KR100977498B1 - Method for Digital Rights Management - Google Patents

Abstract

The present invention relates to a digital rights management method, and more particularly, to providing a decryption key generated by a combination of a license and a key included in a content in a system supporting a content providing service to a trusted user using authentication. The present invention relates to a digital rights management method that supports more secure digital rights management.

A content packaging method of the present invention includes a digital rights management (DRM) method, comprising: generating an authentication key for authenticating a content provider and a content key included in a content header based on the content provider ID; Generating a license key included in a license based on the content ID; Generating a content encryption key by combining the license key and the content key, and encrypting content by using the generated content encryption key; And packaging the content by adding the content header to the encrypted content.

DRM, digital copyright, content, license, authorization, key

Description

How to manage digital rights {Method for Digital Rights Management}

The present invention relates to a digital rights management method, and more particularly, to providing a decryption key generated by a combination of a license and a key included in a content in a system supporting a content providing service to a trusted user using authentication. The present invention relates to a digital rights management method that supports more secure digital rights management.

Recently, with the rapid development of computers and the Internet, various documents and contents are produced and distributed in the form of computer-readable digital data. However, due to the nature of such digital content, not only can you easily make an identical copy or a variation of the original, but also can easily distribute it. Therefore, while authors of digital content, which consumes a lot of money, time, creativity, and labor, want to protect copyrights online or offline, the digital content market has been greatly influenced by the easy copying and distribution of digital content as described above. It is a big obstacle.

Therefore, many technologies are being used to ensure the safety of digital information such as firewalls, IDS solutions, PKI-based encryption solutions, and PC security solutions through PC media control to prevent illegal intrusion of external users in the network. However, the fundamental security measures for the information itself have not been suggested. Therefore, a new technology is required to continuously protect and manage the use rights control and control of the content along with access control-oriented security measures.

Accordingly, a digital rights management (DRM) system, a solution for providing a reliable distribution environment of digital information, has been provided. The DRM system encrypts various digital contents such as texts, music, images, videos, video lectures, movies, software, and games distributed through various channels, and the user terminal authenticates the corresponding contents in order to use the encrypted digital contents. A technology for obtaining a license to use the encrypted digital content from a server, protecting the digital content from illegal copying, and enabling a continuous content monetization service.

SUMMARY OF THE INVENTION An object of the present invention is to provide a digital rights management method in which digital key management can be more securely provided by providing a key for content encryption / decryption through a combination of a license and a key included in the content.

According to another aspect of the present invention, there is provided a digital rights management (DRM) method, comprising: generating an authentication key for authenticating a content provider and a content key included in a content header based on the content provider ID; Generating a license key included in a license based on the content ID; Generating a content encryption key by combining the license key and the content key, and encrypting content by using the generated content encryption key; And packaging the content by adding the content header to the encrypted content.

According to an aspect of the present invention, there is provided a digital rights management (DRM) method, comprising: receiving, by a content management server, a content registration request message for content registration from a content provider terminal; Obtaining, by the content management server, authentication information including a content provider ID, a content provider password, and MAC address information of a content provider terminal from the content registration request message and transferring the authentication information to an authentication server; Authenticating, by the authentication server, a content provider corresponding to the content ID through the authentication information; And registering, by the content management server, content information included in the content registration request message.

According to an aspect of the present invention, there is provided a digital rights management (DRM) method, the method comprising: acquiring, by a user terminal, content including an authentication key for authenticating a content provider and a content key generated based on a content provider ID; A license issuing server receiving a license issuance request message from the user terminal and delivering the license issuance message to a license management server; Obtaining, by the license management server, authentication information including a user ID, a user password, and user terminal MAC address information from the license issuance request message and transferring the authentication information to an authentication server; Authenticating, by the authentication server, a user corresponding to the user ID through the authentication information; Receiving, by the license management server, an authentication partial key generated based on the user terminal MAC address information from the authentication server; Transmitting, by the license management server, a license key generated based on content information and the authentication partial key to the license issuing server; And generating, by the license issuing server, the license based on the content information, the license key, and the authorization information, and delivering the license to the user terminal.

