EP1509828A2

EP1509828A2 - Method and device for producing coded data, for decoding coded data and for producing re-signed data

Info

Publication number: EP1509828A2
Application number: EP03725156A
Authority: EP
Inventors: Karlheinz Brandenburg; Christian Neubauer; Ralph Kulessa; Frank Siebenhaar; Wolfgang Spinnler
Original assignee: Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV
Current assignee: Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV
Priority date: 2002-05-10
Filing date: 2003-05-06
Publication date: 2005-03-02
Also published as: KR100848369B1; KR20050010795A; AU2003227723A1; CN1774684A; AU2003227723A8; WO2003096336A3; WO2003096336A2; DE10220925B4; CN100514252C; DE10220925A1

Abstract

The invention relates to devices and methods for producing coded data, for reproducing coded data and for re-signing originally signed data based on the fact that the coded data in addition to the coded media information, comprises the necessary information for decoding the data in addition to a signature thereof which produces the coded data. The source of the coded data is thus traceable. Reproduction of coded data is allowed within defined limits by the producer of the coded data for friends or relatives for example, yet large-scale duplication of the coded data is seen as an act of piracy. The data pirate can be traced back by means of the signature, since the signature is optionally secured by means of an embedded water-mark signature. Since the issue at stake is a concept wherein only legal use should occur for coded data, unauthorised removal of the coding is a criminal act. The inventive concept enables the wrong doer to be determined and takes into account both the ownership status of the provider with regard to a defined reproduction of media information and also has the potentiality of being acceptable to the market.

Description

Device and method for generating encrypted

Data, for decrypting encrypted data and for

Generation of re-signed data

description

The present invention relates to media distribution and, in particular, to a distribution of media which permits free distribution in a moderate scope, at least makes it difficult to distribute on a large scale and makes it comprehensible in any case.

The digital signal display for media content has made it possible to copy media content as often as required without loss of quality. This has resulted in unauthorized copying i.e. the "piracy" has increased dramatically compared to previous times, causing financial loss to the owners of the rights to the media content. Compared to previous times when analog signaling was predominant and where quality was motivation, For example, buying a record and not just owning a pirated copy has led to the possibility of digital media reproduction, which means that the financial losses of the rights owners are increasing.

In response to this situation, there are various concepts, one of which is known under the keyword SDMI, and companies, such as Intertrust, which try to use cryptographic methods to prevent access for unauthorized operators. However, this means an increased effort on the one hand and a curtailment of previously common property of the operator on the other. Such common property of the operator has always been to distribute a certain small number of private copies to friends or family members. Previous cryptographic methods suffer from the following disadvantages. First of all, a complex logistical distribution of the access keys has to be accepted. In addition, previous formats also require a separate decoding key, which must be provided separately from the media content in an alternative way, such as by post, by telephone, etc. If this separate decoding key is no longer available when, for example, a system change has taken place or a usage contract has expired, the music collection in this protected format becomes worthless, for example. Such a format is therefore not future-proof and quickly becomes obsolete. Furthermore, private copies to friends, such as copying a CD to an audio cassette or copying a CD to an audio cassette yourself, for example to be able to play them in the car, are not possible, since existing rights are only available to devices are bound or to persons and therefore cannot be extended to other devices or persons.

In addition, such systems have always provided a high incentive to crack the cryptographic protection concept because all access other than the permitted access is prevented.

In addition, such cryptographic protection concepts have often relied on cryptographic security. In the case of cracked procedures, the content was then completely free and without reference to anyone in the (illegal) distribution chain. Such an offense was therefore not detectable.

Systems that try to limit the financial damage to the owners of the media content, using the example of audio works in the music industry, are also known as DRM systems (DRM = Digital Rights Management) in specialist circles. Such systems are intended to prevent unauthorized copying and to provide detailed billing, preferably by “e- Such "systems" have not yet been able to establish themselves, and the acceptance by the operator is still questionable, since, as has been explained, the operator's existing acquis is to be restricted.

It is common to all of these methods that they prevent access to the content for unauthorized persons and that authorized persons generally have to pay. These payments can be fine-tuned to the actual uses by means of the attached rules, which are also referred to as “rules”, which is, after all, fairer than flat payments for the devices or data carriers. Such rules, which consist, for example, of the fact that For example, seven copies of the original are permitted, but no copy of the copy is permitted, etc., however, are complex and are also questionable in terms of operator acceptance due to this complexity.

Current systems are described for example in "Secure Delivery of Compressed Audio Compatible by Bitstream scrambling", C. Neubauer, and J. Herre, Preprint 5100, 108 ^th AES Convention, Paris, February 2000. In addition to Jack Lacy, Niels Rump , Talal Shamoon, Panos Kudumakis, "MPEG-4 Intellectual Property Management & Protection (IPMP) Overview &Applications", 17th AES Conference, Florence, Sep. 1999, or to Niels Rump, Philip R. Wiser, "AESSC SC-06-04 Activities on Digital Music Distribution", 17th AES Conference, Florence, Sep. 1999.

As has already been explained, all of the disadvantages described above lead to the fact that the operator acceptance is low, so that the known systems may not prevail on the market. This may be due to the fact that they have so far only focused on the interests of the music industry and have not dealt so much with the "property" of the existing operators, which may be based on the letters of the are illegal, which, however, if touched, could lead to the failure of such a system from the outset.

The object of the present invention is to provide a rights management concept that has a better chance of being accepted by the market.

This object is achieved by a device for generating encrypted data according to claim 1, a method for generating encrypted data according to claim 16, a device for decrypting encrypted data according to claim 17, a method for decrypting encrypted data according to claim 24, a device for generating re-signed data according to claim 25, a method for generating re-signed data according to claim 40 or a computer program according to claim 41.

The present invention is based on the knowledge that only a rights management concept will be enforceable on the market, which not only takes into account the interests of the music industry, but also the existing property rights or interests of the operators, who will ultimately be responsible for enforcement on the market , considered. In other words, the concept of media distribution according to the invention provides a compromise between the interests of media providers and media consumers.

