KR100502580B1 - Method for distrubution of copyright protected digital contents - Google Patents

Abstract

The present invention relates to a method for distributing content to which digital rights management (DRM) technology is applied, while protecting copyright by preventing leakage of an original content in the process of distributing content to which digital rights management technology is applied. The content is to be freely distributed.

The present invention provides a packaging and license registration step of securely transmitting a content key generated when a distributor device packages content to a license server, receiving the license server and registering the content in a secure place thereof, and a user device purchasing content from the distributor device. After requesting a license, the distributor device forwards the request to the license server, the license server generates a license and delivers it to the user device, and the user device receives a license request and issue step to play the content. .

Description

Method for distributing digital content with improved security {Method for distrubution of copyright protected digital contents}

The present invention relates to a secure content distribution method to which digital rights management (DRM) technology is applied, and more particularly, digital content with improved security for more securely distributing content using a public key (PKI). It relates to a distribution method.

Recently, as the use of the Internet becomes more active, hacking and copyright problems with digital contents have emerged as serious social problems. Digital content is inherently vulnerable to unauthorized distribution and use. In the case of digital content in general, it is difficult to further protect once downloaded.

Digital Rights Management (DRM) technology is a concept for protecting copyrighted information. To help understand, DRM is defined as follows. DRM refers to the management of the creation, processing, distribution and consumption of digital information. To put it concretely, DRM prevents illegal copying, and each subject (content creator, distributor, distributor, user, copyrighter, etc.) participates in the life cycle of the content (ie, creation, processing, distribution and consumption of the content). A set of technologies that protect the rights and interests of a company and support the processing of billing and payments for use of its content.

1 is a schematic diagram illustrating a conventional content distribution procedure using digital rights management (DRM) technology.

The operation principle of the content distribution system with DRM technology, which is currently being developed in advanced countries around the US, is as follows.

First, the creator 12 who plans and creates the content for the first time contracts with the content provider or the content distributor 14 to commercialize and distribute the content that he made and then delivers his content (①).

The distributor 14 performs a process of packaging the received content (②). Packaging refers to a series of processes in which a content source is received, a content usage rule (for example, a period of use, a place of use, a number of times of use, etc.) is added thereto, and finally an encryption technology is applied. The content distributor 14 registers (③) the content key generated during the packaging process (that is, the key used to encrypt the content during the packaging process) with the clearing house (e.g., the license server) 16, and the packaged content. Post to the mall.

The buyer (user) 18 selects the packaged content product in a shopping mall operated by the distributor 14 or obtains the packaged content through other means (eg, in the form of an e-mail or diskette from a friend or acquaintance). (④). When the purchaser 18 connects to the distributor 14 or the license server 16 and selects a usage rule for the content and requests a purchase (⑤), the license server 16 receives a credit card, online deposit or electronic payment. After payment is processed using cash, a license is issued to the buyer (⑥, ⑦). The license is a file required to use the packaged content and contains usage rules and content key information.

However, in such a content distribution environment to which the conventional DRM is applied, there is a risk of leaking the content original because the distributor entrusts (registers) the entire content key information to the license server. Typically, the license server is run by a trusted third party. However, there is a problem that the original content is exposed or the copyright information may be infringed by exposing the content key by an internal employee or an external attack of the license server managing the content key information.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problem, and the distributor distributes the content key information to the license server without using a method of entrusting the entire content key information to the license server. Securely and securely and transparently distribute the content by preventing the leakage of the original content that may occur from the license server, and digital content distribution method and a program for realizing the program for realizing this can be read securely. The purpose is to provide a recording medium.

A method of the present invention for achieving the above object, in the content protection distribution method for distributing digital content securely through a network, the distributor device encrypts the content according to a predetermined encryption algorithm to generate a content key and the content package A packaging step; A license registration step of securely transmitting and registering the content key generated in the packaging step to a license server; A license request step of the user device requesting the content purchase from the distributor device and transmitting the purchase information to request a license; A license file generation step of the distributor device transferring the license request to the license server, and the license server generating a license file and delivering the license file to a corresponding user device; And a content decryption step in which the user device receives the license file and decrypts the content.

In addition, the present invention provides a content recording medium in which a program for applying digital content to a content protection distribution through a network, the content key generated while packaging the content in a content protection distribution system having a large capacity processor. The first feature, which securely sends to the license server, the license server receives it and registers it in its secure location, and when the user device purchases content from the distributor device and requests a license, the distributor device sends the request to the license server. The license server generates and delivers a license to the user device, and the user device provides a computer-readable recording medium having recorded thereon a program for realizing a second function of receiving and playing content.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. 2 is an exemplary view showing the configuration of a content distribution system to which the present invention is applied.

