WO2007019760A1

WO2007019760A1 - A method and a system for a mobile terminal joining in a domain and obtaining a rights object

Info

Publication number: WO2007019760A1
Application number: PCT/CN2006/001343
Authority: WO
Inventors: Yimin Li; Guoxin Shi
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-08-12
Filing date: 2006-06-15
Publication date: 2007-02-22
Also published as: CN100337175C; CN1794128A

Abstract

A method for a mobile terminal joining a join domain set by a rights issuer and a method for obtaining a rights object from the issuer are disclosed. The rights issuer RI requires the authorization for the certificate of the RI, and a validity authorizing result and a digital signature of the OCSP responder are carried by the RO or the join domain responding message. The DRM Agent of the mobile terminal confirms the legality of the OCSP responder according to the digital signature of the OCSP responder, and obtains the RO object or the password to join the join domain after confirming the valid of the RI certification, thus the security and reliability of the RO object or the source of the password to join the join domain are guaranteed. The system implementing the method mentioned above includes a rights agent server, a RI server and an OCSP responder, each of which is configured as a security module separately.

Description

Method and system for joining mobile terminal to domain and obtaining rights object

The present invention relates to DRM (Digital Rights Management) technology in a mobile communication system, and more particularly to a method in which a mobile terminal joins an add-on domain set by a content distributor of a digital information product and obtains a rights object from an issuer. Background technique

DRM is a precondition for realizing the sale of copyrighted digital information products via the Internet. Digital copyright protection technology can effectively prevent digital copying, copying and transmission of digital information products through networks and computers. The Digital Issue Product's Content Issuer (RI) encrypts the digital information and uploads it to the network. The user downloads the encrypted digital information to the Copyright Agent (DRM Agent) on the terminal device. If the user wants to use the downloaded number. Information, and then request the rights object (RO) of the digital information product through the network, and the RO includes the key for decrypting the data. If the product is a one-time paid product, the DRMAgent uses the key to decrypt the digital information, and then the user It can be used. If the user operation authority needs to be controlled, the RO also includes the rights management information of the digital information. The DRM Agent manages the specific use of the digital information by the user according to these restrictions. In the prior art, the digital product is Limit controls generally include: number of uses, number of previews, limited time for each preview, and duration of use.

Due to the development of mobile communication technologies, more and more users are beginning to use mobile terminals to download digital information from the network. Among the existing mobile communication systems related to DRM, although the terminal is opened and registered in the 4-pass registration agreement. In the process, in order to prevent illegal terminals and illegal RI, the mobile terminal and the RI are required to perform two-way certificate authentication, that is, the DRMAgent and the RI mutually provide the local certificate, and also authenticate the correctness and validity of the other party certificate, and use the certificate status query. (Online

Certificate Status Protocol (OCSP) to identify the validity of the RI certificate. However, in the 2-pass protocol flow and the 1-pass protocol flow in which the terminal obtains the RO from the RI, and the 2-pass protocol flow in the inbound domain, the verification of the validity of both certificates (ie, the certificate retransmission status) is not involved. , detailed instructions such as Next:

As shown in Figure 1, the 2-pass protocol process for the mobile terminal to actively obtain the RO from the RI includes the following steps:

511. The DRMAgent sends a RO Request message to the RI.

The RO request message carries the identification information and the usage mode of the mobile terminal user to select the digital information. -

512. The RI returns a RO response (RO Response) message to the DRMAgent of the mobile terminal; the RO response message carries the RI according to the usage mode selected by the mobile terminal user to generate a corresponding

RO, after receiving the RO, the DRMAgent controls the use of the corresponding digital information according to the RO.

Sometimes, when RI promotes a promotional event or gives a gift based on the cumulative usage of the end user, R1 wants to actively distribute the RO to the mobile terminal, and prompts the user to download the specific address corresponding to the digital information.

The 1-pass protocol specifies a corresponding process. As shown in FIG. 2, the process includes only one step: S21: The RI sends an RO response message to the DRMAgent of the mobile terminal, where the response message carries the distributed RO; Generally, the specific address for downloading the corresponding digital information is sent to the user by means of short message, and the user can also be notified by any other communication means.