The present invention, as is illustrated below on the basis of various aspects, is based on the fact that, once purchased, content is in principle made available to everyone. However, an identification of the first buyer or the person who passes on the media content is included in the passed on data. In the event of misuse, for example if an immensely large number of copies are made at once, the offender can be prosecuted and the offense punished because the Malefactors can be identified on the basis of the massly distributed copies.

In particular, encrypted data generated according to the invention are distinguished by the fact that they are encrypted, but that they contain decryption information and that they also contain identification information of the person who generated the encrypted data. The encrypted data thus include, in addition to the encrypted media information, additional information which is designed such that identification of the producer of the encrypted data and decryption of the encrypted media information can be carried out on the basis of the additional information.

In other words, the publisher of media content must digitally sign the content before publishing it.

An essential aspect of the concept according to the invention is also the fact that it is based on encryption, i.e. the media content or information is encrypted. Removal of encryption is an illegal act under the relevant United States law known as the Millennium Act. In this context, it should be noted that the copying of non-encrypted files, such as MP3 files, according to this law is not punishable in the United States, but the unauthorized removal of encryption is.

In a preferred embodiment of the present invention, the identification information on the one hand and the decryption information is on the other hand, both part of the encrypted data, are dependent on each other ^¬. This ensures that removal of the identification information from the encrypted data leads to the encrypted data no longer being decrypted. are Seibar. In a preferred embodiment of the present invention, an asymmetrical encryption method is used. In particular, an operator has an associated pair of a public key and a private key. The private key is used by an operator to encrypt a symmetric key to decrypt the media information to obtain an encrypted symmetric key. The operator then adds this encrypted symmetric key and his public key to the encrypted media information. In this case, the attached public key represents the operator identification, since the operator can be clearly identified on the basis of this public key. A recipient of the encrypted data will then extract the public key from the encrypted data, decrypt the enclosed encrypted symmetric key with this public key and then finally decrypt and play the encrypted media information using the decrypted symmetric key. If the public key (public key) of the producer of the encrypted data is removed without authorization, it is no longer possible to decrypt the symmetric key and ultimately to decrypt the encrypted media information. Thus, the operator identification information (signature) is the cause of whether the encrypted data is still usable or not.

It should be pointed out that this allows a free distribution of the media information to a limited extent, that is to say among friends and acquaintances, or for various players of the operator himself. This takes into account the operators' habitual acquisitions, which in all likelihood will not accept it if such acquisitions are cut off. Ultimately, this could be decisive for the concept according to the invention to prevail on the market. On the other hand, the in- The owner's interests in the rights of the media information are taken into account by the fact that they have to accept a limited free duplication - as in the time of analogue audio presentation, for example - but that they have the possibility of a gross misuse, such as the provision of the media information on a large scale for example, can track and punish them via the Internet. The tracking is achieved in that the encrypted data, if they are to be decryptable, contain the identification of the person who carried out the distribution in a large - unauthorized - style.

In a preferred exemplary embodiment of the present invention, it is also preferred, as it were, to add a watermark to the media information as a second line of defense in addition to the operator identification present in plain text, which also enables operator identification. If an attacker succeeds in falsifying or removing the operator identification and still providing an intact data stream, it can still be identified using the watermark. In particular, in the event that an attacker succeeds in generating plain text data from the encrypted data, but this is made more difficult by technical precautions, identification can nevertheless be determined using the watermark. Should he be able to generate plaintext data without his watermark is added to the media information, but a watermark which will be included in the media information that has the encrypted data provided ^¬ the offender. In this way, at least its identity can be determined. This gives at least a chance to find out the real wrongdoer, who acted illegally due to the fact that he removed the encryption and made himself punishable as explained above. The concept according to the invention is thus distinguished by the fact that it contains the media information in encrypted form and that the key for decoding and playing back is contained in the encrypted data, although there is no legal possibility of writing a file with plain text data. Furthermore, the encrypted data contains the operator identity as a digital certificate or user signature in a secure manner. This signature is preferably issued and registered by a certification body, so that in the event of a punishment an operator identification can also be used in court. It is also preferred as a second line of defense to also write the operator identity as a watermark in the media data.

The concept according to the invention is advantageous for the operators or consumers of the media information in that a transparent system is provided which is simple to use and is free to copy for private use (e.g. for friends), that is to say to a limited extent allowed. Simple operators who have previously been in a state of semi-legality and who have no illegal interests will be brought into a legal state - provided the laws and regulations of the media providers are in an appropriate position. Furthermore, it is preferred to compress the media information prior to encryption for data rate compression. If MPEG-4 is used as the compression method, the operator gets even better audio quality and higher compression than MP3, for example, and is motivated to switch from the MP3 format, which can be copied in any way, to MPEG-4 is an encrypted method by the inventive concept. For the normal operator, who still wants to copy freely on a small scale, there are no disadvantages due to the new concept, but certainly for illegal users who practice pirated copies on a large scale. This piracy is not prevented by the encrypted concept, the Pirate copiers can, however, be identified and punished based on the operator identification in the encrypted data.

In addition, the operator receives additional media tracks, especially since MPEG-4 is not only an audio compression process, but is also intended for video, text, etc. Overall, it is assumed that illegal copying can be reduced with the concept according to the invention, so that, for example, the prices for music and video works are reduced due to the lower illegal use.

For the owner of the rights to the media information, the concept according to the invention is also advantageous in that it does not represent a deterioration compared to the times of analog music distribution, but it does provide a means of preventing the widespread piracy in the MP3 age. In addition, the system provides media manufacturers with an entry into an age in which media content is no longer distributed freely, but encrypted.

