Method and apparatus for importing content having plurality of parts

The present invention relates to the protection of digital contents, and more particularly to the protection of digital contents in a DRM (Digital Rights Management) system.

As we switch from the analog era to the digital era, a lot of content is being produced digitally. While analog content requires a lot of effort and time to copy, digital content is easy and quick to copy. Also, analog content deteriorates in quality in proportion to the number of copies, while digital content maintains the same quality regardless of the number of copies. This raises the need for digital content protection, and many companies are conducting a variety of research on digital content protection.

FIG. 1 is a diagram showing a conventional digital content protection environment. As shown in Fig. 1, in the conventional digital content protection environment, a transmission stream is received through various broadcast transmission channels, and the information contained therein is used to protect the content.

In particular, an organization called Cable Labs in the United States has added copy control information (CCI) to content in order to control copying of the content. Copy control information is 2-bit information that limits the number of times content can be copied, and its types are copy free (00), copy once (01), and copy no more (copy no more, 10). ) And copy never (11). Copy-free means that unlimited copying of the content is allowed, and copy-once means that only one copy of the content is allowed. If the copy-once content is copied, the content becomes copy-no-more. Copy never indicates that copying of content is prohibited.

In addition, the Federal Communications Commission (FCC) of the United States has broadcast flags on content to prohibit unlimited redistribution of HD (High Definition) -grade digital content broadcast in the United States. Was attached. The broadcast flag refers to 1-bit information indicating whether or not unlimited redistribution of content is prohibited, and its types include broadcast flag on (1) and broadcast flag off (0). Broadcast flag on means that unlimited redistribution of content is not allowed, and broadcast flag off means that unlimited redistribution of content is allowed. In addition, various usage restriction information may exist.

In general, in order for a user to use various types of content received through various transmission channels, it is troublesome to obtain the license from the author each time each content is used. , The content received by the user through the transmission channel is imported through the user's DRM system, converted into a content file that complies with the rules of the user's DRM system, and licensed by itself within the scope of complying with the original usage restriction information. Once issued, the imported content files are freely available through your device or domain.

On the other hand, if one content file received through a transmission channel, that is, one independent program is composed of a plurality of content parts, a plurality of licenses are required accordingly. The content part constitutes one program, but each has different usage restriction information, and when such content is imported and saved as a content file, the device belonging to the user's domain , In order to use such a content file, grasp how many content parts the content file to be used by parsing the transport packets that make up the content file is composed of, and each content part Since it is necessary to determine what kind of license is required and acquire the license, there is a problem that a time delay occurs. In particular, such a time delay becomes even more problematic when the device attempting to use the content is provided with the imported content file in a stream.

<p num="0008"> In the present invention, when importing content containing a plurality of usage restriction information and converting it into one content file, the position of the information regarding the structure of each content part and the information necessary for decoding and using each content part. The purpose is to provide an import device and a method for including a header that informs in advance in an imported content file.</p>

<p num="0009"> The present invention for achieving such an object is a method of importing a first content file containing a plurality of content parts into a second content file, in which (a) the content part is encrypted by the usage restriction information of the content part. It is characterized by including (b) a step of generating a license for the content portion based on the usage restriction information, and (c) a step of generating a second content file having the content portion and the license. And.</p><p num="0010"> At this time, the information required to use each of the encrypted content portions is the first information representing the position of each of the encrypted content portions in the second content file, and the encryption. It is characterized by including at least one of a second information used for decoding each of the content portions, and a usage rule specified for each of the content portions based on the plurality of usage restriction information. ..</p><p num="0011"> Here, the first information is information representing a position where each of the encrypted content portions starts and / or ends in the second content file, and the second information is the encrypted content. An encryption parameter used to encrypt each of the encrypted content parts and / or a content key capable of decrypting each of the encrypted content parts.</p><p num="0012"> The present invention also provides a computer-readable recording medium in which a program for executing the content import method on a computer is recorded.</p><p num="0013"> Further, the present invention applies a content portion included in the first content file based on the plurality of usage restriction information in a device for importing a first content file containing a plurality of usage restriction information into the second content file. A second that includes an encryption unit that specifically encrypts, a header generation unit that generates a header that provides a position of information necessary for using each of the encrypted content portions, and the generated header. It is characterized by including a file generation unit that generates a content file.</p>

