KR100864949B1 - Digital rights management user data transfer from one terminal to another - Google Patents

Abstract

A method, apparatus, and system using a transport module deployed and used in a managed manner. This sending module has sufficient access rights to decrypt and re-encrypt the content to perform the unbinding and binding operations required to transfer the content from one terminal to the other terminal. Assuming a backup copy of the relevant data is held by the user, the backup copy is encrypted with a trusted party's key. The encrypted data can be sent to the new device. The corresponding decryption key is sent with the sending module from the trusted party to the new device.

Description

Digital rights management user data transfer from one terminal to another terminal {Digital rights management user data transfer from one terminal to another}

The present invention relates to digital content rights management and device management. More specifically, the present invention relates to digital content rights management data transmission.

Digital rights management ("DRM") is a term used to describe the technical scope of using information about the rights and rights holders of copyrighted material and the terms and conditions available to users. . More specifically, DRM includes the description, layering, analysis, value, exchange, and monitoring of the owner's ownership of an asset. DRM deals with the management of digital content rights for the physical representation of a work (eg textbooks) or the digital representation of a work (eg web pages). DRM also deals with the management of assets, whether they are tangible or intangible. Current DRM technologies include language representing terms and conditions for assets and track asset use by enforcing closed structures of controlled environments or encoded asset representations and overall management of digital rights. .

In general, DRM protection is based on the principle that every end-entity that can consume DRM-protected content usually has a unique encryption key for each end entity. DRM-protected content is distributed in encrypted form with a set of consumption rights where possible. Thus, only authorized parties who normally pay for the content can consume the content. This is done, for example, by encrypting the content with a public key that matches the recipient's secret DRM key (asymmetric key encryption). For practical reasons, a hybrid approach is usually chosen, in which the DRM protected content is encrypted under a content encryption key (CEK) using symmetric encryption. The CEK is again encoded with a public DRM key that matches the recipient's secret DRM key. The CEK may involve consumption rights (which may also be encrypted) that express the rules of use for DRM protected content.

The result is the same for both approaches, ie only authorized parties can consume DRM-protected content (if secure and correctly implemented). However, both approaches also share the drawback derived from the fact that every end entity has a unique DRM key: it must be personalized on all devices before the content (or CEK) is consumed.

Usually, DRM content is protected by the network side for a variety of reasons, such as ensuring payment for this content (eg using encryption). Typically, the network infrastructure includes a server for specifying content to be transmitted in a wireless network. However, the network-centric nature of current approaches is not very suitable for certain types of content, such as free content. The most prominent example is the content intended for preview purposes.

Thus, it is common that the transmission of purchased digital content rights management (DRM) protected content from one terminal to another cannot be performed by the end user of the terminal. Typically, rights holders of content want to enforce certain usage rights for content management, which in most cases controls how the content can be copied and what technical and security requirements must be met. Include. One challenge is to create a reliable environment in which such transmissions can be performed. DRM content bound to that particular terminal via a terminal-specific DRM database key would not be able to be sent to another terminal without technical mechanisms to obtain that key from an existing terminal. Such a transmission becomes impossible if the key is stored in the secure area of the terminal or the terminal is no longer in operation. Performing content transfer requires that the content binding for the original terminal be released and a new binding for the new terminal be established. Otherwise, the rights holder (content owner) must issue the content to the end user.

Therefore, there is a need to introduce a transport module that is distributed and used through a management scheme. Furthermore, there is a need for a transport module with sufficient access rights to decrypt and re-encrypt content to perform the unbinding and binding steps in order to transmit DRM-protected content. There is also a need for improved user data transmission under DRM.

The present invention relates to the use of a transport module distributed and used through one management scheme. This transport module has sufficient access rights to decrypt and re-encrypt content to perform the unbinding and binding operations required to transfer content from one terminal to another. Assuming a backup copy of the relevant data is held by the user, this backup copy is encrypted with a trusted party's key. The encrypted data can be sent to the new device. The corresponding decryption key is sent with the sending module from the trusted party to the new device.

Briefly, one exemplary embodiment relates to a method of transmitting data that is subject to digital content rights management (DRM) restrictions. The method includes obtaining data conforming to the DRM restriction from the original terminal at a replacement terminal, obtaining a transmission module from a trusted source at the replacement terminal, and loading the transmission module into the replacement terminal. Decrypting the data according to the DRM restriction using a key provided by the transport module, and encrypting the data according to the DRM restriction.

