KR100727091B1 - Contents providing method and apparatus using drm, and portable memory apparatus thereof - Google Patents

Abstract

A method and a device for providing contents with DRM, and a portable storage device thereof are provided to use the DRM protected contents of the portable storage device in a user device without mutual authentication by using the DRM. A communication interface(510) exchanges data with a user terminal connected to the portable storage device. A controller(520) requests a certificate processor(550) and an RO(Rights Object) processor(540) to issue a certificate and an RO of the contents to be sold, encrypts the contents, encrypts a content encryption key by including the content encryption key to the RO, and encrypts the RO encryption key by including the RO encryption key to the certificate. The controller stores more than one of the encryption RO or the certificate to a secure memory area of the portable storage device, and stores the remaining part to a flash memory area of the portable storage device. A content management database(530) stores/manages the contents to be sold or provided.

Description

Method and apparatus for providing contents using digital rights management, and portable storage device for the same

1 is a diagram illustrating a general digital rights management concept.

2 is a diagram illustrating a content management procedure using digital copyright management between a conventional portable storage device and a device.

3 is a view for explaining a content providing method using digital copyright management according to the present invention.

4 (a) and 4 (b) are conceptual views illustrating a content providing form using DRM according to the present invention in a portable storage device.

5 is a block diagram of a content providing device using digital copyright management according to the present invention.

6 (a) and 6 (b) are structural diagrams of a portable storage device for storing contents provided by using digital copyright management according to the present invention.

7 is a flowchart showing a content providing method using digital rights management according to the present invention.

8 is a flowchart showing another embodiment of a content providing method using digital rights management according to the present invention.

9 is a signal flow diagram illustrating an example of a playback procedure between a portable storage device and a device for content provided by the present invention.

10 is a signal flow diagram illustrating another example of a playback procedure between a portable storage device and a device for content provided by the present invention.

* Description of the symbols for the main parts of the drawings *

310: content provider terminal 340: content providing server

320: certificate issuing server 330: rights object issuing server

350: user terminal 360: portable storage device

370: device

The present invention relates to a content management method and apparatus using digital rights management between a portable storage device and a device which enables a user to directly use contents stored in the portable storage device, and a portable storage device therefor.

Digital Right Management (DRM) is a digital data that can be copied without loss and easy to reuse, process and distribute, unlike analog data. It is proposed to protect the interests and rights of digital content creators from unauthorized copying and distribution of digital content, and manages the use and distribution of the digital content in the entire cycle from the generation and destruction of arbitrary digital content. do.

1 is a view for explaining the basic concept of digital rights management, the user A 110 obtains the DRM-protected encrypted content from the content provider 120, the right to use to reproduce the encrypted content is right Obtained from a Right Object issued from the object issuer 130, the user A (110) can play the encrypted content using the rights object. The encrypted content may be freely flowed or distributed, and user A 110 may freely transmit the encrypted content to user B 150. The user B 150 who has received the encrypted content needs a rights object to play it, which must be obtained from the rights object issuer 150 again.

In this process, the certification authority 140 issues a certificate indicating that the content provider 120, the user A 110, and the user B 150 are legitimate users, and the issued certificate is stored in the user A, B (110, 150). It may be stored, and if the validator expires due to the validity period, it should be reissued by the certification authority 140.

Such DRM can activate the digital contents business by protecting the interests of those who produce or supply digital contents, but it is inconvenient to receive the rights object again in order to use the encrypted contents exchanged between users.

In order to alleviate this inconvenience, a method of allowing a device to be accessed by a device having a right object in a portable storage device has been proposed. Referring to FIG. 2, the user A 210 is encrypted from the content provider 220. The rights object for obtaining and playing the content is obtained from the rights object issuing agency 230. The rights object includes not only a right to the content but also a right to move or copy the rights object itself. 210 may deliver the encrypted content to user B 250 via portable storage 260. At this time, after mutual authentication with the portable storage device 260 having a DRM function, the rights object is moved to the portable storage device 260.

The user B 250, which has received the portable storage device 260 as described above, can play the encrypted content using the rights object stored in the portable storage device 260.

However, according to the conventional method described above, the user side, more specifically, can only be used when mutually authenticated between the device and the portable storage device to which the encrypted content is to be reproduced. There is a point.