In addition, the concept according to the invention is advantageous for the music industry in that it leads the operators to estimate the value of media information based on the fact that it is encrypted. In addition, the concept according to the invention will result in operators being more responsible with media content, since if the media is passed on, they have to expect that their identity will ultimately be contained in a pirated copy which is widespread, which can cause difficulties. Operator acceptance is unlikely to suffer, however, since the transfer is raised to a limited extent from the state of semi-legality to a legal state. The concept according to the invention also solves several problems of previous DRM systems in that the decoding key is included, so that no complex and logistically expensive key management is necessary. Furthermore, the concept according to the invention is self-contained, which in other words means that the encrypted data contains the information required for playback at all times, so that encrypted data generated according to the invention are future-proof. The encryption methods used, such as RSA as an example for an asymmetrical encryption method and Rijndal as an example for a symmetric encryption method, are also public.

As before, the method according to the invention allows any copying and playback in the area of responsibility of the operator, that is, also the transfer to friends in the private area, that is to say in a limited circle.

In addition, the concept according to the invention does not provide the normal operator with an incentive to "crack" since the access is free anyway. The operator's responsibility will limit the mass distribution, not a cryptographic method.

In addition, in the case of cracked media data, a watermark is optionally included, which to a certain extent identifies the signatory as an optional additional line of defense.

In addition, the concept according to the invention is independent of the source coding format used. Any existing compression method, such as MP3, etc., can be integrated, although it is preferred to use the new MPEG-4 method as the source coding method in order to give operators an additional incentive since MPEG-4 has higher Contains data rate compressions and better audio / video qualities and other improved properties. This at ^¬ attractive for the operator to the invention con- admitting, can also be increased by the fact that MPEG-4 coders / decoders are no longer made freely available, but are only issued in connection with the DRM system, free of charge or at a low price, so as not to endanger the market launch. This means that in the best case there should be no decoders, and in particular hardware players, that play the non-encrypted format. This means that it is easier for a normal operator without illegal intentions to download and use the new - encrypted and signed - format than to carry out complex attacks on the cryptographic security or the signature.

Preferred embodiments of the present invention are explained in detail below with reference to the accompanying drawings. Show it:

1 shows a block diagram of the concept according to the invention for generating encrypted data;

2 shows a block diagram of the concept according to the invention for decrypting / reproducing encrypted and signed data;

3 shows a block diagram of the concept according to the invention for the re-signing of encrypted data in order to enable it to be passed on to other - trustworthy - persons;

Fig. 4 is a schematic representation of the format of NEN encrypted and signed Medieninformatio ^¬;

5 an overview of the scenario and the various data formats used by the OF INVENTION ^¬ dung contemporary concept in its forms be ^¬ can be Fig. 6 shows a block diagram of a simple device for reproducing encrypted and signed media information;

7 shows a block diagram of a device according to the invention for generating an operator-specific local archive as a “trial version”;

8 shows a block diagram of a device according to the invention for reproducing, generating and re-signing according to a preferred exemplary embodiment of the present invention;

FIG. 9 shows an extension of the device from FIG. 8 in order to publish media information specifically supplied by a media provider in encrypted and signed format; and

FIG. 10 shows an extension of the device from FIG. 9 in order to enable not only the free encrypted / signed option but also a point-to-point option in which it is not possible to pass on content to other people.

1 shows a device according to the invention for generating encrypted data which represent media information. The media information, which can be in plain text or which can be data rate compressed according to a method, such as MPEG-4, is fed to an input 10 of the device according to the invention. The media information is sent to a device 12 for encryption, the device 12 being supplied with a key by a device 14 for providing additional information, which includes operator identification on the one hand and key information on the other hand. The device 14 for providing, which can be designed as a memory, supplies this additional information, which An operator identification on the one hand and a decryption of the encrypted media information output at the output of the device 12, on the other hand, allow to a device 16 for adding the additional information to the encrypted media information, in order to provide the encrypted information at an output 18 and by an operator of that shown in FIG Device to deliver signed data. It should be noted that the data supplied at the output 18 can be either encrypted files or continuous stream data.

The plain text media information can be, for example, PCM data that an operator has read from or “ripped” from a CD or DVD in his possession. The media information can also be compressed source information, such as encoded PCM data, using a coding algorithm known coding algorithm can be used, such as MPEG-4, MP3, etc.

It should also be noted that any media information can be processed with the concept according to the invention, such as e.g. Audio information, video information, text information, graphics, special music information, e.g. WAV files, MIDI files, music score files, etc.

Any encryption method can be used as the encryption method that is carried out by the device 12 for encryption, such as, for example, symmetrical encryption method (for example Rijndal) or asymmetrical encryption method (for example RSA), although a combination of both concepts is preferred for reasons of computing time. In particular, it is preferable to encrypt a symmetric key to encrypt the actual media information with a key of an encryption rule asymmetri ^¬ concept and as to record information ^¬ both the public key of the asymmetric method as well as the with the corresponding private key encrypted symmetric key. In this case, the added public key also provides the operator identification. In general, the additional information should be designed such that both identification of the operator and decryption of the encrypted media information can be carried out by the additional information. In particular, it is preferred to select the additional information such that at least some of the additional information, such as the public key in the example above, simultaneously represents the operator identification, so that manipulation of the operator identification results in the encrypted data at the output 18 of the 1 in the sense that decryption based on the information contained in the encrypted data itself is no longer possible.

2 shows a device according to the invention for decrypting encrypted data. At an input 20 of the device shown in FIG. 2, for example, the encrypted and signed data supplied at the output 18 of the device shown in FIG. 1 are provided and fed to a device 22 for key extraction and a device 24 for decoding. The device 22 for extracting is designed to extract decryption information from the encrypted data, which is then fed to the device 24 which, using the decryption information from the device 22, decrypts the encrypted media information contained in the encrypted data and a device 26 for Representation or playback leads. Depending on the embodiment, the device 26 for playback will be a loudspeaker (audio information), a monitor (video information), a special device for voice or music output etc. In particular, in the exemplary embodiment shown in FIG. 2, it is preferred that the entire system, in which the ^¬ in Fig. 2 shown Vorrich processing is included, such as a PC of an operator, not is able to output the decrypted media information at the output of the device 24 as digital data or, in other words, to generate a plain text file. However, even if this were done through unauthorized use, it would already violate US law because it involves unauthorized encryption removal. Even if the perpetrator is punished or followed up, however, it will be possible if, as will be explained later, a watermark in the plain text data, which could be “stolen” at the exit of the encryption device 24, as the second line of defense , is included.

