Security management method and apparatus in multimedia middleware, and storage medium therefor

• US 20070192834A1
• Filed: 01/11/2007
• Published: 08/16/2007
• Est. Priority Date: 01/11/2006
• Status: Active Grant

• Current Assignee: Korea Advanced Institute of Science and Technology, Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Jung, Ki-Ho, Song, Young-Joo, Hendry, Kim, Mun-Churl
• Granted Patent: US 8,000,680 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4433 Implementing client middleware, e.g. Multimedia Home Platform [MHP]
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/83555 using a structured language for describing usage rules of the content, e.g. REL

Abstract

A security management method in multimedia middleware of a terminal that can download a multimedia service provided from an external entity. The security management method includes if there is an access request for a particular multimedia service, determining whether there is a corresponding multimedia service; if the access-requested multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity; setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and receiving information for the download from the external entity through the secure session, and determining whether to execute the download.

Claims

1. A security management method in multimedia middleware of a terminal that can download a multimedia service provided from an external entity, the method comprising:

if there is an access request for a particular multimedia service, determining whether there is a corresponding multimedia service;

if the access-requested multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity;

setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

receiving information for the download from the external entity through the secure session, and determining whether to execute the download.

2. The security management method of claim 1, wherein the security parameter is expressed as metadata.

3. The security management method of claim 1, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

4. The security management method of claim 1, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

5. The security management method of claim 4, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

6. The security management method of claim 4, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

7. The security management method of claim 4, wherein the Signature Types comprises at least one of:

Canonicalization Methods indicating a list of canonicalization algorithms;

Signature Methods indicating a list of generation and verification algorithms;

Transform Methods indicating a list of transform algorithms; and

Digest Methods indicating a list of digest algorithms;

all of which are used for signature provided by the multimedia middleware.

8. The security management method of claim 4, wherein the Encryption Types comprises at least one of:

Encrypted Data Encoding Methods;

Encryption Methods;

Digest Methods; and

Key Agreement Methods;

all of which are supported by the multimedia middleware.

9. The security management method of claim 1, further comprising:

if the access-requested multimedia service does not exist before the negotiation, acquiring a network address of the external entity; and

providing a plurality of security parameters supported by the multimedia middleware to the external entity for connection of the secure session to the external entity.

10. The security management method of claim 1, wherein the determination of whether to execute the download further comprises:

receiving a Service Profile of the multimedia service desired to be downloaded from the external entity through the set secure session;

checking a Target Profile related to the Service Profile and a Security Profile related to the secure session;

determining to download the multimedia service based on the Service Profile, the Target Profile and the Security Profile; and

downloading the multimedia service through the secure session.

11. A security management apparatus in multimedia middleware of a terminal that can download a multimedia service provided from an external entity, the apparatus comprising:

a security manager for, if a requested particular multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity, and setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

a service manager for, if there is an access request for the particular multimedia service, determining whether there is the particular multimedia service, receiving information for the download from the external entity through the secure session, and determining whether to execute the download.

12. The security management apparatus of claim 11, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

13. The security management apparatus of claim 11, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

14. The security management apparatus of claim 13, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

15. The security management apparatus of claim 13, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

16. The security management apparatus of claim 13, wherein the Signature Types comprises at least one of:

Canonicalization Methods indicating a list of canonicalization algorithms;

Signature Methods indicating a list of generation and verification algorithms;

Transform Methods indicating a list of transform algorithms; and

Digest Methods indicating a list of digest algorithms;

all of which are used for signature provided by the multimedia middleware.

17. The security management apparatus of claim 13, wherein the Encryption Types comprises at least one of:

Encrypted Data Encoding Methods;

Encryption Methods;

Digest Methods; and

Key Agreement Methods;

all of which are supported by the multimedia middleware.

18. The security management apparatus of claim 11, wherein if the particular multimedia service does not exist, the service manager acquires a network address of the external entity from an M3W Run-time Environment (RRE) in the terminal.

19. The security management apparatus of claim 11, wherein the security manager provides a plurality of security parameters supported by the multimedia middleware to the external entity for connection of the secure session to the external entity.

20. The security management apparatus of claim 11, wherein the service manager comprises:

receiving a Service Profile of the multimedia service desired to be downloaded from the external entity through the set secure session;

checking a Target Profile related to the Service Profile from the RRE in the terminal;

checking a Security Profile related to the secure session from the security manager;

determining whether to download the multimedia service based on the Service Profile, the Target Profile and the Security Profile.

