Security management method and apparatus in multimedia middleware, and storage medium therefor

• US 8,000,680 B2
• Filed: 01/11/2007
• Issued: 08/16/2011
• Est. Priority Date: 01/11/2006
• Status: Active Grant

• Current Assignee: Korea Advanced Institute of Science and Technology, Samsung Electronics Co. Ltd.
• Original Assignee: Information and Communications University Research and Industrial Cooperation Group, Samsung Electronics Co. Ltd.
• Inventors: Hendry, Kim, Mun-Churl, Jung, Ki-Ho, Song, Young-Joo
• Primary Examiner(s): Chang; Kent
• Assistant Examiner(s): Siddiqui; Kashif
• Application Number:
  US11/652,266
• Publication Number:
  US 20070192834A1
• Time in Patent Office: 1,678 Days
• Field of Search: 455403-411, 379/189, 726 1- 36
• US Class Current: 455/410
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4433 Implementing client middleware, e.g. Multimedia Home Platform [MHP]
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/83555 using a structured language for describing usage rules of the content, e.g. REL

Abstract

A security management method in multimedia middleware of a terminal that can download a multimedia service provided from an external entity. The security management method includes if there is an access request for a particular multimedia service, determining whether there is a corresponding multimedia service; if the access-requested multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity; setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and receiving information for the download from the external entity through the secure session, and determining whether to execute the download.

Claims

1. A security management method in multimedia middleware of a terminal that can download a multimedia service provided from an external entity, the method comprising:

if there is an access request for a particular multimedia service, determining whether there is a corresponding multimedia service;

if the access-requested multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity;

setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

receiving information for the download from the external entity through the secure session, and determining whether to execute the download according to the information received through the secure session,

wherein the determination of whether to execute the download further comprises;

receiving a Service Profile of the multimedia service desired to be downloaded from the external entity through the set secure session;

checking a Target Profile related to the Service Profile and a Security Profile related to the secure session in the middleware;

determining to download the multimedia service based on the Service Profile, the Target Profile and the Security Profile; and

downloading the multimedia service through the secure session.

2. The security management method of claim 1, wherein the security parameter is expressed as metadata.

3. The security management method of claim 1, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

4. The security management method of claim 1, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

5. The security management method of claim 4, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

6. The security management method of claim 4, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

7. The security management method of claim 4, wherein the Signature Types comprises at least one of:

Canonicalization Methods indicating a list of canonicalization algorithms;

Signature Methods indicating a list of generation and verification algorithms;

Transform Methods indicating a list of transform algorithms; and

Digest Methods indicating a list of digest algorithms;

all of which are used for signature provided by the multimedia middleware.

8. The security management method of claim 4, wherein the Encryption Types comprises at least one of:

Encrypted Data Encoding Methods;

Encryption Methods;

Digest Methods; and

Key Agreement Methods;

all of which are supported by the multimedia middleware.

9. The security management method of claim 1, further comprising:

if the access-requested multimedia service does not exist before the negotiation, acquiring a network address of the external entity; and

providing a plurality of security parameters supported by the multimedia middleware to the external entity for connection of the secure session to the external entity.

10. The security management method of claim 1, wherein the multimedia service is middleware program needed for processing multimedia application program.

11. A security management apparatus in multimedia middleware of a terminal that can download a multimedia service provided from an external entity, the apparatus comprising:

a security manager for, if a requested particular multimedia service does not exist in middleware of the terminal, performing negotiation for secure session setup with the external entity, and setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

a service manager for, if there is an access request for the particular multimedia service, determining whether there is the particular multimedia service, receiving information for the download from the external entity through the secure session, and determining whether to execute the download according to the information received through the secure session,

wherein the service manager receives a Service Profile of the multimedia service desired to be downloaded from the external entity through the set secure session, checks a Target Profile related to the Service Profile from the RRE in the terminal, checks a Security Profile related to the secure session from the security manager, and determines whether to download the multimedia service based on the Service Profile, the Target Profile and the Security Profile.