Another exemplary embodiment relates to an apparatus for transmitting data in accordance with DRM restrictions. The device uses the DRM user data transfer module to handle the transfer of user data in accordance with the DRM restrictions, and the key from the DRM user data transfer module to decrypt the DRM-compliant data and encrypt the data in accordance with the DRM restrictions to protect the rights stored in the device. Includes managing DRM rights server.

Another exemplary embodiment is directed to a system for transmitting data in accordance with DRM restrictions. The system comprises: an original terminal comprising a first rights database containing data subject to DRM restrictions; A replacement terminal comprising an encrypted rights database and a second rights database; And a credit entity for transmitting the transmission module to the replacement terminal. The transmitting module provides a key that allows the replacement terminal to decrypt the data complying with the DRM restrictions sent from the original terminal.

Other basic features and advantages of the present invention will become apparent to those skilled in the art upon reviewing the following figures, detailed description, and appended claims.

Exemplary embodiments will now be described with reference to the accompanying drawings.

1 is a diagram illustrating a transmission module for performing secure transmission of digital content rights management (DRM) user data from one terminal to another, according to an exemplary embodiment.

2 is a flowchart illustrating operations performed when secure transmission of DRM user data from one terminal to another terminal using a transmission module.

3 is a diagram illustrating a system for copy transmission of data in accordance with DRM restrictions in accordance with an exemplary embodiment.

1 shows a transmission module 6 for securely transmitting digital content rights management (DRM) user data from one terminal 8 to another terminal 10. The transmission module 6 handles content files or license files from the terminal 8. The transmission module 6 is preferably a software module provided from the communication service provider to the terminal 10. The transfer module 6 decrypts and re-encrypts the content and license files to facilitate DRM user data transfer. In one exemplary embodiment, the terminals 8 and 10 are cell phones and the communication service provider is an organization such as the Nokia Customer Care Organization run by the Finnish company Nokia.

2 illustrates operations performed when securely transmitting DRM user data from one terminal to another terminal using a transmission module. More, fewer, or different operations may be performed, depending on the embodiment. In operation 12, a backup copy of the user data is obtained from the original terminal. Backup copies may be provided by the user or may be made as part of the transfer procedure. In operation 14, the backup copy is stored or loaded back to the replacement terminal.

In operation 16, the transmission module is obtained from a trusted source, such as a manufacturer or a service provider customer service association. The trusted module can thus be a software module with an encryption key that allows decryption or encryption of the files. In operation 18, the transmitting module is loaded into the replacement terminal. The loading procedure may be part of the setup operation of the replacement terminal, where the replacement terminal has software applications and / or initialization information necessary for communication on the network.

In operation 20, the transport module is started up. The burnout module decrypts and re-encrypts content and license data files from the original terminal. The transfer module may handle content files (such as media files) or license data files (having a license and decryption key for the content files). This is supported through an extension of the DRM system that creates a secure data transfer container for license data files if necessary.

FIG. 3 illustrates a DRM user transfer (UDT) system 30 comprising two software elements and one data container or database used in transferring data between the original terminal 32 and the replacement terminal 34. According to an exemplary embodiment, the software elements include a DRM rights server 35 that manages rights stored on the device and a DRM user data transfer module 36 that handles the actual transfer process. The DRM UDT module 36 is a software component installed on the replacement terminal 34. The data container is a DRM user data rights database 38, which represents a transport container for transferring DRM rights between terminals 32 and 34. UDT system 30 also includes a credit entity 40, such as a service provider or manufacturer's customer care association.

The DRM rights server 35 prepares the UDT rights database 38 during a normal backup operation. The UDT rights database 38 is a security file stored at a location that is included through normal backup. After completion of the backup operation, the UDT rights database 38 is stored in a secure location such as a user desktop computer.

The process of creating the UDT rights database 38 includes at least two operations. In a first operation, the existing rights database 42 of the original terminal 32 is typically decrypted using an RDB unique key specific to the terminal and unique to each terminal. Only the DRM rights server 35 can obtain this key and perform the decryption operation. In the second operation, the decrypted DRM rights database 38 is encrypted with a special UDT key. This UDT key can be a symmetric key or a public key of a public / private key pair. This encrypted database is stored in the file system of the replacement terminal 34 as the DRM UDT rights database 44.

The performance of the actual user data transfer is based on the above preparation. In the case of UDT, the existing backup of the original terminal is restored to the replacement terminal. This backup includes a DRM UDT database containing the rights that were stored in the original terminal 32. The UDT rights database 38 is made available to the DRM rights server 35 on the replacement terminal. For this purpose, the entity performing the transfer (eg Nokia Service Point) requests the DRM UDT module 36 from the credit entity 40. The credit entity 40 sends the DRM UDT module 36 after verifying the request.

