of the DRM after receiving a request to call a multimedia application. The DRM server side generates a content authorization execution unit in accordance with the encryption algorithm and the encryption key of the content of the multimedia content, DRM client DRM credentials for multimedia content, etc. and issues the content authorization execution unit to the DRM client, and the DRM client directly executes the content authorization execution unit in the DRM client runtime in order to decrypt the multimedia content.

According to the technical result of the present invention, since the execution unit generated by the DRM server side can be directly executed in the DRM client executable environment after sending the DRM client, for a specific multimedia content, a personalized content encryption algorithm, authorization rule, etc. can be set until the corresponding unit of execution unit is available on the server side of the DRM.

Using the technical result of the present invention, the content encryption algorithm can often be updated or replaced, which is especially necessary to protect very high definition content, thereby eliminating the problem of frequently updating the DRM client.

Using the technical result of the present invention, a new DRM function or a new authorization rule can be additionally added until the corresponding unit of execution unit is available on the DRM server side without updating the DRM client and the entire DRM server side, thereby simplifying the commercial operation.

Obviously, using the technical result of the present invention, it becomes possible to flexibly control and protect multimedia content, and therefore, its security is enhanced.

A DRM client in accordance with the present invention can be executed in a trusted terminal runtime. In the case of a trusted runtime to update the content protection algorithm, etc. it is only necessary that the DRM server side generate different units of execution and send them to the DRM client for execution, which does not affect the normal functioning of the functions of other non-DRM clients in a trusted runtime environment.

The DRM client executes the execution unit in the DRM client runtime and performs authorization for multimedia content by executing the execution unit. A unit of execution is issued by the server side of the DRM. Thus, the situation in which the DRM client does not decrypt and reproduce the content in accordance with the requirements of the permission and restriction conditions can be prevented, thereby loopholes and deficiencies associated with the existing method of parsing the content authorization license can be eliminated.

The present invention may be a system, method and / or computer program product. A computer program product may include computer-readable media (or media) with computer-readable software instructions stored on it, based on which the processor can implement aspects of the present invention.

The computer-readable medium may be a material device capable of holding and storing instructions for use by the instruction execution apparatus. Machine readable nosy

- 14 035157 a device may be, for example, but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device, or any combination of these devices. A non-exhaustive list of representative examples of machine-readable media includes the following: portable computer-readable floppy disk, hard disk, random access memory (ROM), read-only memory (ROM), electrically erasable flash-programmable ROM (EEPROM or flash memory), static random access memory (static RAM) , a portable data write-once compact disc (CD-ROM), universal digital disk (DVD), flash drive, floppy disk, a mechanically encrypted device such as punched cards or embossed structures in the groove with the recorded commands, and any other combination of the above higher. The computer-readable medium referred to in this document should not be construed as transient signals as such, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (for example, light pulses passing through an optical fiber cable ), or electrical signals transmitted by cable.

The computer-readable program instructions described herein can be downloaded to appropriate computing or processing devices from computer-readable media or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network and / or a wireless network. The network may include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switching devices, gateway computers and / or edge servers. Machine-readable program instructions are sent to the network adapter card or network interface in each computing or processing device from the network and redirected for storage to computer-readable media in the corresponding computing or processing device.

The machine-readable program instructions for performing the operations of the present invention can be assembler instructions, instruction system architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination in one or more programming languages, including an object-oriented programming language, such as Smalltalk, C ++, etc., and traditional procedural programming languages, such as the C programming language or similar programming languages. Machine-readable program instructions can be executed entirely on a user computer, partly on a user computer, as a stand-alone software package, partly on a user computer and partly on a remote computer or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user computer via any network, including a local area network (LAN) or wide area network (WAN), or the connection can be made with an external computer (for example, via the Internet using an Internet provider). According to some embodiments, an electronic circuit comprising, for example, a programmable logic circuit, user programmable logic element arrays (FPGAs), or programmable gate arrays (FDAs), can execute computer readable program instructions using state information of computer readable program instructions to personalize the electronic circuit to carry out aspects of the present invention.

Aspects of the present invention are described herein with reference to flowcharts and / or structural diagrams of methods, devices (systems), and computer program products in accordance with embodiments of the invention. It should be understood that each block of block diagrams and / or block diagrams, as well as combinations of blocks of block diagrams and / or block diagrams, may be implemented by computer readable program instructions.

These machine-readable program instructions may be provided by a processor of a general purpose computer, a special computer, or other programmable data processing device to create a machine so that instructions executed through a computer processor or other programmable data processing device provide means for performing the functions / actions specified in block or blocks of the flowchart and / or block diagram. These machine-readable program instructions may also be stored in a computer-readable medium that can direct a computer, programmable data processing device and / or other devices to operate in a specific way so that the computer-readable medium with instructions stored in it contains an article containing instructions that perform aspects of a function / action indicated in the block or blocks of the flowchart and / or block diagram.

Machine-readable program instructions can also be downloaded to a computer, another programmable data processing device, or other devices for performing sequential work steps on a computer, another programmable device, or other device to create a computer-executable method such that instructions executed on a computer, another programmable device, or another device, performed the functions / actions indicated in the block or

- 15 035157 blocks of the block diagram and / or structural diagram.

