CN101872399B - Dynamic digital copyright protection method based on dual identity authentication - Google Patents

Abstract

The invention discloses a dynamic digital copyright protection method based on double identity authentication, comprising the following steps: downloading the user's digital certificate to a USBKEY with a built-in random number generator; , activate the USBKEY according to the input PIN code password, and then obtain the digital certificate in the USBKEY. When the digital certificate is valid, the random number generator generates a random number sequence. The use rights stipulated in the extension item are used to play online or download media work files online; when the user is not logged in, after the USBKEY is placed in the client, the USBKEY is activated according to the entered PIN code password, and then the digital certificate in the USBKEY is obtained. When it is valid, the media work file is played offline according to the use authority stipulated in the extension of the digital certificate. The method can restrict the user's use authority and divide the scope of the user's authority, authenticate the identity of the user in the offline state, and prevent offline diffusion.

Description

A Dynamic Digital Copyright Protection Method Based on Double Identity Authentication

technical field

The invention relates to the field of information security, to digital copyright protection and identity authentication, in particular to a dynamic digital copyright protection method based on double identity authentication.

Background technique

With the rapid development of network transmission and communication technology, the distribution, duplication and editing of network multimedia files have become more and more common. more and more attention. The resulting digital rights management technology (Digital Rights Management, hereinafter referred to as DRM) can realize the protection of copyright, which combines the access mechanism of hardware and software to effectively control the access of digital multimedia content in its life cycle . At present, many scholars have conducted in-depth and extensive research on DRM technology.

Steve K et al. proposed a privacy-protectable copyright management model, which can perform online user privacy-protected identity authentication and permission, but cannot locate the identity of the copyright user offline. Andreaux JP et al proposed a copyright protection system for digital home networks, which separates attribute certificates and licenses, thereby realizing the safe distribution of digital media. However, due to the limitation of the network where it is located, it has not been extended to the scope of the wide area network. ShiHao et al. designed a digital rights management scheme for collaborative point-to-point peer-to-peer networks. This scheme uses dynamic license technology, but does not support the migration of copyright-controlled content in physical space.

Although the scientific research results and practical experience in recent years have achieved remarkable results, there are still problems to be solved on the copyright management platform, which are specifically reflected in:

(1) Although the identity authentication technology in the online state solves the legal identity problem of the user well, it cannot correctly restrict the user's use authority and clearly divide the user's authority scope.

(2) Since there is no user identity authentication mechanism in the offline state at present, after the user passes the identity authentication on the copyright management platform, the digital multimedia files downloaded to the local computer can be directly played by a commonly used media player, so that As a result, digital multimedia works are maliciously tampered with or stolen, which cannot effectively prevent offline diffusion.

Therefore, it is necessary to provide an improved digital copyright protection method to overcome the defects of the prior art.

Contents of the invention

The purpose of the present invention is to provide a dynamic digital copyright protection method based on dual identity authentication. The PIN code and digital certificate in the USBKEY can solve the problem that the identity of the copyright user cannot be located in the offline state in the copyright management mode proposed by Steve K et al. , the copyright protection system of digital home network proposed by Andreaux JP et al. has not been extended to the scope of wide area network, and the digital rights management scheme for collaborative peer-to-peer network designed by Shi Hao et al. does not support copyright-controlled content The migration of the physical space, and the extension of the digital certificate can correctly restrict the user's use authority and clearly divide the user's authority range in the online state. The PIN code and the digital certificate can authenticate the user's identity in the offline state, avoiding Media works are maliciously tampered with or stolen, effectively preventing offline diffusion.

In order to achieve the above object, the present invention provides a dynamic digital copyright protection method based on dual identity authentication, comprising the following steps: (1) downloading the user's digital certificate to a USBKEY with a built-in random number generator; (2) when When the user logs in, after the USBKEY is placed in the client, activate the USBKEY according to the input PIN code password, and then obtain the digital certificate in the USBKEY. When the digital certificate is valid, the random number generator generates a random number sequence. When the signature information of the signature is correct, play or download the media work file online according to the use authority stipulated in the extension of the digital certificate; (3) When the user is not logged in, after the USBKEY is placed in the client, according to the input PIN password Activate the USBKEY to obtain the digital certificate in the USBKEY. When the digital certificate is valid, play the media file offline according to the usage rights specified in the extension of the digital certificate.