3 shows a device according to the invention for generating re-signed data from encrypted data which represent media information. In particular, the encrypted data, which are signed by their producer, are provided at an input 30 of the device shown in FIG. 3. This encrypted and signed data is the same data that is present at the output 18 of the device shown in FIG. 1 or at the input 20 of the device shown in FIG. 2. The device for re-signing comprises a device 32 for providing an identification of the operator of the re-signing device shown in FIG. 3 and a device 34 for adding the re-signing operator identification to encrypted media information which is derived from the unencrypted media information by encryption - Tet to deliver the re-signed encrypted data at an output 38. The re-signed encrypted data at the output 38 now in any case contain an identification of the operator of the device shown in FIG. 3 and preferably also the signature of the last producer, that is to say the data stream provided at the input 30, this feature making it possible to walk the entire route to track the media information. In the exemplary embodiment described so far, the device shown in FIG. 3 only has to add a new re-signing identification. This is possible if the key information contained in the encrypted data present at input 30 is independent of the operator information. However, if there is a dependency between the operator data and the decryption information, that is to say the additional information in the encrypted data, the device shown in FIG. 3 further comprises a key extraction device 35, which, like the key extraction device 22 in FIG. 2, can be designed, and a decryption device 36, which can again be designed like the device 24 of FIG. 2 and furthermore an encryption device 37, which in principle can be designed like the device 12 of FIG. 1. In this case, the one signed by a previous producer Data stream at the input 30 is first decrypted by the device 36 using the decryption information provided by the key extraction device 35 and using the new resigning identification which is provided by the device 32 using the identification of the operator the re-signing device is encrypted again. In this case, a dashed line 39 will not exist in FIG. 3.

A preferred embodiment of a file format for the encrypted and signed data is discussed below with reference to FIG. 4. If the encrypted and signed data is available as a file, the file contains a header with a format specification (40). A certificate of the operator or a public key assigned to this operator can follow this header (42). The entry 42 in the file thus ensures the generator identification. The area 42 can be followed by an area 44, which contains a symmetrical key encrypted with the public key in the area 42, which is used to log into a to decrypt encrypted media information standing in area 46. The areas 42 and 44 thus represent the additional information which is designed such that both identification of the operator (by the area 42) and decryption of the encrypted media information (by the areas 42 and 44) can be carried out.

An overview of the possibilities of the inventive concept is shown below with reference to FIG. 5, which is designated in FIG. 5 with DRM system 50 and, in a preferred form, contains all the devices and further features shown in FIGS. 1-3. On the input side, plain text media information or compressed media information can be fed to the DRM system (51a). In addition, in a preferred exemplary embodiment of the present invention, the DRM system 50 is designed to receive the signed and encrypted data as input signal (51b), which for example correspond to the data present at the output 18 of FIG. 1. In addition, in a preferred exemplary embodiment of the present invention, the DRM system 50 is designed to receive local archive data as input (51c) which, as will be explained later, is “hard” encrypted using a machine-dependent key are such that the local archive data contains no decryption information and no operator signature.

Furthermore, in a preferred exemplary embodiment of the present invention, the DRM system 50 shown in FIG. 5 can also be provided with a data format with signed and additionally “hard” -encrypted data, this data format also being referred to as an “AtoB” format (51d). , The "AtoB" format is characterized in that the content has been generated by user A so that it only ent of B can be ^¬ encrypted. In a further embodiment, the DRM system 50 according to the invention can also be provided with a file with secure media information by a media provider 52, which file can be provided by the media provider 52, which can be an owner of the rights to the media information or a licensed publisher, for example. are typically not signed. The media information transmitted from the media provider 52 to the DRM system 50 is cryptographically secured media information. This enables the DRM system to operate in a publish mode in order to support or execute media distribution by the media provider 52. This is also known as super distribution.

On the output side, the DRM system 50 according to the invention is able to reproduce (54a) data formats obtained via the inputs 51a-51d, generate a signed data format (54b), and generate a local data format (54c) in order to build up a local archive or to generate signed and hard-encrypted data at an output (54d), ie to write an AtoB format. The format specification, that is to say whether the format which is supplied to the DRM system 50 is plain text data or compressed data (51a), whether it is signed and encrypted data (51b), whether local data is present (51c ), whether there is an AtoB format (51d) or whether there is a publish format (51e) is contained in the header of FIG. 4. Before each actual action, the DRM system 50 according to the invention shown in FIG. 5, that is to say a header check, is carried out in order to perform certain actions depending on the data format.

If discrepancies are already discovered in the header 40 of FIG. 4, the data format will not be processed anyway. However, the preferred DRM system shown in Fig. 5 has no output for plain text data or compressed data in digital form. It can be seen from this that the DRM concept according to the invention, as has already been explained, will lead to the fact that, apart from CDs or other sound carriers that contain plain text data (PCM data) cannot be created or made available at any point. As has already been stated, the DRM system according to the invention also contains a data compression module which, because of its high data rate compression, enables digital storage in the usual framework anyway. If such a compression module is not available as a plain text version, but is only available embedded in a DRM system, it can be expected that the distribution of data compressed in this compression format will be completely prevented. An incentive for operators can be that this compression format delivers high data compression factors on the one hand and delivers good quality on the other hand and is also distributed free of charge or for only small fees, whereby the actual costs for the new data format, such as MPEG 4, can be easily redeemed by curbing illegal piracy.

At this point it should be pointed out that plain text data can be encoded or uncoded in the sense of the present document, while encrypted data are generated from the plain text data by a cryptographic algorithm.

In the following, reference is made to five different configurations of preferred DRM systems with reference to FIGS. 6, 7, 8, 9 and 10. The same reference numerals designate the same elements and functionalities in the different figures.