21. A storage medium in which multimedia middleware capable of downloading a multimedia service is stored, the storage medium comprising:

a security manager for, if a requested particular multimedia service does not exist in the multimedia middleware, performing negotiation for secure session setup with an external entity from which the multimedia service can be downloaded, and setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

a service manager for, if there is an access request for the particular multimedia service, determining whether there is the particular multimedia service, receiving information for the download from the external entity through the secure session, and determining whether to execute the download.

22. The storage medium of claim 21, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

23. The storage medium of claim 21, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

24. The storage medium of claim 23, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

25. The storage medium of claim 23, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

26. A security management method performed in multimedia middleware in a terminal, the method comprising:

if there is an access request to a particular multimedia service from a particular application program, checking a license list including its access right information; and

if the particular application program is granted access to the particular multimedia service, delivering a handler for the particular multimedia service to the particular application program;

wherein the license list includes information indicating an access right of application programs for middleware services supportable by the terminal.

27. The security management method of claim 26, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

28. The security management method of claim 27, wherein the access principal is the application program, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

29. The security management method of claim 27, wherein the access principal is the application program, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

30. The security management method of claim 27, wherein the access principal is the application program, and the information indicating the access object comprises an identifier of the multimedia service and key information granted with an electronic signature method.

31. The security management method of claim 27, wherein the access principal is the application program, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

32. A security management method performed in multimedia middleware in a terminal, the method comprising:

if there is an access request to a particular platform resource from a particular multimedia service, generating an access identifier thereof; and

checking a license list including access right information based on the access identifier; and

if the particular multimedia service is granted access to the particular platform resource, delivering system resource to the particular multimedia service;

wherein the license list comprises information indicating an access right of multimedia services for platform resources supported by the terminal.

33. The security management method of claim 32, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

34. The security management method of claim 33, wherein the access principal is the multimedia service, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

35. The security management method of claim 33, wherein the access principal is the multimedia service, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

36. The security management method of claim 33, wherein the access principal is the multimedia service, and the information indicating the access object comprises an identifier of the platform resource and key information granted with an electronic signature method.

37. The security management method of claim 33, wherein the access principal is the multimedia service, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

38. A security management apparatus included in multimedia middleware in a terminal, the apparatus comprising:

a service manager for receiving an access request to a particular multimedia service from a particular application program, and delivering a handler for the particular multimedia service to the particular application program, if the particular application program is granted access to the particular multimedia service; and

a security manager for checking a license list including access right information for the particular application program in response to a request of the service manager;

wherein the license list comprises information indicating an access right of application programs for middleware services supportable by the terminal.

39. The security management apparatus of claim 38, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

40. The security management apparatus of claim 39, wherein the access principal is the application program, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

41. The security management apparatus of claim 39, wherein the access principal is the application program, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

42. The security management apparatus of claim 39, wherein the access principal is the application program, and the information indicating the access object comprises an identifier of the multimedia service and key information granted with an electronic signature method.

43. The security management apparatus of claim 39, wherein the access principal is the application program, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

44. A security management apparatus included in multimedia middleware in a terminal, the apparatus comprising:

a security manager for, if there is an access request to a particular platform resource from a particular multimedia service, generating an access identifier thereof, and if the particular multimedia service is granted access to the particular platform resource, delivering system resources to the particular multimedia service; and

an M3W Run-time Environment (RRE) for checking a license list including access right information based on the access identifier in response to a request of the security manager;

wherein the license list comprises information indicating an access right of multimedia services for platform resources supported by the terminal.

45. The security management apparatus of claim 44, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

46. The security management apparatus of claim 45, wherein the access principal is the multimedia service, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

47. The security management apparatus of claim 45, wherein the access principal is the multimedia service, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

48. The security management apparatus of claim 45, wherein the access principal is the multimedia service, and the information indicating the access object comprises an identifier of the platform resource and key information granted with an electronic signature method.

49. The security management apparatus of claim 45, wherein the access principal is the multimedia service, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

50. A storage medium in which multimedia middleware is stored, the storage medium comprising:

a service manager for receiving an access request to a particular multimedia service from a particular application program of a terminal, and delivering a handler for the particular multimedia service to the particular application program, if the particular application program is granted access to the particular multimedia service; and

a security manager for checking a license list including access right information for the particular application program in response to a request of the service manager;

wherein the license list comprises information indicating an access right to application programs for middleware services supportable by the terminal.

51. A storage medium in which multimedia middleware is stored, the storage medium comprising:

a security manager for, if there is an access request to a particular platform resource of a terminal from a particular multimedia service, generating an access identifier thereof, and if the particular multimedia service is granted access to the particular platform resource, delivering system resources of the terminal to the particular multimedia service; and

an M3W Run-time Environment (RRE) for checking a license list including access right information based on the access identifier in response to a request of the security manager;

wherein the license list comprises information indicating an access right to multimedia services for platform resources supported by the terminal.