In one embodiment of the present invention, the method further includes: (11) when the user registers the PIN code set by the user and the user's unique identifier automatically generated by the system as a key element, and using the key element to generate After the asymmetric key pair, the CA agency center will review the user's identity information in the public key of the asymmetric key pair, and after the user's identity information has passed the review, the public key in the asymmetric key pair and the user's identity The information is sent to the CA authority certification center, (12) the CA authority certification center generates a digital certificate when the user's identity information is consistent with the user's identity information information in the public key, and sends the digital certificate to the CA agency center; (13) the CA agent The center issues digital certificates to owners or consumers, and stores the digital certificates in the database.

In another embodiment of the present invention, the digital certificate includes the user's identity information, public key information, identity information of the CA authority certification center, the CA authority certification center's signature on the digital certificate, extensions, and validity period, wherein the user The identity information includes the serial number of the digital certificate, the user name submitted by the user when registering, and the unique identifier generated by the system platform for the user, and is determined by the CA authority certification center 100. The extended items include online playback, online download, and offline media playback. Permission information for the work file.

In yet another embodiment of the present invention, said step (2) is specifically: (21) after the user logs in and puts the USBKEY into the client, when the number of times of the input PIN code password does not exceed the specified number of times, input the PIN code Password, when the PIN code password of input is identical with the PIN code of USBKEY, activate USBKEY; (22) obtain the digital certificate in USBKEY, when digital certificate is valid, random number generator produces random number sequence; The random number generated by the random number generator based on the private key in the asymmetric key pair as the initialization seed, the valid time of the certificate, and the signature of the message composed of the target recipient and the signature information are encrypted by the private key, and the public key of the digital certificate is used. The key decrypts the encrypted signature information, digitally signs the message, and judges whether the user's signature is correct according to the signed message and the decrypted signature information; (24) When the signature is correct, determine whether the server is the receiver of the information, Whether the time stamp of the digital certificate is the current time; (25) When the server is the recipient of the information and the time stamp of the digital certificate is the current time, play or download the media work file online according to the use authority specified in the extension of the digital certificate.

In yet another embodiment of the present invention, said step (3) is specifically: (31) after the user does not log in and puts the USBKEY into the client, when the number of times the input PIN code password does not exceed the specified number of times, input the PIN Code password, when the input PIN code password is the same as the PIN code of the USBKEY, activate the USBKEY; (32) Obtain the digital certificate in the USBKEY, when the digital certificate is valid, play the media offline according to the use authority stipulated in the extension of the digital certificate Works file.

In yet another embodiment of the present invention, the method also includes: after the user pays for the new use right of the media work file, updating the extension and validity period of the user's digital certificate; downloading the updated digital certificate into the USBKEY To replace the original digital certificate.

Compared with the prior art, the present invention's dynamic digital copyright protection method based on double identity authentication has the following advantages:

(1) in online state and offline state, all adopt PIN code password and digital certificate to verify user identity, this double authentication has avoided all users to operate media file, can locate the identity of copyright user like this under offline state, the present invention The home network server forms a domain. By applying for the corresponding certificate from the server that manages the home network and provides digital content, the server manages the domain as a whole, and the digital content applied by the devices in the domain is regarded as the application of the domain. The server side only communicates with this user domain, and does not directly communicate with each device in the domain, which can extend the copyright protection of the digital home network to the scope of the wide area network; distribute the public key of the digital certificate to the peer-to-peer network through the idea of secret sharing The trusted node of the network provides the necessary security guarantee for the distribution of digital content in the digital rights management of the network, and the physical space of copyright-controlled content can be migrated.

(2) The extension item of the digital certificate stipulates the use rights of digital multimedia works, which can realize the restriction and division of the use rights of online download, online play, and offline play.

(3) In the online state, a random number generator is used to generate a random number sequence to require the user to sign, and the random number sequence of each signature of the user is different, which realizes the dynamics of identity authentication.

