Method for transferring encrypted useful data objects

p0001The present invention relates to a method for transmitting encrypted user data objects to a telecommunication terminal, such as a mobile telephone. In particular, the present invention relates to a method in which the arrival and the utilization of the encrypted user data object on the telecommunication terminal is displayed in a user-friendly manner.

p0002A method or service for the reliable and billable transfer of useful data objects to a telecommunication terminal, in particular in the execution of a mobile telephone or mobile telephone, is currently being discussed in a telecommunications network. The transmission or downloading of the useful data objects to the mobile radio device is to take place by means of a protocol specified by the Open Mobile Alliance (OMA) or an Internet protocol (eg Hypertext Transfer Protocol: http). A service for transmitting can be specified in such a way that a user can be allowed to transfer any user data objects with a user program available on the mobile radio, which can be referred to as a transmission client or in the case of a pure download of data as a download client , Which are offered in the data communication network by one or more data provisioning components, in particular servers of service providers or content providers.

p0003The WAP Forum or its successor organization, the Open Mobile Alliance (OMA), has defined various procedures for managing explicit usage rights for digital content of any kind, such as multimedial data. In this case, provision is made for providing a user data object to be transmitted with restrictions or restrictions regarding the use by the recipient or user of the mobile radio device. For example, the number of uses of the useful data object or the duration of use can be restricted. The practice is implemented by describing the restrictions with a corresponding language, such as ODRL (Open Digital Rights Language) or the OMA DRM Rights Expression Language (REL) specified by the OMA, wherein the transmission client or another specific application, A so-called DRM agent, for managing the rights rights (DRM: Digital Rights Management) associated with a (digital) user data object, evaluates them, stores them on the mobile radio in a protected area which is not accessible to the user, User to use the object according to the rights description or not. The user data object itself can be protected against unauthorized access either by being encrypted in a freely accessible memory area on the mobile radio or by being managed by a special application, for example the DRM agent, which does not have unauthorized access to the object By the user.

p0004According to a variant specified by the Open Mobile Alliance, the so-called "Separate-Delivery", for the management of DRM-protected contents, a useful data object provided by a data provision component is encrypted and used for transport and storage to a telecommunications terminal, such as a (Eg, the data type or content type "Application / VND.OMA.DRM.Content") is packaged in a so-called container file or a so-called container object. With a service for reliably transmitting content from a data download component, the encrypted user data object is packaged in the container object using WAP protocols (such as the WSP: Wireless Session Protocol) or Internet protocols (such as the http) The telecommunication terminal. A so-called rights object is transmitted separately from the encrypted user data object via a secure channel to the telecommunication terminal, for example automatically by means of WAP push. The rights object contains a description of the rights granted to the user for the use of the encrypted user data object, a reference to the container object which allows assignment of the rights object to the corresponding container object, and a key with which the encrypted user data object is decrypted Can then use it afterwards. In the telecommunication terminal, such as the mobile radio, a special device or application, which may be the aforementioned DRM agent, is necessary to use the combination of the encrypted user data object and the rights object packed in the container object. After transferring the rights object to the telecommunication facility, the rights object is directly passed to the DRM agent, which is responsible for the administration and maintenance of the secret, namely the key for decrypting the encrypted user data object. In practice, the DRM agent exposes the rights object against unauthorized access by other applications or users on the telecommunication terminal. If an encrypted user data object is to be used, the DRM agent is first activated. The user searches for a right-hand object matching the container object in the memory area he manages in the telecommunication device by means of the identification contained in the container object and also in the rights object, checks whether the usage type (such as "playing" music data or a "Display" of image data, etc.) rights can be granted and decrypts the user data object with the key from the rights object if the rights can be granted. With the method described above, in which an encrypted user data object and a separate rights object can be used, the value of digital data is no longer transmitted by the (encrypted) user data object or the container object itself but rather by the rights object and the content object Key, without which the encrypted useful data object is not usable. Thus, in this case, the encrypted user data objects can be stored packaged in the container objects freely accessible on the telecommunication terminal.

p0005Since, as already mentioned, the useful data objects to be transmitted (encrypted) can be data objects with multimedial content and thus data with a large scope, a service with a large transmission capacity is required for a corresponding transmission of such data. For example, the multimedia messaging service (MMS) specified by the 3GPP (3rd Generation Partnership Project) and the OMA is capable of performing an exchange and transmission of multimedial messages to and from mobile communication subscribers.

