EP1875378A1 - Method and apparatus for managing digital content - Google Patents

Method and apparatus for managing digital content

Info

Publication number
EP1875378A1
EP1875378A1 EP06757524A EP06757524A EP1875378A1 EP 1875378 A1 EP1875378 A1 EP 1875378A1 EP 06757524 A EP06757524 A EP 06757524A EP 06757524 A EP06757524 A EP 06757524A EP 1875378 A1 EP1875378 A1 EP 1875378A1
Authority
EP
European Patent Office
Prior art keywords
digital content
domain
key
decrypted
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP06757524A
Other languages
German (de)
French (fr)
Other versions
EP1875378A4 (en
Inventor
Myung-Sun Kim
Young-Sun Yoon
Sun-Nam Lee
Bong-Seon 903-411 Jugong 9-danji Apt. KIM
Jae-Heung Lee
Sung-Hyu 102-1006 Family 1-danji Apt. HAN
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Samsung Electronics Co Ltd
Original Assignee
Samsung Electronics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from KR1020050065669A external-priority patent/KR100708162B1/en
Priority claimed from KR1020050128708A external-priority patent/KR100739779B1/en
Application filed by Samsung Electronics Co Ltd filed Critical Samsung Electronics Co Ltd
Publication of EP1875378A1 publication Critical patent/EP1875378A1/en
Publication of EP1875378A4 publication Critical patent/EP1875378A4/en
Withdrawn legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/107—License processing; Key processing