The present invention will become clearer through the following description in conjunction with the accompanying drawings, which are used to explain the embodiments of the present invention.

Description of drawings

Fig. 1 is a flowchart of the dynamic digital copyright protection method based on dual identity authentication of the present invention.

FIG. 2 is an architecture diagram of a system involved in the dynamic digital copyright protection method based on dual identity authentication shown in FIG. 1 .

FIG. 3 is a block diagram of USBKEY in the dynamic digital copyright protection method based on double identity authentication shown in FIG. 1 .

FIG. 4 is a flow chart of implementing online playback or downloading in the dynamic digital copyright protection method based on dual identity authentication shown in FIG. 1 .

FIG. 5 is a flow chart of realizing offline playback in the dynamic digital copyright protection method based on dual identity authentication shown in FIG. 1 .

FIG. 6 is a flow chart of issuing digital certificates to users in the dynamic digital copyright protection method based on dual identity authentication shown in FIG. 1 .

Detailed ways

Embodiments of the present invention will now be described with reference to the drawings, in which like reference numerals represent like elements.

With reference to Fig. 1 and Fig. 2, the dynamic digital copyright protection method based on dual identity authentication of the present embodiment comprises the following steps:

Step S1, the service provider downloads the user's digital certificate to the USBKEY (smart password key) 500 with a built-in random number generator, and then turns to step S2 or step S3;

Step S2, when the user logs in, after the USBKEY 500 is placed in the client (user PC) 410, the dynamic identity authentication module activates the USBKEY 500 according to the input PIN code password, and then obtains the digital certificate in the USBKEY 500, when the digital certificate is valid , the random number generator generates a random number sequence, and when the signature information signed by the user on the random number sequence is correct, the media work file can be played or downloaded online according to the usage rights stipulated in the extension of the digital certificate;

Step S3, when the user is not logged in, after the USBKEY 500 is inserted into the client (user PC) 410, the offline playback module activates the USBKEY 500 according to the input PIN code password, and then obtains the digital certificate in the USBKEY 500, when the digital certificate is valid , the media work file will be played offline according to the use rights stipulated in the extension of the digital certificate.

As can be seen from the above, the dynamic digital copyright protection method based on double identity authentication in this embodiment has the following advantages:

(1) In both online and offline states, PIN code passwords and digital certificates are used to verify user identities. This double identity verification prevents all users from operating media files.

(2) The extension item of the digital certificate stipulates the use rights of digital multimedia works, which can realize the restriction and division of the use rights of online download, online play, and offline play.

(3) In the online state, a random number generator is used to generate a random number sequence to require the user to sign. The random number sequence of each signature of the user is different, which realizes the dynamic nature of identity authentication. Even if the hacker intercepts the digital signature, it cannot be counterfeited. The identity of the legitimate user.

3, the USBKEY 500 includes a hardware device management submodule 510, an asymmetric key management submodule 520, an algorithm management submodule 530, a data encryption management submodule 540, and a user's digital certificate 550 downloaded by a service provider. The components of the USBKEY 500 are described in detail below.

The hardware device management submodule 510 includes a USB identification control unit 511, a PIN code identification CPU unit 512, and an EPROM 513 for encryption protection. Described USB identification control unit 511 is used for identifying USBKEY 500 to insert or pull out the operation of client (user PC) 410, controls the CPU (Central Processing Unit, central processing unit) of client 410 to read when identifying USBKEY 500 insertion operation Obtain the PIN password entered by the user. The PIN code identification CPU unit 512 is used for judging whether the PIN code password read by the CPU is correct or not and for judging the times of inputting the PIN code. The EPROM unit 513 is used to store secret data such as a digital certificate 550 and a key. The read and write operations of the EPROM unit 513 are implemented through a program, and the user cannot directly read it, and the user's private key cannot be exported, which prevents the user from copying Possibility of digital certificates or identity information.

