Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N7/00—Television systems
  • H04N7/16—Analogue secrecy systems; Analogue subscription systems
  • H04N7/162—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
  • H04N7/165—Centralised control of user terminal ; Registering at central
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
  • H04N21/41—Structure of client; Structure of client peripherals
  • H04N21/422—Input-only peripherals, i.e. input devices connected to specially adapted client devices, e.g. global positioning system [GPS]
  • H04N21/42201—Input-only peripherals, i.e. input devices connected to specially adapted client devices, e.g. global positioning system [GPS] biosensors, e.g. heat sensor for presence detection, EEG sensors or any limb activity sensors worn by the user
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
  • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
  • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
  • H04N21/462—Content or additional data management e.g. creating a master electronic programme guide from data received from the Internet and a Head-end or controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
  • H04N21/4627—Rights management associated to the content

Definitions

• the invention lies in the field of digital content protection and more specifically relates to a method of authenticating a user with a right of access to a digital content by means of a terminal equipment.
• the invention applies in the context of distribution networks in connected mode or in broadcast mode (Internet, mobile telephony, satellite broadcasting, xDSL, etc.), in which the exchanged contents are protected by a management system.
• digital rights management DRM
• CAS access control system
• a recipient of digital content (subscriber, buyer) is assimilated to his terminal and is identified by information relating to the terminal equipment intended to receive this content, such as, for example, the IP address (for Internet Protocol), the serial number of a computer, a telephone number, the unique identifier of the television decoder, or the unique address of a smart card associated with the decoder, ....
• the digital content is made available to the recipient after being conditioned by at least one parameter depending on one of these information.
• Figure 1 schematically illustrates a conventional architecture of a content distribution system protected by a DRM license.
• This architecture comprises a content server 2 which is associated with a module 4 for formatting said contents and a license server 6.
• the user's receiver equipment 8 comprises a DRM agent 10, a content reader / decoder 12 and a module 13 for dialogue with the user.
• the content server 2 receives (arrow 14) of the formatting module 4 an encryption-protected content adapted to the DRM format and transmits (arrow 15) this content to the agent DRM 10.
• the license server 6 receives (arrow 16) from the formatting module 4 information relating to the formatting of the content, such as the decryption key of this content and transmits (arrow 18) to the terminal equipment the license associated with the content and ensuring the management and control of the uses of digital content.
• a DRM license corresponds to the juxtaposition of information on the content, including its identifier and possibly the cryptographic key for decrypting it, and information on the permissions and constraints of use of the content (number of readings, rights of copy, deadline or duration of use, beneficiary (s) of the content, etc.)
• the DRM agent 10 ensures the control of the rights of the user with the DRM license.
• the content reader 12 allows access to the protected content and delivers this content in clear.
• a DRM system In the implementation of a DRM system, it is functionally to restrict access to content to a duly authorized user or a defined and strictly limited group of such users.
• the license to use a content is encrypted by a unique key specific to the equipment of the user or a limited and strictly defined group of equipment. Therefore, this license is only exploitable by the DRM agent embedded on this equipment or one of the equipment of the group. In other words, a license to use is structurally linked to equipment and not to the individual to whom the license is granted. Thus a DRM system equates the user with his equipment.
• a DRM license related to the terminal equipment allows a priori use of the content by all individuals having access to this equipment.
• digital content can be used in case of theft or loss of terminal equipment, in case of loan of this equipment or its sharing among members of the same community.
• this content is not accessible to its beneficiary on any terminal equipment unknown to the content provider or that has not been previously configured with information specific to the equipment declared by the license holder.
• FIG. 2 schematically illustrates a conventional architecture of a content distribution system protected by a CAS conditional access system.
• This architecture comprises a module 20 for formatting said contents with which is associated a module 22 for conditional access management.
• the receiving equipment 8 of the user comprises in this case a conditional access module 24 and a security processor 26, such as a smart card.
• the conditional access management module 22 generates ECM messages (for "Entitlement Control Message") containing the conditions of access to a content and the descrambling key thereof, usually called the control word (CW for "Control”). Word ”) and transmits these messages (arrow 28) to the formatting module 20. This last transforms, by encryption, the content into protected content that is associated with access conditions ECM messages.
• the conditional access management module 22 further generates EMM messages (for "Entitlement Management Message") and transmits these messages (arrow 30) to the terminal 8 to manage the access titles acquired by the user.
• EMM messages for "Entitlement Management Message”
• arrow 30 the access titles or the means of acquiring them (tokens for the impulsive PPV) are managed and remotely registered by the operator in a non-volatile memory of the security processor 26.
• the conditional access module 24 comprises a first module 32 for processing the ECM and EMM messages in cooperation with the security processor 26.
• Other complementary processing relating to particular functions such as impulse buying a program in PPV (for "Pay Per View") that require a user agreement, are managed by a second module 34 treatment.
• the conditional access module 24 supplies the terminal 8 with the data, typically the control word CW, enabling the latter to descramble the content and to return the content. in clear to the user.
• the terminal 8 also has a module 36 for dialogue with the user.
• the ECM and EMM messages are sent to the receiving system of the subscriber by targeting its security processor 26:
• addressing of the subscriber receiving system may be used, such as individual, group or other addressing of the terminal equipment.
• a CAS system assimilates the user to his equipment.
• the digital content can be used in case of theft or loss of the terminal equipment 8, or in case of loan of this equipment; .
• the digital content may be used in the event of sharing of the terminal equipment 8, by any member, without distinction, of the community sharing this equipment;
