Extending the DRM realm to external devices

• US 8,166,300 B2
• Filed: 05/08/2007
• Issued: 04/24/2012
• Est. Priority Date: 05/12/2006
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Björkengren, Ulf, Ståhl, Per, Olsson, Magnus L.
• Primary Examiner(s): Chen, Shin-Hon
• Application Number:
  US12/300,435
• Publication Number:
  US 20090313471A1
• Time in Patent Office: 1,813 Days
• Field of Search: 713150-194
• US Class Current: 713/170
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user

Abstract

Disclosed is a method and a system for rendering content on external devices securely. The method comprises setting up a communication channel between a proxy rendering server of a mobile device and an external rendering server of an external device, authenticating at least the external rendering server and upon successful authentication transferring a key from the proxy rendering server to the external rendering server, transferring the content encrypted with the transferred key from the proxy rendering server to the external rendering server for rendering the content, wherein the rendering of the content is performed in one of two modes, either in a preprocessing mode or in a non-preprocessing mode, and wherein a DRM agent is only present in the mobile device.

Claims

1. A method for rendering content, comprising the steps of:

setting up a communication channel between a proxy rendering server of a mobile device and an external rendering server of an external device;

authenticating at least the external rendering server and upon successful authentication transferring a key from the proxy rendering server to the external rendering server;

transferring the content encrypted with the transferred key from the proxy rendering server to the external rendering server for rendering the content;

where the rendering of the content is performed in one of two modes, either in a preprocessing mode for performing processing of the content by the mobile device prior to transferring the content to the external rendering server, or in a non-preprocessing mode for performing processing of the content by the external device subsequent to receiving the content, and that a digital rights management (DRM) agent for digitally managing permissions associated with the content is only present in the mobile device and not in the external rendering server to relieve the external rendering server of a need to enforce DRM rights associated with the content, where the external rendering server is not part of same physical device or software control system as the mobile device;

where the preprocessing mode implemented by the mobile device further comprises the steps of;

authenticating at least the external rendering server via an authentication protocol, and upon successful authentication;

transferring the temporary key from the proxy rendering server to the external rendering server via a key provisioning protocol;

accessing decrypted content from the DRM agent;

preprocessing the decrypted content;

re-encrypting the decrypted and preprocessed content; and

transferring the re-encrypted content to the external rendering server for decryption and rendering of the content; and

where the non-preprocessing mode implemented by the mobile device further comprises the steps of;

obtaining the Content Encryption Key from the DRM agent of the mobile device;

authenticating at least the external rendering server via an authentication protocol;

and upon successful authentication;

transferring the Content Encryption Key from the proxy rendering server to the external rendering server via a key provisioning protocol;

accessing encrypted content from a file system in the mobile device; and

transferring the encrypted content to the external rendering server for decryption and rendering of the content.

2. The method according to claim 1, where the key is a temporary key in the preprocessing mode.

3. The method according to claim 1, where the preprocessing of the decrypted content comprises modification of a format of the content.

4. The method according to claim 1, where the preprocessing of the decrypted content comprises filtering of the content.

5. The method according to claim 1, where the preprocessing of the decrypted content comprises extending the content by adding rendering parameters.

6. The method according to claim 1, where the preprocessing of the decrypted content comprises synchronizing the content according to a presentation time.

7. The method according to claim 1, where the key is a Content Encryption Key in the non-preprocessing mode.

8. The method according to claim 1, where the external device has rendering capabilities.

9. The method according to claim 1, where the authenticating further includes authenticating the proxy rendering server.

10. The method according to claim 1, where the communication between the mobile device and the external device is protected via an authentication protocol, and wherein the exchange of keys is enabled via a key provisioning protocol.