The mobile terminal user can also join the domain through a process specified by the 2-pass protocol, which is a member group established by the RI for a similar group purchase behavior, and has a unique domain identifier, and if the mobile terminal user is the member group The member of the group can obtain the RO of the specific digital information by joining the domain. As shown in FIG. 3, the mobile terminal requests to join to a domain by the following steps:

531. The DRMAgent sends a Join Domain Request message to the RI. The mobile terminal user selects the operation of joining the domain through the DRM Agent and enters the domain identifier according to the prompt. The DRMAgent sends a join domain request message to the RI, where the request message carries The identification information of the mobile terminal user and the domain identifier of the joined domain.

532. The RI returns a domain response to the DRM Agent of the mobile terminal (Join Domain

Response ) message

The RI verifies whether the user is a member of the joining domain according to the identification information of the mobile terminal user. If yes, the member is identified as a member who has successfully joined the domain, and carries the information in the joining domain response message. Domain password, if the user is not a member of the domain, the rejection message is carried in the join domain response message. The domain password is generated and saved by the RI when the domain is established. After receiving the domain password, the user obtains the RO corresponding to the digital information through the initiated 2-pass protocol flow, which includes the following steps:

533. The DRMAgent sends a RO request message to the RI, where the request message carries a domain identifier.

534. The RI returns a domain RO response message to the DRM Agent of the mobile terminal.

The RI determines whether the terminal user has successfully joined the domain. If yes, the RO response message carries the joining domain RO encrypted by the domain password. After receiving the RO, the DRMAgent decrypts the domain RO by using the domain password, and according to the joining domain RO Control the mobile terminal user to use the corresponding digital information; otherwise, carry the rejection information in the join domain RO response message.

In the above three processes, neither the mobile terminal nor the RI can verify the validity of the certificate of the other party, resulting in incomplete verification of the validity of the certificate, failing to implement a complete security system, causing system security vulnerabilities, and having an abandoned certificate accessing the RI to obtain the RO. may. Summary of the invention

The present invention provides a method and system for a mobile terminal to acquire a rights object and join a domain, so as to solve the problem of poor security in the existing DRM system. '

A method for a mobile terminal to obtain a rights object includes the following steps:

The issuer (RI) sends an authentication request blank including the RI certificate to the Online Certificate Status Query (OCSP) responder before sending the rights (RO) object to the Copyright Agent Module (DRM Agent).

The OCSP responder returns an authentication response message including the RI certificate validity authentication result and the OCSP responder digital signature to the RI;

The RI sends an RO response message including the RO object and carrying all the authentication response messages to the DRM Agent;

The DRM Agent receives the RO response message, confirms that the OCSP responder is legal according to the OCSP responder digital signature, and confirms that the RI certificate is valid according to the RI certificate validity authentication result. After that, the RO object is obtained.

The method further includes: the DRM Agent sends an RO request message including a DRM Agent certificate to the RI.

In the method, the DRM Agent certificate can also be authenticated by the following steps:

The authentication request message includes the DRM Agent certificate at the same time;

The authentication response message includes the validity certification result of the DRM Agent certificate;

After confirming that the DRM Agent certificate is valid according to the validity verification result of the DRM Agent certificate, the RI sends the RO response message.

Alternatively, first authenticate the DRM Agent certificate by following these steps:

The RI sends an authentication request message including the DRM Agent certificate to the OCSP responder;

The OCSP responder returns an authentication response message including the DRM Agent certificate validity authentication result to the RI;

After confirming that the terminal is legal according to the validity of the DRM Agent certificate validity verification, the RI re-verifies the RI certificate.

In the method, when the DRM Agent and the RI, and/or the RI and the OCSP responder exchange each message, the sender generates a sender digital signature and writes the message together to send to the receiver, and receives After verifying that the sender is legal according to the sender's digital signature, the party performs subsequent processing.

Based on the same technical concept, the present invention also provides a method for a mobile terminal user to join a domain, including the following steps:

The DRM Agent of the mobile terminal sends a join domain request message including the mobile terminal user identifier and the join domain identifier to the RI;

After confirming that the user is a member of the joining domain according to the user identifier and the joining domain identifier, the RI sends an authentication request message including the RI certificate to the OCSP responder, and identifies the user as joining the blast;

The OCSP responder returns to the RI including the RI certificate validity authentication result and the OCSP responder number. Word-signed authentication response message;

The RI sends a domain response message including the domain password of the joining domain to the DRM Agent and carrying all the authentication response messages;

The DRM Agent receives the join domain response message and confirms according to the OCSP responder digital signature.