<p num="0014"> According to the present invention, when a device belonging to a user's domain uses a content file composed of a plurality of content parts in an imported content file, header information is used without parsing the transport packet of the content file. Just by analyzing, you can understand how many content parts the content file is composed of and obtain the license required to use each content part in advance, so the preparation time required to use the content In particular, when the content file is provided and played by the streaming method, the time is delayed in order to obtain the license required to use each content part in the section where the content part changes. Can be prevented.</p><p num="0015"> Further, according to the present invention, a device that inserts the position information of each content portion into the header of the imported content file and uses each content portion can accurately apply the license corresponding to each content portion.</p>

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is a diagram showing a protected environment for digital contents to which the present invention is applied. As shown in FIG. 2, the digital content protection environment to which the present invention is applied is various contents such as DRM system 100, HDCP (High Bandwidth Digital Content Protection) system 110 and DTCP (Digital Transmission Content Protection) system 120. Consists of a protection system and multiple devices 21 to 23 protected by them.

The DRM system 100 is a system for managing the rights of contents received from the outside. The HDCP system 200 is a system for preventing copying of content output to a digital display through a high bandwidth interface such as DVI (Digital Video Interface). The DTCP system 300 is a system for preventing copying of content transmitted via USB (Universal Serial Bus) according to the IEEE (Institute of Electrical and Electronics Engineers) 1394 standard. In addition to the content protection system as described above, other content protection systems such as CAS (Conditional Access System) system and CPRM (Content Protection for Recordable Media) system may be further included.

The DRM system 100 complies with the security requirements of content creators and content providers for content protected by conventional copy control, broadcast flags, etc., and at the same time, further fully satisfies the free use requirements of content users. It is equipped with a content import device 10 that imports into content that complies with the rules of the designed DRM system 100.

Here, import is the process of issuing a license to each of the content parts that compose the content according to the rules of the DRM system 100 and encrypting the content parts, that is, the content that does not comply with the rules of the DRM system 100. The process of converting a file into a content file that complies with the rules of the DRM system 100. In particular, which part of the content is one content part is distinguished by usage restriction information or license. That is, each of the content parts has different usage restriction information or license. On the other hand, the content file refers to a file containing content parts and copy control information or licenses for each of them, and one content file constitutes one content, that is, one broadcasting program. To do. Therefore, those skilled in the art will understand that the term content file may be simply referred to as the term content.

When the content import device 10 according to the present invention receives content including a plurality of usage restriction information, that is, content composed of a plurality of content portions, the content import device 10 imports the content and imports the content file in the process of generating the content file. The content file after being created is provided with a header in which location information, license mapping information, etc. for each content part are recorded. When a device belonging to the user's domain uses the content file imported in this way, the header can be analyzed and the usage rules and licenses for using each content file can be obtained and prepared in advance. , Time delay can be prevented. This will be described in more detail below.

FIG. 3 is a flowchart showing a method of importing content according to an embodiment of the present invention.

The content import device according to an embodiment of the present invention receives a transmission stream through a transmission channel such as a cable or a satellite broadcasting channel (310), and detects a first content file constituting one program from the transmission stream (320). ). At this time, it is assumed that the first content file is composed of a plurality of content parts, and that there are at least two or more content parts having different usage restriction information in each content part.