The present invention has the effect of providing a more secure digital rights management by allowing a content encryption / decryption key for encrypting and decrypting content to be generated through a combination of keys included in a license and content.

The terms or words used in this specification and claims are not to be construed as being limited to their ordinary or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing an embodiment of a digital rights management system according to the present invention, Figure 2 is a detailed block diagram showing an embodiment of a digital rights management system according to the present invention. 1 and 2, the digital rights management system according to an embodiment of the present invention is largely the content provider 110, content management server 120, license issuing server 140, license management server 130, VOD The server 150 and the user terminal 170 is included.

The content provider 110 and the user must first be authenticated through the authentication server 160 in order to use a content service in a digital rights management (DRM) system.

The packager 115 is a module provided to the content provider 110 to package the original content.

The packager 115 includes a key generation module and a packaging module.

The key generation module is a module for generating a content encryption key used when encrypting the original content through the AES algorithm. The content encryption key (K _ENC ) is generated as an encryption key of 128, 192, and 256 bits according to the content information and metadata information, and the license key (K _REL ) included in the license and the content key (K _CON ) included in the content header. Is created by the combination of.

The packaging module encrypts the original content by using the AES-CBC algorithm, and includes the metadata information and the header information.

The authentication server 160 generates an authentication key by using the information of the content provider 110 or the information of the user in order to authenticate the content provider 110 or the user, and uses the generated authentication key to generate the content provider ( 110) or a user verification module that performs user authentication.

The license management server 130 manages a license key K _REL , which is a partial key capable of decrypting content, and authority information about the content. In addition, the license management server 130 includes a license generation module for generating a license according to the content information and the user information.

The license issuer server 140 includes a license issuance module for issuing a license generated by the license management server 130 to a user when receiving a license issue request from a user, and manages license issue history information.

The user terminal 170 is a DRM client for playing a VOD as a terminal for receiving content in a DRM system. For example, the user terminal 170 may be an IPTV set-top box.

The user terminal 170 includes a playback control module, an unpackaging module, a key management module, and a license request module. The reproduction control module is a control module that controls the unpackaging module, the key management module, and the license request module to secure and reproduce the content protected from the DRM from the VOD server 150. The unpackaging module is a module for decrypting encrypted content, and the key management module is a module for managing authentication keys and keys for content decryption. The license request module manages a license including a right to play content, and performs a license issuance request through validation.

3 to 4 are diagrams illustrating one embodiment of a digital rights management method of the present invention.

First, prior to the description of the drawings, the parameters used in the present invention are summarized as follows.

K _S : Shared Key

K _auth : authentication key

K _{auth _1} , _{Kauth _2} : Authentication part key for generating authentication key

K _ENC : Content encryption key for encrypting content using AES-CBC algorithm

K _REL : License key that is a partial key for generating content encryption key

K _CON : Content key which is a partial key for generating content encryption key

K _DEC : Content decryption key for decrypting content

K _LIC : License signature encryption key that signs and encrypts the license key

ID: User ID (ID _U ) or Content Provider ID (ID _C )

pwd: User password (pwd _U ) or content provider password (pwd _C )

Con: Content

Con_ID: Content ID

aes-128-gen (A, B): A 128-bit key of aes using A and B information

aes-n-gen (A, B, n): Function to generate the selected n-bit key from the key lengths (128, 192, 256) supported by the AES algorithm using A and B information

aes-128-cbc-enc (Key, msg): A function that encrypts a message (msg) using an AES-CBC algorithm with a 128-bit encryption key.

aes-n-cbc-enc (Key, msg, n): Encrypts the message (msg) using an encryption key of n bits selected from the key lengths (128, 196, 256) supported by the AES-CBC algorithm. Function

aes-128-cbc-dec (Key, msg): A function that decrypts a message (msg) using an AES-CBC algorithm with a 128-bit decryption key.

aes-n-cbc-dec (Key, msg, n): Decrypt the message (msg) using the n-bit decryption key selected from the key lengths (128, 196, 256) supported by the AES-CBC algorithm. Function

sha1-hmac (Key, msg): A function that generates a message authentication code that hashes a message (msg) using a key with a key.