The OCSP responder is legal, and after confirming that the RI certificate is valid according to the RI certificate validity certification result, the domain password is obtained.

The DRM Agent certificate is included in the Join Domain Request message.

The method can synchronously verify the DRM Agent certificate by the following steps:

After confirming that the DRM Agent certificate is valid according to the validity verification result of the DRM Agent certificate, the RI sends the join domain response message.

Alternatively, verify the DRM Agent certificate by following the steps below:

The RI sends an authentication request message including a DRM Agent certificate to the OCSP responder;

After obtaining the domain password, the DRM agent sends a domain RO request message including the domain identifier and the user identifier to the RI.

After confirming that the user joins the member, the RI returns a join domain RO response message to the DRM Agent, and the join domain RO response message includes the join domain RO encrypted by using the domain password;

The DRM Agent receives the join domain RO response message, obtains the join domain RO, and decrypts using the domain password.

Alternatively, the RO acquisition provided in accordance with the present invention: The method acquires the required join domain RO from the RI. In order to implement the method of the present invention, the present invention also provides a digital information copyright management system, including a copyright agent (DRM Agent) server disposed on a mobile terminal, and a mobile communication network. An RI server connecting the DRM Agent server and an OCSP responder connecting the RI server through a mobile communication network;

The DRM Agent includes a proxy security module for digitally signing a message sent to the RI server; or verifying the legitimacy of a message with the digital signature from the RI server;

The RI server includes an RI security module for digitally signing a message sent to the DRM Agent server or the OCSP responder; or verifying a number from the DRM Agent server or the OCSP responder The legality of the signed message;

The OCSP responder includes an OCSP security module; for digitally signing a message sent to the RI server; or verifying the legitimacy of a message with a digital signature from the RI server.

The DRM Agent further includes a proxy interface module for transmitting and receiving messages and a proxy control module for performing digital information copyright management, respectively connected to the proxy security module; the proxy control module sends a message to the RI server After being sent to the proxy security module for digital signature, sending by the proxy interface module; or, the proxy interface module sends a digitally signed message received from the RI server to the proxy security module. After the proxy security right module confirms that the identity of the generator of the digital signature is legal according to the digital signature, the message is sent to the proxy control module for processing; and/or

The RI server further includes an RI interface module for transmitting and receiving messages and an RI control module for performing RO or joining domain management, respectively connected to the RJ security module; the RI control module is to be sent to the RI server or the After the OCSP responder sends the message to the RI security module for digital signature, the RI interface module sends the message through the RI interface module; or the RI interface module receives the digital signature from the RI server or the OCSP responder. The message is sent to the RI security module, and after the RI security right module confirms that the identity of the digital signature is legal according to the digital signature, the message is sent to the RI control module for processing; and/or

The OCSP responder further includes an OCSP interface module for transmitting and receiving messages and an OCSP authentication module for authenticating the RI certificate and/or the DRM Agent certificate, respectively connecting the OCSP security a full module; the OCSP control module sends the message sent to the RI server to the OCSP security module for digital signature, and then sends the message through the OCSP interface module; or the OCSP interface module will be sent from the RI server The received digitally signed message is sent to the OCSP security module, and after the OCSP security right module confirms that the identity of the digital signature is legal according to the digital signature, the message is sent to the OCSP control module. deal with. The OCSP authentication module further includes an RI certificate revocation list for authentication and/or a DRM Agent certificate revocation list.

The beneficial effects of the present invention are as follows:

In the DRM system, the authentication process of the RI certificate is added in the process specified by the 2-pass, 1-pass and 2-pass. protocol of the application RO, and the DM Agent certificate validity authentication process is further added. Eliminate the security vulnerabilities of the DRM system and improve the entire security system. DRAWINGS

FIG. 1 is a flow of a 2-pass protocol initiated by a mobile terminal to request an RO from an RI; FIG. 2 is a flow chart of a 1-pass protocol for an RO to be dispatched to a mobile terminal by an RI; FIG. A 2-pass protocol flow initiated by the mobile terminal to join the domain to the RI; FIG. 4 is an implementation flow of the RO requesting the RO by the mobile terminal according to the present invention, where the RI sends the RO to the mobile terminal, requesting The OCSP responder verifies the validity of the RI certificate;