In an exemplary embodiment, the DRM UDT module 36 is started when the replacement terminal 34 restarts. Its presence is detected by the DRM rights server 35 which passes management to the UDT module 36. The UDT module includes a UDT key (a symmetric key or a secret key of a public / private key pair), thereby enabling decryption of a UDT RDB previously stored as a replacement terminal. After decrypting it, it encrypts it with the terminal RDB key, deletes itself and restarts the terminal. The newly encrypted rights database is now ready for use.

In another embodiment, no rights database is used, and the content from the original terminal 32 is directly encrypted with the terminal unique key. As such, operations as described with reference to FIGS. 1-3 are performed, but instead of decrypting and re-encrypting the rights database, the actual content files are processed at the replacement terminal.

In this detailed description, the exemplary embodiments of the data transmission method, apparatus and system according to the DRM restriction are outlined. In the foregoing description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to one skilled in the art that the exemplary embodiments may be practiced without such specific details. In other instances, structures and devices are shown in block diagram form in order to facilitate describing the exemplary embodiments.

While the exemplary embodiments shown in the drawings and described above may be said to be desirable at present, it should be understood that they have been presented by way of example only. In other embodiments, other techniques to perform the same operation may be included. The present invention is not limited to the specific embodiments, but may be extended to various modifications, combinations and substitutions within the scope and concept of the appended claims.

Claims (21)

A method of transmitting data in accordance with digital content rights management (DRM) restrictions, Acquiring data according to the DRM restriction from the original terminal by the replacement terminal; Obtaining a transmission module from a reliable source at the replacement terminal; Loading a transmission module into a replacement terminal; Decrypting data complying with the DRM restriction, using the key provided by the transmitting module; And Encrypting the data according to the DRM restriction. The method of claim 1, wherein the acquiring data according to the DRM restriction from the original terminal by the replacement terminal, Obtaining a backup copy of data complying with the DRM restriction from the original terminal; And Transmitting the backup copy to a replacement terminal. The method of claim 2, wherein the backup copy is provided by a user of the original terminal. 2. The method of claim 1, wherein the data subject to the DRM restriction includes content and license data files. The method of claim 1, wherein the data subject to the DRM restriction is encrypted using a public key of a public / private key pair. 2. The method of claim 1, wherein loading the sending module to the replacement terminal comprises communicating with a credit entity sending the sending module to the replacement terminal. 2. The method of claim 1 wherein the data following the DRM restriction is encrypted directly. The method of claim 1, wherein the data subject to the DRM restriction is located in a rights database. In the apparatus for transmitting data in accordance with the DRM restriction, A DRM user data transmission module for handling the transmission of user data in accordance with DRM restrictions; And And a DRM rights server for decrypting data according to the DRM restriction using a key from the DRM user data transmission module and then encrypting the data according to the DRM restriction to manage rights stored on the device. The method of claim 9, And a DRM user data rights database that transmits data to the device in accordance with the DRM restriction. 11. The apparatus of claim 10, wherein the DRM user data rights database retains a backup copy of data subject to DRM restrictions from the original device. 10. The apparatus of claim 9, wherein the DRM user data transfer module is transmitted from a credit entity and loaded into the device. 10. The apparatus of claim 9, wherein the data following the DRM restriction is encrypted directly. A system for transmitting data in accordance with DRM restrictions, An original terminal having a first rights database containing data subject to DRM restrictions; A replacement terminal having an encrypted rights database and a second rights database; And And a credit module for transmitting to the replacement terminal a transmission module that provides a key that allows the replacement terminal to decrypt data conforming to the DRM restrictions from the original terminal. The method of claim 14, And from the original terminal to the replacement terminal, a user data rights database for transmitting data in accordance with the DRM restriction. 16. The system of claim 15, wherein the user data rights database holds a backup copy of data subject to DRM restrictions from the original terminal. 15. The system of claim 14, wherein the data following the DRM restriction is encrypted directly. 15. The system of claim 14, wherein said transmitting module is transmitted as part of an initialization procedure. 15. The system of claim 14, wherein the original terminal and the replacement terminal are cell phones. The method of claim 14, And a rights server for managing rights stored in the replacement terminal. A transmission module configured to help communicate data according to a DRM restriction, Computer code including identification information; And At a first terminal, comprising a key for decrypting or encrypting data complying with a DRM restriction provided from a second terminal, And said transmitting module can be loaded onto a second terminal from a trusted source.

Images