Next, the content part is encrypted using the content key (330), but for encryption, the AES-128-CBC and AES-128-CTR methods are used, and various other methods are used. sell. The encryption parameters used for encryption are the initial vector in the AES-128-CBC method and the SALT and packet sequence number information in the AES-128-CTR method, but different values for each content part. Is used. In the present invention, the content file is a transport packet (TS) that conforms to the MPEG-2 standard. Assuming that it is composed of Packets), encryption is performed in units of this transport packet, but among the transport packets that make up the content file, it is periodic between the transport packets that carry the media stream. Insert a transport packet notifying the encryption method and encryption parameters used to encrypt each content part. In addition, such a transport packet also includes mapping information that can search for a license required to decrypt the content portion. In the following, the information contained in such a transport packet is referred to as PI. We will call it (protection information). A detailed description of the PI packet, which is a transport packet including PI, will be described later with reference to FIG.

Once the encryption of each content part is completed, a license is issued for each content part (340). The license for each content part includes the content key used to encrypt the content part encrypted. A device key or domain key can be used to encrypt the content key depending on the scope of use of the content part, but if the content part must be used only on a specific device, it is encrypted with the device key. The content portion is encrypted with a domain key that can be shared by devices within the domain. In addition, each license includes mapping information for mapping with the content portion.

On the other hand, each of the licenses for the content part also includes the usage rules for the content, but the device must not violate the usage rules included in the license even if the content part can be decrypted. Such usage rules are newly defined based on the usage restriction information contained in the content file before being imported, and a detailed description of this will be described later with reference to FIG.

It then generates a header to include in the imported content file (350), which contains the license and decryption parameters for each content part in advance for the device that intends to use the imported content file. Contains information to be obtained. That is, the device can analyze this header information to obtain the necessary license and decryption parameters in advance. The license for each content part should also be packaged with this header. A detailed description of the header will be given later with reference to FIG.

Once the header is generated, a second content file with the header is generated (360) and stored in storage (370). That is, the second content file is the content file after the first content file is imported, and is distributed to all devices within the user's domain or at the request of a specific device (380).

Figure 4 is a mapping tape was converted using restriction information in the usage rule according to an embodiment of the present invention is a bull. As shown in FIG. 4, the mapping table according to the embodiment of the present invention is composed of the usage restriction information field 41, the import field 42, the usage range field 43, and the usage rule field 44. In particular, the mapping table shown in FIG. 4 is for any one of the content parts constituting the content.

In the usage restriction information field 41, usage restriction information of the content portion is recorded. In the import field 42, a value indicating whether or not the content portion having the usage restriction information recorded in the usage restriction information field 41 can be imported is recorded. In the usage range field 43, a usage range based on the usage restriction information recorded in the usage restriction information field 41 is recorded. In the usage rule field 44, a usage rule based on the usage restriction information recorded in the usage restriction information field 41 is recorded for each usage range recorded in the usage range field 43.

In particular, all of the values recorded in the usage rule field 44 indicates that all types of content parts can be used. Further, "M" among the values recorded in the usage rule field 44 represents the move of the content part. Moving the content part means that the content part saved in any one device is deleted from this device and at the same time saved in the other device. In addition, "S" in the value recorded in the usage rule field 44 represents streaming of the content part. Streaming the content part means that the content part stored in any one device is temporarily output to the other device, but the content part is continuously stored in the original device. Further, P among the values recorded in the usage rule field 44 represents the play of the content portion. Reproduction of the content portion means that any one device reproduces the content portion.

Copy-free means that unlimited copying of the content part is allowed, so if the usage restriction information is copy-free, the device and domain are recorded in the usage range field 43 and "all" in the usage rule field 44. Is recorded. On the other hand, copy-once means that only one copy of the content part is allowed. Therefore, when the usage restriction information is copy-once, the device is recorded in the usage range field 43 and the usage rule field 44 is "M,". S, P is recorded.

Examples of the use of the content portion include copying in addition to the above-mentioned movement, streaming, and playback. Copying the content portion means copying the content portion imported by the present embodiment. However, in order for the content import device 10 to import the content part, the content part copy must be premised, and as a result, if the content part imported by the present embodiment is copied, two copies are performed. Will be. Therefore, the content import device 10 can import the content portion that is copy once, but cannot allow the content portion imported by the present embodiment to be copied. This is the reason why only "M, S, P" is recorded in the usage rule field 44 when the usage restriction information is copy once.