Definitions

  • Methods and apparatuses consistent with the present invention relate to managing digital content, and more particularly, to managing digital content to prevent the digital content from being further leaked when an encryption key of the digital content is leaked.
  • FIG 1 is a view for illustrating a method of managing digital content in a general domain
  • a domain X includes a device A, a device B, and a device C as domain members
  • a domain managing apparatus manages these devices A, B, and C.
  • the domain managing ap paratus encrypts the digital content C using a specific encryption key K and transmits encrypted digital content E(K, C) to the devices A, B, and C according to the requests of the devices A, B, and C
  • the devices A, B, and C previously receive a domain key from the domain managing apparatus.
  • the encryption key K used for encrypting the digital content C can be decrypted only by the domain key.
  • the domain key is identical to the encryption key
  • the digital content C can be shared among the members of the domain X
  • the device cannot decrypt the received E(K, C) because the device does not have the domain key.
  • the present invention provides a method and apparatus for managing digital content, which can detect the leakage of an encryption key when the encryption key used for encrypting the digital content is leaked
  • FIG. 1 is a view for illustrating a method of managing digital content in a general domain
  • FIG 2 is a flowchart schematically illustrating a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention
  • FIG 3 is a flowchart illustrating in detail a method of managing digital contents in a domain managing apparatus according to an exemplary embodiment of the present invention
  • FIG 4 illustrates a configuration of a domain managing apparatus according to an exemplary embodiment of the present invention
  • FIG 5 is a flowchart illustrating an operation of a key leakage detecting module according to an exemplary embodiment of the present invention
  • FIG. 6 is a flowchart illustrating a process of detecting that a digital content encryption key has been leaked, according to an exemplary embodiment of the present invention
  • FIG. 7 is a flowchart illustrating a method of managing digital content according to another exemplary embodiment of the present invention.
  • FIG. 8 illustrates a configuration of a digital content managing apparatus according to another exemplary embodiment of the present invention.
  • a method of managing digital content including: determining whether encrypted digital content, which can be decrypted by a first domain key shared by devices which are members of a domain, has been decrypted by a device which is not a member of the domain; generating a second domain key if it is determined that the encrypted digital content has been decrypted by a device which is not a member of the domain; and providing the second domain key to the members of the domain.
  • a method of managing digital content shared in a domain including encrypting the digital content such that the digital content is decrypted only by a domain key shared by members of the domain; generating a module which determines whether the encrypted digital content has been decrypted by a device which is not a member of the domain and notifies the domain of the determined result; and linking the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
  • the method may further include generating another domain key when the module notifies that the encrypted digital content has been decrypted by a device which is not a member of the domain; and notifying the members of the domain of the generated domain key
  • a computer- readable medium having embodied thereon a computer program for performing the method of managing the digital content.
  • an apparatus for managing digital content shared in a domain including an encryption unit which encrypts the digital content such that the digital content is decrypted only by a domain key shared by members of the domain; a module generating unit which generates a module for determining whether the encrypted digital content has been decrypted by a device which is not a member of the domain and notifying the domain of the determined result; and a link unit which links the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
  • the apparatus may further include a domain key generating unit which generates another domain key when the module notifies that the encrypted digital content has been decrypted by a device which is not a member of the domain, and a notification unit which notifies the members of the domain of the generated domain key.
  • a method of managing digital content in a first device including encrypting the digital content using an encryption key corresponding to a unique decryption key of the first device; generating a module which determines whether the encrypted digital content has been decrypted by a second device and notifies the first device of the determined result; and linking the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
  • a computer- readable medium having embodied thereon a computer program for performing the method of managing the digital content.
  • an apparatus for managing digital content including an encryption unit which encrypts the digital content using an encryption key corresponding to a unique decryption key of a first device; a module generating unit which generates a module for determining whether the encrypted digital content has been decrypted by a second device and notifying the first device of the determined result, and a link unit which links the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted
  • a computer- readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a domain key shared by members of a domain, the method including recognizing that the encrypted digital content is decrypted, determining whether a device, which decrypts the encrypted digital content, is a member of the domain using a predetermined characteristic value of using a predetermined characteristic value of the device; and notifying the domain that the domain key has been externally leaked, based on the determined result.
  • a computer- readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a unique decryption key of a first device, the method including recognizing that the encrypted digital content is decrypted; determining whether a second device, which decrypts the encrypted digital content, corresponds to the first device using a predetermined characteristic value of each of the first and second devices; and notifying the first device that the domain key has been externally leaked, based on the determined result.
  • FIG. 2 is a flowchart schematically illustrating a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention.
  • the domain managing apparatus when digital content is input to a domain, the domain managing apparatus according to the present exemplary embodiment encrypts the digital content using a domain key (operation 210).
  • the domain key is a symmetric key.
  • devices registered m the domain and having the domain key can decrypt the encrypted content.
  • the key leakage detecting module detects whether a device which decrypts the digital content is a member of the domain and notifies the domain managing apparatus of the detected result such that the domain managing apparatus can change the domain key if the domain key is leaked.
  • the key leakage detecting module will be described later.
  • the domain managing apparatus stores information linking the key leakage detecting module to the encrypted digital content (operation 230) such that the key leakage detecting module is automatically driven to determine whether a device which decrypts the digital content is a member of the domain when the encrypted digital content is decrypted.
  • FIG. 3 is a flowchart illustrating in detail a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention.
  • the domain managing apparatus encrypts digital content C using an encryption key
  • DAV which can be decrypted only by a domain key (operation 310).
  • key leakage detecting data a and a key leakage detecting program b are generated (operation 320) and packaged to generate a key leakage detecting module y (operation 330).
  • the key leakage detecting data a includes information on the members of the domain and used for determining whether devices are members of the domain.
  • the key leakage detecting program b extracts a characteristic value d from a device which decrypts the digital content and determines whether the device is a member of the domain based on the key leakage detecting data a and the characteristic value d .
  • the key leakage detecting data a and the characteristic value d are not limited to specific data.
  • the key leakage detecting data a may be a set of public keys of devices registered in the domain and the characteristic value d may be a public key of a device which decrypts the content
  • the key leakage detecting program b determines whether the characteristic value d is included in the key leakage detecting data a .
  • the domain managing apparatus links the encrypted content x with the key leakage detecting module y (operation 340).