• the content is not accessible to its beneficiary on any terminal equipment unknown to the content provider or which has not been previously configured with information specific to a device that the holder of the access rights wishes to use.
• a first object of the invention is to restrict access to digital content exclusively to the natural person holding the DRM license or access credentials.
• a second object of the invention is to allow this person to access the content by means of any terminal equipment without the need for the equipment to be previously registered with the content provider or configured by the latter.
• a third object of the invention is to prohibit access to said content to any person, other than the holder of access credentials, by means of terminal equipment deemed to be held by the latter.
• the invention recommends a method of authenticating a user with a right of access to a digital content by means of a terminal equipment comprising: a configuration phase consisting in attributing to the user , by a trusted third party, a exclusive reference, independent of the terminal equipment and previously correlated with an identifier of the user,
• control phase carried out locally in the terminal equipment, consisting in checking a predefined relation of correspondence between information provided by the user and the reference attributed to the user and designated by said identifier, and
• control phase is activated in response to the condition of access to the content.
• Verification of the predefined correspondence relation between the information provided by the user and the reference assigned to the user and designated by the identifier present in the access condition is performed according to a security level agreed between the provider of the access right and the identity server.
• This correspondence relationship may for example be a strict equality between the information provided by the user and the reference assigned to it. In another example, this correspondence relation may be the equality between the reference assigned to the user and a cryptographic digest calculated from the information provided by that user.
• said reference is stored in a remote autonomous identity server.
• the control phase is preferably performed by the remote identity server on request of the terminal equipment.
• the external reference is stored on a secure removable medium associated with the terminal equipment.
• the control phase is preferably performed by a security processor, such as a smart card comprising security software, locally associated with the terminal equipment.
• the digital content represents audio data, video data or multimedia data.
• the content may be encrypted and its use in the terminal equipment may be subject to access conditions contained in a DRM license or transmitted in ECM messages.
• the invention also relates to terminal equipment for receiving digital content.
• This equipment comprises a control module for the right of access of a user to said digital content and a trusted module cooperating with an identity server to authenticate. the user compared to a reference independent of the terminal equipment.
• FIG. 1 previously described, schematically represents an architecture of a content distribution system protected by a DRM license
• FIG. 2 previously described, schematically represents an architecture of a content distribution system protected by a CAS
• FIG. 3 diagrammatically represents an architecture of a content distribution system protected by a DRM license in which the method according to the invention is implemented;
• FIG. 4 schematically shows a first embodiment of a terminal equipment in which is implemented the method according to the invention in the case where the content is protected by a DRM license;
• FIG. 5 schematically illustrates the different steps of the process of authentication of a user of a content protected by a DRM license according to the invention
• FIG. 6 schematically represents a second embodiment of a terminal equipment in which the method according to the invention in the case where the content is protected by a DRM license;
• FIG. 7 shows a first embodiment of a terminal equipment in which is implemented the method according to the invention in the case where the content is protected by a CAS.
• FIG. 8 schematically shows a second embodiment of a terminal equipment in which is implemented the method according to the invention in the case where the content is protected by a CAS.
• the invention is detailed in its application in the DRM context with reference to FIGS. 3, 4, 5 and 6 and in the CAS context with reference to FIGS. 7 and 8.
• the architecture described in FIG. 3 comprises, on the upstream side, means for performing a complementary packaging of the content taking into account the identity of the beneficiary user. These means are integrated in the module 4 formatting the protected content.
• the terminal equipment comprises means for interpreting this packaging. More specifically, the terminal equipment comprises a confidence module 40 intended to verify the identity of the user.
• the module 40 is functionally connected, on the one hand, to the DRM agent 10 via an interface 42, and on the other hand, to an identity server 44 via an interface 46.
• This interface 46 can be implemented by a bidirectional link as available in an xDSL or telephone network, or by a return channel or upstream channel in the case of a broadcast network.
• the license server 6 is separate from the identity server 44 due to the fact that the management of the access rights is functionally separate from the management of the identities of the users. Indeed these two servers are placed under two distinct responsibilities: on the one hand the license operator who manages the access to the content by the control of the license via the server 6, on the other hand the identity operator which , as a trusted third party, manages the identity of the users to be authenticated, via the identity server 44.
• the identity server 44 assigns the user an exclusive reference independent of the terminal equipment 8 and previously correlated with an identifier of this user.
• This reference is in a one-to-one correspondence relation with information that the user will have to provide to be authenticated.
• This correspondence relationship is predefined and consists for example in a strict equality of this information and the reference, or in the equality of a cryptographic digest of the information provided by the user and the reference, or in any other one-to-one relationship between these two values.
• the DRM agent 10 activates the trust module 40 to verify the identity of the user.
• the confidence module 40 asks the user, via the dialog module 13, information specific to its identity.
• the confidence module 40 checks the correspondence relation between the information provided by the user and the reference attributed to this user and designated by the identifier present in the user. the access condition.
• the trusted module 40 integrated in the terminal 8 verifies that the user of the content is actually the authorized beneficiary.
• the license issued (arrow 52) by the License server 6 includes additional information on the identity of the recipient and the desired level of security for the authentication of this recipient.
• the validity of the identity of a beneficiary is linked to the area of trust in which this identity is defined.