Referring to the drawings, the system of the present invention is composed of a certificate issuer 21, a distributor device 23, a license server 24, and a user device 25 connected through the Internet 20. 23 obtains content from the content creator 22. At this time, the distributor device 23, the license server 24, and the user devices 25 include certificates 23a, 24a, and 25a, which are authenticated by the certificate issuer 21, respectively.

First, the encryption algorithm will be briefly described to facilitate understanding of the present invention. Encryption algorithms are classified into symmetric key encryption algorithms having the same encryption key and decryption key and asymmetric key encryption algorithms having different encryption / decryption keys according to the characteristics of a key used for encryption and decryption.

The symmetric key encryption algorithm can be divided into stream encryption algorithm and block encryption algorithm according to the data processing type. The symmetric key encryption method requires fast distribution while securely distributing keys.

The public key algorithm uses two keys, a public key and a private key. The public key is open on an open network and the private key is kept private.

Therefore, in the case of using the public key method, if the plain text is encrypted and transmitted, the plain text is transmitted by encrypting the plain text with the public key of the other party, and the other party decrypts it with its private key.

In the public key infrastructure (PKI), when a sender encrypts his or her ID with a secret key and sends it to the receiver, the receiver can verify that the signature has been transmitted from the sender by decrypting the signature with the public key of the sender. This is called digital signature or digital signature and is used to verify sender's identity and message integrity.

The digital content distribution system of the present invention is based on a public key infrastructure (PKI) as shown in FIG. 2.

Referring to the drawings, the distributor device 23 and the license server 24 generate a public key / private key, respectively, and the certificate 23a, for the public key, from the Certificate Authority (CA) system 21. Receive 24a). The user device 25 also generates a public key / private key pair (PubKey / PriKey) and receives a certificate 25a. At this time, the distributor device 23 receives the digital content from the content creator 22.

Here, the asymmetric key algorithms used are RSA, Diffie-Hellman, DSA, El Gamal, ECC, etc. The present invention is not dependent on the use of a specific asymmetric key cryptographic algorithm.

3 is a flowchart illustrating a content distribution procedure according to the present invention. Content distribution procedure according to the present invention comprises a packaging and license registration process (S1 ~ S4) and a license request and issuance process (S5 ~ S15), which will be described separately for convenience of description.

1. Packaging and License Registration Process

3, a distributor, a license server, and a user device generate a public key and a private key from a certificate issuer, receive a certificate, and receive a certificate (S1).

The distributor device 23 obtains and packages the content to be distributed (S2). The procedure for packaging by the distributor device 23 includes key generation step 401, partitioning content 402, symmetric key block encryption step 403 of content key, and content key as shown in FIG. Symmetric key encryption (404), the content metadata is electronically signed (405).

Referring to FIG. 4, the distributor device 23 includes three encryption keys as follows, namely, content keys CKEY 1, ..., CKEY m and a second encryption key LKEY of the content key. And a first encryption key (PKEY) of the content key (401). Here, each encryption key uses a symmetric key block encryption algorithm that is effective for encrypting a large amount of content. Symmetric key block encryption algorithms include DES, IDEA, RC2, AES, etc. The present invention is not dependent on the use of a specific symmetric key block encryption algorithm.

The distributor device 23 divides the content into n blocks C1, C2, ... Cn, and then encrypts the values E by applying a symmetric key block encryption algorithm and content keys CKEY 1, ..., CKEY m, respectively. _{Calculate CKEY 1} (C1), E _{CKEY 2} (C2), ..., E _{CKEY m} (Cn) (403). Where E _K (M) indicates that message M is encrypted with key K.

If the content is small, the content may be encrypted with one content key CKEY 1, or the content may be divided into blocks according to the size and may be encrypted by applying different content keys. Some content block data may omit encryption.

The distributor device 23 generates the second encryption key LKEY of the content key by encrypting the above content keys CKEY 1, ..., CKEY m using a symmetric key block encryption algorithm, and again encrypts the first content key. encrypting to generate an encryption key PKEY calculates the result _{E PKEY (E LKEY (CKEY 1} )), ...., E PKEY (E LKEY (CKEY m)) (404). In addition, the distributor device 23 configures the content metadata with the following information, that is, content ID, business rules, distributor information, etc., and calculates a digital signature value using the private key of the distributor device. (405).

Here, the business rule refers to a usage rule that is basically applied to the content. For example, the business rule may specify an age limit (not available under 19 years old) or a regional limit (not available on public places). The distributor information stores information such as distributor name and contact information.