In Fig. Level-1-DRM system shown 6 comprising as the main ^¬ functionality playback of the signed format and comprises, in addition, as an addition to the operator a clear text input, or an input for encoded Medienin ^¬ formations (51a) that alternatively are coded for the signed and encrypted data at the input (51b). Age- natively encoded data is provided to an alternate decoder 60 to be decoded prior to being displayed / reproduced (26). If plain text data is fed in at the input (51a), * the alternative decoder is bypassed (62). In the following it is always assumed that the media information is compressed media information and is preferably compressed by MPEG-4. A decoder 64 is therefore connected between the decryption device 24 and the display device 26 and is connected to the DRM system via a secure channel (SAC 66; SAC = Secure Authenticated Channel). The decoder 64 can either be part of the DRM system or can be connected as an external module. In this case, the SAC 66 is an external interface for the DRM system which ensures that only special decoders 64 are operated, namely decoders which are certified to not allow plain text output as a digital file etc.

PCM data or MP3-coded data can be fed in as plain text or alternatively coded input data, in which case the alternative decoder is an MP3 decoder.

7 shows a level 2 DRM system which, in addition to the DRM system shown in FIG. 6, generates a local archive (54c) on the one hand and feeds in local archive data (51c ) enables. The ge in Fig. 7 showed ^¬ Level 2 DRM system thus results in the local format that serves that an operator MPEG-4 files can testify locally ER and can also play out only locally. For this purpose, plain text data is encoded at the input (51b) with an MPEG-4 encoder 70, which may be integrated again or 72 interfaced gekop ^¬ may be pelt over a SAC.

The encoded data are then subjected to Verschlüsselungsein ^¬ direction supplied 74 which encrypts the encoded data using a local key 76 and a Local archive output (54c) feeds. However, the locally encrypted data does not include decryption information. For decryption, the local archive data is therefore fed to the decryption device 24, which, however, does not attempt to extract key information, but rather, when a local format is recognized (40 from FIG. 4), decryption device 24 to the local key 76 switches.

The Level 2 DRM system is intended for an operator who wants to look at the new system and in particular the new encoder / decoder (70/74), but has not (yet) registered for encrypted and signed data to generate (Fig. 1) or to re-sign (Fig. 3). The operator of the Level 2 DRM system can thus not yet generate encrypted and signed data or pass it on legally, but he can already examine the functionality of the new coding / decoding concept and may then opt for a full version. However, the operator can play works already received from acquaintances or distributors in the signed format, since the level 1 DRM system of FIG. 6 is contained in the level 2 DRM system of FIG. 7. The operator can also generate a local archive (54c) of his own music data, that is to say a digital archive of his own CDs, for example, but this can only be played on his own device, for example his PC, using the local key 76. As will be explained with reference to FIG. 8, the level 2 DRM system becomes a level 3 DRM system after registration by the operator, so that encrypted and signed data can also be generated, regardless of whether the input data are plain text data or encrypted but not signed local data. The local key 76, for example, as will be explained later, is derived from a machine-dependent identification, such as the serial number of a PC, etc. The level 3 DRM system is described below with reference to FIG. 3 which, in addition to the functionalities of the DRM systems of FIGS. 6 and 7, that is to say the functionality of playing signed and encrypted data and the functionality of generating a local Archive has the functionality to generate the signed format, for example on the basis of plain text information (device from FIG. 1) or to convert a signed data format into a re-signed data format (device from FIG. 3).

The device 14 for providing a certified key is essential to the device shown in FIG. 8, on the one hand to generate encrypted (and thus signed) data or to re-sign data signed by a first operator. The certified key is preferably provided by the registration entity 56 (FIG. 5), which represents a neutral entity, by means of which the identity of the operator of the device shown in FIG. 8 can be ascertained on the basis of the certified key. The public key entered in block 42 in FIG. 4 thus represents the operator identification information.

8 also shows the preferred functionality of embedding watermarks either at the PCM level or at the bitstream level. The watermark embedding therefore takes place using a PCM watermark embedder 80 or a bitstream watermark embedder 82.

PCM watermark embedders are shown, for example, in German patent DE 196 40 814 Cl. Like a bitstream watermark embedder, a PCM watermark embedder is based on applying a spreading sequence to a payload, such as an operator ID or user ID in this case, in order then to weight the spread payload signal such that it when it is combined with the audio data that are to be provided with egg ^¬ nem watermark is inaudible, that is energetically below the psychoacoustic see masking threshold lies. This - optional - watermark embedding can, as has been carried out, take place either at the temporal level (block 80) or at the bitstream level (block 82), whereby only a partial unpacking of the encoded data and not a complete decoding is required is. If the watermark embedding is carried out in the time domain, the output signal of the decoder 64 is fed into the PCM watermark embedder 80 via a transmission line 84. If, on the other hand, bitstream watermarking is carried out, the input signal into decoder 64, that is to say the coded source information at the output of decoding device 24, 36, is fed into the bitstream watermark embedder via another transmission line 86. In this case, the bitstream watermark embedder 82 already provides the media information to be encrypted, so that in the case of bitstream watermarking the encoder 70 is not required.

It should be noted that the watermark is not evaluated in normal use. However, should the protection mechanism of the concept according to the invention be circumvented illegally and the raw data should be used further, then the invisible watermark or, for video data, the invisible watermark or, for text data, the watermark entered for text data with steganographic methods can be evaluated for forensic purposes in order to draw a conclusion to get to the illegal disseminator.

It is preferred that the watermark itself, so the payload information that either the user ID match or if the user ID is too long or the direct transfer ^¬ transmission of the user identification for reasons of Schut- of privacy not zes desired is, for example, is derived by means of ei ^¬ ner hashing of the user ID, or with a process known as "Random key" in Figure 8 is thus key to embed another -.. encrypted - Pseudorandom sequence used for spreading. This has the advantage that less or no payload interference occurs compared to encryption of the payload by encryption of the spreading sequence.

This has the advantage that the watermark is better protected. This also has the advantage that several watermarks can be entered by successive operators if the spreading sequences derived from the random keys are orthogonal to one another. This concept corresponds to the known CDMA method, in which several message channels are contained in a frequency channel, each of which uses the same frequency band, but which can be separated from one another by means of a correlator in a watermark extractor. Furthermore, a modification of the watermark improves the anonymity of the legal operator, but enables the illegal operator to be raised from anonymity and punished if necessary.