Broadcast flag-on means that unlimited redistribution of the content part is not allowed, so if the broadcast flag is broadcast flag-on, the device and domain are recorded in the range field 43 and the usage rule field 44 is "all". Is recorded. Any form of use, including copying the content portion within the device scope, is in line with the unlimited redistributable prohibition of the content portion, and the domain scope is also a specific region recognizable by the user, so the content portion within the domain scope. Any use in any form, including a copy of, constitutes an unlimited redistribution prohibition of the Content Part.

FIG. 5 is a flowchart showing a process in which devices in the domain utilize the imported content according to the embodiment of the present invention. By the process in FIG. 3, the second content file of the content file after the first content file received from the outside of the user's domain is imported is stored in the import device. If a device belonging to the domain requests a second content file from the importer and receives the second content file in response to it (510), it analyzes the information contained in the header (520). As described above, if the header is analyzed, the structure of the second content file and each content part constituting the second content file can be decrypted and used without parsing the transport packet of the second content file. The license and encryption parameters can be acquired in advance to prepare for decryption. That is, the device refers to the PI packet included in the content portion to be decrypted and acquires the mapping information and the decryption parameter for searching for the license. In addition, the desired content portion can be used by searching for the license through the mapping information and finally decoding each transport packet that constitutes the content portion.

FIG. 6 is a diagram showing the structure of a content file imported according to an embodiment of the present invention. In this embodiment, it is assumed that the imported content file is composed of three content parts. As shown in FIG. 6, a PI packet 610 including a PI is periodically inserted into each content portion. PI packet 610 contains CID_SEQUENCE_NUMBER 620, ENCRYPTION PARAMETER 640.

CID_SEQUENCE_NUMBER 620 is mapping information for finding the license required to use each content part. That is, CID_SEQUENCE_NUMBER 620 informs which of the three content parts it is in order to search for the license corresponding to the content part to be used among the licenses generated for all the content parts.

Generally, in the DRM system, a content ID is given for each content in order to manage the content, but even if the content ID of the content is inserted instead of the PI packet ECID_SEQUENCE_NUMBER 620, it can be used as mapping information. In general, the content ID can be shaped by the policies of the DRM system, but in some cases its size can be larger than the maximum size of 184 bytes of data that can be contained in the payload of an MPEG-2 transport packet. Therefore, in the PI packet, instead of the content ID, the size of the data is smaller than that of the content ID, but it is desirable to use CID_SEQUENCE_NUMBER 620 as the mapping information corresponding to each content ID. For example, if the content ID is urn: marlin: broadcast: 1-0: cable: 03302006: 0001, then CID_SEQUENCE_NUMBER 620 can be configured as cable: 03302006: 0001.

ENCRYPTION PARAMETER 640 is the encryption parameter used for encryption. For example, if AES-128-CTR is used as the encryption method, the PI packet may contain serial number information.

FIG. 7 is a diagram showing a header structure of a content file imported according to an embodiment of the present invention. As shown in FIG. 7, the header of the content file imported by one embodiment of the present invention includes PROGRAM_ID 701 and PI_PID 702, and each content portion includes CONTENT_ID 703, CONTENT_ID_SEQUENCE_NUMBER 704, CONTENT_START_POINTER 705, and CONTENT_END_POINTER 706. It also includes a license 710 for each content part. The information will be described in detail below.

PROGRAM_ID 701 is information representing the title of the program. That is, it is an identifier that distinguishes one program completed by N content parts from other programs, and its form can be determined by the policy specified by the DRM system.

PI_PID 702 is index information for searching for PI packets. The transport packet that constitutes each content portion has a unique packet ID in the header of each packet depending on the information contained in each packet. That is, each content part has a separate license, and the encryption method and encryption parameters may differ, but among the transport packets included in one content file, the PI packet containing the PI. Since the packet ID of is the same for all content parts, the PI packet can be found by analyzing PI_PID 702.