12. The security management apparatus of claim 11, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

13. The security management apparatus of claim 11, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

14. The security management apparatus of claim 13, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

15. The security management apparatus of claim 13, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

16. The security management apparatus of claim 13, wherein the Signature Types comprises at least one of:

Canonicalization Methods indicating a list of canonicalization algorithms;

Signature Methods indicating a list of generation and verification algorithms;

Transform Methods indicating a list of transform algorithms; and

Digest Methods indicating a list of digest algorithms;

all of which are used for signature provided by the multimedia middleware.

17. The security management apparatus of claim 13, wherein the Encryption Types comprises at least one of:

Encrypted Data Encoding Methods;

Encryption Methods;

Digest Methods; and

Key Agreement Methods;

all of which are supported by the multimedia middleware.

18. The security management apparatus of claim 11, wherein if the particular multimedia service does not exist, the service manager acquires a network address of the external entity from a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) in the terminal.

19. The security management apparatus of claim 11, wherein the security manager provides a plurality of security parameters supported by the multimedia middleware to the external entity for connection of the secure session to the external entity.

20. The security management apparatus of claim 11, wherein the multimedia service is middleware program needed for processing multimedia application program.

21. A storage medium in which multimedia middleware capable of downloading a multimedia service is stored, the storage medium comprising:

a security manager within the multimedia middleware for, if a requested particular multimedia service does not exist in the multimedia middleware, performing negotiation for secure session setup with an external entity from which the multimedia service can be downloaded, and setting up a secure session to the external entity using a security parameter selected as a result of the negotiation; and

a service manager within the multimedia middleware for, if there is an access request for the particular multimedia service, determining whether there is the particular multimedia service, receiving information for the download from the external entity through the secure session, and determining whether to execute the download according to the information received through the secure session,

wherein the service manager comprises;

receiving a Service Profile of the multimedia service desired to be downloaded from the external entity through the set secure session;

checking a Target Profile related to the Service Profile from the RRE in the terminal;

checking a Security Profile related to the secure session from the security manager; and

determining whether to download the multimedia service based on the Service Profile, the Target Profile and the Security Profile.

22. The storage medium of claim 21, wherein the selected security parameter comprises at least one security parameter selected by the external entity in a security parameter list transmitted from the terminal to the external entity.

23. The storage medium of claim 21, wherein the security parameter for negotiation comprises at least one of Data Transfer Protocols, Authentication Protocols, Signature Types, and Encryption Types.

24. The storage medium of claim 23, wherein the security parameter further comprises Uniform Resource Identifiers (URIs) for a corresponding protocol/algorithm and Preferences for the multimedia middleware.

25. The storage medium of claim 23, wherein the security parameter comprises a list of protocols/algorithms supported by the multimedia middleware.

26. The storage medium of claim 21, wherein the multimedia service is middleware program needed for processing multimedia application program.

27. A security management method performed in multimedia middleware in a terminal, the method comprising:

receiving, by a service manager included in the multimedia middleware in the terminal, an access request to a particular multimedia service from a particular application program included in the terminal;

checking, by a security manager included in the multimedia middleware, through a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware, a license list including access right information corresponding to the received access request; and

if the particular application program is granted access to the particular multimedia service, delivering a handler for the particular multimedia service from the service manager to the particular application program;

wherein the license list includes information indicating an access right of application programs for middleware services supportable by the terminal.

28. The security management method of claim 27, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

29. The security management method of claim 28, wherein the access principal is the application program, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

30. The security management method of claim 28, wherein the access principal is the application program, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

31. The security management method of claim 28, wherein the access principal is the application program, and the information indicating the access object comprises an identifier of the multimedia service and key information granted with an electronic signature method.

32. The security management method of claim 28, wherein the access principal is the application program, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

33. A security management method performed in multimedia middleware in a terminal, the method comprising:

receiving, from a service manager included in the multimedia middleware, by a security manager included in the multimedia middleware, request to access a particular platform resource from a particular multimedia service;

generating, by the security manager, an access identifier corresponding to the received access request; and

checking, by a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware, a license list including access right information based on the generated access identifier; and

if the particular multimedia service is granted access to the particular platform resource, delivering, by the M3W RRE, the particular platform resource to the particular multimedia service;

wherein the license list comprises information indicating an access right of multimedia services for platform resources supported by the terminal.