• An area of trust is the domain over which the authority of a trusted third party is exercised. The management of the user's identity depends on the relationships between license operators and trusted third parties.
• a beneficiary has the same identity for several license operators referring to this same domain. If this beneficiary uses license operators linked to different trust domains, it will have as many different identities as different domains. A particular license operator will then reference it by its identity in the trusted domain corresponding to this operator. On the other hand, if an identity federation mechanism is implemented, the beneficiary can be authenticated by any one of the federated identities. The invention applies to these different cases of definition and, whatever the case, the identity of a future user can be created on the fly at the request of the user but always under the exclusive control of a user. trusted third party .
• the level of authentication security of the recipient is defined by an authentication context, for example, a set of parameters contributing to the authentication function of the identity, such as the size of the encryption keys, the conditions of the authentication. registration of the users, the security of the container of the keys, etc.
• an authentication context is agreed between the license server which applies it and by the identity server which exploits it to authenticate the identity. of the user.
• the authentication context used is explicitly described or by designation of a context agreed between the license operator who is the provider of the access right and the identity operator.
• Figure 4 schematically illustrates terminal equipment 8 for receiving content protected by a DRM license.
• the confidence module 40 is physically integrated into the terminal equipment 8 and comprises a download module 60 connected to the identity server 44, an interpretation module 62 and a cache memory 64.
• the terminal can further include a biometric sensor 102 such as for example a fingerprint reader, an eye iris reader or a voiceprint analyzer, etc.).
• the identity check activated by the confidence module 40 implements a biometric data control via the dialogue module 13.
• the license server 6 issues a license indicating the identifier ID_B of the license beneficiary and the authentication context desired (AuthCtxt).
• the DRM agent 10 interprets the granted license to check whether this license meets the following conditions: - the user is B; - it is authenticated with the level of security stipulated in the context of authentication desired (AuthCtxt).
• the verification of the conditions related to the identity of the user is delegated to the confidence module 40.
• the DRM agent 10 transmits to the confidence module 40, via the interface 42, a request asking it to verify that the user is B (ID_B) with the desired authentication level (AuthCtxt).
• ID_B the desired authentication level
• AuthCtxt the desired authentication level
• the request requests that the identity of the user be verified without specifying its expected value ID_B.
• the request from the DRM agent 10 furthermore includes information (AuthTime) corresponding to a maximum validity date of the authentication.
• AuthTime information corresponding to a maximum validity date of the authentication.
• the DRM agent 10 verifies that the data [ID_B, AuthCtxt, AuthTime] provided in the license are in accordance with those collected by the trusted module 40 in the signed assertion and timestamp of the identity server 44. More precisely, at least the following data is provided to the confidence module 40 via the interface 42:
• the address of the identity server 44 is used by the download module 60 to communicate with this server. Note that this address can be previously provided to the trusted module
• Figure 5 schematically illustrates the different steps in the process of authenticating user B with content protected by a license.
• the license server 6 transmits to the agent
• the DRM 10 (arrow 70) the content license.
• the DRM agent 10 transmits to the confidence module 40 (arrow 72), via the interface 42, a request to verify that the user is B (ID_B) with the desired level of authentication (AuthCtxt).
• the confidence module 40 transmits an AuthRequest authentication request to the identity server 44 (arrow 74) via the interface 46.
• a session is then established between the identity server 44 and the user B, for example with the help of the dialogue module 13.
• the identity server 44 requires (arrow
• the identity server 44 checks the correspondence between the user information and the reference, then responds to the confidence module 40 (arrow 80) by communicating a signed assertion containing the identifier of B and the validated authentication level. : [ID_B; AuthCtxt] s i nied - This assertion can be stored locally in the cache 64 of the trusted module 40 ( Figure 4) to be reused as required for dates before authtime without having to start a new session with the server identity 44.
• the trust module 40 finally transmits
• FIG. 6 diagrammatically represents another variant embodiment in which the module trusted 40 verifies the identity of the user locally to the terminal, without connecting to a remote identity server.
• the terminal further comprises a secure external support 100 such as for example a smart card, connected to the terminal for the occasion.
• the verification is performed relative to a reference independent of the user's terminal 8 which is previously stored on the external medium 100 and which is designated by the identifier present in the access condition.
• the terminal may further comprise a biometric sensor 102 fulfilling the same function as in the case illustrated in FIG. 4.
• Figure 7 schematically illustrates an architecture in which the content is protected by a CAS.
• the terminal 8 has a confidence module 400 which is structured and functions as the corresponding module in the DRM context described above.
• the confidence module 400 is connected to a remote identity server 440 via a link 460.
• the terminal may furthermore comprise a biometric sensor 102 such as, for example, a fingerprint reader , an eye iris reader or a voice impression analyzer, etc.).
• the identity control activated by the confidence module 400 implements a biometric data control via the dialog module 13.
• the module 24 of the CAS in the terminal 8 sends a request for authentication of the user to the trusted module 400 which in return provides a positive or negative authentication response according to the security level described in the condition access or attached to the dialogue phase concerned.
• the module 24 of the CAS then decides to continue access or dialogue with the user by exploiting this response from the trusted module 400.
• FIG. 8 diagrammatically represents another variant embodiment in which the confidence module 400 verifies the identity of the user locally at the terminal, without connecting to a remote identity server.
• the terminal further comprises a secure external support 500 such as for example a smart card, connected to the terminal for the occasion.
• the terminal may furthermore comprise a biometric sensor 102 fulfilling the same function as in the case illustrated in FIG. 7.
• the verification is performed relative to a reference independent of the user's terminal 8 which is previously stored on the external medium 500 and which is designated by the identifier present in the access condition.