The present invention has been proposed to solve the above-mentioned conventional problems, and the purpose is to use the content protected by DRM stored in the portable storage device using digital rights management to enable the user's device to use without additional mutual authentication. To provide a method and apparatus, and a portable storage device for the same.

As a construction means for achieving the above object, the present invention comprises the steps of selecting at least one content to be stored in one portable storage device; Generating and encrypting a certificate for the selected content; Issuing and encrypting a rights object specifying usage rights for the selected contents; Encrypting the selected content; And combining the encrypted content and the rights object to form an integrated content, and storing the encrypted content in a flash memory area of the portable storage device, and storing the encrypted certificate in a secure memory area of the portable storage device. Provides a content providing method used.

In addition, the present invention provides another configuration means for realizing the above object, comprising: selecting one or more contents to be stored in one portable storage device; Generating and encrypting a certificate for the selected contents; Issuing and encrypting a rights object specifying usage rights for the selected contents; Encrypting the selected contents; And storing the encrypted content in a flash memory area of a portable storage device, and storing the encrypted rights object and a certificate in a secure memory area of the portable storage device. do.

In addition, the present invention is another configuration means for implementing the above object, the communication I / F unit for providing an interface with the communication terminal through a communication network; When one or more contents are selected in response to a user's request through the communication I / F unit or a request of a content provider, request issuance of a certificate and a rights object for the selected contents, and the content and the issued certificate and rights object. A control unit for encrypting and outputting the encrypted data through the communication I / F unit so as to be stored in a portable storage device; A content management database that stores / manages content information sold or provided; A certificate processing unit for issuing a certificate for authenticating that the content is normal content with respect to the selected content; And a rights object processing unit which generates a rights object specifying usage rights for each content included in the contents authenticated by the certificate processing unit and provides the control unit under the control of the control unit. Provide the device.

In addition, the present invention is another configuration means for achieving the above object, a communication interface for receiving data or output data connected to the device; An access control unit which accesses the following storage unit to read / delete / move data in response to a request of a device connected through the communication interface unit; And a storage unit configured to include an accessible flash memory area and an accessible secure memory area, the one or more contents protected by the DRM, and a storage unit storing rights objects and certificates for the one or more stored contents. .

Hereinafter, a method and apparatus for providing content using digital copyright management according to the present invention and a portable storage device for the same will be described in detail with reference to the accompanying drawings. It should be noted that the same reference numerals and the same elements among the referenced drawings are represented by the same reference numerals and symbols as much as possible even though they are shown in different drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

3 is a view for explaining the concept of content provision using digital rights management according to the present invention.

In FIG. 3, reference numeral 310 is a content provider terminal for supplying content, 320 is a certificate issuing server, 330 is an issuing server of a rights object, 340 is a content providing server selling individual content and package content to users, 350 is a user terminal for purchasing and using individual content and package content, 360 is a portable storage device for storing the package content purchased by the user, and 370 has a function of playing the content stored in the portable storage device 360. The user's device.

The present invention is to store / sell the package content in the portable storage device 360 through the content providing server 340, one or more stored in the portable storage device 360 for each of the portable storage device 360 By assigning rights objects and certificates to content and storing it with the content in portable storage 360, any device 370 can simply use the content stored in portable storage 360 without complex mutual authentication procedures. I would have to.

The content provider terminal 310 is a side for supplying content to be sold. In this case, content supply may be provided to the content providing server 340 in an offline manner as well as online.

The certificate issuing server 320 is, for example, a server generating a certificate by an asymmetric based algorithm, and issues a certificate (also referred to as an album certificate) for individual content and packaged content to be sold.

The rights object issuing server 330 is a server that provides a rights object having information on usage rights for the content sold by the content providing server 340, and a rights object for predetermined content from the content providing server 340. Is requested, the certificate issuing server 320 checks whether the corresponding content is authenticated, generates a right object for the authenticated content, and provides the content providing server 340. Here, in the case of package content, the rights object generated for the package content has a form of Multi-CEK that specifies rights information for individual contents included in the package content.