CONTENT_ID 703 is an identifier for distinguishing each content part. Each content part requires a different license, but since each license includes the content ID of the content part, the content ID is utilized as mapping information corresponding to the license.

The CONTENT_ID_SEQUENCE_NUMBER 704 is information for mapping the PI packet to the license as explained in FIG. 6, but since the size of the CONTENT_ID 703 is too large to be inserted into the PI packet, only a part of the PI packet is included in the PI packet. And record it in the content file header as shown in Figure 6. That is, if the device recognizes the CONTENT_ID_SEQUENCE_NUMBER recorded in the PI packet, the CONTENT_ID 703 of the content portion can be found by referring to the header, and the required license 720 can be searched for using the CONTENT_ID 703 as mapping information.

CONTENT_START_POINTER 705 and CONTENT_END_POINTER 706 represent the start position and end position of the content portion, respectively. Analyzing this information will give you an idea of how many content parts the imported content file is made up of without having to parse the transport packets each time, and you can accurately apply the licenses you have acquired to each content part. Depending on the embodiment, any one of CONTENT_START_POINTER 705 and CONTENT_END_POINTER 706 may be omitted.

License 720 includes Content ID 721, Content Key 722 and Usage Rule 723. The content ID 721 is mapping information for mapping the required license to each of the content parts. For example, a device that intends to use the first content portion in FIG. 7 can search and find license 720 with the same content ID if it knows the content ID 703. That is, CONTENT_ID 703 and content ID 721 have the same information.

The content key 722 is an encryption key used for encrypting the content portion. The usage rule 723 was generated based on the usage restriction information contained in the content file before being imported, and has already been described in FIG. 4, so detailed description thereof will be omitted here.

FIG. 8 is a diagram showing a structure of a content import device according to an embodiment of the present invention. As shown in FIG. 8, the content import device 800 according to the embodiment of the present invention includes a receiving unit 801 and a detecting unit 802, a usage rule determining unit 803, an encryption unit 804, a license issuing unit 805, and a header generating unit 806. It includes a file generation unit 807, a storage unit 808, and a transmission / reception unit 809.

The receiving unit 801 receives the transmission stream through various transmission channels outside the domain, and the detection unit 802 detects the content files constituting one program from the received transmission stream, and also for each content part. Detect usage restriction information. As described above, examples of usage restriction information may include copy control information, broadcast flags, and the like.

The usage rule determination unit 803 determines the usage rule for each of the content parts after being imported based on the usage restriction information detected by the detection unit 802.

The encryption unit 804 encrypts the content file detected by the detection unit 802, that is, each content part contained in the content file before being imported by using a separate content key according to the corresponding usage restriction information. To become. Further, the encryption unit 804 encrypts the content key used for encrypting each content portion by using the device key or the domain key. If the encrypted content portion needs to be used only on a particular device, then the domain can be encrypted using the device key of that device and shared by any device in the domain. Encrypt using the key.

The license issuing unit 805 issues a separate license for each of the content parts, but as described above, the license is necessary for the device to use the content part, and each license is the content part. It has usage rules and an encrypted content key.

The header generator 806 generates a header for the imported content file, which is imported when the device attempts to use the imported content file, without parsing each transport packet altogether. It contains information that allows you to understand the structure of the content file and obtain a license for each content part in advance. Also, as shown in FIG. 7, it is desirable that the header also includes a license for each content portion.

The file generation unit 807 adds a header to the encrypted content portion to generate a content file. The content file generated at this time is the content file after being imported. The storage unit 808 stores the imported content file, and the transmission / reception unit 809 transmits the imported content file as a response to the request of the device belonging to the user's domain.

FIG. 9 is a flowchart showing a process of using the content file imported by one embodiment of the present invention.

In step 910, the mapping information is analyzed from the protection information contained in the imported content file. This mapping information can be CONTENT_ID_SEQUENCE_NUMBER 704 in Figure 7.

In step 920, the identification information of the content portion is analyzed using the mapping information. The identification information of the content part can be CONTENT_ID 703 in FIG.

