DIGITAL RIGHTS MANAGMENET USING ATTRIBUTE-BASED ENCRYPTION

• US 20120260094A1
• Filed: 12/14/2010
• Published: 10/11/2012
• Est. Priority Date: 12/18/2009
• Status: Abandoned Application

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Asim, Muhammad, Petkovic, Milan, Lenoir, Petrus Johannes
• Application Number:
  US13/516,503
• Publication Number:
  US 20120260094A1
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: G06F 21/1015 to users
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

A data provider (1) for use in a digital rights management system comprises a data protector (2) for protecting data (20), using attribute-based encryption, in dependence on an access policy over a plurality of attributes. A license issuer (3) issues a license (17) comprising a representation of a set of usage rights (18), wherein the set of usage rights (18) is associated (19) with the data (20), for granting the usage rights (18) in respect of the data (20) to a plurality of entities (10) having attributes satisfying the access policy. A data receiver (10) comprises a data access subsystem (11) for accessing data, using attribute-based decryption, in dependence on a decryption key (16) associated with a set of attributes. The data receiver (10) further comprises a usage constraining subsystem (12) for constraining the access to the data (20), based on a license (17) comprising a representation of a set of usage rights (18) associated (19) with the data.

Claims

1. A data provider (1) for use in a digital rights management system, comprising

a data protector (2) for protecting data (20), using attribute-based encryption, in dependence on an access policy over a plurality of attributes;

and

a license issuer (3) for issuing a license (17) comprising a representation of a set of usage rights (18), wherein the set of usage rights (18) is associated (19) with the data (20), for granting the usage rights (18) in respect of the data (20) to a plurality of entities (10) having attributes satisfying the access policy.

2. The data provider (1) according to claim 1, wherein the data (20) comprises content and the data protector (2) comprises

a key encrypter (4) for encrypting a representation of a content key, using attribute-based encryption, to obtain an encrypted content key;

and

a content encrypter (5) for encrypting the content, based on the content key.

3. The data provider (1) according to claim 1, wherein the data protector (2) comprises a data encrypter (6) for encrypting the data (20), using the attribute-based encryption.

4. The data provider (1) according to claim 1, wherein the attribute-based encryption comprises ciphertext-policy attribute-based encryption.

5. The data provider (1) according to claim 1, wherein the license issuer (3) is arranged for including a representation of the access policy (21) in the license (17).

6. The data provider (1) according to claim 1, further comprising a key generator (7) for generating a private key associated with a subset of the plurality of attributes.

10. A digital rights management system, comprising the data provider (1) according to claim 1 and the data receiver (10) comprising:

a data access subsystem (11) for accessing data, using attribute-based decryption, in dependence on a decryption key (16) associated with a set of attributes; and

a usage-constraining subsystem (12) for constraining the access to the data (20), based on a license (17) comprising a representation of a set of usage rights (18) associated (19) with the data.

11. A license (17) for use in a digital rights management system according to claim. 10, comprising a representation of a set of usage rights (18), and an association. (19) of the set of usage rights with data (20) protected using attribute-based encryption in dependence on an access policy over a set of attributes.

7. A data receiver (10) for use in a digital rights management system, comprising

a data access subsystem (11) for accessing data, using attribute-based decryption, in dependence on a decryption key (16) associated with a set of attributes;

and

a usage-constraining subsystem (12) for constraining the access to the data (20), based on a license (17) comprising a representation of a set of usage rights (18) associated (19) with the data.

8. The data receiver (10) according to claim 7, wherein the data (20) comprises content, and the data access subsystem (11) comprises

a key decrypter (13) for decrypting an encrypted representation of a content key, using attribute-based decryption, to obtain a decrypted content key;

and

a content decrypter (14) for decrypting the content based on the decrypted representation of the content key.

9. The system according to claim 7, wherein the data access subsystem (11) comprises a data decrypter (15) for decrypting the data (20), using the attribute-based decryption.

12. A computer system comprising a data receiver (10) according to claim 7, for accessing personal health records provided by a data provider (1), said data provider comprising:

a data protector (2) for protecting data (20), using attribute-based encryption, in dependence on an access policy over a plurality of attributes; and

a license issuer (3) for issuing a license (17) comprising a representation of a set of usage rights (18), wherein the set of usage rights (18) is associated (19) with the data (20), for granting the usage rights (18) in respect of the data (20) to a plurality of entities (10) having attributes satisfying the access policy.

13. A method of providing data for use in a digital rights management system, comprising

protecting (201) data, using attribute-based encryption, in dependence on an access policy over a plurality of attributes;

and

issuing (202) a license comprising a representation of a set of usage rights, wherein the set of usage rights is associated with the data, for granting the usage rights in respect of the data to a plurality of entities having attributes satisfying the access policy.

15. A computer program product comprising computer-readable instructions for causing a processor system to perform the method according to claim 13.

14. A method of receiving data for use in a digital rights management system, comprising

accessing (301) data, using attribute-based decryption, in dependence on a decryption key associated with a set of attributes;

and

constraining (302) the access to at least part of the data, based on a license comprising a representation of a set of usage rights associated with the data.