5 is an implementation process of the RO being actively initiated by the RI to the mobile terminal, where the RI requests the OCSP responder to verify the validity of the RI certificate before dispatching the RO to the mobile terminal;

FIG. 6 is a flowchart of an implementation process for a RI request to join a domain initiated by a mobile terminal according to the present invention, where the RI requests the OCSP responder to verify the validity of the RI certificate before sending the domain password to the mobile terminal; FIG. 7 is a schematic diagram showing the main structure of a DRM system according to Embodiment 4. detailed description

The purpose of the method of the present invention is to optimize a 2-pass protocol process in which a mobile terminal initiates an RO application to an RI in a DRM system, a 1-pass that is initiated by the RI to distribute an RO to a mobile terminal, and a join domain initiated by the mobile terminal. The 2-pass protocol process adds validity certificates for RI certificates and/or DRM Agent certificates in these three processes.

To implement the method, the present invention uses the OCSP authentication method to add the RI request OCSP responder (Responder) to verify the validity of the RI certificate in the above three processes to ensure the RI's legal line. Further, the RI request OCSP responder is verified to verify the validity of the mobile DRM Agent certificate to ensure the legitimacy of the mobile terminal, thereby implementing a complete certificate verification system in the above three processes.

First, several concepts related to the method of the present invention are illustrated:

1, DRM Agent certificate

The DRM Agent certificate, also known as the terminal certificate, end user certificate, etc., is the only proof of the legal identity of the mobile terminal user, including a unique user private key, which corresponds to a public user public key.

2, RI certificate

The RI certificate is the only proof of the legal identity of each RI, including a unique RI private key and certificate identifier, and the RI private key corresponds to a public RI public key.

3, OCSP responder certificate

The OCSP Responder Certificate is a proof of the legal identity of the OCS Responder, which includes a unique Responder private key that corresponds to a public Responder public key.

4, OCSP certification method

Refers to the method of authenticating the validity of the RI certificate by using the OCSP responder. The RI certificate revocation list is established on the OCSP responder and updated in time. The RI certificate revocation list is used for registration cancellation. The valid RI certificate identifier, the OCSP responder queries the current RI certificate revocation list to verify the validity of the RI certificate.

5, using digital signatures for authentication

The digital signature can be used for the information receiver to legalize the identity of the sender of the information. For example: The sender of the information uses his private key and the complete information to be sent to generate a digital signature, and sends the digital signature and the information together to the receiver. The receiving party decrypts the digital signature by using the public key, and obtains the verification information therefrom. If the verification information is the same as the received information, it indicates that the sender of the information is legal and trusted.

The invention will now be described in detail by way of specific embodiments with reference to the accompanying drawings.

Embodiment 1:

As shown in FIG. 4, the first embodiment adds the RI request OCSP responder to verify the validity of the RI certificate based on the existing 2-pass protocol flow initiated by the mobile terminal to the RO requesting the RO:

541. The DRM Agent sends an RO request message to the RI.

The RO request message carries the DRM Agent certificate, the identification information of the digital information selected by the mobile terminal user, and the usage mode, and the user digital signature generated by the DRM Agent using the user private key and the complete RO request message.

542. The RI sends an OCSP Request (OCSP Request) message to the OCSP responder to verify the validity of the RI certificate.

After receiving the RO request message sent by the mobile terminal, the RI first uses the user public key and the user digital signature to verify whether the identity of the terminal is legal. The positive method is: decrypting the digital signature by using the public key of the user, obtaining a complete message of the certificate, and receiving the complete message. The received messages are compared. If they are not the same, the RO request message is considered to be from an illegal terminal and will not be returned. On the other hand, if the same, the RO request message is considered to be from the legal terminal, and then an OCSP request message is sent to the OCSP responder, which carries the RI certificate and the RI digital signature generated by using the RI private key and the complete OCSP request message.

543. The OCSP responder returns an OCSP Response (OCSP Response) message to the RI; the OCSP responder still first uses the RI public key to verify the RI digital signature to determine the legality of the RI, and refuses to reply to an illegal RI. According to the RI certificate revocation list, the RI certificate The validity of the certification.