p0006A combination of both techniques DRM and MMS is therefore useful. With MMS, valuable digital content can be transferred to other participants, whereby the concrete usage rights for the content can be defined and also transmitted. The contents are packed in the DRM container objects and optionally encrypted (depending on the selected DRM method). The use of the content on the addressed recipient of the MMS message can thus be restricted and, for example, an undesired further spread can be pre-determined by simply forwarding a message by the first receiver. As an example of using a combination of DRM and MMS, subscription-type services can be viewed. For this purpose, a user orders the delivery of user data objects (with picture content, audio content, text content or other information contents) of any kind when available, ie, for example, when certain events occur (a video sequence with a game in a football match) Of the gate, current weather forecast with a picture of a weather map and audio information for explaining the map, etc.). As it is in<figref idrefs="f0001">FIG</figref> The provider sends the desired information in the form of encrypted user data objects NDO via MMS via its data provisioning component DBK (for example, a data server on the Internet) to the telecommunications terminal TG1, ie, the useful data objects NDO reach the telecommunications terminal integrated into a multimedia message MM TG1 via a switching component VK, for example in the form of an MMS switching unit, in push mode at times which the user can not generally foresee and without the user having to explicitly initiate a charging process, which is a significant difference from the so-called pull Mode in which the user must always send an explicit request to the provider in order to obtain a desired user data object. In parallel, the rights provider, which can be identical to the service provider mentioned above, sends the rights object (s) RO (s) assigned to the encrypted user data object NDO via WAP push via a WAP push proxy gateway PPG by means of the data provision component DBK To the telecommunication terminal TG1 of the user. This means that the user data object and the rights object (s) reach the recipient's terminal in separate ways and asynchronously. In the telecommunication terminal TG1, the MMS messages MM transmitted via the switching component, in particular with the user data objects NDO, are received and processed by a MMS user application MUA, and the rights objects RO are received and managed by a DRM agent DA, the MMS user application MUA and the DRM agent DA are connected to each other for the purpose of utilizing the encrypted user data object by means of the corresponding rights object. The MMS user application MUA and the DRM agent DA may be software applications which are executed by a processing unit (not shown), such as a microprocessor, in the telecommunications terminal TG1.

p0007As already mentioned, the encrypted user data objects and the corresponding binary rights objects are transmitted on separate independent transport channels. In this case, the transmission is conventionally temporally unsynchronized. Only when both objects are present on the receiving terminal is it possible to use the protected contents of a user data object on the terminal. When using the http or the special variant of the Open Mobile Alliance to download user data objects to mobile devices (so-called "OMA Download"), the user actively requests a concrete useful data object with a so-called "http Get-Request" (http delivery request) Which is then assigned to it in the so-called "http response message" (http reply message). With this type of delivery of a DRM-protected user data object, the provider can automatically supply a rights object via short message service (SMS) or via WAP push in addition to the user data object.

p0008In other words, conventionally, the behavior of the telecommunication terminal in the case of the temporally unsynchronized reception of DRM-protected user data objects via MMS and corresponding rights objects can not yet be matched specifically to the requirements of DRM. An incoming MMS message MM with contained DRM-protected user data objects NDO is immediately sent to the user in a first receive message via a user interface GUI (cf.<figref idrefs="f0001">FIG</figref>) Which, for example, has a display DSP and a loudspeaker LS. If the user opens the message and the necessary rights objects are not yet available, the user is initially denied the use of the user data object (s) by the terminal. After the arrival of the corresponding rights object (s), the user is additionally signaled in a second receive message that a utilization of the useful data object in the multimedian message is now possible. For the user, this type of information representation by his terminal is relatively unsatisfactory since, although it is initially informed of the arrival of the multimedian message, it can not use it because the necessary rights objects have not yet been received as a rule (asynchronous reception) Of user data object and rights object (s) as described above). It is only when the user is informed a second time that the necessary rights objects have arrived, he can actually use the message. The user is thus unnecessarily informed twice, and, at the first time, additionally remembers that the useful data objects are subject to protection, ie certain restrictions.

p0009US2002138435 discloses a method for content distribution control wherein a user, upon receipt of a transaction tag over a first network, sends back a validation report via a second network and finally receives the desired contents

p0010It is thus the object of the present invention to create a user-friendly possibility of signaling the receipt of a usable useful data object on a telecommunications terminal.

p0011This object is achieved by the independent claims. Advantageous embodiments are the subject matter of the subclaims.