In particular, two methods for generating these watermark keys are preferred. The first method for generating these watermark keys uses a further random key with a variable length, which can be adapted to the decoding times as technology advances. This ensures that when testing all possible keys for watermark extraction for forensic purposes, a certain amount of effort has to be carried out and thus the watermark ID is practically secure and anonymous, since it can only be read with considerable effort since the key is not known to anyone. The decoding for forensic purposes is done by trying all possible keys. This is not a problem since there is sufficient time for decoding for forensic purposes, since the number of illegal distributors will typically be adapted to the current computer technology. The alternative method for generating watermark keys is that a set of different keys exist, which are derived from the operator ID in a known manner, and that one of these possible watermark keys is used in the watermark encryption. This means that proof of identification can only be provided for an operator to be checked with moderate effort.

From FIG. 8 it can be seen that the level 3 DRM system comprises all functionalities, that is to say to play signed data, local data and plain text data, to generate signed data from plain text data and to generate re-signed data from signed data , As is indicated in FIG. 8, the functionality is further preferred that when an operator feeds local data on the input side in order to reproduce it, a conversion into the encrypted and signed format can be carried out. This is possible because the operator of the system shown in FIG. 8 has already registered since he is in possession of the certified key 14.

As has already been illustrated with reference to the exemplary embodiment shown in FIG. 7, the local data format for generating an encrypted local archive is advantageous in that a taster version for a new coding method 70 or decoding method 64 is provided to a certain extent becomes. For reasons of economy, it is preferred to provide a free-keeping device 88 in the level 3 DRM system shown in FIG. 8, which enables a signed data format to be output if the operator receives the certified key 14 from the registration authority 56 in FIG. 5, for example had received. If the operator has not yet received the certified key, the free-keeping device 88 is active in order to only allow local data to be output, but not signed data. It is thus possible if the operator has registered and has a certified 7, the functionality shown in FIG. 8 can be added to the functionality shown in FIG. 7 simply by activating the free-keeping device, without the operator requiring new software or new hardware. Depending on the embodiment, full versions can already be distributed, but in which a free-keeping device 88 ensures that the full functionality can only be used by the operator when he has registered, that is, when he has received the certified key 14.

An extension of the DRM system according to the invention to a so-called distribution format (level 4 DRM system) is shown below with reference to FIG. 9. For this purpose, an operator of a DRM system contains media information that is secured but not signed by the media provider 52 via an input (51e). In order to decrypt this secure, that is to say encrypted, media information which does not contain any encryption information, a further decryption device 90 is provided, which is to be provided with a key 92, which is typically transmitted to the operator of the DRM system via a secure channel. Here too, an asymmetrical encryption method in combination with a symmetrical encryption method is preferred. The secured media information (51e) provided by the provider 52 is also encrypted with a symmetric key, which is not contained in the secured media information in one embodiment of the present invention. This key is provided externally (92).

Here, too, an asymmetrical encryption method can advantageously be used. In this case, the operator of the device shown in FIG. 9 supplies his public key to the media provider 52, who then encrypts the symmetrical key for decrypting the media information with this public key and this encrypted symmetrical key to the measurement key. service information included. The operator of the device shown in FIG. 9 can then use his private key (92) to decrypt the encrypted symmetric key contained in the data stream, in order to then receive the unsigned information received from the media provider through the device 90 decrypt. The decrypted media information, if it is encoded data, is fed to the decoder 64 and then output by the display device 26 in the form shown, but not as a file.

In order to generate a signed data format from the secured media information provided by the provider, the output data of the decryption device are processed as before. The level-4 DRM system shown in FIG. 9 thus enables super distribution or distribution via non-personalized media such as e.g. CDs.

The DRM system shown in FIG. 9 also has the functionality, if an operator of the same still has local data, to convert the data automatically or not automatically into signed data, depending on the embodiment.

A further embodiment of the concept according to the invention, which is referred to as a Level 5 DRM system for the sake of simplicity, is shown below with reference to FIG. 10. In order to enable a signed and encrypted file to be passed on to only one user person, the system shown in FIG. 10 is able to additionally encrypt with a personal key and transmit it to the recipient person. This point-to-point format is also known as the AtoB format. If the system shown in FIG. 10 is receiver B, the system receives an AtoB data stream (51d) on the input side, which is encrypted with the public key of system B. For decryption, a further decryption device 100 is provided, which is the private one Key (B) is supplied from B to decrypt the AtoB format and then further process as shown in the other figures. If the device shown in FIG. 10 is a producer of the AtoB format, a further encryption device 102 is provided for this after the addition device 16, 34, in order to use a public key contained by a recipient to transmit from the recipient B the to re-encrypt the signed and encrypted data stream to output a data stream in AtoB format.

It should be pointed out that an asymmetrical encryption method does not necessarily have to be used for the encryption or decryption in the devices 102 and 100. However, this is preferred for reasons of economy. In addition, the device shown in FIG. 10 is designed to prevent conversion of the hard-encrypted AtoB format into a free, encrypted and signed format. The device shown in FIG. 10 only allows the media information to be displayed, but not converted into a signed / encrypted format.

In this regard, the AtoB format is a way to share signed files with people you don't trust 100%. These recipients can then no longer pass on the content in the sense of conventional restrictive DRM systems. An exception to playing back into a file is if it was signed for B for distribution purposes and sent to B. If the signer and recipient are identical, the signed format can be written as a file. As has already been stated, a private key is required on each player to play the AtoB format. This private key must be supplied to the decryption device 100. In order to prevent circumvention of the AtoB format, it is preferred to darken the area shown in FIG. area of the DRM system (104) to be executed in hardware.

To transfer the private key to a recipient, this key is encrypted and transferred to the corresponding player of the recipient, so that the AtoB format can be converted into a signed format for playback, which can then be played back without any storage option. A secure method (SAC = Secure Authenticated Channel) is also preferred for this transmission.