The OCSP writes the authentication result into the OCSP Response authentication response message, and then generates the OCSP digital signature by using the responder private key and the complete OCSP authentication response message, and writes the OCSP authentication response message, and then carries the authentication result and the OCSP digital signature. The OCSP authentication response message is sent to the RI.

S44. The RI returns an RO response message to the DRM Agent of the mobile terminal.

After receiving the OCSP authentication response message, the RI completes the following operations:

1) generating the RO requested by the DRMAgent and writing the RO response message;

2), the OCSP authentication response message carrying the OCSP digital signature is directly written into the RO response message as a parameter;

3), using the RI private key and the complete RO response to generate the RI digital signature, and write the RI digital signature into the RO response message, and then send the RO response message to the DRM Agent.

After receiving the RO response message, the DRM Agent completes the following operations:

1) verify the RI identity with the RI public key and the RI digital signature, if it is legal, continue, otherwise it ends;

2) verify the validity of the OCSP responder identity by using the responder public key and the OCSP digital signature, if it is legal, then continue, otherwise it ends;

3) Determine whether the authentication result of the RI certificate is valid. If the certificate is valid, obtain the RO from the RO response message, otherwise it ends.

From the above steps, the DRM Agent on the mobile terminal side only confirms that the RO response message is from the legal RI, and the authentication result validated by the RI certificate comes from the legal OCSP responder, and the end user is allowed to use the downloaded digital information to ensure the digital information. The legitimacy and security of the source.

Further, in step S42, the authentication request message sent by R1 to the OCSP responder may further carry a terminal certificate, requesting the OCSP responder to authenticate the DRMAgent certificate, and similarly, the OCSP responder carries the authentication result of the DRM Agent certificate in the OCSP authentication response. The message is returned to the RI, and the RI determines whether to send an RO response message to the terminal according to the authentication result of the DRM Agent certificate.

Alternatively, the RI sends the identification of the bearer certificate to the OCSP responder before performing step S42. The request message is sent to the OCSP responder to authenticate the DRMAgent certificate, and the OCSP responder carries the authentication result of the DRM Agent certificate in the OCSP authentication response message and returns it to the RI. If the authentication result of the DRMAgent certificate is valid, the RI proceeds to step S42. Certification of the RI certificate.

To implement the above-mentioned DRM Agent certificate authentication, the OCSP responder side needs to establish a DRM Agent certificate revocation list and update it in time.

Embodiment 2

As shown in FIG. 5, the second embodiment is based on the 1-pass protocol procedure of the existing RI to distribute the RO to the mobile terminal, and the step of verifying the validity of the RI is added. Compared with the first embodiment, the DRMAgent is not required to be sent to the RI. The RO request message, the other steps are the same as in the first embodiment, specifically:

S51. The RI sends an OCSP request message to the OCSP responder to request verification of the validity of the RI certificate.

The RI sends an OCSP request message to the OCSP responder, which carries the RI certificate and the RI digital signature generated using the RI private key.

552. The OCSP responder returns an OCSP Response authentication response message to the RI.

The OCSP responder first uses the RI public key and the RI digital signature to authenticate the RI identity. If it is legal, it judges the validity of the RI certificate according to the RI^ book revocation list, and vice versa.

The OCSP responder writes the authentication certificate into the OCSP Response authentication response message, generates the OCSP digital signature by using the responder private key, and writes the OCSP authentication response message, and then carries the OCSP authentication response message carrying the authentication result and the OCSP digital signature. Send to RI.

553. The RI sends an RO response message to the DRM Agent.

After receiving the OCSP authentication response message carrying the OCSP digital signature, the RI completes the following operations:

1), the RO to be dispatched is written into the RO response message;

3) Write the RO response message by using the RI private key and the RI digital signature generated by the complete RO response message, and then send the RO response message to the DRMAgent of the mobile terminal.

1), verify the RI identity with the RI public key and the RI digital signature, if it is legal, continue, otherwise Bunch

In this embodiment, since the RI actively distributes the RO to the mobile terminal, there is no need to increase the step of verifying whether the DRM Agent certificate is valid.