The asymmetric key management submodule 520 is used to use the PIN code set by the user and the user's unique identifier (ID) automatically generated by the system when the user registers as key elements, and use the key elements to generate an asymmetric key using the RSA algorithm. Key pair, store the asymmetric key pair and the digital certificate 550 in the encrypted protected EPROM unit; the key is divided into a symmetric key and an asymmetric key, and both have validity periods (the key cannot be used indefinitely, because the key uses The longer the time, the greater the chance of it leaking, and the greater the damage it will cause). During the validity period of the key, the user uses the private key in the asymmetric key to encrypt the message, and the receiver uses the public key in the digital certificate to decrypt the message. When the key expires, the key element is used to regenerate the asymmetric Symmetric key pair, update the key based on the regenerated asymmetric key pair. Specifically, the asymmetric key management submodule 520 includes a key installation generation unit 521 , a key usage update unit 522 , and a key storage revocation unit 523 . The key installation generation unit 521 is used to use the PIN code set by the user and the user's unique identifier (ID) automatically generated by the system when the user registers as key elements, and use the key elements to generate an asymmetric key pair using the RSA algorithm; The key usage update unit 522 is used to read the asymmetric key pair in the EPROM unit 511 and update the invalid asymmetric key pair; the key storage revocation unit 523 is used to save the generated asymmetric key pair to the EPROM unit 511 Delete or delete the asymmetric key pair in the EPROM unit 511.

The algorithm management sub-module 530 is used to mark each algorithm with an ID, store and identify each algorithm, and select an encryption algorithm among each algorithm. Among them, the algorithms include asymmetric key algorithms such as RSA and DSA, symmetric key algorithms such as DES, RC6, and RC5, and data hash algorithms such as SHA-1 and MD5. Better solve the USBKEY space storage problem. Specifically, the algorithm management submodule 530 includes an algorithm library management unit 531 , an encryption algorithm selection unit 532 , and a random number generator 533 . Algorithm library management unit 531 is responsible for managing asymmetric key algorithms, symmetric key algorithms, and data hash algorithms; encryption algorithm selection unit 532 is responsible for scheduling each algorithm according to task requirements; random number generator 533 has an input parameter, that is, initialization seed , the initialization seeds are different, and different random number sequences can be generated each time.

The data encryption management submodule 540 is used for encrypting data according to the encryption algorithm selected by the algorithm management submodule 530 , and performing data decryption according to the encryption algorithm selected by the algorithm management submodule 530 . Specifically, the data encryption management submodule 540 includes a data encryption implementation unit 541 , a data decryption implementation unit 542 , and a data file signature unit 543 . The data encryption implementation unit 541 is responsible for the operation of the encryption algorithm; the data decryption unit 542 is responsible for the operation of the decryption algorithm; the data file signature unit 543 is responsible for the operation of the digital signature.

It can be seen from the above that the USBKEY 500 can be regarded as a combination of a smart card and a card reader.

As shown in Figure 4 and in conjunction with Figure 2 and Figure 3, the step S2 is specifically:

Step S21, after the user logs in, the USB identification control unit 511 of the hardware device management submodule 510 of the USBKEY 500 recognizes that when the USBKEY 500 is inserted into the client (user PC) 410 for operation, the PIN code identification CPU unit 512 judges the input PIN code Whether the number of passwords exceeds the specified number of times, if so, end (blocking the user password to prevent non-personal use), if not, continue to the next step;

Step S22, after the user inputs the PIN code password, the CPU of the USB identification control unit 511 controls the client terminal 410 to read the PIN code password input by the user, and the PIN code discrimination CPU unit 512 judges whether the input PIN code password is correct, if so, continue One step, if not, go to step S21;

Step S23, the server end (copyright management platform server) 230 obtains the digital certificate 550 of USBKEY 500 through the network, judges whether the digital certificate 550 stored in the EPROM unit 513 of USBKEY 500 is valid, if so, continue to the next step, if not, end;