The content providing server 340 receives and stores individual content or package content in an upload form from the content provider terminal 310. This is provided by the content provider in advance to separately provide the package content, the individual contents contained in the package content is fixed in advance by the content provider. On the contrary, the user can collect individual contents that he / she wants to compose the package contents. In this case, the content providing server 340 may further include a user selection function of content to be included in the package content. In this case, charging of the package content may be implemented by adding up the charges of the individual contents. When the contents are selected as described above, the content providing server 340 receives a certificate and a rights object for the corresponding contents from the certificate issuing server 320 and the rights object issuing server 330, and the rights object and certificate. And by encrypting the contents and storing the contents in the portable storage device 360, the contents are protected by the DRM in a form stored in the portable storage device 360. The provision of the content protected by the DRM may be made in such a manner that the content is directly stored in the portable storage device 360 designated by the user through the user terminal 350 from the content providing server 340 by using an online method. After the portable storage device storing the above-described content, certificate, and rights object is manufactured through a manufacturer or a manufacturer of the portable terminal, the portable device may be offline or online.

At this time, the content, the certificate, and the rights object are provided in encrypted form to prevent illegal use. The encryption key of the content is described in the rights object, and the encryption key for the rights object is described in the certificate.

For example, the content may be encrypted by a symmetric key based algorithm, the rights object is encrypted in a symmetric key based manner, and the encrypted rights object includes an encryption key of the content, a DRM policy of each content, and the like. Information is included. Next, the certificate is encrypted by a symmetric key method based on an album code, and includes an encryption key for the rights object, a certificate issued by the certificate issuing server 320, and other information.

In this case, the certificate or the certificate and the rights object may not be stored and copied in the secure area of the portable storage device 360 so that the certificate or the certificate and the rights object may be illegally copied to the other place in the portable storage device 360. Since is not copied, illegal copying or distribution can be prevented.

The portable storage device 360 is a storage device that can be attached and detached to store and move data of various digital devices such as a mobile phone, a computer, a digital camera, a PDA, and has a storage space for storing data. Has an accessible flash memory area and a restricted access secure memory area. An example of a portable storage device having only such a simple storage function is a Secure Digital (SD) memory card. In addition, the portable storage device 360 may further include a calculation and control function in addition to a simple storage function. An example of such a portable storage device is an MMC (MultiMedia Card) memory card.

The device 370 is a digital device that reads and uses data stored in the portable storage device 360. Examples of the device 370 include a mobile phone, an MP3 player, a digital camera, a PDA, and the like, and a software player for using the corresponding content. It is built.

By using the above system, the present invention can store and sell individual contents or package contents composed of two or more contents in a portable storage device, and prevent illegal use by moving or copying contents stored in the portable storage device. You can do it.

In the following description, a package content consisting of two or more individual contents will be described as an example, but the present invention is not limited thereto, and the following description is also applicable to individual contents. However, in the case of individual content, instead of the album certificate, an individual certificate for authenticating that the individual content is normally used may be used.

4 (a) and 4 (b) show a structure of providing DRM-protected package contents in a portable storage device according to the present invention.

FIG. 4A illustrates a case where the package content and the rights object are separated, and the encrypted package content 421 is stored in the flash memory area 411 in which the portable storage device 360 is free to access. The object 422 and album certificate 423 are stored together in the secure memory area 412 where the portable storage device 360 has limited access.

At this time, the DRM rights object 422 encrypted by the symmetric key based algorithm is encrypted by the album code based symmetric key method together with the album certificate 423.

In this case, the package contents 421 may be copied to another storage device. However, even if the package contents 421 are copied to other storage devices, the package object 421 may not be used because there is no right object and a certificate. However, when purchasing online, the purchase log may be managed to use the program controlled through the content providing server 340.

4B illustrates a case in which the package contents and the rights object are integrated and mounted on the portable storage device 360, and the package contents and rights encrypted in the flash memory area 411 accessible to the portable storage device 360 are free. The object stores the integrated content 424 integrated, and the album certificate 425 for the package content is stored in the secure memory area 412 of the portable storage device 360.

The integrated content 424 stored in the flash memory area 412 may be copied or moved to another place, but the album certificate 425 for this is located in the secure memory area 412 which cannot be copied or moved. Can be prevented from being used.