  • the encrypted content x is linked with the key leakage detecting module y in order to automatically drive the key leakage detecting module when the encrypted digital content is decrypted.
  • the encrypted content x and the key leakage detecting module y are then packaged to generate g (operation 350) which is then distributed to the members of the domain (operation 360).
  • g is generated by packaging the encrypted content x and the key leakage detecting module y and g is distributed to the domain
  • the encrypted content x does not necessarily need to be packaged and distributed with the key leakage detecting module y. Since the encrypted content x is already linked with the key leakage detecting module y, only the encrypted content x may be distributed without the key leakage detecting module y since the key leakage detecting module y is driven when the digital content is decrypted.
  • FIG 4 illustrates a configuration of a domain managing apparatus 400 according to an exemplary embodiment of the present invention.
  • the domain managing apparatus 400 includes a transmission/reception unit 410, an encryption unit 420, a module generating unit 430, an information generating unit 440, an information updating unit 450, a database 460, a link unit 470, a domain key generating unit 480, and a notification unit 490
  • the transmission/reception unit 410 is a communication interface for allowing the domain managing apparatus 400 to transmit data to and receive data from an external device.
  • the encryption unit 420 encrypts digital content using an encryption key corresponding to a domain key, when the digital content is received from the external device through the transmission/reception unit 410.
  • the module generating unit 430 generates a key leakage detecting module of the received digital content
  • the information generating unit 440 generates key leakage detecting data a which is information on devices registered in the domain, stores the key leakage detecting data a in the database 460, and provides the key leakage detecting data a to the module generating unit 430 for generating the key leakage detecting module.
  • the information updating unit 450 updates the key leakage detecting data a when one of the members of the domain is changed, that is, when a device is newly registered in the domain or a registered device is deleted from the domain.
  • the link unit 470 links the encrypted digital content with the key leakage detecting module, packages the encrypted digital content and the key leakage detecting module, and distributes the encrypted digital content and the key leakage detecting module to the members of the domain through the transmission/reception unit 410.
  • the key leakage detecting module of the distributed digital content When the key leakage detecting module of the distributed digital content operates and detects that the digital content is decrypted by a device which is not a valid member of the domain, the key leakage detecting module notifies the domain managing apparatus 400 that the encryption key has been leaked. In response, the domain key generating unit 480 discards the existing domain key and generates a new domain key, and the notification unit 490 notifies the members of the domain of the new domain key through the transmission/reception unit 410. In this case, the encryption unit 420 encrypts digital content which will be received later using an encryption key corresponding to the new domain key.
  • FIG. 5 is a flowchart illustrating an operation of a key leakage detecting module y according to an exemplary embodiment of the present invention
  • the key leakage detecting module y includes a key leakage detecting program b and key leakage detecting data a .
  • the key leakage detecting program b detects that linked digital content is decrypted (operation 510) and extracts a characteristic value d from a device which decrypts the digital content (operation 520)
  • the domain managing apparatus is notified that the encryption key is leaked (operation 550) Since the key leakage detecting module performs the above process, the domain managing apparatus 400 can be notified that the encryption key is leaked.
  • FIG. 6 is a flowchart illustrating a process of detecting that an encryption key DAV of digital content C has been leaked, according to an exemplary embodiment of the present invention.
  • a domain managing apparatus When the digital content C is input to a domain (operation 610), a domain managing apparatus generates data x obtained by encrypting the digital content C using the encryption key DAV corresponding to a domain key (operation 615). In response to a request of a device A registered in the domain, the domain managing apparatus transmits the data x to the device A (operation 620), and the device A then transmits the data x to a device B through any path (operation 630). Here, it is assumed that a device B is not registered in the same domain as that of the device A.
  • the device B must follow compliance rules of the DRM system in order to decrypt the digital content C. That is, if the device B has a DRM module in it, the device B has to check the module when it decrypts content. On the other hand, if there is no module in it, the device B will ask the domain managing apparatus according to the compliance rule
  • the key leakage module operates by using link information generated when the key leakage detecting module is linked with the data x (operations 640 and 645).
  • a key leakage detecting program b which detects that the digital content C has been decrypted, extracts a characteristic value d of the device B (operations 650 and 655), and determines whether the device B is a valid member of the domain using the key leakage detecting data a and the characteristic value d (operation 660). If it is determined that the device B is not a valid member of the domain (operation 670), the key leakage detecting program b notifies the domain managing apparatus of the determined result.
  • the domain managing apparatus which knows that the digital content C is decrypted by a device which is not a valid member of the domain, updates the domain key (operation 675) and notifies the device A of the updated domain key (operation 680). Accordingly, the domain managing apparatus encrypts digital content which will be distributed to the domain later using an encryption key corresponding to the updated domain key.
  • FIG. 7 is a flowchart illustrating a method of managing digital content according to another exemplary embodiment of the present invention.
  • a general digital content managing apparatus manages digital content which must not be decrypted by another device regardless of a domain.
  • the digital content managing apparatus encrypts digital content using a device key
  • the device key is a unique encryption key of an encryption device and is used for encrypting the digital content such that only the encryption device can decrypt the digital content.
  • the device key is a public key of the device.
  • the device key may be a symmetric key.
  • the key leakage detecting module includes key leakage detecting data and a key leakage detecting program, extracts a characteristic value of a device for decryption the encrypted content, and determines whether the device is an authorized device, i.e., a member of the domain.
  • the characteristic value of the device is not specified and may be, for example, a public key of the device.
  • the digital content managing apparatus has link information on the encrypted digital content (operation 730) such that the module is automatically driven to determine whether a device which decrypts the content is a member of the domain when the encrypted digital content is decrypted.
  • FIG. 8 illustrates a configuration of a digital content managing apparatus 800 according to another exemplary embodiment of the present invention.
  • the digital content managing apparatus 800 is an individual device which does not belong to a domain
  • the digital content managing apparatus 800 includes a transmission/reception unit 810, an encryption unit 820, a module generating unit 830, a key changing unit 840, and a link unit 850.
  • the transmission/reception unit 810 is a communication interface through which the digital content managing apparatus 800 transmits data to and receives data from an external device.
  • the encryption unit 820 encrypts digital content using a device key when the digital content is received from the external device through the transmission/ reception unit 810.
  • the module generating unit 830 generates a key leakage detecting module of the received digital content, and the link unit 850 links the encrypted digital content with the key leakage detecting module.
  • the key changing unit 840 discards the existing device key and generates a new device key.
  • the encryption unit 820 can encrypt digital content to be received later using the new device key.
  • the exemplary embodiments of the present invention can be written as computer programs and can be implemented in general-use digital computers that execute the programs using a computer readable recording medium.
  • Examples of the computer readable recording medium include magnetic storage media (e.g., ROM, floppy disks, hard disks, etc ), optical recording media (e g , CD-ROMs, or DVDs), and storage media such as carrier waves (e.g., transmission through the Internet).