Step S24, the key installation generation unit 521 in the asymmetric key management submodule 520 of the USBKEY 500 uses the PIN code set by the user and the user unique identifier (ID) automatically generated by the system when the user registers as key elements, using The RSA algorithm generates an asymmetric key pair (public key+private key); the random number generator 533 in the algorithm management submodule 530 generates a random number r _c as an initialization seed according to the private key in the asymmetric key pair, and the random The number r _c , the valid time of the certificate t _c , and the target recipient _sc are used as the message; the data file signature unit 543 of the data encryption management submodule 540 signs the message through the user to obtain the signature information S(rc, _{t c} , _sc ); the data encryption implementation unit 541 of the data encryption management submodule 540 uses the private key in the asymmetric key pair to encrypt the signature information S(rc _, t _c , _sc ), and encrypts the encrypted signature information and The message is sent to the server 230 together, wherein the digital signature is a one-way function performed on the entire message, and is a group of fixed-length codes representing the characteristics of the message. If only one part of the message is changed, the digital signature will be completely different.

Step S25, the server 230 extracts the user's public key from the digital certificate 550, and uses the user's public key to decrypt the encrypted signature information sent by the data encryption management submodule 540 to obtain a digitally signed plaintext. In addition, the server 230 Carry out the same digital signature to the message sent by the data encryption management submodule 540, and compare the consistency with the plaintext of the digital signature to verify whether the signature of the data file signature unit 543 is correct;

Step S26, when the signature is correct, the server side 230 verifies whether the server is the receiver of the information, and whether the timestamp of the digital certificate 550 is the current time (so anyone who has the user's public key can receive or refuse to receive the message according to the verification result , and at the same time realize the prohibition of forgery of digital signatures and modification of messages);

Step S27, when the server 230 is the receiver of the information and the time stamp of the digital certificate is the current time, the server 230 judges whether the user has the right to play or download the media file online according to the extension content of the digital certificate 550, if so, continue Next step, if not, end;

In step S28, the server 230 allows online playback or online download of the media file.

It can be seen from the above that when a user plays or downloads a media file online, the identity of the user is double-authenticated by using a PIN code password and a digital certificate, which realizes a high degree of credibility of identity authentication, and a random number generator is used to generate a sequence of random numbers. The random number sequence of each user's identity authentication is different, which realizes the dynamic nature of identity authentication. In addition, the extension of the digital certificate clearly stipulates the authority relationship between the authorized multimedia file and the user, which solves the problem of online viewing and downloading authority distribution.

As shown in Figure 5 and Figure 2 and Figure 3, the step S3 is specifically:

Step S31, after the user logs in, the USB identification control unit 511 of the hardware device management submodule 510 of the USBKEY 500 recognizes that when the USBKEY 500 is inserted into the client (user PC) 410 for operation, the PIN code identification CPU unit 512 judges the input PIN code Whether the number of passwords exceeds the specified number of times, if so, end (blocking the user password to prevent non-personal use), if not, continue to the next step;

Step S32, after the user inputs the PIN code password, the CPU of the USB identification control unit 511 controls the client terminal 410 to read the PIN code password imported by the user, and the PIN code discrimination CPU unit 512 judges whether the input PIN code password is correct, if so, continue One step, if not, go to step S31;

Step S33, the client 410 obtains the digital certificate 550 of the USBKEY 500, and judges whether the digital certificate 550 stored in the EPROM unit 513 of the USBKEY 500 is valid, if so, proceed to the next step, if not, end;

Step S34, the client 410 judges whether the user has the authority to play the media file offline according to the extension content of the digital certificate 550, if so, proceed to the next step, if not, end;

In step S35, the client 410 allows offline playback of the media file.

It can be seen from the above that when the user plays the media file offline, the PIN code password and the digital certificate 550 are used to double-authenticate the user's identity, which realizes the high reliability of identity authentication; the extension of the digital certificate clearly stipulates that the authorized multimedia file The authority relationship with users solves the problem of offline playback authority allocation.