The content finally packaged by the distributor device 23 is as shown in FIG. Metadata Digital Signature; _{E PKEY (E LKEY (CKEY 1} )), ...., E PKEY (E LKEY (CKEY m)); E _{CKEY 1} (C1), E _{CKEY 2} (C2), ..., E _{CKEY m} (Cn)}, and the entire package consists of the key part of (a) and the encrypted content part of (b). do. The distributor device 23 thus completes the packaging process. Here, the content key in a broad sense is composed of content keys CKEY 1, ..., CKEY m for encrypting the content, and second and first encryption keys LKEY, PKEY for encrypting the content key.

3, the distributor device 23 of the ID of the content, LKEY, E _PKEY (E _LKEY (CKEY 1)), ...., E _PKEY (E _LKEY (CKEY m)) the information on the work The key is registered by transmitting to the license server 24 through a secure communication path (S3).

The license server 24 stores the ID and LKEY information of the content received from the distributor device 23 in a safe place, and then transmits a 'key registration OK' message to the distributor device 23 (S4). The license server 24 thereby completes the packaging and license registration process by the distributor device 23.

2. License Request and Issuance Steps

The user (purchaser) device 25 may acquire the packaged content through various paths (S5). For example, it may be delivered from another person in the form of an e-mail or a diskette, or may be obtained by visiting a content shopping mall. The buyer selects the content and makes a purchase request (S6).

The distributor device 23 presents the usage rule and payment terms of the corresponding content to the user device 25 with respect to the requested content (S7).

The user device 25 transmits purchase information such as "user device ID, public key PubKey of the user device, content ID, selected usage rules and payment information" to the distributor device 23 (S8). The distributor apparatus 23 makes a payment request by transferring this purchase information to the license server 24 (S9).

Then, the license server 24 performs the payment process (S10), and returns the result to the distributor device 23 (S11).

The distributor device 23 makes a request for issuance of a license to the license server 24 with respect to the purchases for which payment processing is completed (S12). In step S12, the distributor device 23 encrypts the first encryption key “PKEY” generated in the packaging process using the asymmetric key encryption algorithm and the public key of the user device 25. “E _PubKey ( _PKEY )” Is transmitted to the license server 24.

The license server 24 generates a license file as follows (S13). The license file is "Content ID, the user selects usage _{rules, LKEY, E PKEY (E LKEY} (CKEY 1)), ...., E PKEY (E LKEY (CKEY m)), E PubKey (PKEY)" including The information is generated by electronic signature with the private key of the license server 24 (S13). The license server 24 transmits the license file to the user device 25 through a secure communication path (S14).

After receiving the license file from the license server 24, the user device 25 performs a content decryption process S15 as shown in FIG. 6.

The content decryption process (S15) may include verifying a digital signature of the license server with respect to the license file using the public key of the license server 24 (601); Restoring the PKEY with its private key (602); Confirming the electronic signature of the distributor device with respect to the content metadata by using the public key of the distributor device 23 (603); Recovering a content key using a first encryption key (PKEY) and a second encryption key (LKEY) (604); And decrypting the content with the content key (605).

Referring to FIG. 6, the user device 25 parses the license file and then checks the electronic signature of the license server 24 with respect to the license file using the public key of the license server 24 (601). If the electronic signature is passed, the user device 25 _decrypts the E _PubKey ( _PKEY ) with its own private key (PriKey) to restore the first encryption key (PKEY) (602). If the digital signature does not pass, an error message is issued and the license is reissued.

The user device 25 first extracts the metadata digital signature portion from the packaged content, and then confirms the digital signature of the distributor device with respect to the content metadata by using the public key of the distributor device 23 (603). If the digital signature does not pass, it sends an error message and reacquires the packaged content. If the digital signature has passed, the user device 25 using the restored PKEY _PKEY E (E _LKEY (CKEY 1)), ...., E _PKEY (E _LKEY (CKEY m)) from E _LKEY (CKEY 1 )), ...., E _LKEY (CKEY m) is extracted. In addition, the user device 25 extracts the second encryption key (LKEY) from the license file, and decrypts the E _LKEY (CKEY 1), ...., E _LKEY (CKEY m) using the content key (CKEY 1, CKEY m) is obtained (604).

Finally, the user device is configured to block content blocks E _{CKEY 1} (C1), E _{CKEY 2} (C2), ..., E _{CKEY m} (encrypted using the content key CKEY 1, ..., CKEY m). Cn) is decoded to extract and execute the content original blocks C1, C2, ... Cn (605).

As described above, in the digital content distribution method with improved security of the present invention, a distributor distributes content key information, and partly delivers the content key to a license server, and partly securely by using a user device (DRM client module). Since the content key information is distributed and managed, the original content can be prevented from leaking even if an attack such as a hack occurs on the license server. The present invention has its features and effects in that it improves safety while easily supporting content distribution through the Internet.

