GB2412452A

GB2412452A - Protection and controlled distribution of digital content

Info

Publication number: GB2412452A
Application number: GB0406975A
Authority: GB
Inventors: George Stronach Mudie
Original assignee: Individual
Current assignee: Individual
Priority date: 2004-03-27
Filing date: 2004-03-27
Publication date: 2005-09-28
Anticipated expiration: 2024-03-27
Also published as: GB0408014D0; GB2412452B; GB0406975D0

Abstract

A system that employs a licensing scheme for distributed digital content. The licensing scheme requires the authentication of a physical key device 1 (e.g. a smart card) and an application extension 9 and may provide content 4 and licenses 5 which are encrypted in a fashion that is unique to the physical key device. The licensing scheme and authentication mechanisms used minimise the possibility of commercial copying. The licensing scheme and authentication mechanisms also allow the consumption of content without the physical key device being present, but still under the conditions defined by the licence. Independent claims relate to various aspects including: <SL> <LI>(i) Claim 1 characterised by a physical key device and licensing system using their own cipher scheme. <LI>(ii) Claims 2-9 characterised by making content available to users only if certain (licensing) conditions are met such as the encoding of the content or the classification of an associated application extension. <LI>(iii) Claims 10-11 characterised by determining the authenticity of an application extension using algorithms resident in a physical key device. <LI>(iv) Claims 12-13 characterised by determining the authenticity of a physical key device by using algorithms resident in a licensing system. <LI>(v) Claim 14 characterised by using a constantly changing data structure in a physical key device to deter duplication of the device. <LI>(vi) Claim 15 characterised by issuing encrypted content in a format specified by a user to physical media specified by the user. </SL>

Description

24 1 2452

DATA PROTECTION AND CONTROLLED DISTRIBUTION

The problems that this invention aims to resolve are: Peer-to-peer file sharing on the internet. For example the sharing of a single audio track by numerous consumers Piracy of digital content. For example, the copying and selling of a CD audio album The solution is made up of: Content. A raw piece of digital information e.g. a music track, feature film or a software application License. A piece of logic which governs the consumption of a piece of content Licensing System. Distributes content that is encoded and then encrypted. A license is also encrypted and is needed to consume the content.

A physical key, which contains a Smart Card. The Smart Card must store the License information, it may also store the Content Application Extension. A piece of code that may exist inside a suitable microchip or protected unit of software. The Application Extension knows how to interact with a Smart Card. This is important as the Smart Card and Application Extension negotiate a Cipher system prior to any transaction.

The concept is: You need a License 5 to consume Content 4 The Content 4 is encrypted in a manner which may be unique The License 5 may be unique in structure and encryption format The Licensing System 10 will only issue encrypted Content 4 and Licenses 5 once a Physical Key Device 1 has been authenticated The License 5 is stored on the Physical Key Device 1 The License 5 holds the key which will decrypt the Content 4 An Application Extension. 2 is required by an application to process the protected Content 4 and protected Licenses 5 The Physical Key Device 1 will only pass License 5 information to authenticated Application Extensions 9 The objective of this invention is to provide a consumer with a device that can provide consuming applications with a valid license to consume a piece of content.

Description of Diagrams

Figure 1: A block diagram of one of the systems 1: Physical Key Device (e.g. a Smart Card inside a piece of jewellery), which contains 2: License Application (e.g. a piece of software burned into the Smart Card), 3: an optional area for storing encrypted Content 4 4: encrypted content (e.g. a music track which has been encrypted), 5: encrypted license associated with a piece of Content 4 (e.g. a license which enables you to play an encrypted music track) 6: a piece of hardware (e.g. computer, CD player, car entertainment system) that contains 7: optional browsing application e.g. an internet browser 8: an application that can consume the content in its decrypted, encoded format 9: application extension that can interact with Physical Key Device 1. It may also understand how to consume the content in its decrypted, encoded format 10: Licensing System that may contain, 11: a service that allows a Physical Key Device 1 to be securely provisioned, 12: a service that can authenticate a Physical Key Device 1, 13: a service that will provision an Application Extension 20, 14: a service that can authenticate an Application Extension 20 that has network access, 15: the service that manages the distribution of encrypted Content 4, 16: a service that monitors license consumption and issues new encrypted licenses 5, 17: encryption service, which may employ different encryption methodologies when encrypting a piece of Content 4 or License 5. The encryption service may be required to encode the Content 4 prior to encryption.