In this embodiment, the digital certificate 550 is issued by the CA authority 100 and the digital certificate management module 200 . As Fig. 2, described digital certificate management module 200 comprises CA agent center 210, database 220 and server end (copyright management platform server) 230, then as Fig. 6, described dynamic digital copyright protection method based on dual identity authentication also comprises steps :

Step S61, when the user uses the PIN code set by the user and the user unique identifier (ID) automatically generated by the system when the user registers as the key element, the key element is used to pass the asymmetric key management submodule 520 of the USBKEY500 through the RSA algorithm Generate an asymmetric key pair (public key+private key) and send the public key in the asymmetric key pair to the CA agency center 210 through the copyright management platform server 230, and the CA agency center 210 will check the identity information of the user in the public key Perform an audit, and after the user's identity information passes the audit, send the public key in the asymmetric key pair and the user's identity information to the CA authority certification center 100;

Step S62, the CA authoritative certification center 100 generates a digital certificate 550 when the user's identity information is consistent with the user's identity information in the public key, and the format of the digital certificate 550 is based on the X.509 digital certificate format as a standard, which includes The user's identity information, public key information, identity information of the CA authority certification center 100, the signature of the CA authority certification center 100 on the digital certificate 550, and the extensions, time stamp and validity period of the digital certificate, wherein the user identity information includes The serial number of the certificate, the user name submitted by the user during registration, and the unique identifier (ID) generated by the system platform for the user are determined by the CA authority certification center 100. The extensions of the digital certificate include online play, online download, offline Permission information for playing media works files (only when the digital certificate is within the validity period, and the extension of the digital certificate indicates the online playback, online download, and offline playback permissions, the user can perform corresponding operations), the user’s identity information in the digital certificate Indicates whether the user's identity is legal, the public key is used to decrypt the ciphertext, the extension is used to limit user permissions, the time stamp ensures real-time transmission, and the validity period monitors the validity of the digital certificate;

Step S63 , the CA authority certification center 100 sends the digital certificate 550 to the CA proxy center 210 , and the CA proxy center 210 issues the digital certificate 550 to the user, and stores the digital certificate in the database 220 .

It can be seen from the above that the CA agency center 210 is responsible for verifying the user's identity, and the CA authority certification center 100 is responsible for issuing digital certificates.

In addition, the dynamic digital copyright protection method based on double identity authentication also includes the steps of:

Step S101, when the user sends a certificate update request or a certificate revocation request to the CA proxy center 210 through the copyright management platform server 230, the CA proxy center 210 reviews the user identity information contained in the certificate update request or the certificate revocation request, and when the user identity After the information review is passed, the CA agency center 210 uses the user's private key as an initialization seed to generate a random number sequence with a fixed-length code, and after the user signs the random number sequence, apply to the CA authority certification center 100 for updating the certificate or revoking the certificate;

Step S102, the CA authority 100 updates the digital certificate 550 and sends the updated digital certificate to the user through the CA proxy center 210, or revokes the digital certificate and adds the revoked digital certificate to the certificate revocation list CRL.

It can be seen from the above that the CA proxy center 210 is responsible for processing the update request or invalidation request for the digital certificate, and the CA authoritative certification center 100 is responsible for updating the digital certificate or revoking the digital certificate.

In addition, the dynamic digital copyright protection method based on double identity authentication also includes the steps of:

Step S201, after the user submits a certificate status query request to the CA proxy center 210 through the copyright management platform server 230, the CA proxy center 210 checks the user identity information contained in the certificate status query request;

Step S202, when the user identity information is verified, the CA authoritative certification center 100 queries the time stamp in the digital certificate 550 or the certificate revocation list CRL. When the time stamp is the current time, it determines that the status of the certificate 550 is within the validity period. When the digital certificate 550 is in the certificate revocation list (CRL), it is determined that the status of the certificate is revoked.

It can be seen from the above that the CA proxy center 210 is responsible for processing the status query request for the digital certificate, and the CA authority certification center 100 is responsible for querying the status of the digital certificate.

In this embodiment, the dynamic digital copyright protection method based on double identity authentication also includes the steps of:

Step S301, after the user pays the fee for the new usage right of the media file, the CA agency center 210 applies to the CA authoritative certification center 100 to update the extension and the validity period of the digital certificate 550 of the user;

Step S302, after the CA authority certification center 100 updates the digital certificate 550, the service provider downloads the updated digital certificate to the USBKEY 500 to replace the original digital certificate 550.