11. The method according to claim 10, where the authentication protocol and key provisioning protocol is preceded by a cipher suite negotiation protocol comprising the steps of:

the external rendering server sending a cipher suite list to the proxy rendering server;

the proxy rendering server responding by sending a random number and the chosen cipher suite to the external rendering server;

the external rendering server verifying the chosen cipher suite, and upon successful verification, accepting a commonly negotiated cipher suite.

12. The method according to claim 10, where the authentication protocol and key provisioning protocol is preceded by a step of sending rendering parameters.

13. The method according to claim 12, where the rendering parameters are selected from a group consisting of:

encryption cipher, encryption key, initialization vector (IV), padding scheme, offset to byte in content file where decryption should start, and the size of the encrypted content.

14. The method according to claim 1, where the method further comprises the steps of, prior to setting up a communication channel between the proxy rendering server and the external rendering server:

evaluating if the rendering resources are present in the mobile device, and if the rendering resources are present in the mobile device,

determining if the rendering is to be performed by the mobile device, and if the mobile device is to render the content, performing the following steps;

directing a request for rendering content from application software of the mobile device to a device rendering server of the mobile device;

verifying license credentials by the DRM agent;

allowing rendering of content upon successful verification; and

further directing the rendering request to the proxy rendering server.

15. The method according to claim 1, where the method further comprises the steps of, prior to setting up a communication channel between the proxy rendering server and the external rendering server:

evaluating if the rendering resources are present in the external device, and if the rendering resources are present in the external device,

determining if the rendering is to be performed by the external device, and if the external device is to render the content, performing the following steps;

directing a request for rendering content from application software of the mobile device to a proxy server of the mobile device;

verifying license credentials by the DRM agent; and

allowing rendering of content upon successful verification.

16. The method according to claim 15, where the evaluating and determining steps are performed by application software.

17. The method according to claim 1, where selection of the modes is performed by means of a capability discovery procedure indicating which mode to use for the external device.

18. The method according to claim 1, where selection of the modes is performed by means of a policy stored in the mobile device.

19. The method according to claim 1, where selection of the modes is performed by an active decision by an end-user.

20. An electronic device for facilitating rendering of content in an external device, the electronic device comprising:

a processor;

application software adapted to be executed by the processor for generating a request for rendering content;

a rendering server for receiving the request for rendering content;

a digital rights management (DRM) agent for verifying license credentials;

a proxy rendering server for setting up a communication channel with the external device and transferring content, where the electronic device is adapted to facilitate the content rendering in one of two modes, either in a preprocessing mode for performing processing of content by the electronic device prior to transferring the content to the external rendering server, or in a non-preprocessing mode for performing processing of content by the external device subsequent to receiving the content, and that the DRM agent for digitally managing credentials associated with the content is only present in the electronic device and not in the external device to relieve the external device of a need to enforce DRM rights associated with the content, where the external device is not part of same physical device or software control system as the mobile device;

the electronic device is adapted to facilitate the preprocessing mode by;

authenticating at least the external rendering server via an authentication protocol, and upon successful authentication;

transferring the temporary key from the proxy rendering server to the external rendering server via a key provisioning protocol;

accessing decrypted content from the DRM agent;

preprocessing the decrypted content;

re-encrypting the decrypted and preprocessed content; and

transferring the re-encrypted content to the external device for decryption and rendering of the content; and

the electronic device is adapted to facilitate the non-preprocessing mode by;

obtaining the Content Encryption Key from the DRM agent of the mobile device;

authenticating at least the external rendering server via an authentication protocol;

and upon successful authentication;

transferring the Content Encryption Key from the proxy rendering server to the external device via a key provisioning protocol;

accessing encrypted content from a file system in the mobile device; and

transferring the encrypted content to the external device for decryption and rendering of the content.

21. The electronic device according to claim 20, where the electronic device is a mobile device.

22. The electronic device according to claim 21, where the external device is a trusted entity.

23. The electronic device according to claim 21, where communication between the mobile device and the external device is protected via an authentication protocol, and where the exchange of keys is enabled via a key provisioning protocol.