Embodiment 3

As shown in FIG. 6, the third embodiment adds the RI certificate authentication step based on the existing mobile terminal to the RI request to join the domain 2-pass protocol, and specifically includes:

561. The DRMAgent sends a join domain request message to the RI.

The mobile terminal user selects the operation of joining the domain through the DRMAgent and enters the domain identifier according to the prompt. The DRMAgent sends a join domain request message to the RI, where the request message carries the identification information of the mobile terminal user, joins the domain identifier, and uses the user private key and The user's digital signature generated by the complete join domain request message.

562. The RI sends an OCSP request message to the OCSP responder, requesting to verify the validity of the RI certificate.

After receiving the domain join request message sent by the mobile terminal, the RI uses the user public key and the user digital signature to verify the validity of the identity of the terminal user, and refuses to reply to the illegal terminal. For the legitimate terminal user who passes the authentication, the RI according to the identity of the mobile terminal user The information verifies whether the user belongs to the member of the joining domain, and if so, identifies the member as a member of the domain, and then sends an OCSP request message to the OCSP responder, where the message carries the RI certificate and the generated RI digital signature. .

S63. The OCSP responder returns an OCSP Response authentication response message to the RI.

The OCSP responder first verifies the RI validity by using the RI public key and the RI digital signature, and then determines the validity of the RI certificate in the RI certificate list, and writes the authentication result into the OCSP authentication response message, and the OCSP authentication response is performed after the OCSP is digitally signed. The message is sent to the RI;

S64. The RI returns a join domain response message to the DRM Agent of the mobile terminal. After receiving the domain join response message carrying the third digital signature, the RI completes the following operations:

1), the domain password is written into the domain response message;

2), directly writing the OCSP authentication response message carrying the OCSP digital signature as a parameter to the adding domain response message;

3), using the RI private key and the join domain response message to generate an RI digital signature to write the join domain response message, and then send the join domain response message to the DRM Agent.

After receiving the domain response message, the DRM Agent completes the following operations:

3) Determine whether the authentication result of the RI certificate is valid. If the certificate is valid, obtain the domain password from the RO response message, otherwise it ends.

At this point, the DRM Agent confirms that the valid authentication result of the RI certificate comes from the legal OCSP responder, and then obtains the domain password from the RO response message, which ensures the legality and security of the domain password source.

After receiving the domain password, the DRM agent obtains the corresponding domain RO from the RI by initiating the 2-pass protocol process, including the following steps:

565. The DRM Agent sends an RO request message to the RI, where the request message carries a domain identifier.

566. The RI returns an RO response message to the DRM Agent of the mobile terminal.

The RI determines whether the mobile terminal user has been identified as a joining member of the corresponding domain. If yes, the RO response message carries the joining domain RO encrypted with the password. After receiving the RO, the DRM Agent obtains the joining domain by using the decryption with the password. The RO is used to control the user's use of the digital information. If the RI determines that the mobile terminal user has not successfully joined, the RO response message carries the rejection information.

The above steps S65 and S66 use the existing 2-pass protocol flow. To further increase the security, the first embodiment of the present invention may be used to further increase the validity of the RI certificate and/or the DRMAgent certificate. the specific implementation details of the same embodiment example 1 and omitted here ₀ The present invention is directed to the DRM system, in the process of applying the 2-pass, 1-pass of the RO and the 2-pass protocol added by the i, the RI certificate authentication process is added, and the certificate is valid. Sexuality, eliminating the security vulnerabilities of the DRM system, and further increasing the DRM Agent certificate validity certification process, and improving the entire security system.

Embodiment 4

In order to implement the method of the present invention, the present invention also discloses a DRM system. As shown in the figure, the DRM system in the field of mobile communication includes: a copyright agent server installed on the mobile terminal 100.

(DRM Agent) 101, an RI server 200 connected to the DRM Agent 101 through a mobile communication network, and an OCSP responder 300 connected to the RI server 200 through a mobile communication network; wherein: the DRM Agent 101 includes an agent interface module 1011 for transmitting and receiving messages and proxy

(Agent) control module 1013; RI server 200 includes RI interface module 201 and RI control module 203 for sending and receiving messages; OCSP responder 300 includes OCSP interface module 301 and OCSP authentication module 303 for sending and receiving messages;

In order to implement the method of the present invention, a security module for generating a digital signature or verifying a digital signature is required to be respectively set on the DRM Agent 101, the RI server 200, and the OCSP responder 300. The security module stores a private key for encrypting and decrypting the digital signature. The corresponding public key, when the interface module sends a message, generates a digital signature for the message and sends it to the interface module; when the interface module receives the message, it is responsible for verifying the legality of the RI and/or OCSP responder identity to ensure the source of the message. Reliability and security. Described separately as follows:

The Agent security module 1012 of the DRM Agent 101 is connected between the Agent interface module 1011 and the Agent control module 1013. The Agent control module 1013 sends the message sent to the RI server 200 to the Agent security module 1012 for digital signature, and then sends the message through the Agent interface module 1011. Or the agent interface module 1011 sends the digital signature message received from the RI server 200 to the agent security module 1012. After the agent security module 1012 confirms that the identity of the digital signature is legal according to the digital signature, the agent sends the message to the agent. The control module 1013 performs processing; the agent control module 1013 is connected to the display module 102 of the mobile terminal 100 for displaying the operation interface. The RI security module 202 of the RI server 200 is connected between the RI interface module 201 and the RI control module 203; the RI control module 203 sends the message sent to the RI server 200 or the OCSP responder 300 to the RI security module 202 for digital signature. The RI interface module 201 sends the digitally signed message received from the RI server 200 or the OCSP responder 300 to the RI security module 202, and the RI security right module confirms the digital signature according to the digital signature. After the identity of the producer is legal, the message is sent to the RI control module 203 for processing;

The OCSP security module 302 of the OCSP responder 300 is connected between the OCSP interface module 301 and the OCSP authentication module 303; the OCSP control module sends the message sent to the RI server 200 to the OCSP security module 302 for digital signature, and then passes the OCSP interface module. The OCSP interface module 301 sends the digitally signed message received from the RI server 200 to the OCSP security module 302. After the OCSP security right module confirms the identity of the digital signature generator according to the digital signature, the message is sent. Into the OCSP control module for processing. The OCSP authentication module 303 also includes an RI certificate revocation list 3031 for authentication and a DRM Agent certificate revocation list 3032.

The specific implementation details are described in detail in the first embodiment, the second embodiment, and the third embodiment, which will not be described again.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of the inventions

Claims

Rights request

A method for obtaining a rights object by a mobile terminal, comprising the steps of: an issuer (RI) responding to an online certificate status query (OCSP) before transmitting a rights (RO) object to a rights agent module (DRM Agent) Transmitting an authentication request message including an RI certificate;

The DRM Agent receives the RO response message, confirms that the OCSP responder is legal according to the OCSP responder digital signature, and obtains the RO object after confirming that the RI certificate is valid according to the RI certificate validity authentication result.

2. The method according to claim 1, wherein the RI sends an authentication request message including the RI certificate to the OCSP responder after receiving the RO request message including the DRM Agent certificate sent by the DRM Agent.

3. The method of claim 2, wherein

The method according to claim 2, after receiving the RO request message including the DRM Agent certificate sent by the DRM Agent, the RI first sends an authentication request message including the DRM Agent certificate to the OCSP responder;

The OCSP responder returns an authentication response message including the DRM Agent certificate validity authentication result to the RI; After confirming that the terminal is legal according to the DRM Agent certificate validity authentication result, the RI sends an authentication request message including the RI certificate to the OCSP responder.

5. The method according to claim 3 or 4, wherein the sender generates a sender digital signature and writes when each message is exchanged between the DRM Agent and the RI, and/or between the RI and the OCSP responder. The incoming message is sent to the receiver together, and the receiver verifies the sender according to the sender's digital signature, and then performs subsequent processing.

A method for a mobile terminal user to join a domain, comprising the steps of: the DRM Agent of the mobile terminal sends a join domain request message including the mobile terminal user identifier and the join i or the identifier to the RI;

The RI sends a join i or a response message including the domain password of the joining domain to the DRM Agent and carrying all the authentication response messages;

The DRM Agent receives the join domain response message, confirms that the OCSP responder is legal according to the OCSP responder digital signature, and obtains the domain password after confirming that the RI certificate is valid according to the RI certificate validity authentication result.

7. The method according to claim 6, wherein the joining domain request message includes the DRM Agent certificate at the same time.

8. The method of claim 7 wherein:

The authentication response message includes both the validity certification result of the DRM Agent certificate; and '

After confirming that the DRM Agent certificate is valid according to the validity verification result of the DRM Agent certificate, the RI sends the join i or response message.