It can be seen from the above that when the digital certificate expires and is invalid, the CA agency center 210 can renew the digital certificate according to the user's request on the premise of paying the new usage right fee, and the user can continue to use the USBKEY 500 with the updated digital certificate Perform online playback, online download, and offline playback operations.

The present invention has been described above in conjunction with the best embodiments, but the present invention is not limited to the above-disclosed embodiments, but should cover various modifications and equivalent combinations made according to the essence of the present invention.

Claims (5)

1. A dynamic digital copyright protection method based on dual identity authentication, comprising the steps of: (1) Download the user's digital certificate to the smart password key with a built-in random number generator; (2) When the user logs in, after the smart password key is placed in the client, the smart password key is activated according to the input PIN code password, and then the digital certificate in the smart password key is obtained. When the digital certificate is valid, the random number generator generates Random number sequence, when the user signs the message composed of the random number generated by the random number generator based on the private key in the asymmetric key pair as the initialization seed, the valid time of the certificate, and the target recipient, and the signature information is encrypted by the private key Finally, the encrypted signature information is sent to the server together with the message, and the server extracts the user's public key from the digital certificate, uses the user's public key to decrypt the encrypted signature information, and obtains a digitally signed plaintext. In addition, The server will carry out the same digital signature on the message, and judge whether the user's signature is correct according to the signed message and the decrypted signature information. download media work files; (3) When the user is not logged in, after the smart password key is placed in the client, activate the smart password key according to the input PIN code password, and then obtain the digital certificate in the smart password key. When the digital certificate is valid, according to the digital certificate The use rights stipulated in the extension item play the media work file offline, It is characterized in that it also includes: (11) When the user uses the PIN code set by the user and the unique user identifier automatically generated by the system when the user registers as the key element, and uses the key element to generate an asymmetric key pair, the CA agency center will verify the asymmetric key Review the user's identity information in the public key, and send the public key and user's identity information in the asymmetric key pair to the CA authority certification center after the user's identity information has passed the review; (12) The CA authoritative certification center generates a digital certificate when the user's identity information is consistent with the user's identity information in the public key, and sends the digital certificate to the CA agency center; (13) The CA agency center issues the digital certificate to the owner or consumer, and stores the digital certificate in the database. 2. the dynamic digital copyright protection method based on dual identity authentication as claimed in claim 1, is characterized in that, described digital certificate comprises user's identity information, public key information, time stamp, the identity information of CA authoritative certification center, CA Authoritative certification center's signature, extension, and validity period of the digital certificate, where the user's identity information includes the digital certificate serial number, the user name submitted by the user when registering, and the unique identifier generated by the system platform for the user, and is certified by the CA authority Determined by the center, the extension includes permission information for online playback, online download, and offline playback of media work files. 3. the dynamic digital copyright protection method based on dual identity authentication as claimed in claim 1, is characterized in that, described step (2) further comprises: After the user logs in and puts the smart password key into the client, when the number of times the input PIN code password does not exceed the specified number of times, enter the PIN code password, and when the input PIN code password is the same as the PIN code of the smart password key, the smart password key; When the user's signature is correct, determine whether the server is the recipient of the information, and whether the timestamp of the digital certificate is the current time; When the server is the recipient of the information and the time stamp of the digital certificate is the current time, the media work file can be played or downloaded online according to the usage rights stipulated in the extension of the digital certificate. 4. the dynamic digital copyright protection method based on dual identity authentication as claimed in claim 1, is characterized in that, described step (3) is specifically: (31) After the user does not log in and puts the smart password key into the client, when the number of times the input PIN code password does not exceed the specified number of times, enter the PIN code password, and when the input PIN code password matches the PIN code of the smart password key At the same time, activate the smart password key; (32) Obtain the digital certificate in the smart cryptographic key, and when the digital certificate is valid, play the media work file offline according to the use authority specified in the extension of the digital certificate. 5. the dynamic digital copyright protection method based on dual identity authentication as claimed in claim 1, is characterized in that, also comprises: After the user pays for the new right to use the media work file, update the extension and validity period of the user's digital certificate; Download the updated digital certificate into the smart password key.

Images