Landscapes

• Engineering & Computer Science (AREA)
• Multimedia (AREA)
• Signal Processing (AREA)
• Databases & Information Systems (AREA)
• Computer Security & Cryptography (AREA)
• Biomedical Technology (AREA)
• Life Sciences & Earth Sciences (AREA)
• General Health & Medical Sciences (AREA)
• Neurosurgery (AREA)
• Health & Medical Sciences (AREA)
• Analytical Chemistry (AREA)
• Chemical & Material Sciences (AREA)
• Biophysics (AREA)
• Physics & Mathematics (AREA)
• Theoretical Computer Science (AREA)
• Mathematical Physics (AREA)
• Software Systems (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Data Mining & Analysis (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=35457303

Family Applications (1)

Country Status (7)

Families Citing this family (9)

Citations (1)

Family Cites Families (15)

• 2005
  • 2005-04-06 FR FR0503418A patent/FR2884377B1/fr not_active Expired - Fee Related
• 2006
  • 2006-03-31 TW TW095111548A patent/TWI449393B/zh not_active IP Right Cessation
  • 2006-04-04 WO PCT/FR2006/050295 patent/WO2006106262A2/fr not_active Ceased
  • 2006-04-04 US US11/887,193 patent/US20090106788A1/en not_active Abandoned
  • 2006-04-04 EP EP06726305A patent/EP1867159A2/de not_active Ceased
  • 2006-04-04 CN CNA2006800105986A patent/CN101151898A/zh active Pending
  • 2006-04-04 KR KR1020077022594A patent/KR20070116622A/ko not_active Ceased

Patent Citations (1)

Also Published As

Similar Documents

Legal Events