KR100964386B1 - Digital movie management device and method - Google Patents

Abstract

The present invention relates to a digital movie management apparatus and a method thereof.

The digital movie managing apparatus of the present invention generates a first authentication key and a private key matching the first authentication key and issues a first certificate for the generated first authentication key from the device for issuing the certificate—the first certificate. Is issued with the first authentication key-and registered with the mastering device. And receiving a first message including a first key encrypted with the key and a first electronic signature of the mastering device from the mastering device by using the first authentication key of the digital movie management device, and receiving the first key. Decrypt using the private key.

Thereafter, a second electronic signature for verifying that the decrypted first key is encrypted using a second authentication key of the stored digital movie providing device to verify that the second key is a message of the device. The included second message is generated and provided to the digital movie providing device.

According to the present invention, an effect of efficiently issuing a key for decrypting encrypted movie content with a digital movie providing device can be expected while maintaining security at the time of entrusting / issuing a key for decrypting movie content. have.

Digital, movie, cinema, key, KDM, certificate

Description

DIGITAL CINEMA MANAGEMENT APPARATUS AND METHOD THEREOF

The present invention relates to a digital movie management apparatus and a method thereof. In particular, the present invention relates to an apparatus and method for managing a digital movie for providing a highly secured key for playing a digital movie.

In July 2005, the United States, a leading Hollywood film company called Digital Cinema Initiatives (“DCI”), announced a DCI specification, a technical standard for the distribution / screening of digital films.

The DCI standard is intended to enable digital movie content created in the Digital Cinema Management System (DMS) to be played in DCP (DCP), regardless of the manufacturer. It is a standard.

In order to display the digital movie contents of the DCI standard, a digital projector and a digital movie player (DCP) must be installed in the theater theater, and when the contents are encrypted and delivered to the DCP, they can be played only by securing a KDM for them. It was.

Movie content and KDM are obtained from DMS supplied by video equipment manufacturers. Currently, DMSs are performing content encryption processing and encryption key management to provide movie content and KDM to a plurality of registered DCPs, and provide applications for KDM issuance.

However, the KDM issuing function of DMS can enhance security, but it becomes difficult to manage when the number of DCPs increases.

In case of issuing KDM in DMS, DMS receives certificate files of DCP for each theater and issues KDM one by one using KDM issuing application.

Since the KDM file is small in size, it is delivered to each theater through e-mail, removable disk, or other secure channel. However, if the theater has increased to hundreds or thousands, including domestic and international, it is extremely inefficient to obtain a DCP certificate, check the contents of the contract, and issue and transmit / manage KDMs one by one. have.

SUMMARY OF THE INVENTION The present invention has been made in an effort to provide a digital movie management apparatus and method for providing a security-consigned key for playing a digital movie with high security.

In accordance with an aspect of the present invention for solving the above technical problem, a mastering device for providing an encrypted movie content and a key to encrypt the movie content and a digital movie providing device for playing the encrypted movie content using the key. Digital movie management device for relaying data transmission and reception between,

A first certificate from the device generating a private key matching the first authentication key and the first authentication key and issuing a certificate using the generated first authentication key—the first certificate includes the first authentication key A key management unit for receiving a -key and providing the mastering device to the mastering device, and receiving a first message from the mastering device including a first key encrypted with the key and a first electronic signature using the first authentication key; And decrypting the first key using the private key, generating a second key encrypted using the second authentication key of the digital movie providing apparatus, and storing the decrypted key. And a message manager to generate a second message including the second electronic signature and provide the same to the digital movie providing apparatus.

Here, the digital film management device further includes a contract management unit that manages contract information including a period for providing the second message to the digital film providing device.

The message management unit,

When the period has not expired based on the contract information, the second message including the period is further generated to provide movie content during the period, and provided to the digital movie providing apparatus.