In principle, there should always be only one private key on each device, since several private keys enable content that belongs to several people to be played. On the other hand, the private operator should be changeable, which is achieved by loading a new key and deleting the old one. The change effort, for which an artificial time lock of one hour or one day may be required for an update, is considered sufficient to prevent gross misuse. But personalizing the second devices is easy.

With regard to members of a shopping club, it is preferred to install one or more additional club keys, which are valid for a limited period, for example annually, on the private device so that content relating to the club can be played in AtoB format , There are many keys in the device for this, but not in the media section itself, since the keys are then available to everyone. These many keys are needed to keep a library of personalized files playable.

Depending on the circumstances, the method according to the invention outlined in FIGS. 1 to 3 and in particular in FIGS. 6 to 10 can be implemented in hardware or in software. be implemented. The implementation can take place on a digital storage medium, in particular a floppy disk or CD with electronically readable control signals, which can interact with a ^* programmable computer system in such a way that the corresponding method is carried out. In general, the invention thus also consists in a computer program product with program code stored on a machine-readable carrier for carrying out the method according to the invention when the computer program product runs on a computer. In other words, the present invention thus relates to a computer program with a program code for carrying out the method when the computer program runs on a computer.

Claims

claims

1. Device for generating encrypted data, which represent media information, with the following features:

a device (14) for providing an operator identification by means of which an operator of the device can be identified;

means (12) for encrypting the media information with an encryption key to generate encrypted media information; and

a device (16) for adding additional information to the encrypted media information in order to generate the encrypted data, the additional information being designed such that both identification of the operator and decryption of the encrypted media information can be carried out.

2. The apparatus of claim 1, further comprising:

an encoder (70) for encoding source information to obtain the media information which is a data rate compressed version of the source information.

Device according to claim 1 or 2,

in which the operator identification is identical to or derived from at least part of the encryption key (42), and

in which the device (12) is designed for encryption in order to use the encryption key Operator identification or to use information derived from the operator identification, and in which the device (16) is designed to add, in order to add, as additional information, only decryption information which additionally enables the operator to be identified.

4. Device according to one of the preceding claims,

in which the device (12) is designed for encryption in order to carry out a symmetrical encryption method with a symmetrical key,

a device for encrypting the symmetrical key with a private key of an asymmetrical encryption method is also provided in order to obtain an encrypted symmetrical key (44), and

in which the device (16) is designed to add in order to use the encrypted symmetrical key (44) and a public key (42) belonging to the private key as additional information.

5. Device according to one of the preceding claims, further comprising the following feature:

means (80, 82) for embedding a watermark, the watermark corresponding to the operator identification or derived from the operator identification.

6. The device according to claim 5,

wherein the means (82) of a What's ^¬ formed serzeichens for embedding to the watermark in the media information to embed. Device according to claim 5,

in which the media information is a data rate-compressed version of source information, the means (80) for inserting a watermark being designed to embed the watermark in the source information before compression.

Device according to claim 5,

in which the media information is a data rate compressed version of source information, the device (82) being designed for inserting a watermark in order to embed the watermark in a partially decoded version of the media information.

9. Device according to one of claims 5-8,

in which the device (80, 82) is designed for embedding a watermark in order to embed the watermark using a watermark key.

10. The device according to claim 9,

in which the device (80, 82) is designed for embedding a watermark in order to randomly select the watermark key or to select from a set of different keys derived from the operator identification.

11. The device according to claim 1, where the media information is a data rate compressed version of source information that can be generated by an encoder (70),

the device further comprising:

an interface device (72) for interfacing an encoder (70), the interface device (72) being designed to check a connected encoder (70) for a security feature in order to carry out communication with the encoder (70) only when the encoder fulfills the security feature, which is that the encoder prevents output of compressed source information.

12. Device according to one of the preceding claims,

in which the device (14) is designed to provide only an operator identification (42) assigned to the operator of the device by a registration entity.

13. Device according to one of the preceding claims, further comprising the following features:

a release device (88) for enabling an output of the encrypted data only if the device (14) for providing has an externally assigned operator identification; and

a local archiving device (74) for encrypting media information with a local key (76) clearly assigned to the device and for outputting local data (54c) which do not have the local key (76), so that the local Data (54c) can only be decrypted by the device itself,

wherein the local archiving device can be operated independently of an activation by the release device (88).

14. The apparatus according to claim 13,

in which the local archiving device is designed to derive the local key from a machine identification, a network identification or a time stamp which is assigned to a system in which the device is embedded.

15. Device according to one of the preceding claims, in which the media information (51e) is encrypted by a media provider (52) and has no signature of the media provider (52), the device furthermore having the following feature:

means (90) for decrypting the encrypted media information using a key (92) not contained in the encrypted media information, the means (52) for decrypting the means (24) for encryption being connected upstream.

16. A method for generating encrypted data representing media information, comprising the following steps:

Providing (14) the operator identification by which an operator of the device can be identified;

Encrypting (12) the media information with an encryption key to encrypted Medienin ^¬ formations to produce; and Adding (16) additional information to the encrypted media information in order to generate the encrypted data, the additional information being designed in such a way that both identification of the operator and decryption of the encrypted media information can be carried out.

17. Device for decrypting encrypted data representing media information, the encrypted data comprising encrypted media information (46) and additional information (40, 42, 44) by means of which an identification (42) of a producer of the encrypted data and a decision - encryption (42, 44) of the encrypted media information can be carried out, with the following features:

means (22) for extracting a decryption key (42) from the encrypted data;

means (24) for decrypting the encrypted media information using the decrypting key to obtain decrypted media information;

means (26) for reproducing the media information.

18. The apparatus of claim 17 which is further formed to output the decrypted Medieninfor ^¬ mation to prevent as digital data.