3 is a view showing a user authentication method in the digital rights management method according to the present invention. 3, a user authentication method according to the present invention is as follows.

First, the authentication server 160 generates an authentication key based on the content provider information or the user information through the AES-128-CBC function to authenticate the content provider 110 or the user 170. Subsequently, the authentication server 160 transmits the message including the partial information of the authentication key to the content provider terminal 110 or the user terminal 170 of the content provider in order to securely deliver the authentication key. Transfer to the terminal 170 of. The terminal 110 of the content provider or the terminal 170 of the user generates and utilizes an authentication key using partial information included in the received messages.

Through this process, the DRM system can reliably mutually authenticate the content provider 110 or the user 170 using the authentication key and the authentication key partial information.

Hereinafter, a method of mutual authentication based on a user will be described in more detail.

First, the user 170 transmits an authentication key generation request message for generating an authentication key to the content management server 120 through the user terminal 170 (S310), and the content management server 120 generates the received authentication key. The request message is transmitted to the authentication server 160 (S320).

Here, the authentication key generation request message includes information such as a user ID, a user password, and a user terminal MAC address. That is, the authentication key generation request message includes a password and a user ID (ID) encrypted with user password (pwd) and user terminal MAC address (MAC) information using a shared key (K _S ), and can be expressed as follows. .

Subsequently, the authentication server 160 generates a first authentication key (K1 _auth ) based on the user ID (ID), the user password (pwd), and the user terminal MAC address (MAC) information included in the authentication key generation request message. do.

The authentication server 160 sends messages including the authentication portion key to generate the same authentication key as the first authentication key to securely transfer the generated first authentication key to the user terminal 170 to the user terminal 170. By transmitting, the user terminal 170 can generate and utilize the same authentication key as the first authentication key.

Here, the first authentication key can be expressed as follows.

To this end, the authentication server 160 first generates a first authentication portion key (K _{auth _1} ) based on the user ID (ID) and user password (pwd) included in the authentication key generation request message and the first authentication key. Transfer to the user terminal 170 together (S330).

Here, the first authentication partial key can be expressed as follows.

That is, the authentication server 160 hashes the first authentication partial key with a user password (pwd), encrypts it with a shared key, includes the first authentication message in the first response message (Response_1), and transmits the same to the user terminal 170. The key is hashed with a user password (pwd) and included in the first response message and transmitted to the user terminal 170.

Here, the first response message can be expressed as follows.

In addition, the authentication server 160 generates a second authentication partial key (K _{auth _2} ) based on the user terminal MAC address (MAC) information included in the authentication key generation request message and the user terminal through the content management server 120. Transfer to 170 (S340, S350).

Here, the second authentication partial key can be expressed as follows.

That is, the authentication server 160 hashes the second authentication partial key with the user password (pwd), encrypts the hashed value with the shared key, and includes the second response message in the second response message (Response_2) to allow the user through the content management server 120. Transfer to the terminal 170.

Here, the second response message can be expressed as follows.

The user terminal 170 obtains a first authentication partial key and a second authentication partial key from the received first response message and the second response message, and combines them to generate a second authentication key (K2 _auth ). That is, the user terminal 170 decrypts a cipher value included in the received first response message, decrypts the received second response message, and combines the decrypted values to generate a second authentication key.

Here, the second authentication key can be expressed as follows.

The user terminal 170 generates a hash value v using the SHA-1 function of the second authentication key generated by the user terminal 170, and the first authentication included in the generated hash value v and the first response message. The key hash value (hash) is compared with each other and the result information is transmitted to the authentication server 160 (S360).

Here, the mutual comparison between the second authentication key hash value and the first authentication key hash value may be expressed as follows.

As such, after the user terminal 170 secures the authentication key, the user terminal 170 may access the DRM system and receive the service. That is, the user terminal 170 transmits authentication information, which is an authentication message (Auth _msg ) including a user ID (ID) and the obtained authentication key (K _auth ), to the content management server 120, and the authentication server 160. After authentication through, you will be provided with a content providing service.