p0012A method for transmitting encrypted user data objects to a first telecommunication terminal comprises the following steps. First, at least one encrypted useful data object is transmitted from a switching component of a telecommunications network to the first telecommunication terminal. Furthermore, time information is transmitted from the switching component to the first telecommunication terminal, which specifies up to which time a rights object associated with the at least one encrypted user data object, which contains the key as well as the usage rights for the assigned user data object, also arrives at the first telecommunication terminal. The time may in this case be determined or specified such that a concrete absolute time and / or a concrete absolute date is indicated in the time information until an assigned rights object is to arrive, or may be determined on the other hand by a following time interval, Within the (to the last possible time) the rights objects are to be expected. Subsequently, a rights object assigned to the at least one user data object is then received by the first telecommunication terminal. The first telecommunication terminal now checks whether the time specified in the time information has already elapsed and, in the event that it has not yet elapsed, outputs a signal (for example optically or acoustically) with respect to the reception of a usable useful data object via a user interface. This means that both the user data object and the corresponding suitable rights object have arrived for the purpose of utilizing the user data object at the telecommunication terminal (within the predetermined time), then a signaling by the telecommunication terminal is made to the user. Thus, by means of this delayed signaling, the user only experiences that a useful user data object has arrived at his telecommunication terminal, and is not even informed that the user data object is protected or encrypted, and a rights object is required for decryption, Which may still be delivered to the telecommunications terminal. Through this user-friendly method of transmitting encrypted user data objects to a telecommunication terminal and signaling it to a user, the acceptance with regard to the introduction of encrypted user data objects can be increased.

p0013If the first telecommunication terminal determines during the verification that the time specified in the time information has already elapsed, a (simple) signal is output via the user interface, although an encrypted useful data object has been received but (still) no rights Or no rights object is available for use.

p0014As a criterion until a rights object can still be validly received without the issuance of a simple signal, a time or a predetermined period of time (after reception of the useful data object) which can be set by the user of the telecommunication terminal can also be used in the first telecommunication terminal . In this case, a minimum value or maximum value of the two time points (specified in the time information or preset by the user), ie, the nearer or further-reaching time from the reception of the (encrypted) useful data object, can be used as the final last time.

p0015The illustrated method for transmitting encrypted user data objects to the first telecommunication terminal takes place according to an advantageous embodiment according to the multimedia messaging service (MMS). This makes possible the transmission of (encrypted) user data objects, which can also include multimedial content with a large amount of data such as digital photos or video clips.

p0016According to an advantageous embodiment, the at least one encrypted user data object is transmitted together with the time information by means of a delivery message to the first telecommunication terminal. In the case of MMS, the encrypted user data object and the time information can be integrated in an MMS delivery message. It is also conceivable for the time information to be transmitted to the first telecommunication terminal separately by means of a notification message (in the case of MMS by means of an MMS receiver notification), which indicates that a user data object is ready for delivery to the first telecommunication terminal in the switching component. In the latter case, the time information is first transmitted in a first message, and the useful data object is transmitted to the first telecommunication terminal only later in a second message. The respective notification message and / or delivery message can have a separate header field, which is assigned as a field value, the time information.

p0017According to a further advantageous embodiment, the at least one encrypted useful data object can be transmitted by a data provision component, for example, a data server of a provider of contents or useful data objects (in the telecommunications network) to the switching component for forwarding to the first telecommunications terminal. The user data objects can be transmitted in the context of a subscription or other information service. Furthermore, it is also possible for encrypted user data objects to be transmitted from a second telecommunications terminal to the switching component for forwarding to the first telecommunication terminal.

p0018According to a further advantageous embodiment, the first telecommunication terminal has a time measuring device or a timer which, after receiving the time information, instructs the user to measure the time up to the time specified in the time information.

p0019Furthermore, the first telecommunication terminal can have a communication device for carrying out the communication with the switching component, in particular a MMS user application, and an administration device, in particular a DRM agent, for managing the encrypted user data objects which is connected to the communication device. In this case, it is possible for the communication device, after receiving the at least one encrypted user data object, to ask the management device whether a rights object is already present for the at least one encrypted useful data object, and to measure the time if the time measuring device is not present.

p0020According to a further advantageous embodiment, the at least one encrypted useful data object and the respective assigned rights object are transmitted to the first telecommunication terminal via two different transport channels.

p0021According to an advantageous embodiment, the first telecommunication terminal and possibly further telecommunication terminals as well as the switching component are part of a telecommunication network. In this case, the other telecommunications terminal (s) may be part of a first telecommunications network (however, in the case of a plurality of telecommunications terminals, these must not be part of the same telecommunications network). Correspondingly, the switching component, which is designed in particular as a server of a data transmission service, such as, for example, as a MMS relay server, can be provided in a second telecommunications network which is connected to the telecommunications network or networks which are assigned to the further telecommunications terminal or devices . This second telecommunications network can in particular be implemented as a telecommunication network based on Internet protocols, such as the Hypertext Transfer Protocol. It is also conceivable that the data provision component is also provided in the second telecommunications network or in a further telecommunications network connected to it.