34. The security management method of claim 33, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

35. The security management method of claim 34, wherein the access principal is the multimedia service, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

36. The security management method of claim 34, wherein the access principal is the multimedia service, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

37. The security management method of claim 34, wherein the access principal is the multimedia service, and the information indicating the access object comprises an identifier of the platform resource and key information granted with an electronic signature method.

38. The security management method of claim 34, wherein the access principal is the multimedia service, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

39. A security management apparatus included in multimedia middleware in a terminal, the apparatus comprising:

a service manager included in the multimedia middleware in the terminal for receiving an access request to a particular multimedia service from a particular application program included in the terminal, and delivering a handler for the particular multimedia service to the particular application program, if the particular application program is granted access to the particular multimedia service; and

a security manager included in the multimedia middleware in the terminal for checking, through a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware, a license list including access right information for the particular application program in response to a request received from the service manager corresponding to the received access request;

wherein the license list comprises information indicating an access right of application programs for middleware services supportable by the terminal.

40. The security management apparatus of claim 39, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

41. The security management apparatus of claim 40, wherein the access principal is the application program, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

42. The security management apparatus of claim 40, wherein the access principal is the application program, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

43. The security management apparatus of claim 40, wherein the access principal is the application program, and the information indicating the access object comprises an identifier of the multimedia service and key information granted with an electronic signature method.

44. The security management apparatus of claim 40, wherein the access principal is the application program, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

45. A security management apparatus included in multimedia middleware in a terminal, the apparatus comprising:

a security manager included in the multimedia middleware in the terminal for, if a request to access a particular platform resource from a particular multimedia service is received from a service manager included in the multimedia middleware in the terminal, generating an access identifier corresponding to the received access request, and if the particular multimedia service is granted access to the particular platform resource, delivering system resources to the particular multimedia service; and

a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware in the terminal for checking, in response to a request received from the security manager corresponding to the received access request, a license list including access right information based on the access identifier;

wherein the license list comprises information indicating an access right of multimedia services for platform resources supported by the terminal.

46. The security management apparatus of claim 45, wherein the information indicating the access right is expressed as metadata, and comprises information indicating at least one of an access principal, an access type, an access object, and an access condition of the multimedia middleware.

47. The security management apparatus of claim 46, wherein the access principal is the multimedia service, and the information indicating the access principal comprises an identifier of the access principal and key information granted with an electronic signature method.

48. The security management apparatus of claim 46, wherein the access principal is the multimedia service, and the information indicating the access type indicates that at least one of Open, Write, Read, and Execute is granted.

49. The security management apparatus of claim 46, wherein the access principal is the multimedia service, and the information indicating the access object comprises an identifier of the platform resource and key information granted with an electronic signature method.

50. The security management apparatus of claim 46, wherein the access principal is the multimedia service, and the information indicating the access condition comprises at least one of accessible file system, memory size, and access count.

51. A storage medium, in which multimedia middleware is stored, included in a terminal, the storage medium comprising:

a service manager included in the multimedia middleware in the terminal for receiving an access request to a particular multimedia service from a particular application program included in the terminal, and delivering a handler for the particular multimedia service to the particular application program, if the particular application program is granted access to the particular multimedia service; and

a security manager included in the multimedia middleware in the terminal for checking, through a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware, a license list including access right information for the particular application program in response to a request received from the service manager corresponding to the received access request;

wherein the license list comprises information indicating an access right to application programs for middleware services supportable by the terminal.

52. A storage medium, in which multimedia middleware is stored, included in a terminal, the storage medium comprising:

a security manager included in the multimedia middleware in the terminal for, if a request to access a particular platform resource of a terminal from a particular multimedia service is received from a service manager included in the multimedia middleware in the terminal, generating an access identifier corresponding to the received access request, and if the particular multimedia service is granted access to the particular platform resource, delivering system resources of the terminal to the particular multimedia service; and

a Moving Picture Experts Group (MPEG) Multimedia MiddleWare (M3W) Run-time Environment (RRE) included in the multimedia middleware in the terminal for checking, in response to a request received from the security manager corresponding to the received access request, a license list including access right information based on the access identifier;

wherein the license list comprises information indicating an access right to multimedia services for platform resources supported by the terminal.