In the exemplary embodiments of the present invention, only the case of using the album certificates 423 and 425 is used as an example. However, without using the album certificate 423 and 425, the key is set as the seed of a serial number unique to each portable storage device 360. The key generated by the generation algorithm may be used. In this case, instead of a certificate, the secure memory area 412 of each portable storage device 360 is provided with a key generation algorithm for generating a predetermined key using the SN of the portable storage device 360 as a seed. In this case, it is not necessary to receive the album certificate for each package content through the certificate issuing server 320.

In the above-described configuration, the certificate issuing server 320, the rights object issuing server 330 and the content providing server 340 will be collectively referred to as a DRM-based package content providing server for performing the package content providing method according to the present invention. Can be.

Therefore, hereinafter, the certificate issuing server 320, the rights object issuing server 330, and the content providing server 340 are collectively referred to as a DRM-based package content providing server.

5 is a functional block diagram illustrating a schematic configuration of a DRM-based package content providing server according to an embodiment of the present invention. Referring to FIG. 5, the DRM-based package content providing server according to the present invention includes a communication interface (hereinafter referred to as 'I / F') unit 510, a controller 520, and a content management database (hereinafter, 'DB'). 530, a rights object processor 540, and a certificate processor 550.

The communication I / F unit 510 provides an interface with a user terminal and a content provider terminal through a communication network. For example, the uploaded content or package content from the provider terminal may be received and transmitted to the controller 520, the package content request from the user terminal may be received and transmitted to the controller 520, and provided by the controller 520. Package contents, rights objects, and certificates protected by the DRM may be provided to the user terminal.

The control unit 520 configures and manages package contents according to a user's request or a content provider's request through the communication I / F unit 510, and requests for issuance of a certificate and a rights object for each package content, thereby providing package contents. And encrypt and provide the issued certificate and rights object. In this case, the package content and the rights object may be provided as an integrated object or the package content and the rights object may be provided in a separate form.

The content management DB 530 is a means for storing / managing content information to be sold or provided. The individual content management DB 531 for storing individual content information and the package content management DB 532 for storing package content information. It includes. The individual content refers to conventional digital content, that is, one digital content, and the package content refers to a bundle of one or more digital contents, that is, a bundle of the individual contents.

The rights object processing unit 540 issues a rights object specifying the usage rights for each content included in the package content and provides the rights object to the controller 520. At this time, when the rights object is issued, a certificate for the corresponding package content is issued. Verify that it issues a rights object for the authenticated package content.

The certificate processing unit 550 issues an album certificate for authenticating that the package content is normal content for each package content, and generates a certificate through an asymmetric key based algorithm.

 The rights object processing unit 540 and the certificate processing unit 550 may be configured to generate a rights object and album certificate by itself. The rights object and album certificate may be requested by accessing an external rights object issuing authority and a certificate issuing authority. You can also get

6 (a) and 6 (b) show a configuration example of a portable storage device according to the present invention, and FIG. 6 (a) is a functional block diagram when only a simple storage function is provided, and FIG. 6 (b) Is a functional block diagram in the case of having an operation / control function together with a simple storage function.

Referring to FIG. 6A, the portable storage device according to the present invention includes a communication interface 611 connected to a device 370 to receive data or output data, and the communication interface 611. DRM-protected package content comprising an access control unit 612 for controlling data access from the device 270 connected through the < RTI ID = 0.0 >), < / RTI > free flash memory area 613a and restricted access secure memory area 613b. And a storage unit 613 for storing the rights object and the certificate of the package contents.

Referring to FIG. 6B, the portable storage device according to the present invention includes a communication interface 621 connected to the device 370 to receive data or output data, and the communication interface 621. When the use of the content is requested through the control unit 623 and the storage unit 624 to load the stored rights object and certificate to decrypt the package content with the key extracted from the rights object and certificate to provide to the device 370, An access control unit 622 for controlling access to data stored in the secure memory area 624b, a freely accessible flash memory area 624a and a restricted access secure memory area 624b, and are protected by DRM. And a storage unit 613 for storing rights objects and certificates of the package contents.

The storage contents of the package content, the rights object, and the certificate in the storage units 613 and 614 may be implemented as shown in FIG. 4A or FIG. 4B. That is, package contents may be stored in the flash memory areas 613a and 624a, and rights objects and certificates may be stored in the secure memory areas 613b and 624b. Alternatively, package contents and rights objects may be integrated. Can be stored in the flash memory areas 613a and 624a, and only certificates can be stored in the secure memory areas 613b and 624b.