p0022In order to be able to use the method for transmitting user data objects as flexibly as possible, the telecommunications terminal (or else the further telecommunication terminals) can preferably be designed as a mobile telecommunications terminal. In particular, it is conceivable for the data or messages to be sent to and from the first or the further telecommunication terminal via an air interface. The respective telecommunication terminal can comprise a radio module. For example, the telecommunication terminal can be embodied as a mobile telephone, a cordless telephone, a smartphone (combination of a small portable computer and a mobile telephone), a PDA (personal digital assistant) or an organizer. Furthermore, the telecommunications terminal can also comprise other mobile-accessible devices, such as a personal computer (PC) or a laptop, which can be reached by means of a connected mobile device (mobile telephone or mobile radio module) via a mobile radio network. The mobile radio device can then, for example, be connected to the personal computer or laptop via a cable or can also contact the latter wirelessly via an infrared interface or a local Bluetooth network. As already mentioned, the transmission of data and messages to and from the respective telecommunication terminal can then take place by means of WAP protocols or the Hypertext Transfer Protocol (http). A telecommunication terminal, such as the mobile radio device, including the telecommunications network assigned to it, can operate in the execution of a mobile radio network according to the GSM (Global System for Mobile Communication) standard or the UMTS (Universal Mobile Telecommunications System) Such mobile radio networks or telecommunication devices according to the GSM or UMTS standard can represent a platform for WAP protocols or the WAP protocol application (WAP: Wireless Application Protocol), by means of which data (messages or useful data objects) in the respective Mobile radio network.

p0023Advantageously, the first and the second telecommunications network are interconnected by a connecting component. In the case of using the WAP protocol stack as mentioned above, by using a WAP gateway as an interface between a mobile network and another network such as an Internet protocol based network, Connection to this. In this way, it is possible for the switching components to be located in a network based on an Internet protocol, such as the Internet, wherein the data (messages, useful data objects) are transmitted via a WAP gateway, and finally via an air interface of a mobile radio network between the or The base stations of the mobile radio network and to the respective telecommunication terminals of users. In this connection, it should be mentioned that messages can be transmitted by a MMS relay server as part of an exchange component, in particular within the context of the MMS data transmission service, automatically, ie, without a telecommunication terminal, to a telecommunications terminal by means of WAP push. The MMS relay server serves as a so-called push initiator, which causes the WAP gateway or a subcomponent thereof, namely the push proxy gateway, to send a message to the telecommunication terminal via WAP push. For example, according to the MMS transmission service, the receiver notification is transmitted by means of WAP push to the first telecommunication terminal. The rights objects are passed directly from the data provision component to the WAP Push Proxy Gateway (PPG) for delivery to the telecommunications terminal. The two transport paths from the data preparation component to the telecommunication terminal are thus different for the user data object and the rights object and are not synchronized in time since the data provision component has no direct influence on the delivery of the multimedia message by the switching component to the telecommunication device.

p0024According to an advantageous embodiment, the user data objects can be data in the form of text data, image data or video data, audio data, executable programs or software components, or a combination of these data types, ie, multimedial data or contents.

p0025According to a further aspect, there is provided a telecommunication arrangement comprising a switching component and a first telecommunication terminal having a user interface, the telecommunication arrangement being adapted to perform a method as mentioned above.

p0026Preferred embodiments of the present invention are explained in more detail below with reference to the appended drawings. Show it:<dl id="dl0001"><dt>FIG</dt><dd>A block diagram of an architecture of a telecommunication arrangement for transmitting encrypted user data objects and associated rights objects from a data provision component via a switching component to a telecommunication terminal;</dd><dt>FIG</dt><dd>1 is a block circuit diagram of the essential components of a telecommunication terminal in which the message flow is shown on reception of an encrypted useful data object according to a preferred embodiment of the invention;</dd><dt>FIG</dt><dd>A flowchart for explaining the process flow in an MMS user application upon receipt of a multimedia message or MMS message with DRM protected user data objects;</dd><dt>FIG</dt><dd>A block diagram showing the message flow when an encrypted user data object is delivered to a telecommunication terminal according to the MMS;</dd><dt>FIG</dt><dd>A MMS message in the form of an MMS receiver notification according to an embodiment of the invention;</dd><dt>FIG. 6</dt><dd>An MMS message in the form of an MMS delivery message according to an embodiment of the invention.</dd></dl>

p0027For explaining the message flow according to a preferred embodiment of the invention between the essential components of a telecommunication terminal upon receiving an encrypted useful data object <figref idrefs="f0001">FIG</figref>, First of all <figref idrefs="f0001">FIG</figref> To describe the communication environment of the telecommunication terminal.