As described above, the authentication key is used as authentication information of a user or a content provider in a content uploading process and a content obtaining process.

Here, authentication information which is an authentication message can be expressed as follows.

In this case, the ID used, the ID, password, and MAC address included in the authentication key (K _auth ) vary depending on whether the user is the user 170 or the content provider 110. That is, the user ID (ID _U ), the user password (pwd _U ), and the user MAC address (MAC _U ) are used for authentication when authenticating the user 170, and the content provider ID when authenticating the content provider 110. (ID _C ), content provider password (pwd _C ) and content MAC address (MAC _C ) are used.

4 is a diagram illustrating a content registration method in the digital rights management method according to the present invention.

Referring to FIG. 4, the content registration method according to the present invention relates to a VOD content registration process from a content provider to a DRM system. That is, the content registration method is largely divided into a content packaging method in which the content provider 110 packages the content through the packager 115, and a content upload method for registering the packaged content, content information, and authority information in the DRM system. .

First, the content packaging method is as follows.

The content provider 110 packages the original content using the packager 115. Packaging is the encryption of the original content using the AES-CBC algorithm. At this time, a key is required to encrypt the content.

In order to generate a key capable of encrypting the content, the content provider 110 first generates a content key K _CON included in the content header based on the authentication key K _auth and the content provider ID ID. Based on the content information (Con_ID, Con_name, etc.), a license key (K _REL ) included in the license is generated.

Here, the content key and the license key can be expressed as follows.

Subsequently, the content provider 110 generates a content encryption key K _ENC by combining the generated content key and the license key.

Here, the content encryption key can be expressed as follows.

The content provider 110 encrypts the content using the generated content encryption key and packages the content by adding a content header to the encrypted content.

Here, the encrypted content (Con _Pack ) and the packaged content (Con _Enc ) can be expressed as follows.

In addition, the content header included in the packaged content includes a hash value hashing the content encryption key and the license key, and a value obtained by encrypting the content key message authentication code (K _{Con_msg} ) hashed with the content key with the license key (K _{CON _). Info} ).

Here, the content header can be expressed as follows.

At this time, Con_ID means content ID, enc _Info means encryption related information, and Con _Info means content related information.

Next, the content upload method is as follows. The content upload method may be divided into a method of registering content information and a method of registering a license.

First, referring to the method of registering the content information, after the packaging of the content is completed, the content provider 110 transmits a content registration request message for registering the content information to the content management server 120 (S410). The content registration request message includes authentication information (Auth _msg ) for authenticating the content provider 110 together with the content information to be registered.

The content management server 120 secures the authentication information included in the content registration request message and transmits it to the authentication server 160 (S420).

Here, the authentication information can be expressed as follows.

In this case, the ID, password, and MAC address included in the authentication information are the content provider ID, the content provider password, and the content provider terminal MAC address.

The authentication server 160 authenticates the content provider 110 through the authentication information received from the content management server 120, and the content management server 120 registers the content information according to the result.

Next, in the content upload method, looking at the license registration method, after the content provider 110 registers the content information to the content management server 120, the content provider 110 requests a license registration for registering a license The message is transmitted to the license management server 130 (S430). The license registration request message includes authentication information for authenticating the content provider 110 together with the license key and authority information to be registered. In addition, the license registration request message includes an encryption value obtained by encrypting the hash value msg hashed from the license key K _REL based on the content information with the authentication partial key K _{auth_2} with the shared key K _S.

Here, the license registration request message (Register _msg ) including the password value can be expressed as follows.

The license management server 130 secures the authentication information included in the license registration request message and transmits it to the authentication server 160 (S440). The authentication information is the same as the authentication information used to authenticate the content provider 110 at the time of registration of the content information.

The authentication server 160 authenticates the content provider 110 through the authentication information received from the license management server 130.

After the content provider 110 is authenticated, the authentication server 160 transmits the authentication portion key (K _{auth_2} ) generated based on the content provider terminal MAC address information together with the authentication result information to the license management server 130 ( S450).