What has been described above is only one embodiment that describes a digital content distribution method with improved security of the present invention, and the present invention is not limited to the above-described embodiment, but the present invention is claimed in the following claims. Without departing from the gist of the present invention, those skilled in the art to which the present invention pertains to the spirit of the present invention to the extent that various changes can be made.

1 is a schematic diagram showing a conventional content distribution procedure using digital rights management (DRM) technology;

2 is a configuration example of a content protection distribution system to which the present invention is applied;

3 is a flowchart illustrating a content distribution procedure according to the present invention;

4 is a flowchart illustrating a procedure of packaging content according to the present invention;

5 is a format example of a package encrypted according to the present invention;

6 is a flowchart illustrating a process of decrypting encrypted content according to the present invention.

* Description of the symbols for the main parts of the drawings *

20: Internet 21: Certificate Issuer

22: Content Creator 23: Distributor Device

24: license server 25: user device

23a, 24a, 25a: certificate

Claims (8)

In the content protection distribution method for securely distributing digital content through a network, A packaging step in which the distributor device encrypts the content according to a predetermined encryption algorithm to generate a content key and a content package; A license registration step of securely transmitting and registering the content key generated in the packaging step to a license server; A license request step of the user device requesting the content purchase from the distributor device and transmitting the purchase information to request a license; A license file generation step of the distributor device transferring the license request to the license server, and the license server generating a license file and delivering the license file to a corresponding user device; And And a content decrypting step in which the user device receives the license file and decrypts the content. The method of claim 1, wherein the packaging step Generating a content key (CKEY 1 to CKEY m) and an encryption key (PKEY, LKEY) of the content key; Block dividing the content to be distributed; Symmetric block encryption of each divided content with a corresponding content key; Symmetric block encryption of the content key with an encryption key of the content key; And digitally signing content metadata with the public key of the distributor device. The method of claim 2, wherein the content metadata is Digital content distribution method with improved security, characterized in that consisting of the content ID, business rules, distributor information. The method of claim 2, wherein the content key and the content generated as a result of the packaging {Content id; Metadata Digital Signature; _{E PKEY (E LKEY (CKEY 1} )), ...., E PKEY (E LKEY (CKEY m)); E _{CKEY 1} (C1), E _{CKEY 2} (C2), ..., E _{CKEY m} (Cn)}, ID of the _{contents, LKEY, E PKEY (E LKEY} (CKEY 1)), ...., E PKEY (E LKEY (CKEY m)) information, the security of which comprises transmitting to the license server improved digital How to distribute content. The method of claim 1, wherein the license requesting step Requesting a purchase after the user device acquires content through various paths; Presenting, by the distributor device, the usage rules and payment terms of the corresponding content to the user device with respect to the requested content; Transmitting, by the user device, a user device ID, a public key (PubKey), a content ID, a selected usage rule, and payment information of the user device to the distributor device; Making a payment request by the distributor device by transmitting the received purchase information to the license server; And performing, by the license server, a payment process and returning a result of the execution to the distributor device. The method of claim 1, wherein the license file generation step Requesting, by the distributor device, to issue a license by transmitting a value obtained by encrypting a first encryption key (PKEY) of a content key using an asymmetric key encryption algorithm and a public key (PubKey) of a user device to the license server; And the license server, a content ID, a user, including using the selected _{rules, LKEY, E PKEY (E LKEY} (CKEY 1)), ...., E PKEY (E LKEY (CKEY m)), E PubKey (PKEY) And digitally signing the information with the private key of the license server to generate the license file. The method of claim 1, wherein the decrypting of the content comprises: Verifying an electronic signature by decoding the license file with the public key of the license server; Restoring a first encryption key (PKEY) of a content key with a private key of the user device; Extracting the metadata digital signature portion from the packaged content and then confirming the digital signature using the public key of the distributor device; Restoring the content key using the second encryption key (LKEY) of the content key extracted from the license file and the first encryption key of the content key; And decrypting the content with the restored content key. Claims [1] A recording medium having recorded thereon a program for applying digital content to content protection distribution through a network. 1. A content protection distribution system having a large capacity processor, comprising: a first function of transmitting a content key generated while a distributor device packages content to a license server, and receiving the license server and registering the content key in a secure place thereof; And If a user device requests a license after purchasing content from the distributor device, the distributor device sends the request to the license server, the license server generates a license and delivers it to the user device, and the user The apparatus receives the second function to play the content; computer-readable recording medium recorded with a program for realizing.