p0028As it is in <figref idrefs="f0001">FIG</figref> The telecommunication arrangement according to a preferred embodiment for carrying out a method for transmitting user data objects by means of the MMS comprises a switching component VK, a WAP push proxy gateway PPG and a (first) telecommunication terminal TG1. The telecommunication terminal is, for example, designed as a mobile telephone operating according to the UMTS standard. It is also assumed that the telecommunication terminal TG1, which is designed as a mobile telephone, is part of a mobile radio network. The mobile telephone TG1 is able to use WAP protocols (eg, wireless session protocol: WSP, etc.) or the WAP protocol stack to transmit data via an air interface to a corresponding stationary transmission / reception arrangement of the mobile telephone TG1 Assigned mobile radio network. The telecommunication arrangement also comprises a data provision component DBK of a provider of contents or useful data objects, wherein the data provision component can also serve as a "rights-providing component" RBK of a provider of rights objects to the respective useful data objects (the provider of rights objects and the provider of useful data objects can be identical) . In this case, the switching component VK, the data provision component DBK or the rights provisioning component RBK can be provided in the mobile radio network assigned to the mobile telephone TG1, or can be provided, for example, in the Internet which is connected to the mobile network of the mobile telephone TG1 via corresponding WAP gateways.

p0029As further described in FIG <figref idrefs="f0001">FIG</figref> , The mobile telephone TG1 comprises an MMS user application or MMS user application MUA for carrying out the communication, in particular according to the MMS with the switching component, as well as a DRM application or a DRM agent DA for managing the encrypted user data objects. Furthermore, the mobile telephone TG1 comprises a user interface GUI which, for example, has a loudspeaker LS and a display or display DSP for displaying text and / or graphical contents.

p0030In the following, an embodiment of the invention will be described with reference to the reception and the evaluation of a received multimedia message and of assigned rights objects, as well as the output based on this information on the user by the mobile telephone TG1 using <figref idrefs="f0001">FIG</figref> Can be explained. The logic flow of the information flow and the control signals in the mobile telephone TG1 with integrated MMS user application MUA, DRM agent DA and graphical user interface GUI is described with reference to the numbers in the figure:<ol><li>1. A multimedia message MM with the contained, DRM-protected contents or user data objects NDO, originating from the switching component VK, is received by the mobile telephone TG1 and processed and evaluated by the MMS user application MUA integrated therein. In this case, the MMS user application MUA determines in the illustrated case that the MMS message MM contains DRM-protected content according to the method "Separate Delivery", ie the contents or user data objects NDO in objects or container objects with the MIME Type "application / vnd.oma.drm.content". Furthermore, the MMS user application MUA determines whether the MMS message MM is a signaling or time information s_ABS (See, for example, the discussion below on the <figref idrefs="f0003">5 and 6</figref>), Which is used to display a timely delivery of the rights object (s) required for use. Both are assumed to be given in the illustrated case.</li><li>2. This step provides a better understanding of the behavior of a conventional MMS user application MUA and is included here for information only. Thereafter, the MMS user application MUA transmits to the graphical user interface the information about a received multimedia message MM or a received encrypted NDO for display to the user. According to the preferred embodiment of the invention, precisely this behavior is prevented in the illustrated case. Instead, further processing is performed as shown below.</li><li>3. The MMS user application MUA first checks with the DRM agent DA whether rights objects for the DRM-protected user data object (s) NDO contained in the multimedian message MM are already present. This can be the case, for example, when subscribing to user data objects (such as the regular transmission of exchange information or football results) or if the rights objects have already been delivered before the multi-media message has arrived.</li><li>4. DRM Agent DA searches for appropriate rights objects. In the case presented here, it finds no and reports this to the MMS user application MUA.</li><li>5. a) The MMS user application MUA evaluates the time information s_ABS In the information element in the MMS message MM and starts a time-measuring device ZME with this value. Alternatively, the MMS user application MUA can have a minimum value from s_ABS And the upper limit of a time delay for notifying the user of received messages or user data objects and starting the timer ZME with this value. B) The MMS user application MUA starts a function in the DRM agent DA, by means of which the DRM agent DA sends a message to the MMS user application MUA in the case of incoming rights objects which allow access to the DRM-protected user data objects in the multimedia message MM sends. A transfer parameter is or are the identifiers (ContentID) of the DRM-protected user data objects NDO. These identifiers are also contained in the assigned rights objects RO. The identifiers are therefore used to recognize the assigned rights objects. Subsequently, the MMS user application MUA is put into a waiting loop which leaves it on the occurrence of an event according to FIG. 7a) or 7b).</li><li>6. One or more rights objects RO are forwarded by the mobile telephone TG1, for example, via WAP push via a WAP push proxy gateway PPG (cf. <figref idrefs="f0001">FIG</figref>) And passed internally to the DRM agent DA. In this example, this is done before the timer ZME runs.</li><li>7.<ol><li>A) The ZME timer runs and sends notification to the MMS user application MUA or alternatively -</li><li>B) in accordance with FIG. 6), the necessary rights objects RO were received and the DRM agent DA informed about the MMS user application MUA.</li></ol></li><li>8. The MMS user application now controls the graphical user interface GUI so that it displays the input of a new multimedia message MM, ie the input of a user data object NDO. Depending on whether the rights are present, the multimedia message is indicated either as "usable" (see case 6 and 7 b)) for existing rights objects, or for non-existent rights objects, indicating that activation is still required ( See Case 7.a)).</li></ol>

p0031The user interface GUI then outputs the just-mentioned positive (case 6. and 7. b)) or negative (case 7. a)) information, for example, via the display DSP in the form of a text message or a corresponding symbol, and the user can, Case access to the message or the useful data object.