] 8: piece equipment that can communicate securely with the Licensing System 10. It allows a consumer to insert their Physical Key Device 1, and request Content _ and/or License 5. The piece of equipment 18 will then vend the Content 4 on the appropriate media and deliver the required License 5 to the Physical Key Device 1. This is sometimes referred to as Super Distribution.

Figure 2 (comprising Figure 2A and Figure 2B): An overview of the logical steps used by the solution to distribute content and licenses Figure 3: the steps performed to associate a Physical Key Device 1 with a Licensing System 10 Figure 4: the steps performed to generate and issue an Application Extension 9 that is associated with a Licensing System 10 Figure 5: the steps performed to authenticate a request issued by a Physical Key Device 1 or Application Extension 9 to a Licensing System 10 Figure 6: the detailed steps used when a Physical Key Device I attempts to obtain a License 5 and piece of Content 4 Figure 7 (comprising Figure 7A, Figure 7B, Figure 7C and Figure 7D): the structure of the Licensing Application _ that may be resident on the Physical Key Device I and the different encryption and storage structures that may be used When a piece of new content is created, the content owner can associate a set of conditions that govern how the content can be consumed. This set of conditions is known as the License 5. The License 5 can have general settings, but it can also be specific to the encoding scheme used, the ability of the Application Extension 9 to communicate with the Licensing System 10 and it can also define which portions if any of the License 5 can be shared with an Application Extension 9 with an appropriate security classification. For example, the content owner may decide that Audio Track A should be available in MP3 and WMA encoded formats. However, if the MP3 format is used then content owner may wish to define a set number of 'plays' or consumptions of the track. If the WMA encoding scheme is used, the content owner may want to define that it can be used on Network Attached and No Network devices without restriction. This corresponds with Step 1, Step 2 and Step 3 of Figure 2A.

The content and associated license information can be transferred to the Licensing System 10. Note that the content may be stored in a neutral format, this allows the Licensing System 10 to encode and encrypt the content as required. This has the effect of reducing the storage capacity the Licensing System 10 would normally use.

This corresponds with Step 4 of Figure 2A.

The Licensing System 10 may advertise the availability of the new content directly to consumers, however it is more likely that a group of distributors will perform this marketing function. The Licensing System 1 O. must ensure that trusted distributors are informed of changes to the content and license catalogue. An example of this would be the Licensing System 1 O. informing an internet store of new music content that was now available, which formats, conditions of use and possibly the prices. The content 4 and license 5 are never released to the distributor, only the Meta data associated with the content 4 and license 5. This corresponds with Step S of Figure 2A.

A consu ner may wish to obtain a piece of content that has been advertised by a distributor or the Licensing System 10. For example, the consumer visits an internet store and clicks on a hyperlink for a new musical track. The consumer may be using a browsing application 7 to do this. By clicking on the hyperlink, they may invoke an Application Extension 2. The Application Extension 2 is known to the Licensing System 1 O. possibly using the steps outlined in Figure 4. The Application Extension 2, may use the native features of the Browsing Application 7 to request the user to insert their Physical Key Device 1. This corresponds with Step 6 of Figure 2A.

The consumer has a Physical Key Device 1. The Physical Key Device 1 may be known to the Licensing System 10 using the steps outlined in Figure 3. The Physical Key Device I could appear embedded in another piece of equipment. For example, pieces of jewellery like a watch, necklace or mobile phone. The Physical Key Device 1 could also use a number of interface technologies that would allow it to communicate with a piece of Hardware 6. The physical interface exposed by the Physical Key Device I that connects to the Hardware 6 could rely on physical contact or use wireless or optical technology. Some examples of these transmission technologies are Ethernet cable, WEAN, Infrared, Bluetooth, Passive Resonance, and Microwave or modulated Laser.

To activate the Physical Key Device I a Private Identity Number (PIN) could be entered by the user or some biometric data could be used to verify the presence of the user of the Physical Key Device 1. For example, the Physical Key Device I, could have a finger print scanner, number entry system or a retina scanner built into it.

These scanners or keys could supply additional information to ensure the user of the Physical Key Devi' e I is present.

The Physical Key Device I contains a Licensing Application 2 that controls how external systems can interact with the data and applications that are resident on the Physical Key Device 1. The Licensing Application 2 could be an embedded piece of logic in a microchip or operate as a secure application on a Smart Card or a Subscriber Identity Module.