19. The apparatus of claim 17 or 18,

wherein the encrypted media information using a symmetric key Locks are ^¬ selt, wherein the symmetric key at Use of a producer's private key is encrypted, and in which a producer ^'s public key (42) belonging to the private key is contained in the additional information,

the device (24) being designed to extract the public key (42) and an encrypted symmetric key (44) from the additional information, and

wherein the decryption device is designed to decrypt the symmetric key using the public key (42) and to decrypt the encrypted media information using the decrypted symmetric key.

20. Device according to one of claims 17 to 19,

where the media information is a data rate compressed version of source information, and

wherein the means for displaying comprises a decoder (64) for decoding the decrypted media information in order to obtain the source information,

wherein the means (26) is designed to display to prevent storage of the source information in digital form.

21. Device according to one of claims 17 to 19, in which the media information is a data rate-compressed version of source information which can be decoded by a decoder (64), ^wherein the device also has the following feature: an interface device (66) for interfacing a decoder (64), the interface device (66) being designed to check a connected decoder (64) for a security feature in order to carry out communication with the decoder (64) only when the decoder fulfills the security feature which consists in the decoder preventing output on decoded source information in digital form.

22. The device according to one of claims 17 to 21, further comprising the following features:

means (26) for displaying non-encrypted media information.

23. The device according to one of claims 17 to 22, further comprising the following features:

a local representation device for decrypting (24) local data (51c) which do not have any decrypting information as additional information, using a key (76) locally assigned to the device and for displaying (26) the decrypted local data.

24. A method for decrypting encrypted data which represent media information, the encrypted data having encrypted media information (46) and additional information (40, 42, 44) by means of which an identification (42) of a producer of the encrypted data and decryption (42, 44) of the encrypted media information can be carried out, with the following steps:

Extracting (22) a decryption key (42) from the encrypted data; Decrypting (24) the encrypted media information using the decryption key to obtain decrypted media information;

Playing (26) the media information.

25. Device for generating re-signed data from encrypted data which represent media information, the encrypted data having encrypted media information (46) and additional information (40, 42, 44) by means of which an identifier (42) of the encrypted data and an identifier Decryption (42, 44) of the encrypted media information can be carried out, with the following features:

means (32) for providing a re-signing operator identification of an operator of the device for generating re-signed data; and

a device (34) for adding the re-signing operator identification to encrypted media information which is derived from the media information by encryption in order to obtain the re-signed data (54b).

26. The apparatus of claim 25, wherein the additional information comprises decryption information (42), which also represent the identity of the generator, the apparatus further includes the following features ^¬:

means (35) for extracting the decisions ^¬ lung information from the encrypted data; means (36) for decrypting the encrypted data using the decrypting information; and

means (37) for encrypting the decrypted data using encryption information corresponding to or derived from the re-signing operator identification (32) to obtain the encrypted media information.

27. The apparatus according to claim 26,

in which the decryption information comprises a public key (42) of the producer and a symmetric key (44) encrypted with a private key of the producer, using which the media information is encrypted,

wherein the decrypting device (36) is designed to first decrypt the encrypted symmetric key (44) using the public key, and then to decrypt the encrypted media information (46) using the symmetric key, and

in which the device (37) is designed to encrypt first to encrypt the media information using a symmetrical key and then to use the symmetric key using a private key assigned to an operator of the device for generating re-signed data encrypt, with the Umsignierungs operator identifier is the public key (42) the operator of the apparatus for generating umsignierten data or derived from the same ^¬.

28. The device according to one of claims 25 to 27, further comprising:

means (80, 82) for embedding a watermark, the watermark corresponding to, or derived from, the resigning operator identification.

29. The apparatus of claim 28, wherein the means for embedding a watermark is designed to embed the watermark in the media information.

30. The apparatus of claim 27, wherein the media information is a data rate compressed version of source information, the means (80) for embedding a watermark being configured to embed the watermark in the source information before it is compressed.

31. The apparatus of claim 27, wherein the media information is a data rate compressed version of source information, the means (82) for embedding a watermark being configured to embed the watermark in a partially decoded version of the media information.

32. Device according to one of claims 28 to 31,

in which the device (80, 82) is designed for embedding a watermark in order to add the watermark, which is based on the resigning operator identification, to one or more watermarks, which are already embedded.

33. Device according to claim 32, in which the device is designed to embed a watermark in order to achieve a deterioration in the quality of the display of the media information with each additional watermark

34. Device according to one of claims 27 to 33,

in which the device is designed for embedding a watermark in order to embed the watermark using a watermark key.

35. The apparatus of claim 34, wherein the means for embedding a watermark is designed to randomly select the watermark key or to select from a set of different keys derived from the reassignment operator identification.

36. Device according to one of claims 25 to 35, further comprising the following features:

a free-keeping device (88) for enabling an output of the encrypted data only if the device (14) for providing has an externally assigned operator identification; and

a local archiving device (74) for encrypting media information with a local key (76) uniquely assigned to the device and for outputting local data (54c) which do not have the local key (76), so that the local data ( 54c) can only be decrypted by the device itself,

wherein said local archiving means is operable independently of an activation by the Freisehalteinrieh ^¬ tung (88).

37. Device according to one of claims 25 to 36, further comprising the following feature:

means (22) for extracting a decryption key (42) from the encrypted data;

means (26) for reproducing the media information.

38. Device according to one of claims 25 to 37,

in which a device for preventing output of plain text media information, plain text source information or data rate-compressed source information is also provided for the purpose of storage in digital form.

39. Device according to one of claims 25 to 38, further comprising the following features:

means (102) for encrypting the re-signed data for an exclusive operator such that only the exclusive operator is able to reproduce the media information.

40. Method for generating re-signed data from encrypted data which represent media information, the encrypted data having encrypted media information (46) and additional information (40, 42, 44) by means of which a producer (42) identifies the encrypted data and also a Decryption (42, 44) of the encrypted media formations can be carried out with the following steps:

Providing (32) a re-signing operator identification of an operator of the device for generating re-signed data; and

Adding (34) the re-signing operator identification to encrypted media information derived from the media information by encryption to obtain the re-signed data (54b).

41. Computer program with a program code for performing the method according to claim 16, claim 24 or claim 40, if the computer program runs on a computer.