p0032In <figref idrefs="f0002">FIG</figref> Is now the internal processing and the process flow in the MMS user application MUA (corresponding <figref idrefs="f0001">1 or 2</figref>) Are displayed on receipt of an MMS message MM containing DRM-protected user data objects NDO. The course is explained below using the letters of the process steps:<ol><li>A) After the start of the process, the MMS user application MUA receives an MMS message MM, the DRM-protected useful data objects NDO, as well as a time information s_ABS On the future service of rights objects. </li><li>B) The MMS user application MUA examines the MMS message MM for DRM-protected user data objects NDO contained therein, and contains signaling or a time information S_ABSIn that the assigned rights objects RO are additionally allocated to a separate transport route in the near future.</li><li>C) If neither is the case, process step I) is jumped. Otherwise, the United goes processing step D) further.</li><li>D) The MMS user application MUA (if DRM-protected user data objects are present) queries the DRM agent DA whether the rights objects RO assigned to the DRM-protected user data objects NDO are already present and receives the information from the DRM agent as a response.</li><li>E) If the required object objects RO are already present, process step I) is again jumped, otherwise the process proceeds to step F).</li><li>F) The MMS user application extracts the time information or the value s_ABS From the corresponding information element of the MMS message MM, if this is present. If several of these information elements are contained in the MMS message MM, which may be the case with a plurality of DRM-protected useful data objects NDO and individual signaling of the separate delivery of rights objects, the MMS user application MUA can transmit the information, for example by forming the maximum value or also by Addition of the specified time periods to a single time value s_GES to reduce. The MMS user application MUA can then limit the time value to a maximum value which can be stored specifically in the terminal device and can be adjustable by the user. With the resulting time value, the MMS user application MUA starts a timer ZME and sets a condition for the DRM agent DA, according to which the DRM agent DA receives the MMS user application MUA on the arrival of suitable rights objects RO, ie the DRM protected useful data objects NDO Of the MMS message MM.</li><li>G) The MMS user application MUA checks whether all necessary rights objects RO have arrived for the present MMS message MM. If yes, ie, if the DRM agent has sent a positive message about the arrival of the appropriate rights objects to the MMS user application MUA before expiration of the timer ZME, the process is continued with step I), otherwise the process continues with step H) .</li><li>H) The MMS user application MUA checks whether the timer ZME has expired. If so, the process is continued with step I); otherwise, the process is resumed with step G), ie the loop is looped through again.</li><li>I) The MMS user application MUA forwards the information about the received MMS message MM to the graphical user interface GUI for output to the user. In the positive case, the rights objects RO required to use the MMS message MM or the useful data objects NDO contained therein are present at this time, and the user can use the message or the user data objects NDO contained therein. If the required rights objects are not yet available, a message is displayed to the user, but a usage is not yet possible or only to a limited extent.</li></ol>

p0033In summary, therefore, it can be stated that an essential point in the method for transmitting user data objects to a telecommunication terminal or mobile telephone just shown is to be seen in the controlled output of information about received multimedia messages or user data objects and assigned rights objects by the telecommunication terminal. An essential aspect is the transmission of contents or user data objects and rights objects via two logically separate transport channels to two logically separate function units (MMS user application and DRM agent), the transmission being not synchronized in time.

Other aspects are

p0034<ul><li>The evaluation of the incoming multimedia message by the MMS user application MUA on the DRM-protected user data object NDO, which is contained in the message,</li><li>The evaluation of the incoming multimedia message MM by the MMS user application MUA on information elements contained in the message, which signal an expected delivery of rights objects for the DRM-protected content in the near future,</li><li>The internal communication between the MMS user application MUA and the DRM agent DA, ie, the MMS user application MUA at the DRM agent DA on the telecommunication terminal, determines whether the DRM protected (or the DRM) N) user data object (s) already assigned rights objects RO are present on the telecommunication terminal,</li><li>The internal control of a timer ZME by the MMS user application MUA, ie the start of a timer ZME by the MMS user application MUA, wherein the information element (s) contained in the MMS message MM or time information for signaling an imminent separate delivery of rights objects RO Is taken into account and furthermore a maximum running time of the timer is also taken into account which can be implementation-specific and / or can also be selected by the user,</li><li>Waiting for the arrival of the rights object (s) assigned to an MMS message or individual MM elements, the DRM agent directly receiving and managing the rights objects RO, and / or expiring the timer ZME by the MMS user application MUA,</li><li>Time-delayed output and signaling of the received multimedia message MM with DRM-protected user data objects NDO on the user interface GUI of the telecommunication terminal (TG1) if either the necessary rights are present (or at least one is present) and the user directly accesses the user data objects of the multimedia message Or alternatively the timer ZME has expired.</li></ul>