Abstract

A method and apparatus for managing digital content, which can detect the leakage of an encryption key when the encryption key used for encrypting the digital content is leaked or cracked. When the encrypted digital content is decrypted by an illegal device, a module linked with the encrypted digital content is automatically driven and a digital content managing apparatus is then notified that the encrypted digital content has been decrypted by the illegal device such that the digital content managing apparatus can change the encryption key. Thus, it is possible to prevent the digital content from being continuously leaked due to the use of the same encryption key for encrypting subsequent digital content.

Description

Description METHOD AND APPARATUS FOR MANAGING DIGITAL
CONTENT
Technical Field
[1] Methods and apparatuses consistent with the present invention relate to managing digital content, and more particularly, to managing digital content to prevent the digital content from being further leaked when an encryption key of the digital content is leaked.
Background Art
[2] Recently, transmission of digital content using various communication media such as the Internet, ground waves, cables, and satellites has rapidly increased, and the sale and lending of the digital content using mass recording media such as compact discs and digital versatile discs (DVDs) has also rapidly increased. Accordingly, digital rights management, which is a means for protecting copyright of digital content has been spotlighted. In particular, research into allowing a legal user of a home domain to freely receive various content services using devices belonging to the home domain is actively ongoing These devices such as digital televisions or personal digital assistants (PDAs) belonging to the same domain share their content with the other devices
[3] However, in order to ideally protect the content, only devices which are registered in the domain, can use the content in the domain, and devices which are not registered in the domain cannot use the content in the domain Accordingly, the devices which are registered in the domain share a domain key. Hereinafter, this domain key will be described in detail.
[4] FIG 1 is a view for illustrating a method of managing digital content in a general domain As illustrated in FIG 1, a domain X includes a device A, a device B, and a device C as domain members A domain managing apparatus manages these devices A, B, and C. When digital content C is input to the domain X, the domain managing ap paratus encrypts the digital content C using a specific encryption key K and transmits encrypted digital content E(K, C) to the devices A, B, and C according to the requests of the devices A, B, and C
[5] Meanwhile, the devices A, B, and C previously receive a domain key from the domain managing apparatus. The encryption key K used for encrypting the digital content C can be decrypted only by the domain key. In a symmetric key, the domain key is identical to the encryption key Thus, the digital content C can be shared among the members of the domain X In other words, although a device which is not registered in the domain X, can receive the encrypted digital content E(K, C), the device cannot decrypt the received E(K, C) because the device does not have the domain key.
[6] However, when the domain key is leaked and the domain managing apparatus does not detect the leakage of the domain key, the digital content input to the domain may be leaked In other words, when the domain key is leaked or cracked to decrypt the encrypted digital content E(K, C) and the domain managing apparatus does not detect the leakage of the domain key, the digital content, which will be input to the domain X later, may be encrypted using the domain key, and the encrypted digital content E(K, C) may be then decrypted. Thus, the digital content, which must be shared in only the domain, cannot be protected In addition, this problem may be caused even when digital content used only in a specific device is encrypted using a unique encryption key of the device Disclosure of Invention
Technical Solution
[7] The present invention provides a method and apparatus for managing digital content, which can detect the leakage of an encryption key when the encryption key used for encrypting the digital content is leaked
Advantageous Effects
[8] According to the present invention, when an encryption key used for encrypting digital content is leaked or cracked, a digital content managing apparatus for encrypting the digital content is automatically notified that the encryption key is leaked to allow the encryption key to be changed Thus, it is possible to prevent the digital content from being continuously leaked due to the use of the same encryption key for encrypting subsequent digital content.
Description of Drawing
[9] FIG. 1 is a view for illustrating a method of managing digital content in a general domain,
[10] FIG 2 is a flowchart schematically illustrating a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention,
[11] FIG 3 is a flowchart illustrating in detail a method of managing digital contents in a domain managing apparatus according to an exemplary embodiment of the present invention,
[12] FIG 4 illustrates a configuration of a domain managing apparatus according to an exemplary embodiment of the present invention,
[13] FIG 5 is a flowchart illustrating an operation of a key leakage detecting module according to an exemplary embodiment of the present invention, [14] FIG. 6 is a flowchart illustrating a process of detecting that a digital content encryption key has been leaked, according to an exemplary embodiment of the present invention;
[15] FIG. 7 is a flowchart illustrating a method of managing digital content according to another exemplary embodiment of the present invention; and
[16] FIG. 8 illustrates a configuration of a digital content managing apparatus according to another exemplary embodiment of the present invention.
Best Mode
[17] According to an aspect of the present invention, there is provided a method of managing digital content, the method including: determining whether encrypted digital content, which can be decrypted by a first domain key shared by devices which are members of a domain, has been decrypted by a device which is not a member of the domain; generating a second domain key if it is determined that the encrypted digital content has been decrypted by a device which is not a member of the domain; and providing the second domain key to the members of the domain.
[18] According to another aspect of the present invention, there is provided a method of managing digital content shared in a domain, including encrypting the digital content such that the digital content is decrypted only by a domain key shared by members of the domain; generating a module which determines whether the encrypted digital content has been decrypted by a device which is not a member of the domain and notifies the domain of the determined result; and linking the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
[19] Here, the method may further include generating another domain key when the module notifies that the encrypted digital content has been decrypted by a device which is not a member of the domain; and notifying the members of the domain of the generated domain key
[20] According to another aspect of the present invention, there is provided a computer- readable medium having embodied thereon a computer program for performing the method of managing the digital content.
[21] According to another aspect of the present invention, there is provided an apparatus for managing digital content shared in a domain, including an encryption unit which encrypts the digital content such that the digital content is decrypted only by a domain key shared by members of the domain; a module generating unit which generates a module for determining whether the encrypted digital content has been decrypted by a device which is not a member of the domain and notifying the domain of the determined result; and a link unit which links the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