Next, FIGS. 7 and 8 are flowcharts illustrating a procedure of providing package content in a form stored in a portable storage device by the DRM-based package content providing server of the present invention.

First, referring to FIG. 7, the DRM-based package content providing server of the present invention selects package content stored in a portable storage device (701). As described above, the package content 701 may be selected to reflect the intention of the content provider, or may be selected to reflect the needs of the user.

With respect to the selected package content, an album certificate is issued (702). The album certificate is not a personal certificate for authenticating a user or a provider, but is given to package content, and is for authenticating that the package content is distributed by a normal path and is not an illegal copy. The album certificate is generated by an asymmetric key based algorithm. The generated album certificate is then encrypted 703 by album code base.

Next, the right object for the selected package content is issued and encrypted (704). The rights object is of multi-CEK type and describes a DRM policy for each individual content included in the package content, and further includes an encryption key of each content included in the package content.

As described above, when the rights object and the certificate are issued, the selected package contents are encrypted (705). At this time, the package content is encrypted using a content encryption key included in the rights object.

Thereafter, the package content and the rights object are formed as integrated contents using an album code and stored in the flash memory area of the portable storage device, and the encrypted album certificate is stored in the secure memory area of the portable storage device (706). .

The portable storage device implemented by the above procedure has a package content, a rights object, and an album certificate in the form as shown in FIG.

Next, referring to FIG. 8, another DRM-based package content providing server, as described above with reference to FIG. 7, selects package content 801, issues and encrypts album certificates 802, 803, and rights object. Issue and encrypt 804 and encrypt 805 of package content.

However, there is a difference in the process of storing the prepared package content, rights object and album certificate in the portable storage device.

That is, as shown in (a) of FIG. 4, only encrypted package contents are stored in a flash memory area of the portable storage device, and a rights object is separated from the package content and the secure memory area of the portable storage device together with the album certificate. At 806. The portable storage device provided to the user according to the embodiment of FIG. 8 includes a package content, a rights object, and an album certificate in the form as shown in FIG.

9 and 10 are signal flow diagrams illustrating a method of using package content stored in a portable storage device as described above.

When the package contents of the portable storage device are used, the package contents should be decrypted. The decoding function of the package contents may be provided in the device or may be provided in the portable storage device.

For example, when the portable storage device has only a simple storage function such as an SD card, a decoding process of the package content must be performed on the device side, which means that a dedicated player having a decryption processing function of the package content is provided on the device side. It can be implemented by providing it in. 9 is a signal flowchart showing a content reproduction process in this case.

Referring to FIG. 9, when a device 370 requests the use of content stored in the portable storage device 360 using a dedicated player (901), the device 370 corresponds to the device 370. Digital content is provided (902).

At this time, the provided digital content is encrypted, and decryption processing is required for use.

Accordingly, the device 370 receives and provides a rights object RO for decrypting the digital content to the portable providing apparatus 360 (903, 904). Then, since the rights object RO is also encrypted, the rights object RO Obtain and request an album certificate to decrypt (905,906).

Then, the device 370 decrypts the obtained certificate to extract an encryption key of the rights object (907), decrypts the obtained rights object with the extracted rights object to extract a content encryption key (908), and The content is decrypted using the extracted content encryption key (909) and played back (910). Here, the usage right for the reproduced content is confirmed through the DRM policy of the decrypted rights object.

As another example, when the portable storage device has an operation / control function such as an MMC card, by providing a decryption processing function of package contents in the portable storage device, the device side can use the content by using a general-purpose player generally presented. Can be. 10 is a signal flow diagram illustrating a package content usage procedure in this case.

Referring to FIG. 10, when the user executes a universal player in the device 370 and requests the use of the content stored in the portable storage device 360 using the executed universal player (1001), the portable storage is performed. Device 360 first reads the requested digital content (1002). At this time, the provided digital content is encrypted and requires decryption processing for use. After confirming this, the portable storage device 360 reads a rights object RO for decrypting the digital content and an album certificate for decrypting the rights object (1003, 1004), and then decrypts the album certificate. Extract the encryption key of the extracted rights object (1005), extract the content encryption key by decrypting the obtained rights object with the extracted encryption object (1006), and decrypt the corresponding content by using the extracted content encryption key ( In operation 1008, the decrypted decoding content is provided to the device 370. In the device 370, since the provided content is in a decrypted state, it is immediately played (1009).