Within the Licensing Application 2, there is an Application Interface 20. The Application Interface 20 is the only part of the Licensing application 2 that is accessible to external systems. Prior to any meaningful transaction, the Application Interface 20 will create a ciphering system between itself and the external system attempting to communicate with the Licensing Application 2, the external system could be the Application Extension 2 or Licensing System 10 attempting to use the Application Interface 20. The Application Interface 20 may use a traditional Challenge/ Response mechanism or a Self Securing negotiation.

The Self Securing Negotiation is analogous to a human-to-human conversation. A number of facts are exchanged. As each fact is exchanged, it increases the level of trust between the two entities. This could be replicated between the Application Interface 20 and the Application Extension 9 or the Application Extension 2 and the Licensing System 10 or the Application Interface 20 and the Licensing System 10.

The Application Extension 9 can only be authenticated by the Licensing System 10 if it is connected to an appropriate network. An Application Extension 9 that is attached to a suitable network is classed as Network Attached. The Network Attached and No Network classification associated with an Application Extension 9 is an important one. A traditional CD player does not interact with a network and thus has no real- time access to the Licensing System 10. This means that there is a greater risk of fraudulent activity. To challenge this condition, the License 5 can incorporate specific No Network' conditions or even prevent the use of the content on a 'No Network' device. It may also allow the Physical Key Device 1 to perform additional authentication checks on the Application Extension 9 prior to the dispatch of license 5 information.

The use of algorithms or negotiation is important as current systems use Public/Private key pairings. With large distributions of public/private key pairings, it becomes possible to apply power-breaking approaches that will reveal the key pairing.

The main limitation with using Public/Private key pairings for the communication is that the data exchanged is predictable. This would allow a thief to create a piece of software that could respond like a key device and to emulate supplying the license.

The thief would not have to understand the contents, they would just have to know which piece of content the recorded response was for. This flaw makes Public/Private key pairings an insecure mechanism for a large-scale distribution.

An Application Extension 9 will attempt to use the Application Interface 20. Within the request, the Application Extension 2 will attempt to identify itself to the Application Interface 20. The Application Interface 20 may pass the identity through an algorithm to generate an initial Cipher setting. The Application Interface 20 will respond to the unknown Application Extension 2 with a challenge. The enquiring Application Extension 2 will only be capable of reading the challenge if it has predicted the use of the initial Cipher. The Application Extension 2 will then compute the required result and return it to the Application Interface 20 using the initial Cipher setting. The Application Interface 20 will inspect the result to the challenge and generate a new Cipher setting. The Application Interface 20 may also generate another challenge to determine the security classification of the Application Extension 9. The Application Extension 2 needs to predict the use of the second Cipher setting.

The result is computed using the algorithm associated with the security classification of the Application Extension 2 The Application Extension 2 may also indicate that it has additional algorithms associated with greater levels of security. The result is returned to the Application Interface 20. The Application Interface 20 can now trust the Application Extension 9 and may issue further challenges to determine which higher security algorithms are available. In essence the more trusted facts that the two entities share and qualify, the greater the degree of trust. This corresponds to Step 7 of Figure 2B.

At any point, either the Application Interface 20 or the Application Extension 9 may request that the Licensing System 10 mutually authenticate the Application Extension 2 and Application Interface 20.

The Application Interface 20 is also responsible for creating requests for required licenses or content. These requests will be issued to the 'home' Licensing System 10.

The 'home' licensing system is the system that provisioned the Physical Key Device 1; however, there may be a list of alternative licensing systems. A provisioning process used to allocate the Physical Key Device 1 to the Licensing System 10 is shown in Figure 3.

The Licensing system identifier will define how the Licensing System 10 can be contacted by the Physical Key Device 1.

An alternative to directly requesting new content is the activation of existing content.

For example when a Browsing Application 7 (optional) or a Consuming Application 8 attempts to obtain a piece of content it is likely to look for the Content 4 locally. This corresponds to Step 10 of Figure 2B.