p0035As before <figref idrefs="f0001">FIG</figref> , The transmission of encrypted or DRM-protected user data objects from the switching component VK to the telecommunications terminal TG1 can take place via MMS. The detailed message flow for this purpose between the switching component VK, in particular in the execution of an MMS switching unit MRS in a telecommunication network, and the MMS user application MUA on the telecommunication terminal TG1 is shown in FIG<figref idrefs="f0002">FIG</figref> shown.

p0036First, an MMS recipient notification M-Nind is sent by MRS to the MUA via WAP push. In the illustrated case, the MUA first responds to the message M-Nind with a confirmation M-NRind for the notification. At a later stage, the MUA sends a download request W-Greq to the MRS. The latter responds with a delivery message M-Rconf in which the useful data object or multimedial content of the message is contained. Finally, the MUA also confirms the delivery of the multimedian message with the delivery confirmation M-Aind.

p0037The two following examples illustrate the embedding of a new header in accordance with the invention into an MMS receiver message M-Nind or an MMS delivery message M-Rconf:

Example A:

Integration of the additional information element (time information) in the form of a header field into the MMS receiver notification

p0038In this example, the integration of an additional information element for the time information into a recipient notification takes place as an additional header, which is given an example of the name "X-MmS-DRM-Separate-Delivery". Table 1 shows the header fields for an MMS receiver notification, including the new header field "X-Mms-DRM-Separate-Delivery" according to the invention. It should be mentioned that the following table 1 shows the field names and field values ​​in the original English names, which are known to a person skilled in the art.<tables id="tabl0001" num="0001"><table frame="all"><title>Table 1</title><tgroup cols="3"><colspec colnum="1" colname="col1" colwidth="51mm" /><colspec colnum="2" colname="col2" colwidth="58mm" /><colspec colnum="3" colname="col3" colwidth="58mm" /><thead><row><entry valign="top">field name</entry><entry valign="top">field value</entry><entry valign="top">description</entry></row></thead><tbody><row><entry morerows="1" rowsep="1">X-Mms message type</entry><entry morerows="1" rowsep="1">Message-typevalue = m-notification-ind</entry><entry>Compulsory.</entry></row><row><entry>Identifies the type of MMS PDU (Packet Data Unit).</entry></row><row><entry morerows="1" rowsep="1">X-Mms transaction ID</entry><entry morerows="1" rowsep="1">Transaction-id-value</entry><entry>Compulsory.</entry></row><row><entry>Transaction ID to identify the recipient notification (M-Notification.ind or M-Nind) and the corresponding acknowledgment by the recipient (M-NotifyResp.ind and M-NRind, respectively).</entry></row><row><entry morerows="1" rowsep="1">X-Mms MMS version</entry><entry morerows="1" rowsep="1">MMS-version-value</entry><entry>Compulsory.</entry></row><row><entry>The MMS version number.</entry></row><row><entry>From</entry><entry>From-value</entry><entry>Optional.</entry></row><row><entry>Address of the last MMS user application that the multimedian message has handled, ie which has either transmitted or forwarded the multimedian message.</entry></row><row><entry>Subject</entry><entry>Subject-value</entry><entry>Optional.</entry></row><row><entry>Subject of the multimedian message.</entry></row><row><entry morerows="1" rowsep="1">X-Mms message size</entry><entry morerows="1" rowsep="1">Message-sizevalue</entry><entry>Compulsory.</entry></row><row><entry>Data volume of the associated MMS delivery message (M-Rconf) in octets. ...</entry></row><row><entry>...</entry><entry>...</entry><entry>...</entry></row><row><entry morerows="1" rowsep="1">X-Mms content location</entry><entry morerows="1" rowsep="1">Content-location-value</entry><entry>Compulsory.</entry></row><row><entry>Reference for downloading the multimedia message.</entry></row><row><entry morerows="1" rowsep="1">X-Mms-DRM-Separate-Delivery</entry><entry morerows="1" rowsep="1">DRM-Separate-Delivery-value</entry><entry>Optional.</entry></row><row><entry>Indicates that one or more DRM protected objects will be included in the MMS delivery message, and that additionally DRM rights objects are transferred to the telecommunication terminal, for example, via WAP push, whereby optionally the maximum delivery delay is described or a date / time is described To which delivery will be made.</entry></row></tbody></tgroup></table></tables>

p0039It should be mentioned that, in the MMS receiver notification according to the above embodiment of the invention, the new header field is double-framed in Table 1.