According to an aspect of the present invention, a device for relaying data transmission and reception between an encrypted movie content and a mastering device for providing a key for encrypting the movie content and a digital movie providing device for playing the encrypted movie content using the key. Digital film management method,

Generating a first authentication key and a private key matching the first authentication key; Receiving a first certificate for the generated first authentication key, the first certificate including the first authentication key, from the device issuing the certificate and registering the certificate with the mastering device; Receiving from the mastering device a first message including a first key encrypted with the key using a first authentication key of the device and a first digital signature of the mastering device; Decrypting the first key using the private key; Generating a second key encrypted using the decrypted first key using a second authentication key of the stored digital movie providing device; And generating a second message including the second key and a second electronic signature for verifying that the message of the device is provided to the digital movie providing device.

here,

Providing the second message to the digital movie providing device,

Confirming contract information on a contract period with the pre-stored digital movie providing device; And generating a second message further including the period so that the digital movie providing apparatus provides movie contents during the period when the contract period has not expired as a result of the confirmation.

According to the present invention, an effect of efficiently issuing a key for decrypting encrypted movie content with a digital movie providing device can be expected while maintaining security when entrusting / issuing a key for decrypting movie content. .

In particular, by receiving the KDM from the mastering device using the certificate of the digital film management device, and re-issuing the KDM using the certificate of the digital film providing device, it is possible to apply without changing the existing devices when issuing KDM. Therefore, there is an advantage that can reduce development costs and management costs.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

As used throughout this specification, KDM (Key Delivery Message) includes a specific key encrypted with an authentication key and an electronic signature of the transmitting device to ensure object authentication and data integrity, nonrepudiation, and confidentiality. SMPTE standard file format.

Now, a digital movie management apparatus and method thereof according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a digital movie system to which a digital movie managing apparatus is applied according to an exemplary embodiment of the present invention.

As shown in FIG. 1, a digital movie providing system according to an exemplary embodiment of the present invention includes a mastering device 300, a digital movie management device (KMS) (hereinafter also referred to as “KMS”) 200, and The digital movie providing apparatus 100 and the digital certificate issuing apparatus 400 are included.

The mastering device 300 provides the digital movie management device 200 with a movie content encrypted with a specific key and a key encrypted with the specific key using the authentication key of the digital movie management device 200. To this end, the mastering device 300 performs a function of formatting and providing a movie content to be reproduced by the digital movie player 104, a movie content encryption process for the safe management of the movie content, and a KDM issue function. .

At this time, the mastering device 300 receives a KMS certificate including the authentication key, contract information, owner, and the like of the digital film management device 200, and contracts with the digital film management device 200 based on the KMS certificate. Contract information about the period is stored separately and KDM is issued based on the contract information when issuing KDM.

The digital movie managing apparatus 200 includes an encryption key received from the mastering apparatus 300 including the KDM managing unit 202, the contract managing unit 204, the theater managing unit, the key managing unit 208, and the storing unit 210. The digital movie providing apparatus 100 is relayed.

The KDM manager 202 issues / transmits the KDM to the digital movie player 104. Specifically, the KDM management unit 202 requests the contract management unit 204 to confirm the contents of the contract information for the digital movie player 104 in order to issue a KDM for playing the digital movie content of the digital movie player 104. The KDM is generated and transmitted to the digital movie player 104 only when the contract is valid (the contract period has not expired).

At this time, the KDM management unit 202 reads the key of the corresponding movie content stored in the storage unit 210 to the contracted digital movie reproduction unit 104, and the certificate of the digital movie reproduction unit 104 (hereinafter, "DCP"). Encrypted using an authentication key included in the "certificate", the encrypted key and the digital signature, the target DCP (Digital Cinema Play; A KDM including a content ID (hereinafter, referred to as an “ID”) is generated and transmitted to the digital movie providing apparatus 100.

 Here, the DCP certificate includes contract information and DCP authentication key. Also, the playback conditions included in the KDM are the same as the contract information between the digital movie playback unit 104 and the KDM management unit 202 for issuing a KDM.

Here, the KDM management unit 202 may generate an electronic signature included in the KDM using the KMS certificate, and may generate an electronic signature using a separate certificate contracted through mutual agreement with the digital film management apparatus 100. .