As described above, contents protected using the DRM stored in the portable storage device 370 according to the present invention can be used not only with a dedicated player but also through a general-purpose player.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

As described above, according to the present invention, in the portable storage device, by providing the user with the package content, by storing the certificate and the rights object for authenticating and authorizing the package content to provide to the user, In this regard, while allowing the user to use the device without a separate authentication procedure, the certificate and / or rights object may be stored in a secure memory area of the portable storage device, thereby preventing illegal use by illegal copying.

Claims (13)

In the content providing method using digital rights management in the content providing server, Selecting one or more contents to be stored in one portable storage device; Authenticating that the selected contents are normal contents and generating and encrypting a certificate including an encryption key of a rights object; Specifying a right of use for the authenticated contents and issuing a rights object including an encryption key of the content and encrypting the encryption content with an encryption key of the rights object included in the certificate; Encrypting the selected content with a content encryption key included in the rights object; And Combining the encrypted content and the rights object to form an integrated content, and storing the encrypted content in a flash memory area of the portable storage device, and storing the encrypted certificate in a secure memory area of the portable storage device. How content is delivered. In the content providing method using digital rights management in the content providing server, Selecting one or more contents to be stored in one portable storage device; Authenticating the selected contents as normal contents and generating and encrypting a certificate including a right object encryption key; Specifying a right to use the authenticated content and issuing a rights object including an encryption key of the content and encrypting the rights object with a rights object encryption key included in the certificate; Encrypting the selected content with an encryption key of content included in the rights object; And Storing the encrypted content in a flash memory area of a portable storage device, and storing the encrypted rights object and a certificate in a secure memory area of the portable storage device. delete delete The method according to claim 1 or 2, And wherein the certificate is generated by an asymmetric key based algorithm. A communication I / F unit for data exchange with a user terminal to which a portable storage device is connected; Request for issuance of a certificate for authenticating the legitimate content and a rights object specifying the right to use the content, the content is encrypted, the content encryption key is included in the issued rights object, and encrypted; After encrypting the encryption key of the rights object by including the issued certificate, at least one of the encrypted rights object or certificate is stored in a secure memory area of a portable storage device, and the rest is flash memory of the portable storage device. A controller for controlling to be stored in an area; A content management database that stores / manages content information sold or provided; A certificate processor for issuing a certificate for authenticating that the content is normal content for each content; And And a rights object processor configured to generate a rights object specifying a use right for the content authenticated by the certificate processor under the control of the controller and provide the rights object to the controller. The method of claim 6, The control unit configures the integrated content by combining the encrypted content and the rights object, and stores the encrypted content in the flash memory area of the portable storage device, and controls the encrypted certificate to be stored in the secure memory area of the portable storage device. Device for providing contents using digital rights management. The method of claim 6, The controller controls the encrypted content to be stored in the flash memory area of the portable storage device, and the encrypted rights object and the certificate are stored in the secure memory area of the portable storage device. Provision device. delete A communication interface unit connected to the device to receive data or to output data; An access control unit which accesses the following storage unit to read / delete / move data in response to a request of a device connected through the communication interface unit; And Storing an encrypted certificate including an encrypted content, an entitlement object specifying the usage rights of the content and including an encryption key of the content, authenticating that the content is legitimate and including an encryption key of the rights object, And a storage unit comprising a secure memory area storing at least one of the encrypted rights object and a certificate, and a flash memory area storing the rest. The method of claim 10, If the use of the content is requested through the communication interface unit further comprises a control unit for loading the stored rights object and certificate through the access control unit to decrypt the content with a key extracted from the rights object and certificate to provide to the device; Portable storage device. The method according to claim 10 or 11, wherein The encrypted content and the rights object are stored in the flash memory area of the storage unit, and the encrypted certificate is stored in the secure memory area. The method according to claim 10 or 11, wherein And the encrypted content is stored in a flash memory area of the storage unit, and an encrypted certificate and a rights object are stored in a secure memory area.

Images