The block diagram and structural diagrams shown in the figures depict the architecture, functionality, and principle of operation of possible systems, methods, and computer software products in accordance with various embodiments of the present invention. In this regard, each block in the block diagram or structural diagrams may correspond to a module, segment or part of the code containing one or more executable instructions for performing the specified one or more logical functions. It should also be noted that in some alternative embodiments, the functions indicated in the block may be performed in an order different from that indicated in the figures. For example, two blocks shown in sequence can actually be executed almost simultaneously, or sometimes blocks can be executed in the reverse order, depending on which function is needed. It should also be noted that each block indicated in the block diagrams and / or structural diagrams, as well as combinations of blocks in the block diagrams and / or structural diagrams, can be performed by special-purpose hardware systems that perform the indicated functions or actions, or by combinations special-purpose hardware systems and computer teams.

One skilled in the art of the present invention is well aware that embodiments using hardware, software, or a combination of software and hardware may be equivalent to each other.

The various embodiments of the present invention have been described for illustrative and descriptive purposes, are not exhaustive, and do not limit the present invention to the disclosed embodiments. Various changes to the described embodiments will be apparent to those skilled in the art to which the present invention relates, without departing from the scope of the present invention. The terminology used herein has been chosen so as to best explain the principles of the embodiments, the practical application or technical improvement of the technologies on the market, or to enable other specialists in the field of technology to understand the embodiments disclosed herein. The scope of the present invention is defined in the attached claims.

Claims (8)

1. A digital rights management (DRM) method for multimedia content implemented in a terminal device on which a DRM client is installed, the method comprising: stage 1: receiving by the DRM client a call request for the multimedia application of the terminal device and retrieving the unique identifier of the multimedia content to be played from the DRM client from the call request; stage 2: the DRM client sends a DRM authorization request to the DRM server side to retrieve the content authorization execution unit, the DRM authorization request contains the multimedia content identifier and basic DRM client information, while the DRM server side generates the content authorization execution unit in the following way: server the DRM side obtains a content encryption algorithm and a content encryption key used for multimedia content, and a DRM client DRM authority for multimedia content in accordance with a DRM authorization request by a request, and then it is generated in accordance with the multimedia content identifier, the content encryption algorithm and a content encryption key applicable for multimedia content, basic DRM client information, and DRM client DRM credentials for multimedia content; and stage 3: the DRM client executing the content authorization execution unit in the DRM client executable environment, verifying that the terminal executable environment matches the DRM client DRM authority for the multimedia content through the content authorization execution unit and, if the multimedia content is decrypted in accordance with the content encryption algorithm and a content encryption key, wherein the DRM client includes a core unit of execution and a unit of control and planning unit of execution, the core of a unit of execution is configured to execute a unit of execution, and the DRM client plans and manages units of execution through a unit of management and planning of a unit of execution, including introducing units the execution plan for the unit of execution for execution, and the units of execution include a unit of authorization of content. 2. The method according to claim 1, further comprising the step of verifying the signature of the content authorization execution unit by the DRM client unit signing verification module. 3. The method according to claim 1 or 2, further comprising the step of adapting the kernel of the unit of execution to the operating system of the terminal through the adaptation module of the operating system of the DRM client terminal. 4. The method according to any one of claims 1 to 3, further comprising the step of providing, through the kernel, a unit of execution of a memory management interface, an external storage management interface - 16 035157 em, network management interface, encryption algorithm interface, playback control interface and data output control interface for executing the execution unit; and the stage of adaptation of the memory management interface, the external storage management interface, the network management interface, the encryption algorithm interface, the playback control interface and the execution unit kernel data output control interface to the corresponding interfaces of the terminal operating system through the adaptation of the terminal operating system module. 5. The method according to any one of claims 1 to 4, further comprising the stage of planning and managing various units of execution, including adding to the kernel a unit of execution of the plan regarding the unit of execution to execute, add, delete, and update the unit of execution through the control unit and planning the unit of execution of the client DRM 6. A digital rights management (DRM) method for multimedia content implemented on the server side of a DRM, the method comprising: stage 1: receiving by the DRM server side the DRM authorization request sent by the DRM client, wherein the DRM authorization request contains a unique multimedia content identifier and basic DRM client information; stage 2: obtaining by the DRM server side the content encryption algorithm and the content encryption key used for multimedia content, and the DRM client DRM credentials for multimedia content in accordance with the DRM authorization request by request; stage 3: the DRM server side generates a content authorization execution unit in accordance with the multimedia content identifier, the content encryption algorithm and the content encryption key used for multimedia content, basic DRM client information and DRM client DRM authority for multimedia content, while the content authorization is arranged to be executed in the DRM client executable environment in such a way as to check whether the executable environment of the terminal of the terminal device where the DRM client is located complies with the DRM client DRM authority for the multimedia content and, if so, decrypt the multimedia content in accordance with the algorithm content encryption and content encryption key; stage 4: the DRM server issuing the generated content authorization execution unit to the DRM client, the DRM client including the execution unit core and the unit of control and scheduling unit, the execution unit core configured to execute the unit of execution, and the DRM client planning and managing the units of execution through the module management and planning of the unit of execution, including the inclusion in the core of the unit of execution of the plan regarding the unit of execution for execution, and the units of execution include the unit of execution of content authorization. 7. The method according to claim 6, further comprising the step of signing the content authorization execution unit before the issuing unit of issuing the execution unit issues the content authorization performing unit through the signature module of the DRM server-side execution unit. 8. The method according to any one of claims 8 or 9, further comprising the step of managing the content authorization execution unit template, including adding, updating and deleting the content authorization execution unit template via the DRM server side execution unit template management module.