The key of the content stored in the storage unit 210 is encrypted so that it is not exposed at random and is securely stored / managed.

The contract manager 204 stores contract information which is term information contracted with the digital movie player 104 for issuing a KDM, and confirms contract information with the digital movie player 104 at the request of the KDM manager 202. To the KDM management unit 202.

In this case, the contract manager 204 stores contract information of each of the digital movie player 104 included in the plurality of digital movie providing apparatus 100.

The key manager 208 manages a key for playing a digital movie received from the mastering device 300. To this end, the key manager 208 generates a digital movie authentication key / private key in association with the digital certificate issuing device 400 and receives a KMS certificate for the generated authentication key from the digital certificate issuing device 400.

The key manager 208 registers the KMS certificate received from the digital certificate issuing device 400 in the mastering device 300 and then receives the KDM from the mastering device 300.

The key manager 208 verifies whether the KDM is received from the valid (registered) mastering device 300 using the electronic signature, and then stores the encrypted key, the content ID, and the playback condition included in the KDM. Stored in the unit 210. Here, the reproduction condition received from the mastering device 300 is contract information between the key management unit 208 and the mastering device 300.

In addition, the key management unit 208 provides a key for recovering the encrypted movie content to the user to access through the original recovery unit 102 of the digital movie providing device 100.

The theater manager 206 is an apparatus for inputting and managing information of digital movie providing apparatuses. The theater manager 206 issues an ID for each digital movie player 104 and receives and stores a DCP certificate from each digital movie player 104. Stored in the unit 210.

The storage unit 210 stores the movie content received from the mastering device 300 and the KDM information matching the movie content. Here, the information of the KDM includes a content ID, a reproduction condition, an encrypted key, and the like.

In addition, the storage unit 210 receives and stores DCP certificates for the plurality of digital movie player 104 through the theater manager 206, and provides the DCP certificate to the KDM manager 202.

The digital movie providing apparatus 100 includes an original recovery unit 102 and a digital movie reproduction unit 104.

The original recovery unit 102 connects to the digital movie management apparatus 200 at the request of the user, receives a key for decoding the movie content, and decodes and stores the movie content using the received key.

Here, the original recovery unit 102 is an application for recovering the original of the encrypted movie content, and includes a separate storage. In this case, the separate storage is configured in a RAID (Redundant Array of Independent Disks) method, and has a high data reliability, there is an advantage that can be stored for a long time.

The digital movie player 104 receives the KDM from the digital movie management apparatus 200, decodes the movie content using the received KDM, and plays the movie content. To this end, the digital movie player 104 requests the digital movie management apparatus 200 for a key for decoding the movie content, receives the KDM, and converts the encrypted key included in the received KDM into a DCP authentication key. To decode. The digital movie player 104 then plays the movie content using the decrypted key.

At this time, the digital movie player 104 plays the movie content on the basis of the playback conditions included in the KDM, and decodes the movie content by the digital movie management apparatus 200 again when the playback condition of the decryption key expires. Request / receive key for

The DCP certificate of the digital movie player 104 may be installed at the time of product release from the manufacturer or may be issued from the digital certificate issuing device 400 when the device is installed in the corresponding theater for service opening.

The digital certificate issuing device 400 issues a certificate that can be authenticated by the mastering device 300 or the digital movie player 104. At this time, the certificate issued by the digital certificate issuing device 400 is a digital certificate (X.509 format digital certificate) of a public key infrastructure format.

By consigning / issuing a key for decrypting the encrypted content provided by the mastering device to the digital movie providing device through the digital movie managing device according to an embodiment of the present invention, the vulnerability of security occurring at the time of entrusting / issuing is eliminated. There is a great advantage to efficiently issue keys to the digital movie providing device while maintaining high security by greatly improving.

Moreover, the digital film management device receives the KDM from the mastering device using the certificate of the digital film management device, and re-issues the KDM using the certificate of the digital film providing device, thereby making it possible to apply the existing devices without change. It is possible to reduce development cost and management cost.