p0040According to the embodiment, the following definition can be given for the value of the new header:<ul><li>X-Mms-DRM-Separate-Delivey = Value-length (absolute-token data-value | relative-token delta-secods-value)</li></ul>With:<ul><li>Date-value: The date and time at which the required rights object (s) will be transmitted to the terminal.</li><li>Delta-secods-value: Number of seconds within which the required right object (s) will be transmitted to the terminal</li><li>Absolute-token = <octet 128></li><li>Relative-token = <Octet 129></li></ul>

p0041In accordance with the embodiment, a binary token for the coding of the header field name "X-Mms-DRM-Separate-Delivery" is assigned one of the values ​​"0x34", "0x35", "0x36", "0x37", "0x38", "0x39" 0x3A "," 0x3B "," 0x3C "," 0x3D "," 0x3E "or" 0x3F "are used. This has the advantage of a more compact representation and a more efficient transmission of the MMS message.

p0042Based on this explanation, an MMS receiver notification can now be used in principle <figref idrefs="f0003">FIG</figref> , The headings being shown as text for the sake of clarity. By contrast, binary codes are used in a standard-compliant transmission to the telecommunication terminal.

p0043In the embodiment shown in FIG <figref idrefs="f0003">FIG</figref> , A copy field named "X-Mms-DRM-Separate-Delivery" is embedded in the MMS recipient notification. The WerL consists of the first specification of a number of the following characters of the header, a second value ( "<129>") indicating that the following value is a "Delta-seconds-value", and a third value "Delta-seconds-value" ( "300") indicating the number of seconds until all associated rights objects should be received.

p0044The proposed variant has the advantage that it is already apparent after the delivery of the MMS receiver notification for the MMS user application that the MMS message will contain DRM-protected objects and from this a receiver-specific behavior can be derived, according to which all messages with DRM Protected user data objects are immediately downloaded to the telecommunication terminal or the like.

p0045Backward compatibility for MMS userapplications without the additional DRM functionality is easily possible with the procedure presented here. According to the OMA / WAP specification, MMS user applications should simply ignore unknown Kopffelder and discard their contents.

Example B:

p0046Integration of the additional information element (time information) in the form of a header field into the MMS delivery message

p0047The following example demonstrates the integration of an additional information element into an MMS delivery message. This is carried out analogously to Example A. The following Table 2 shows the definition of the new "X-Mms-DRM-Separate-Delivery" according to the invention as already shown in Table 1.<tables id="tabl0002" num="0002"><table frame="all"><title>Table 2</title><tgroup cols="3"><colspec colnum="1" colname="col1" colwidth="50mm" /><colspec colnum="2" colname="col2" colwidth="47mm" /><colspec colnum="3" colname="col3" colwidth="69mm" /><thead><row><entry valign="top">field name</entry><entry valign="top">field value</entry><entry valign="top">description</entry></row></thead><tbody><row><entry>...</entry><entry>...</entry><entry>...</entry></row><row><entry morerows="1" rowsep="1">X-Mms-DRM-Separate-Delivery</entry><entry morerows="1" rowsep="1">DRM-Separate-Delivery-value</entry><entry>Optional.</entry></row><row><entry>Indicates that one or more DRM protected objects will be included in the MMS delivery message, and that additionally DRM rights objects are transferred to the telecommunication terminal, for example by WAP push, whereby optionally the maximum delivery delay is described or a date / time is described , Up to which the delivery will be effected.</entry></row></tbody></tgroup></table></tables>

p0048This in <figref idrefs="f0003">FIG. 6</figref> The example of a textually encoded MMS delivery message is analogous to the MMS receiver notification shown above and again contains the new "X-Mms-DRM-Separate-Delivery" according to the invention, this time due to the somewhat later delivery but with a reduced "delta seconds" -value ".

p0049Disclosed is a method for transmitting encrypted user data objects NDO to a first telecommunication terminal TG1, comprising the following steps. At first, at least one encrypted user data object is transmitted from a switching component of a telecommunications network to the first telecommunication terminal. Further, a time information s_ABS From the switching component to the first telecommunication terminal which indicates up to which time a rights object RO, which is assigned to the at least one encrypted user data object, which contains the key as well as the usage rights for the assigned useful data object, also arrives at the first telecommunication terminal. Subsequently, a rights object assigned to the at least one user data object is then received by the first telecommunication terminal. The first telecommunication terminal now checks whether the time specified in the time information has already elapsed and, in the event that it has not yet elapsed, does not yet output a signal regarding a user data object via a user interface. Only when the specified time has elapsed or at least at least one necessary object of rights (before the expired time) has been received by the first telecommunication terminal, the MMS user application forwards the information about the presence of a multimedia message with a useful data object to the user interface for output.