[22] Here, the apparatus may further include a domain key generating unit which generates another domain key when the module notifies that the encrypted digital content has been decrypted by a device which is not a member of the domain, and a notification unit which notifies the members of the domain of the generated domain key.
[23] According to another aspect of the present invention, there is provided a method of managing digital content in a first device, including encrypting the digital content using an encryption key corresponding to a unique decryption key of the first device; generating a module which determines whether the encrypted digital content has been decrypted by a second device and notifies the first device of the determined result; and linking the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted.
[24] According to another aspect of the present invention, there is provided a computer- readable medium having embodied thereon a computer program for performing the method of managing the digital content.
[25] According to another aspect of the present invention, there is provided an apparatus for managing digital content, including an encryption unit which encrypts the digital content using an encryption key corresponding to a unique decryption key of a first device; a module generating unit which generates a module for determining whether the encrypted digital content has been decrypted by a second device and notifying the first device of the determined result, and a link unit which links the encrypted digital content with the module such that the module is automatically driven when the encrypted digital content is decrypted
[26] According to another aspect of the present invention, there is provided a computer- readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a domain key shared by members of a domain, the method including recognizing that the encrypted digital content is decrypted, determining whether a device, which decrypts the encrypted digital content, is a member of the domain using a predetermined characteristic value of using a predetermined characteristic value of the device; and notifying the domain that the domain key has been externally leaked, based on the determined result.
[27] According to another aspect of the present invention, there is provided a computer- readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a unique decryption key of a first device, the method including recognizing that the encrypted digital content is decrypted; determining whether a second device, which decrypts the encrypted digital content, corresponds to the first device using a predetermined characteristic value of each of the first and second devices; and notifying the first device that the domain key has been externally leaked, based on the determined result.
Mode for Invention
[28] FIG. 2 is a flowchart schematically illustrating a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention.
[29] First, when digital content is input to a domain, the domain managing apparatus according to the present exemplary embodiment encrypts the digital content using a domain key (operation 210). In the present exemplary embodiment, it is assumed that the domain key is a symmetric key. Thus, devices registered m the domain and having the domain key can decrypt the encrypted content.
[30] After encrypting the digital content, a key leakage detecting module is generated
(operation 220). When the digital content encrypted in operation 210 is decrypted, the key leakage detecting module detects whether a device which decrypts the digital content is a member of the domain and notifies the domain managing apparatus of the detected result such that the domain managing apparatus can change the domain key if the domain key is leaked. The key leakage detecting module will be described later.
[31] When the key leakage detecting module is generated, the domain managing apparatus stores information linking the key leakage detecting module to the encrypted digital content (operation 230) such that the key leakage detecting module is automatically driven to determine whether a device which decrypts the digital content is a member of the domain when the encrypted digital content is decrypted.
[32] FIG. 3 is a flowchart illustrating in detail a method of managing digital content in a domain managing apparatus according to an exemplary embodiment of the present invention.
[33] The domain managing apparatus encrypts digital content C using an encryption key
DAV which can be decrypted only by a domain key (operation 310). After the digital content is encrypted C, key leakage detecting data a and a key leakage detecting program b are generated (operation 320) and packaged to generate a key leakage detecting module y (operation 330). The key leakage detecting data a includes information on the members of the domain and used for determining whether devices are members of the domain. When the encrypted digital content is decrypted, the key leakage detecting program b extracts a characteristic value d from a device which decrypts the digital content and determines whether the device is a member of the domain based on the key leakage detecting data a and the characteristic value d . Here, the key leakage detecting data a and the characteristic value d are not limited to specific data. For example, the key leakage detecting data a may be a set of public keys of devices registered in the domain and the characteristic value d may be a public key of a device which decrypts the content In this case, the key leakage detecting program b determines whether the characteristic value d is included in the key leakage detecting data a .
[34] Next, the domain managing apparatus links the encrypted content x with the key leakage detecting module y (operation 340). The encrypted content x is linked with the key leakage detecting module y in order to automatically drive the key leakage detecting module when the encrypted digital content is decrypted. The encrypted content x and the key leakage detecting module y are then packaged to generate g (operation 350) which is then distributed to the members of the domain (operation 360).
[35] Although, in the present exemplary embodiment, g is generated by packaging the encrypted content x and the key leakage detecting module y and g is distributed to the domain, the encrypted content x does not necessarily need to be packaged and distributed with the key leakage detecting module y. Since the encrypted content x is already linked with the key leakage detecting module y, only the encrypted content x may be distributed without the key leakage detecting module y since the key leakage detecting module y is driven when the digital content is decrypted.
[36] FIG 4 illustrates a configuration of a domain managing apparatus 400 according to an exemplary embodiment of the present invention.
[37] As illustrated in FIG. 4, the domain managing apparatus 400 according to the present exemplary embodiment includes a transmission/reception unit 410, an encryption unit 420, a module generating unit 430, an information generating unit 440, an information updating unit 450, a database 460, a link unit 470, a domain key generating unit 480, and a notification unit 490
[38] The transmission/reception unit 410 is a communication interface for allowing the domain managing apparatus 400 to transmit data to and receive data from an external device. The encryption unit 420 encrypts digital content using an encryption key corresponding to a domain key, when the digital content is received from the external device through the transmission/reception unit 410. The module generating unit 430 generates a key leakage detecting module of the received digital content The information generating unit 440 generates key leakage detecting data a which is information on devices registered in the domain, stores the key leakage detecting data a in the database 460, and provides the key leakage detecting data a to the module generating unit 430 for generating the key leakage detecting module. The information updating unit 450 updates the key leakage detecting data a when one of the members of the domain is changed, that is, when a device is newly registered in the domain or a registered device is deleted from the domain.