FIG. 2 is a flowchart illustrating a method of receiving a KDM from a mastering device by a digital movie managing device according to an exemplary embodiment of the present invention.

As shown in FIG. 2, in the digital movie managing method according to an exemplary embodiment of the present invention, the key manager 208 of the digital movie managing apparatus 200 illustrated in FIG. 1 issues a certificate from the digital certificate issuing apparatus 400. Is done.

The key management unit 208 of the digital film management device 200 generates a private key and an authentication key, issues a certificate for an authentication key for accessing the digital certificate issuing device 400 and registering it with the mastering device 300. Ask. The key manager 208 stores the private key generated by the device and the certificate issued by the digital certificate issuing device 400 (S100).

The key manager 208 stores the private key in the storage 210 (S102), and transmits the certificate to the mastering device 300 (S104).

The mastering device 300 receives a certificate from the key management unit 208, and after checking whether the received certificate is reliable, registers the certificate if it is confirmed as a trusted certificate (S106). At this time, the mastering device 300 checks the authenticity of the certificate through a public key infrastructure (PKI) authentication key verification method defined in the Internet Engineering Task Force (IETF) standard.

Subsequently, when the movie content for providing to the digital movie player 104 is generated, the mastering device 300 encrypts the movie content using a specific key and stores the certificate in the certificate of the stored key manager 208. Encrypt a specific key using the included authentication key. The mastering device 300 generates a KDM including an encrypted key, a content ID, an electronic signature, and a playback condition (S108), and converts the encrypted movie content together with the generated KDM to the digital movie management device 200. Transmit (S110).

The digital movie management apparatus 200 verifies the electronic signature of the received KDM, and if the verification is successful, stores the content ID, the playback condition, and the encrypted key.

Next, the KDM providing method of the digital movie management apparatus 200 according to the embodiment of the present invention will be described with reference to FIG. 3.

3 is a data flow diagram illustrating a method for providing a KDM to a digital movie providing apparatus by a digital movie management apparatus according to an embodiment of the present invention.

As shown in FIG. 3, in the KDM providing method according to an exemplary embodiment of the present invention, the digital movie managing apparatus 200 is requested to issue a KDM from the manager unit to the digital movie providing apparatus 100.

Here, it is assumed that the digital movie managing apparatus 200 receives and stores respective DCP certificates from the plurality of digital movie reproducing units 104.

 The KDM managing unit 202 of the digital movie managing apparatus 200 receives a request from the manager to provide the digital content to the digital movie playing unit 104 and issues a KDM (S200).

The KDM management unit 202 checks the contract contents for each digital movie providing unit 104 (S202), and determines whether KDM issuance is possible (S204).

As a result of the determination in step S204, when the KDM issuance is not possible because the contract is not valid, the KDM management unit 202 notifies the manager that KDM issuance to the corresponding digital movie player 104 is not possible (S206).

As a result of the determination in step S204, when the contract is valid and KDM is issued, the KDM management unit 202 searches for the DCP certificate of the digital movie player 104 (S208).

The KDM manager 202 retrieves an encrypted key for the movie content to be provided and decrypts the retrieved encryption key using the private key stored in the storage 210 (S210).

The KDM management unit 202 encrypts the decrypted key again using the authentication key included in the DCP certificate (S212), and generates a KDM including an encryption key, content ID, playback condition, and electronic signature (S214), The generated KDM is transmitted to the digital movie player 104 (S216).

The KDM management unit 202 stores the KDM issuance history transmitted to the digital movie player 104 (S218).

The digital movie player 104 decrypts the encryption key using a pre-stored DCP certificate (S220), and plays back the movie content encrypted using the decrypted key (S222).

4 is a data flow diagram illustrating a method for providing a specific key to a digital movie providing apparatus by a digital movie managing apparatus according to an exemplary embodiment of the present invention.