In step 930, the identification information is used to analyze the license. More specifically, it selects the license that corresponds to the identifying information and processes the user's usage request according to the usage rules contained in the license. That is, the content key is parsed only when the user's request for use matches the usage rule.

In step 940, the content portion is decrypted using the protection information and the license.

FIG. 10 is a diagram showing the structure of a device that uses the content file imported according to the embodiment of the present invention. As shown in FIG. 10, the device 1000 using the imported content file includes a storage unit 1001, a mapping information analysis unit 1002, an identification information analysis unit 1003, a license analysis unit 1004, and a decoding unit 1005.

The storage unit 1001 saves the imported file, and the mapping information analysis unit 1002 analyzes the mapping information of the content part from the protection information periodically included between the content parts of the imported file. This mapping information can be CONTENT_ID_SEQUENCE_NUMBER 704 in Figure 7.

The identification information analysis unit 1003 analyzes the identification information corresponding to the mapping information. The identification information can be CONTENT_ID 703 in Figure 7.

The license analysis unit 1004 analyzes the license of the content part using the identification information. That is, the license corresponding to the identification information is selected, the usage rules included in the license are referred to, and the user's content usage request is processed. Therefore, although not shown, the license analysis unit 1004 provides a means for selecting a license corresponding to the identification information, a means for comparing the user's request with the license usage rules, and a means for analyzing the license content key based on the comparison result. It is desirable to prepare.

The decryption unit 1005 decrypts the content part by using the protection information and the license.

On the other hand, the above-described embodiment of the present invention can be created by a program that can be executed by a computer, and can be embodied by a general-purpose digital computer that operates the program by using a computer-readable recording medium.

The computer-readable recording media include magnetic recording media (eg, ROMs, floppy (registered trademark) disks, hard disks, etc.), optically readable media (eg, CD-ROMs, DVDs, etc.) and carrier waves (eg, CD-ROMs, DVDs, etc.). Includes recording media such as (transmission over the Internet).

The present invention has been described above, focusing on its preferred embodiments. Those skilled in the art will appreciate that the invention can be embodied in a modified form without departing from the essential properties of the invention. Therefore, the disclosed embodiments must be considered from a descriptive point of view, not from a limiting point of view. The scope of the present invention is shown in the claims, not in the above description, and all differences within the equivalent scope shall be construed as included in the present invention.

<figref num="1">It is a figure which shows the protection environment of the conventional digital contents.</figref><figref num="2">It is a figure which shows the protection environment of the digital content to which this invention is applied.</figref><figref num="3">It is a flowchart which shows the method of importing the content by one Embodiment of this invention.</figref><figref num="4">It is a mapping table which converted the use restriction information into a use rule by one Embodiment of this invention.</figref><figref num="5">It is a flowchart which shows the process which the device in the domain uses the imported content by one Embodiment of this invention.</figref><figref num="6">It is a figure which shows the structure of the content file imported by one Embodiment of this invention.</figref><figref num="7">It is a figure which shows the header structure of the content file imported by one Embodiment of this invention.</figref><figref num="8">It is a figure which shows the structure of the content import apparatus which concerns on one Embodiment of this invention.</figref><figref num="9">It is a flowchart which shows the process of using the content file imported by one Embodiment of this invention.</figref><figref num="10">It is a figure which shows the structure of the apparatus which uses the content file imported by one Embodiment of this invention.</figref>

Code description

10,800 content importer 21, 22, 23 devices 41 Usage Restriction Information Field 42 Import field 43 Range of use field 44 Usage Rule Field 100 DRM system 110 HDCP system 120 DTCP system 801 Receiver 802 detector 803 Use Rule Decision Department 804 Encryption Department 805 License Issuing Department 806 Header generator 807 File generator 808 Storage section 809 Transmitter / receiver 1001 Preservation section 1002 Mapping Information Analysis Department 1003 Identification Information Analysis Department 1004 License Analysis Department 1005 Decryptor