DOMAIN DIGITAL RIGHTS MANAGEMENT SYSTEM, LICENSE SHARING METHOD FOR DOMAIN DIGITAL RIGHTS MANAGEMENT SYSTEM, AND LICENSE SERVER

• US 20090208016A1
• Filed: 02/18/2008
• Published: 08/20/2009
• Est. Priority Date: 02/18/2008
• Status: Active Grant

• Current Assignee: Sungkyunkwan University Foundation For Corporate Collaboration (SungKyunKwan University)
• Original Assignee: Sungkyunkwan University Foundation For Corporate Collaboration (SungKyunKwan University)
• Inventors: Won, Dong Ho, Lee, Yun Ho, Kim, Seung Joo, Choi, Dong Hyun
• Granted Patent: US 8,165,304 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Disclosed is a domain DRM system, a license sharing method for the domain DRM system, and a license server. The domain DRM system includes at least one domain including at least one user module adapted for encryption or decryption using a provided encryption key and a domain manager adapted for decryption using a provided encryption key, and a license server for creating encryption keys corresponding to the domain manager and the one user module, respectively, and providing them with the created contents, respectively, so that, when at least one user module requests contents, a contents encryption key used to encrypt the contents is encrypted by using an encryption key of the user module and an encryption key of the domain manager according to a commutative encryption scheme, and one of the domain manager and the user module is provided with a shared license obtained as a result of encryption.

Claims

1. A domain DRM system comprising:

at least one domain comprising at least one user module adapted for encryption or decryption using a provided encryption key and a domain manager adapted for decryption using a provided encryption key; and

a license server for creating encryption keys corresponding to the domain manager and at least one user module, respectively, and providing the domain manager and at least one user module with the created contents, respectively, so that, when at least one user module requests contents, a contents encryption key used to encrypt the contents is encrypted by using an encryption key of the user module and an encryption key of the domain manager according to a commutative encryption scheme, and one of the domain manager and the user module is provided with a shared license obtained as a result of encryption.

2. The domain DRM system as claimed in claim 1, wherein the license server is adapted to provide the domain manager with a server certificate for mutual authentication between the domain manager and the license server, when the domain manager provides the license server with a domain certificate in response to a registration request of the domain manager.

3. The domain DRM system as claimed in claim 2, wherein the domain manager is adapted to provide the license server with at least one selected from the group consisting of a domain ID of the domain, the domain manager belonging to the domain, a user module list enumerating a module ID of at least one user module belonging to the domain, a public key of each user module, and a public key of the domain manager when the mutual authentication is completed.

4. The domain DRM system as claimed in claim 3, wherein at least one user module is adapted to transmit the module ID of the user module, the public key allocated to the user module in advance, and a module certificate of the user module to the domain manager so that the user module is registered in the domain, the domain manager belonging to the domain.

5. The domain DRM system as claimed in claim 3, wherein the license server is adapted to create encryption keys corresponding to the domain manager and at least one user module, respectively, encrypt the encryption keys corresponding to the domain manager and at least one user module by using corresponding public keys, respectively, and provide the domain manager and at least one user module with the corresponding encrypted encryption keys, respectively.

6. The domain DRM system as claimed in claim 1, wherein the license server comprises:

an encryption key creation module for creating encryption keys corresponding to the domain manager and at least one user module, respectively; and

an encryption module for encrypting a contents encryption key used to encrypt contents requested by a first module of the user modules by using the encryption keys corresponding to the first module and the domain manager, respectively, according to the commutative encryption scheme.

7. The domain DRM system as claimed in claim 6, wherein the shared license is encrypted by the encryption module according to the commutative encryption scheme as defined by equation

CE_K1(CE_K2(M))=CE_K2(CE_K1(M))

wherein, CE_K(M) refers to encryption of data M by an encryption key K, and CE_K1(CE_K2(M)) means that the data M is encrypted by an encryption key K2 and is again encrypted by an encryption key K1.

8. The domain DRM system as claimed in claim 7, wherein the first module is adapted to provide the domain manager with the shared license when the license server provides the first module with the shared license.

9. The domain DRM system as claimed in claim 7, wherein the domain manager comprises a decryption module for decrypting the shared license by using the encryption key provided by the license server, when the domain manager is provided with the shared license, so that the first module is provided with the decrypted shared license.

10. The domain DRM system as claimed in claim 9, wherein the first module comprises an encryption/decryption module for decrypting the decrypted shared license by using the encryption key provided by the license server, when the domain manager provides the first module with decrypted shared license, so that the contents encryption key used to encrypt the contents can be obtained from the shared license.

11. The domain DRM system as claimed in claim 7, wherein the first module is adapted to decrypt the shared license provided by the license server by using the encryption key provided by the license server and provide a second module with the decrypted shared license, when the second module in the domain requests that the shared license be shared.

12. The domain DRM system as claimed in claim 11, wherein the second module is adapted to encrypt the decrypted shared license by using the encryption key provided by the license server and provide the domain manager with the encrypted shared license, when the first module provides the second module with the decrypted shared license.

13. The domain DRM system as claimed in claim 9, wherein the domain manager further comprises a stamp/signature module for creating a shared license concatenated with a time stamp by concatenating the shared license decrypted by the decryption module with a time stamp corresponding a current time value, creating an electronic signature value by hashing the shared license concatenated with the time stamp and electronically signing a resulting hash value, and providing the first module with the shared license concatenated with the time stamp and the electronic signature value.

14. The domain DRM system as claimed in claim 13, wherein the first module further comprises a legitimacy determination module for determining if the electronic signature value corresponds to the domain manager, if a value obtained by hashing the shared license concatenated with the time stamp by using the public key of the domain manager equals the electronically signed hash value, and if a difference between a value of the time stamp and current time is below a predetermined threshold, when the domain manager provides the first module with the shared license concatenated with the time stamp and the electronic signature value.