If the Content package 4 is located, the content header can be used to determine the License ID required to consumer the content. A possible structure of the content header is show in Figure 8. If the Application Extension 2 of the Consuming Application 8 has all approved Application Interface AL it may have a security classification that allows it to store a copy of the License 5 locally. If no local copy of the License 5 is available or the local copy of the License 5 has expired, the Application Extension 2 will request the consumer to insert their Physical Key Device 1 for interrogation. This corresponds to Step 11 of Figure 2B. b

The Application Extension 9 will then issue a request to the Application Interface 20 of the Physical Key Device 1. Once the Application Interface 20 has achieved a level of trust with the Application Extension 2, using either the challenge/response mechanisms explained earlier or the selfsecuring method described earlier (this corresponds to Step 12 of Figure 2B), the Application Interface 20 will attempt to locate the License ID in the License Store 23. If the License ID is located, then the Application Interface 20 will apply the current Local License Mapping Encryption Algorithm 21 to decrypt the contents of the License Encryption Mapping 22. This will return the key that was used to encrypt the required License 5. Note that the Licensing System 10 can decide to apply a different key when encrypting each License 5.

This is an important security feature. The Local License Mapping Encryption Algorithm 21 may be altered each time the Physical Key Device 1 interacts with an authenticated Licensing System 10. This results in the Licensing Encryption Mapping 22 store being freshly encrypted. This helps to prevent the cloning of the Physical Key Device 1. It also minimises the amount of data that needs to be stored in 'clear' format on the Physical Key Device 1.

The Application Interface 20 now has the key that is used to unlock the appropriate License 5 in the License Store 23. The Application Interface 20 could compare the information stored within the License 5 with the information issued by the Application Extension 2. This would add a further degree of certainty that a valid request was being processed. The License 5 information is then returned by the Application Interface 20 using the latest Cipher setting to the Application Extension Depending on the security classification associated with the Application Extension 9 then Application Interface 20 may return a subset of the License 5 or grant a single consumption of the content 4. This corresponds to Step 13 of Figure 2B.

The Application Extension 2 inspects the License 5 to obtain the content key. This corresponds to Step 14 of Figure 2B. This key allows the Application Extension 2 to decrypt the Content 4 file and to obtain the encoded content. The Application Extension 2 may have a security classification that allows it to keep a copy of the License 5 locally, thus allowing the Application Extension 2 to monitor content consumption and to apply the licensing restrictions. This allows the Consuming Application 8 to consume the Content 4 without the presence of the Physical Key Device 1. This corresponds to Step 15 of Figure 2B. Furthermore, the Application Extension 2 is trusted to consume the content in a secure manner, which means that the content will never be revealed in an unencrypted format to any other application resident on the Hardware 6. This corresponds to Step 16 of Figure 2B.

If the Application Interface 20 does not locate a License 5 locally, then it will create a request for the License 5. The request is encrypted and passed to the Application Extension 2 that in turn will relay the request to the Licensing System 10. As the request is encrypted, no intercepting entity will understand the contents of the request.

The Licensing System I O will inspect the request and authenticate the Physical Key Device 1, either by a traditional challenge/response or by a self-securing negotiation (as described earlier). Figure 5 illustrates the possible steps used to achieve authentication.

Once the Physical Key Device I has been authenticated, the request will be processed by the Licensing System 10. This corresponds to Step 7 of Figure 2B.

If the request is for a License 5, the Licensing System 10 will generate a unique encryption scheme and apply that to the appropriate licensing instructions. The encrypted License 5 will then be delivered to the Physical Key Device 1 via the intermediary entities. This corresponds to Step 8 of Figure 2B.

The Physical Key Device 1 should acknowledge reception of the License 5.

At any point, the Licensing System 10 may request the Physical Key Device I to use a different Cipher. This is analogous to frequency hopping used in wireless radios.

The request may also require a piece of content 4 to be delivered. For example a music track. The encryption settings defined by the encrypted License 5 will be applied to the raw content once it has been encoded, this produces a protected content package 4. The content 4 may be placed on to the Hardware 6 or if available on to the Content Store 3 of the Physical Key Device L. This corresponds to Step 9 of Figure 2B.

Alternatively, the Content 4 could be delivered to a Super Distribution Node 18. A Super Distribution Node allows a Physical Key Device 1 to be authenticated, for the consumer to select a one or more pieces of content 4 from a menu, and for the content to be delivered on the required physical format. For example, the Super Distribution Node 1 8 could be in a retail outlet. The consumer could browse the store a pick-up the case belonging to the CD they wish to purchase. The consumer enters their Physical Key Device 1 into the Super Distribution Node 18, selects the CD from a menu and the Super Distribution Node 18 interacts with the Licensing System 10, in a fashion similar to an Application Extension 2. The required License 5 is placed on to the consumers Physical Key Device 1, and the required content 4 is burned onto a writeable CD. This system would remove the need for the mass copying of CDs and therefore prevent the commercial piracy of CDs.