The license management server 130 receives authentication result information from the authentication server 160 to confirm the authentication of the content provider 110, and authenticates the message received from the content provider 110. That is, in order to authenticate the message received from the content provider 110, the license management server 130 first decodes the license registration request message (Register _msg ) with a shared key and decrypts the message (msg) delivered by the content provider 110. Secure. The hash value v to be compared with the decrypted message msg is generated using the authentication partial key K _{auth_2} received from the authentication server 160. The message including the license key delivered by the content provider 110 is authenticated by comparing the obtained message msg with the generated hash value v.

Here, the authentication process can be expressed as follows.

After the license management server 130 authenticates the message including the license key received from the content provider 110, the license management server 130 registers a license including the license key and the authority information based on the content information.

When the content information and license information is normally registered in the content management server 120 and the license management server 130, the encrypted content is uploaded to the VOD server 150 (S460).

5 is a diagram illustrating a content securing method in the digital rights management method according to the present invention. The set top box of FIG. 5 may be a user terminal 170.

First, the user terminal 170 transmits authentication information to the content management server 120 to request its own authentication. After the user terminal 170 is authenticated through the authentication server 160 using the authentication information received by the content management server 120, the content management server 120 may use the service as the user terminal 170. Communicate information When the user selects one of the received content information, the selected content is downloaded from the VOD server 150 and provided.

At this time, the user terminal 170 must generate a content decryption key to play the provided content. The content decryption key is generated by a combination of the content key included in the content header and the license key included in the license.

In order to secure a license key, a license should be issued through authentication, and the issued license key should be written as a message authentication code using authentication information, and then encrypted and transmitted.

In addition, since the content key is included in the content header, the received content is decrypted and secured.

First, a method of obtaining a license key is as follows.

The user terminal 170 transmits a license issuance request message including the content ID and authentication information to the license issuing server 140 (S510).

The license issuing server 140 transmits the received license issuance request message to the license management server 130 (S520).

The license management server 130 transmits the authentication information to the authentication server 160 to authenticate the user terminal 170. That is, the license management server 130 transmits the authentication information to the authentication server 160 to request the authentication of the user terminal 170 (S530). The authentication server 160 receiving the authentication information authenticates the user terminal 170, and encrypts the authentication result information along with the authentication partial key generated based on the MAC address information of the user terminal and transmits it to the license management server 130. (S540).

The license management server 130 decrypts the information received from the authentication server 160 to secure the authentication portion key (K _{auth_2} ), and hashes the hash value (msg) hashing the license key (K _REL ) corresponding to the content ID. The password is transferred to the license issuing server 140 together with the authentication partial key obtained by encrypting the encrypted value K _LIC encrypted with the shared key K _S (S550).

Here, the hash value msg and the password value K _LIC can be expressed as follows.

Subsequently, the license issuing server 140 generates a license based on the content ID, the license key and the authority information, and transmits the license to the user terminal 170 (560).

The user terminal 170 secures a license key included in a license received from the license issuing server 140 and secures a content key included in a content header.

At this time, the authentication of the license key and the content key is as follows.

First, since the license key is included in the password value K _LIC delivered to the license issuing server 140 by the license management server 130, it is possible to authenticate using this. That is, the user terminal 170 decrypts the cipher value K _LIC included in the license with a shared key, secures a hash value msg, and uses the authentication partial key K _{auth_2} received from the authentication server 160. Hash value v to be compared with the decoded hash value msg is generated. The information including the license key transmitted from the license issuing server 140 is authenticated through mutual comparison between the obtained hash value msg and the generated hash value v.

Here, the authentication process can be expressed as follows.

In addition, since the content key is included in the provided content header, authentication is possible using the content header information. That is, the user terminal 170 _secures the hash value K _{Con_msg} obtained by decrypting the encryption value K _{CON_Info} included in the content header with the license key, and compares the hash value K _{Con _ msg with the} obtained hash value (K _{Con _ msg} ). The value v is generated using the content key and the shared key. The information including the content key is authenticated by comparing the obtained hash value (K _{Con_msg} ) with the generated hash value (v).

Here, the authentication process can be expressed as follows.