[39] The link unit 470 links the encrypted digital content with the key leakage detecting module, packages the encrypted digital content and the key leakage detecting module, and distributes the encrypted digital content and the key leakage detecting module to the members of the domain through the transmission/reception unit 410.
[40] When the key leakage detecting module of the distributed digital content operates and detects that the digital content is decrypted by a device which is not a valid member of the domain, the key leakage detecting module notifies the domain managing apparatus 400 that the encryption key has been leaked. In response, the domain key generating unit 480 discards the existing domain key and generates a new domain key, and the notification unit 490 notifies the members of the domain of the new domain key through the transmission/reception unit 410. In this case, the encryption unit 420 encrypts digital content which will be received later using an encryption key corresponding to the new domain key.
[41] FIG. 5 is a flowchart illustrating an operation of a key leakage detecting module y according to an exemplary embodiment of the present invention The key leakage detecting module y includes a key leakage detecting program b and key leakage detecting data a . The key leakage detecting program b detects that linked digital content is decrypted (operation 510) and extracts a characteristic value d from a device which decrypts the digital content (operation 520) In addition, it is determined whether the device is a member of the domain (operation 540) using the key leakage detecting data a and the characteristic value d of the device as input values (operation 530). If it is determined that the device is a member of the domain, the domain managing apparatus is notified that the encryption key is leaked (operation 550) Since the key leakage detecting module performs the above process, the domain managing apparatus 400 can be notified that the encryption key is leaked.
[42] FIG. 6 is a flowchart illustrating a process of detecting that an encryption key DAV of digital content C has been leaked, according to an exemplary embodiment of the present invention.
[43] When the digital content C is input to a domain (operation 610), a domain managing apparatus generates data x obtained by encrypting the digital content C using the encryption key DAV corresponding to a domain key (operation 615). In response to a request of a device A registered in the domain, the domain managing apparatus transmits the data x to the device A (operation 620), and the device A then transmits the data x to a device B through any path (operation 630). Here, it is assumed that a device B is not registered in the same domain as that of the device A.
[44] The device B must follow compliance rules of the DRM system in order to decrypt the digital content C. That is, if the device B has a DRM module in it, the device B has to check the module when it decrypts content. On the other hand, if there is no module in it, the device B will ask the domain managing apparatus according to the compliance rule When the device B decrypts digital content C using a decryption key k (operation 635), the key leakage module operates by using link information generated when the key leakage detecting module is linked with the data x (operations 640 and 645). A key leakage detecting program b , which detects that the digital content C has been decrypted, extracts a characteristic value d of the device B (operations 650 and 655), and determines whether the device B is a valid member of the domain using the key leakage detecting data a and the characteristic value d (operation 660). If it is determined that the device B is not a valid member of the domain (operation 670), the key leakage detecting program b notifies the domain managing apparatus of the determined result. The domain managing apparatus, which knows that the digital content C is decrypted by a device which is not a valid member of the domain, updates the domain key (operation 675) and notifies the device A of the updated domain key (operation 680). Accordingly, the domain managing apparatus encrypts digital content which will be distributed to the domain later using an encryption key corresponding to the updated domain key.
[45] FIG. 7 is a flowchart illustrating a method of managing digital content according to another exemplary embodiment of the present invention. In the present exemplary embodiment, it is assumed that a general digital content managing apparatus manages digital content which must not be decrypted by another device regardless of a domain.
[46] The digital content managing apparatus encrypts digital content using a device key
(operation 710). Here, the device key is a unique encryption key of an encryption device and is used for encrypting the digital content such that only the encryption device can decrypt the digital content. In a public key infrastructure, since a device has its own private key, the device key is a public key of the device. Alternatively, the device key may be a symmetric key.
[47] When the encryption is finished, a key leakage detecting module is generated
(operation 720). Here, the key leakage detecting module includes key leakage detecting data and a key leakage detecting program, extracts a characteristic value of a device for decryption the encrypted content, and determines whether the device is an authorized device, i.e., a member of the domain. Here, the characteristic value of the device is not specified and may be, for example, a public key of the device.
[48] When the key leakage detecting module is generated, the digital content managing apparatus has link information on the encrypted digital content (operation 730) such that the module is automatically driven to determine whether a device which decrypts the content is a member of the domain when the encrypted digital content is decrypted.
[49] FIG. 8 illustrates a configuration of a digital content managing apparatus 800 according to another exemplary embodiment of the present invention. In the present exemplary embodiment, it is assumed that the digital content managing apparatus 800 is an individual device which does not belong to a domain
[50] As illustrated in FIG. 8, the digital content managing apparatus 800 according to the present exemplary embodiment includes a transmission/reception unit 810, an encryption unit 820, a module generating unit 830, a key changing unit 840, and a link unit 850.
[51] The transmission/reception unit 810 is a communication interface through which the digital content managing apparatus 800 transmits data to and receives data from an external device. The encryption unit 820 encrypts digital content using a device key when the digital content is received from the external device through the transmission/ reception unit 810. The module generating unit 830 generates a key leakage detecting module of the received digital content, and the link unit 850 links the encrypted digital content with the key leakage detecting module.
[52] When the encrypted digital content is externally transmitted and the key leakage detecting module then operates such that it is notified that the encryption key is leaked, the key changing unit 840 discards the existing device key and generates a new device key. Thus, the encryption unit 820 can encrypt digital content to be received later using the new device key.
[53] The exemplary embodiments of the present invention can be written as computer programs and can be implemented in general-use digital computers that execute the programs using a computer readable recording medium. Examples of the computer readable recording medium include magnetic storage media (e.g., ROM, floppy disks, hard disks, etc ), optical recording media (e g , CD-ROMs, or DVDs), and storage media such as carrier waves (e.g., transmission through the Internet).
[54] According to the present invention, when an encryption key used for encrypting digital content is leaked or cracked, a digital content managing apparatus for encrypting the digital content is automatically notified that the encryption key is leaked to allow the encryption key to be changed. Thus, it is possible to prevent the digital content from being continuously leaked due to the use of the same encryption key for encrypting subsequent digital content.
[55] While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.