15. The domain DRM system as claimed in claim 14, wherein the first module is adapted to remove the time stamp from the shared license concatenated with the time stamp by using the encryption/decryption module, decrypt the shared license by using the encryption key provided by the license server, and obtain the contents encryption key from the shared license, when it is determined that the electronic signature value corresponds to the domain manager, that the value obtained by hashing the shared license concatenated with the time stamp by using the public key of the domain manager equals the electronically signed hash value, and that the difference between the value of the time stamp and current time is below the predetermined threshold.

16. A method for sharing a license for a domain DRM system, the method comprising the steps of:

creating encryption keys corresponding to a domain manager and at least one user module, respectively, and providing the domain manager and at least one user module with corresponding encryption keys by a license server, respectively;

receiving a request for contents from a first module of the user modules and encrypting a contents encryption key in response to the request, the contents encryption key having been used to encrypt the contents, by using the encryption keys corresponding to the first module and the domain manager, respectively, according to a commutative encryption scheme by the license server; and

providing one of the domain manager and the first module with a shared license as a result of encryption by the license server.

17. The method as claimed in claim 16, further comprising a step of providing the domain manager with a server certificate of the license server for mutual authentication between the domain manager and the license server, when the domain manager provides the license server with a domain certificate in response to a registration request of the domain manager.

18. The method as claimed in claim 17, further comprising a step of providing the license server with at least one selected from the group consisting of a domain ID of the domain, the domain manager belonging to the domain, a user module list enumerating a module ID of at least one user module belonging to the domain, a public key of each user module, and a public key of the domain manager when the mutual authentication is completed.

19. The method as claimed in claim 18, further comprising a step of transmitting the module ID of at least one user module, the public key allocated to the user module in advance, and a module certificate of the user module to the domain manager by the user module so that the user module is registered in the domain, the domain manager belonging to the domain.

20. The method as claimed in claim 19, wherein the step of creating and providing respective encryption keys comprises the steps of:

creating encryption keys corresponding to the domain manager and at least one user module, respectively;

encrypting the encryption keys corresponding to the domain manager and at least one user module, respectively, by using corresponding public keys; and

providing the domain manager and at least one user module with the corresponding encrypted encryption keys, respectively.

21. The method as claimed in claim 16, wherein the shared license is encrypted according to the commutative encryption scheme as defined by equation

CE_K1(CE_K2(M))=CE_K2(CE_K1(M))

wherein, CE_K(M) refers to encryption of data M by an encryption key K, and CE_K1(CE_K2(M)) means that the data M is encrypted by an encryption key K2 and is again encrypted by an encryption key K1.

22. The method as claimed in claim 21, further comprising a step of providing the domain manager with the shared license by the first module when the license server provides the shared license.

23. The method as claimed in claim 22, further comprising a step of decrypting the shared license by using the encryption key provided by the license server, when the shared license is provided, and providing the first module with the decrypted shared license by the domain manager.

24. The method as claimed in claim 23, further comprising a step of decrypting the decrypted shared license by using the encryption key provided by the license server, when the domain manager provides the decrypted shared license, and obtaining the contents encryption key by the first module.

25. The method as claimed in claim 21, further comprising a step of decrypting the shard license by using the encryption key provided by the license server, when a second module in the domain requests that the shared license be shared, and providing the second module with the decrypted shared license by the first module.

26. The method as claimed in claim 25, further comprising a step of encrypting the decrypted shared license by using the encryption key provided by the license server, when the first module provides the decrypted shared license, and providing the domain manager with the encrypted shared license by the second module.

27. The method as claimed in claim 24, wherein the step of providing the first module with the decrypted shared license comprises the steps of:

decrypting the shared license by using the encryption key provided by the license server by the domain manager;

concatenating the decrypted shared license with a time stamp corresponding to a current time value;

creating an electronic signature value by hashing the shared license concatenated with the time stamp and electronically signing a resulting hash value; and

providing the first module with the shared license concatenated with the time stamp and the electronic signature value.

28. The method as claimed in claim 27, wherein the step of decrypting the shared license by the first module comprises the steps of:

determining if the electronic signature value corresponds to the domain manager, if a value obtained by hashing the shared license concatenated with the time stamp by using a public key of the domain manager equals the electronically signed hash value, and if a difference between a value of the time stamp and current time is below a predetermined threshold, when the shared license concatenated with the time stamp and the electronic signature value are provided;

removing the time stamp from the shared license concatenated with the time stamp when it is determined that the electronic signature value corresponds to the domain manager, that the value obtained by hashing the shared license concatenated with the time stamp by using the public key of the domain manager equals the electronically signed hash value, and that the difference between the value of the time stamp and current time is below the predetermined threshold; and

decrypting the shared license by using the encryption key provided by the license server.

29. A license server comprising:

an encryption key creation module for creating encryption keys corresponding to a domain manager and at least one user module belonging to a domain, respectively;

an encryption module for encrypting a contents encryption key used to encrypt contents requested by a first module of the user modules by using the encryption keys corresponding to the first module and the domain manager, respectively, according to a commutative encryption scheme; and

a communication module for transmitting the encryption keys created by the encryption key creation module to the domain manager and at least one user module, respectively, and providing one of the domain manager and the first module with a shared license as a result of encryption by the encryption module.

30. The license server as claimed in claim 29, wherein the shared license is encrypted by the encryption module according to the commutative encryption scheme as defined by equation

CE_K1(CE_K2(M))=CE_K2(CE_K1(M))

wherein, CE_K(M) refers to encryption of data M by an encryption key K, and CE_K1(CE_K2(M)) means that the data M is encrypted by an encryption key K2 and is again encrypted by an encryption key K1.