The user terminal 170 generates a content decryption key for decrypting the content by combining the secured license key and the content key and reproduces the provided content using the generated content decryption key.

Here, the content decryption key K _DEC may be expressed as follows.

The generated content decryption key may be authenticated through the following authentication process. That is, the user terminal 170 secures the hash value Hash hashing the content encryption key K _ENC included in the content header, and the hash value v to be compared with the secured hash value Hash. Is generated using the content decryption key. The user terminal 170 authenticates the content decryption key by comparing the secured hash value with the generated hash value v. FIG.

Here, the authentication process can be expressed as follows.

Although the present invention has been shown and described with reference to the preferred embodiments as described above, it is not limited to the above embodiments and those skilled in the art without departing from the spirit of the present invention. Various modifications and variations are possible without departing from the spirit of the present invention and equivalents of the claims to be described below.

1 is a block diagram showing an embodiment of a digital rights management system according to the present invention;

2 is a detailed block diagram showing an embodiment of a digital rights management system according to the present invention;

3 is a view showing a user authentication method in the digital rights management method according to the present invention;

4 is a view showing a content registration method in the digital rights management method according to the present invention;

5 is a diagram illustrating a content securing method in the digital rights management method according to the present invention.

                 <Explanation of symbols for the main parts of the drawings>

110: content provider 115: packager 120: content management server

130: license management server 140: license issuing server 150: VOD server

160: authentication server 170: user terminal

Claims (7)

In the digital rights management (DRM) method, Generating an authentication key for authenticating the content provider and a content key included in the content header based on the content provider ID; Generating a license key included in a license based on the content ID; Generating a content encryption key by combining the license key and the content key, and encrypting content by using the generated content encryption key; And Packaging the content by adding the content header to the encrypted content; and And the content header includes the content ID, the content key, and the license key. delete The method of claim 1, Wherein the authentication key is generated based on content provider ID, content provider password, and content provider terminal MAC address information. In the digital rights management (DRM) method, Receiving, by the content management server, a content registration request message for registering content from a content provider terminal; Obtaining, by the content management server, authentication information including a content provider ID, a content provider password, and MAC address information of a content provider terminal from the content registration request message and transferring the authentication information to an authentication server; Authenticating, by the authentication server, a content provider corresponding to the content ID through the authentication information; And Registering, by the content management server, content information included in the content registration request message; Content upload method comprising a. The method of claim 4, wherein Receiving, by a license management server, a license registration request message for registration of a license for the content from the content provider terminal; Obtaining, by the content management server, the authentication information from the license registration request message and transferring the authentication information to the authentication server; Authenticating, by the authentication server, the content provider through the authentication information; Receiving, by the license management server, an authentication partial key generated based on the content provider terminal MAC address information from the authentication server; Authenticating, by the license management server, the license registration request message through the authentication partial key; And Registering, by the license management server, the license including a license key and authorization information based on the content information; More, The license registration request message includes a cryptographic value obtained by encrypting a hash value hashed by the license key with the authentication partial key with a shared key. In the digital rights management (DRM) method, Obtaining, by the user terminal, content including an authentication key for authenticating the content provider and a content key generated based on the content provider ID; A license issuing server receiving a license issuance request message from the user terminal and delivering the license issuance message to a license management server; Obtaining, by the license management server, authentication information including a user ID, a user password, and user terminal MAC address information from the license issuance request message and transferring the authentication information to an authentication server; Authenticating, by the authentication server, a user corresponding to the user ID through the authentication information; Receiving, by the license management server, an authentication partial key generated based on the user terminal MAC address information from the authentication server; Transmitting, by the license management server, a license key generated based on content information and the authentication partial key to the license issuing server; And Generating, by the license issuing server, the license based on the content information, the license key, and the authority information, and delivering the license to the user terminal; Content acquisition method comprising a. The method of claim 6, Obtaining, by the user terminal, the content key included in a content header from the content; Acquiring, by the user terminal, the license key from the license; And Generating, by the user terminal, a content decryption key for content reproduction by combining the content key and the license key Content acquisition method further comprising.

Images