Claims

Claims
[ 1 ] 1. A method of managing digital content, the method comprising: determining whether encrypted digital content, which can be decrypted by a first domain key shared by devices which are members of a domain, has been decrypted by a device which is not a member of the domain, generating a second domain key if it is determined that the encrypted digital content has been decrypted by a device which is not a member of the domain and notifying the members of the domain the second domain key.
[2] 2. The method of claim 1 , wherein each of the first and second domain keys is a symmetric key
[3] 3 The method of claim 1, further comprising generating a module which is operable to determine whether the encrypted digital content has been decrypted by a device which is not a member of the domain, and linking the encrypted digital content with the module such that the module is driven if the encrypted digital content is decrypted, wherein the determining whether encrypted digital content has been decrypted by a device which is not a member of the domain is performed by the module
[4] 4. The method of claim 3, wherein the module determines whether the encrypted digital content has been decrypted by a device which is not a member of the domain with reference to information on the members of the domain.
[5] 5. The method of claim 4, wherein the information comprises public keys of the members of the domain, and the module compares the information with a public key of the device which decrypted the encrypted digital content
[6] 6 The method of claim 4, further comprising updating the information if one of the members of the domain is changes
[7] 7 A computer-readable medium having embodied thereon a computer program for performing a method of managing digital content, the method comprising determining whether encrypted digital content, which can be decrypted by a first domain key shared by devices which are members of a domain, has been decrypted by a device which is not a member of the domain, generating a second domain key if it is determined that the encrypted digital content has been decrypted by a device which is not a member of the domain, and providing the second domain key to the members of the domain
[8] 8. An apparatus for managing digital content, the apparatus comprising an encryption unit which encrypts digital content such that the encrypted digital content can be decrypted only by a first domain key which is shared by devices which are members of a domain; a domain key generating unit which generates a second domain key if it is notified that the encrypted digital content has been decrypted by a device which is not a member of the domain; and a notification unit which notifies the members of the domain of the second domain key.
[9] 9. The apparatus of claim 8, wherein each of the first and second domain keys is a symmetric key.
[10] 10. The apparatus of claim 8, further comprising: a module generating unit which generates a module which determines whether the encrypted digital content has been decrypted by a device which is not a member of the domain; and a link unit which links the encrypted digital content with the module such that the module is driven if the encrypted digital content is decrypted.
[11] 11 The apparatus of claim 10, further comprising an information generating unit which generates information on the members of the domain, wherein the module determines whether the encrypted digital content is decrypted by a device which is not a member of the domain with reference to the information.
[12] 12. The apparatus of claim 11, wherein the information comprises public keys of the members of the domain, and the module compares the information with a public key of the device which decrypted the encrypted digital content
[13] 13. The apparatus of claim 11, further comprising an information updating unit which updates the information if one of the members of the domain changes
[14] 14. A method of managing digital content, the method comprising: encrypting digital content at a first device, using an encryption key corresponding to a decryption key of the first device, generating a module which determines whether the encrypted digital content has been decrypted by a second device and notifies the first device of a determined result; and linking, at the first device, the encrypted digital content with the module such that the module is driven if the encrypted digital content is decrypted.
[15] 15. The method of claim 14, further comprising: changing a value of the encryption key if the module determines that the encrypted digital content has been decrypted by the second device.
[16] 16 The method of claim 14, wherein the module determines whether the encrypted digital content has been decrypted by the second device with reference to a predetermined characteristic value of the first device.
[17] 17 The method of claim 16, wherein the characteristic value is a public key of the first device, and the module compares the public key of the second device with the characteristic value.
[18] 18. A computer-readable medium having embodied thereon a computer program for performing a method of managing digital content, the method comprising' encrypting digital content at a first device, using an encryption key corresponding to a decryption key of the first device; generating a module which determines whether the encrypted digital content has been decrypted by a second device and notifies the first device of a determined result, and linking, at the first device, the encrypted digital content with the module such that the module is driven if the encrypted digital content is decrypted .
[19] 19. An apparatus for managing digital content, the apparatus comprising: an encryption unit which encrypts digital content using an encryption key corresponding to a unique decryption key of a first device; a module generating unit which generates a module which determines whether the encrypted digital content has been decrypted by a second device and notifies the first device of a determined result, and a link unit which links the encrypted digital content with the module such that the module is driven if the encrypted digital content is decrypted.
[20] 20. The apparatus of claim 19, further comprising: a key changing unit which changes a value of the encryption key if the module notifies the first device that the encrypted digital content has been decrypted by the second device.
[21] 21. The apparatus of claim 19, wherein the module determines whether the encrypted digital content has been decrypted by the second device with reference to a predetermined characteristic value of the first device.
[22] 22. The apparatus of claim 21, wherein the characteristic value is a public key of the first device, and the module compares the public key of the second device with the characteristic value.
[23] 23. A computer-readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a domain key shared by devices which are members of a domain, the method comprising, detecting that the encrypted digital content is decrypted, determining whether a device, which decrypts the encrypted digital content, is a member of the domain using a predetermined characteristic value; and notifying that the domain key has been externally leaked, based on a result of the determining
[24] 24. A computer-readable medium having embodied thereon a computer program for performing a method of managing digital content encrypted using an encryption key corresponding to a unique decryption key of a first device, the method comprising: detecting that the encrypted digital content is decrypted, determining whether a second device, which decrypts the encrypted digital content, corresponds to the first device using a predetermined characteristic value of each of the first and second devices; and notifying the first device that the domain key has been externally leaked, based on a result of the determining.
EP06757524.1A 2005-04-25 2006-04-25 Method and apparatus for managing digital content Withdrawn EP1875378A4 (en)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US67433305P 2005-04-25 2005-04-25
KR1020050065669A KR100708162B1 (en) 2005-04-25 2005-07-20 Method for managing a domain and apparatus therefor
US73943905P 2005-11-25 2005-11-25
KR1020050128708A KR100739779B1 (en) 2005-12-23 2005-12-23 Method and apparatus for managing digital content
PCT/KR2006/001546 WO2006115364A1 (en) 2005-04-25 2006-04-25 Method and apparatus for managing digital content

Publications (2)

Publication Number Publication Date
EP1875378A1 true EP1875378A1 (en) 2008-01-09
EP1875378A4 EP1875378A4 (en) 2014-12-10