The Super Distribution Node 18 could also place the content _ onto other media, for example a Memory Stick or a Mobile Phone.

The Application Extension 2 or Application Interface 20 will acknowledge receipt of the encrypted Content_.

The Licensing System 10 can apply cloning checks on a Physical Key Device 1 and an Application Extension 2 that is connected to a network.

The Physical Key Device 1 may employ an encryption and integrity checking mechanism that is constantly changing a very large data structure e.g. a number with I million digits. The changes to the data structure could be governed by a multi-step algorithm. That is a sequence of algorithms are used, or the same algorithm is used a number of times to complete a number of changes. If the data structure looses its integrity, it may stop the Physical Key Device 1 from allowing the distribution of any I licenses. The Physical Key Device 1 may alert the user via the Application Extension 2, that it needs to be validated by the Licensing System 1 O. I The Licensing System 10 can then apply cloning checks to the Physical Key Device I prior to re-initialising the Physical Key Device 1.

The Application Extension 2 may also request confirmation that the Physical Key Device 1 has a valid data structure.

An alternative to using a constantly changing algorithm to detect interruptions, could be the use of a powered clock or counter on the Physical Key Device 1. Where the on- I board clock would be synchronized with the 'home' Licensing System 10. The on board counter would increment every time a computational cycle is completed on the Physical Key Device 1.

The clock or the counter can be interrogated by the Licensing System 10 or Application Extension 2 to spot interference or potential clones. q

Claims

CLAIMS DATA PROTECTION AND CONTROLLED DISTRIBUTION

1. The physical key device 1 and Licensing System 10 use their own Cipher scheme, they do not rely on their being an existing Cipher system available e.g. HTTPS.

2. A data protection system, which allows a content provider to provide content that is then encrypted and can only be accessible to users when certain conditions have been met. The conditions can be particular to the content, the encoding of the content, the classification of the application extension 9 and subject to an authentication process performed between the application extension 2 and the physical key device 1, the physical key device 1 and the licensing system 10 2. A system according to claim 2, in which the storage and the processing means are incorporated in a physical key device 1.

3. A system according to any preceding claim, including means for determining the case when (a) the first processing means has determined for a particular user, that the requesting application extension 2 is authentic and (b) the physical key device 1 is authenticated by the licensing system 10

4. A system according to any preceding claim, including the means to use supply a license

5 which has been encrypted in a manner specific to the identity of the physical key device 1 5. A system according to claim 4, in which the license request may identify user data associated with the physical key device 1.

6. A system according to claim 4, in which the content issued by the licensing system is encrypted according to the encryption settings contained by the encrypted license 5

7. A system according to claim 4 and 6, in which the license store 23 stores authorizations respective to different content providers and/or to different encoded content, application extension classification and that each license storage entry may be encrypted by a different encryption mechanism

8. A system according to claim 4, in which there can be a number of Licensing Systems 10, offering a number of authentication services 12 and 14, offering a number of content distribution services 15, offering a number of license distribution services 16 and offering a number of encryption services 17

9. A system according to any one of claims 4 7, in which the physical key device 1 confirms that the application extension 2 originating the license or content request is an authentic application extension before allowing the request to be processed.

10. A method which uses algorithms resident in the physical key device 1, which allow the physical key device to determine the authenticity of the application extension 9 No

11. A method according to 11, including the step to determine further authentication algorithms that may be available to both the physical key device I and the application extension 2

12. A method which uses algorithms resident in the Licensing System 10, which allow the Licensing System to determine the authenticity of the physical key device 1

13. A method according to 13, including the step to determine further authentication algorithms that may be available to both the Licensing System I O and the Physical Key Device I

14. A method that uses a constantly changing data structure resident on the physical key device I to deter the duplication of the physical key device I

15. A method which allows a piece of equipment 18 to issue the encrypted content 4, in the format specified by the user, on the physical media specified by the user

16. A method according to 15, which allows a piece of equipment 18 to issue an encrypted license 5 to the physical key device I of the user, that is associated with the encrypted content 4

17. A data processing system, substantially as described with reference to Figures I and 2 of the accompanying drawings.

18. A data processing system, substantially as described with respect to all the Figures of the accompanying drawings.

19. A data processing method, substantially as described with reference to Figures I and 2 of the accompanying drawings.

20. A data processing method, substantially as described with respect to all the Figures of the accompanying drawings.