9. The method according to claim 7, wherein the RI receives the joining domain of the mobile terminal After requesting the message, first send an authentication request including the DRM Agent certificate to the OCSP responder.

After confirming that the DRM agent is legal according to the DRM Agent certificate validity authentication result, the RI sends an authentication request message including the RI certificate to the OCSP responder.

The method according to claim 7, 8 or 9, wherein after receiving the domain password, the DRM Agent sends a join domain RO request message including a domain identifier and a user identifier to the RI;

The method according to claim 7, 8 or 9, wherein the DRM Agent obtains the domain password, and sends a domain RO request message including a domain identifier, a user identifier, and a DRM Agent certificate to the RI;

After confirming that the user joins the member, the RI sends an authentication request message including the RI certificate to the OCSP responder;

The OCSP responder returns an authentication response message including the validity verification result of the RI certificate and the digital signature of the OCSP responder to the RI;

The RI returns a domain RO response message to the DRM Agent, where the RO response message includes the join domain RO encrypted by using the domain password and carries the complete authentication response message;

Receiving, by the DRM Agent, the join domain RO response message, confirming that the OCSP responder is legal according to the OCSP responder digital signature, and confirming that the RI certificate is valid according to the RI certificate validity authentication result, acquiring the join domain RO and using the domain Password decryption.

12. The method of claim 11 wherein:

The authentication request message includes the DRM Agent certificate at the same time; The authentication response message includes the validity certification result of the DRM Agent certificate;

The method according to claim 11, wherein after receiving the domain RO request message of the DRM Agent, the RI first sends an authentication request message including the DRM Agent certificate to the OCSP responder;

After confirming that the terminal is legal according to the DRM Agent certificate validity authentication result, the RI sends an authentication request message including the RI certificate to the OCSP responder.

14. The method according to claim 12 or 13, wherein when the DRM Agent and the RI, the RI and the OCSP responder interact with each message, the sender generates a sender digital signature and writes the The message is sent to the receiver together, and the receiver verifies the sender according to the sender's digital signature, and then performs subsequent processing.

15. A digital information copyright management system, comprising a copyright agent (DRM Agent) server disposed on a mobile terminal, connected to the DRM Agent server by a mobile communication network

An RI server and an OCSP responder that connects the RI server through a mobile communication network;

The DRM Agent includes a proxy security module for digitally signing a message sent to the R1 server; or verifying the legitimacy of a message with the digital signature from the RI server;

The OCSP responder includes an OCSP security module; for digitally signing a message sent to the RI server; or, verifying from the RI server with a digital signature The legitimacy of interest.

The system according to claim 15, wherein the DRM Agent further comprises a proxy interface module for transmitting and receiving messages and a proxy control module for performing digital information copyright management, respectively connected to the proxy security module; The proxy control module sends the message sent to the RI server to the proxy security module for digital signature, and then sends the message through the proxy interface module; or the proxy interface module receives the number from the RI server. The signed message is sent to the proxy security module, and after the digital security signature confirms that the identity of the generator of the digital signature is legal, the message is sent to the proxy control module for processing; and/or The RI server further includes an RI interface module for transmitting and receiving messages and an RI control module for performing RO or joining domain management, respectively connected to the RI security module; the RI control module is to be sent to the RI server or the After the OCSP responder sends the message to the RI security module for digital signature, the RI interface module is used. Sending; or, the RI interface module sends a digitally signed message received from the RI server or the OCSP responder to the RI 'security module, and the RI security right module according to the number After the signature confirms that the identity of the generator of the digital signature is legal, the message is sent to the RI control module for processing; and/or

The OCSP responder further includes an OCSP interface module for transmitting and receiving messages and an OCSP authentication module for authenticating the RI certificate and/or the DRM Agent certificate, respectively connecting the OCSP security module; the OCSP control module will send the After the RI server sends the message to the OCSP security module for digital signature, it is sent by the OCSP interface module; or the OCSP interface module sends a digitally signed message received from the RI server to the OCSP. The security module, after the OCSP security right module confirms that the identity of the generator of the digital signature is legal according to the digital signature, sends the message to the OCSP control module for processing.

The system according to claim 16, wherein the OCSP authentication module further includes an RI certificate revocation list for authentication and/or a DRM agent certificate revocation list.