Family

ID=37214965

Family Applications (1)

Application Number Title Priority Date Filing Date
EP06757524.1A Withdrawn EP1875378A4 (en) 2005-04-25 2006-04-25 Method and apparatus for managing digital content

Country Status (2)

Country Link
EP (1) EP1875378A4 (en)
WO (1) WO2006115364A1 (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5825883A (en) * 1995-10-31 1998-10-20 Interval Systems, Inc. Method and apparatus that accounts for usage of digital applications
US20030056093A1 (en) * 2001-09-19 2003-03-20 Microsoft Corporation Peer-to-peer name resolution protocol (PNRP) group security infrastructure and method
US20040103312A1 (en) * 2002-11-27 2004-05-27 Thomas Messerges Domain-based digital-rights management system with easy and secure device enrollment
WO2004077301A1 (en) * 2003-02-28 2004-09-10 Matsushita Electric Industrial Co., Ltd. Terminal device, server device, license distribution system using the same
WO2004084050A1 (en) * 2003-03-21 2004-09-30 Koninklijke Philips Electronics N.V. User identity privacy in authorization certificates

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4709468B2 (en) * 2000-06-02 2011-06-22 パナソニック株式会社 Recording medium, license management device, recording / reproducing device
US20020157002A1 (en) * 2001-04-18 2002-10-24 Messerges Thomas S. System and method for secure and convenient management of digital electronic content
CA2502605A1 (en) * 2003-02-07 2004-08-19 Matsushita Electric Industrial Co., Ltd. Terminal device and data protection system using the same
KR20050007830A (en) * 2003-07-11 2005-01-21 삼성전자주식회사 Method for Domain Authentication for exchanging contents between devices

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5825883A (en) * 1995-10-31 1998-10-20 Interval Systems, Inc. Method and apparatus that accounts for usage of digital applications
US20030056093A1 (en) * 2001-09-19 2003-03-20 Microsoft Corporation Peer-to-peer name resolution protocol (PNRP) group security infrastructure and method
US20040103312A1 (en) * 2002-11-27 2004-05-27 Thomas Messerges Domain-based digital-rights management system with easy and secure device enrollment
WO2004077301A1 (en) * 2003-02-28 2004-09-10 Matsushita Electric Industrial Co., Ltd. Terminal device, server device, license distribution system using the same
WO2004084050A1 (en) * 2003-03-21 2004-09-30 Koninklijke Philips Electronics N.V. User identity privacy in authorization certificates

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of WO2006115364A1 *

Also Published As

Publication number Publication date
EP1875378A4 (en) 2014-12-10
WO2006115364A1 (en) 2006-11-02

Similar Documents

Publication Publication Date Title
US8161296B2 (en) Method and apparatus for managing digital content
CN100550005C (en) The method and apparatus of managing digital content
KR100749867B1 (en) System and method for securely installing a cryptographic system on a secure device
US8639928B2 (en) System and method for mounting encrypted data based on availability of a key on a network
EP1985057B1 (en) Method of transferring digital rights
US20080209231A1 (en) Contents Encryption Method, System and Method for Providing Contents Through Network Using the Encryption Method
US20070169203A1 (en) Method and apparatus for transmitting content to device which does not join domain
CA2619161A1 (en) Administration of data encryption in enterprise computer systems
US9172683B2 (en) Method and apparatus for key distribution with implicit offline authorization
US7995766B2 (en) Group subordinate terminal, group managing terminal, server, key updating system, and key updating method therefor
CN101140610B (en) Contents decryption method using DRM card
WO2008048712A2 (en) Device-independent management of cryptographic information
US8538890B2 (en) Encrypting a unique cryptographic entity
US20140192980A1 (en) Data Encryption System and Method
US20070239617A1 (en) Method and apparatus for temporarily accessing content using temporary license
US9015077B2 (en) Method and apparatus for efficiently encrypting/decrypting digital content according to broadcast encryption scheme
US20070083469A1 (en) Use of licensed content without identification thereof
EP1875378A1 (en) Method and apparatus for managing digital content
JP2002247021A (en) Method and device for displaying access limited contents
KR100739779B1 (en) Method and apparatus for managing digital content
KR101287367B1 (en) Contents sharing method for DRM system
JP2009505448A (en) Digital content management method and apparatus therefor
KR100708133B1 (en) Method and apparatus for encrypting/decrypting efficiently according to broadcast encryption scheme
KR100708134B1 (en) Method and apparatus for encrypting/decrypting efficiently according to broadcast encryption scheme

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20071023

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): DE FR GB IT NL

RIN1 Information on inventor provided before grant (corrected)

Inventor name: KIM, MYUNG-SUN

Inventor name: YOON, YOUNG-SUN

Inventor name: KIM, BONG-SEON,903-411 JUGONG 9-DANJI APT.

Inventor name: HAN, SUNG-HYU,102-1006 FAMILY 1-DANJI APT.

Inventor name: LEE, SUN-NAM

Inventor name: LEE, JAE-HEUNG

DAX Request for extension of the european patent (deleted)
RBV Designated contracting states (corrected)

Designated state(s): DE FR GB IT NL

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: SAMSUNG ELECTRONICS CO., LTD.

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN WITHDRAWN

A4 Supplementary search report drawn up and despatched

Effective date: 20141110

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 21/10 20130101AFI20141104BHEP

Ipc: H04L 9/08 20060101ALI20141104BHEP

18W Application withdrawn

Effective date: 20141111