As shown in FIG. 4, in the method for providing a specific key according to an exemplary embodiment of the present invention, the key management unit 208 of the digital movie management apparatus 200 may access the original recovery unit 102 of the digital movie providing apparatus 100. Is done through.

The original recovery unit 102 connects to the key management unit 208 at the request of the user, and proceeds with the user login for user authentication (S300). At this time, the original recovery unit 102 receives the user ID / password from the user and transmits it to the key management unit.

The key manager 208 receives the user ID / password from the original recovery unit 102 (S302), and performs user authority authentication to determine whether the authentication is successful (S304). At this time, the key manager 208 authenticates based on whether the received user ID / password matches a pre-registered ID / password.

As a result of the determination in step S304, if authentication is not successful, the key management unit 208 notifies the original recovery unit 102 of the authentication failure (S306).

As a result of the determination in step S304, when authentication is successful, the key manager 208 notifies the original recovery unit 102 of the authentication success (S307).

When the original recovery unit 102 receives the authentication success, the original recovery unit 102 informs the user that the user authentication succeeded. Thereafter, when the original recovery unit 102 receives a key request for decrypting the encrypted movie content from the user, the original recovery unit 102 generates a key request message for decrypting the encrypted movie content and transmits it to the key manager 208 (S308).

The key manager 208 receives the key request message and searches for an encryption key matching the encrypted movie content based on the received key request message (S310).

After decrypting the retrieved encryption key using the private key, the decrypted key is provided to the original recovery unit 102 (S312). Here, after the key manager 208 provides the decrypted key to the original recoverer 102, the key manager 208 may store a record of the decrypted key provided in the storage 210.

The original recovery unit 102 receives the key and decrypts the encrypted movie content using the received key (S316). The original recovery unit 102 stores the decoded movie content (S318).

Meanwhile, when the key management unit 208 provides the key to the original recovery unit 102, the key management unit 208 receives the authentication key of the user using the original recovery unit 102, and encrypts the key using the received user authentication key. After that, a KDM including a key encrypted with the authentication key may be generated and provided to the original recovery unit 102. At this time, when receiving the KDM, the original recovery unit 102 decrypts the encrypted key included in the KDM using the user authentication key.

Such, by separately providing a key for decoding the encrypted content to the original recovery unit through the digital movie management device according to an embodiment of the present invention, there is an advantage that the user of the digital movie providing device can separately store / manage movie content. .

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a block diagram illustrating a digital movie system to which a digital movie managing apparatus is applied according to an exemplary embodiment of the present invention.

FIG. 2 is a flowchart illustrating a method of receiving a KDM from a mastering device by a digital movie managing device according to an exemplary embodiment of the present invention.

3 is a data flow diagram illustrating a method for providing a KDM to a digital movie providing apparatus by a digital movie management apparatus according to an embodiment of the present invention.

4 is a data flow diagram illustrating a method for providing a specific key to a digital movie providing apparatus by a digital movie managing apparatus according to an exemplary embodiment of the present invention.

Claims (12)

A digital movie management apparatus for relaying data transmission and reception between a mastering device for providing encrypted movie content and a digital movie providing device for reproducing the encrypted movie content, A first certificate from the device for generating a first authentication key and a private key matching the first authentication key and issuing a certificate using the first authentication key, wherein the first certificate includes the first authentication key The master receives a first message including a first key and a first electronic signature obtained from a first key and an encryption key for decrypting the encrypted movie content through the first authentication key. A key manager which receives from a ring device; And Decrypts the first key using the private key, generates a second key encrypted using a second authentication key of the digital movie providing apparatus, and stores the decrypted encryption key; 2 A message manager which generates a second message including an electronic signature and provides it to the digital movie providing device. Digital film management device comprising a. The method of claim 1, And a contract management unit for managing contract information including a period for providing the second message to the digital movie providing device. The message management unit, And generating the second message further including the period to play the movie content during the period when the period has not expired based on the contract information, and provide the generated second message to the digital movie providing device. The method of claim 2, The key management unit, And verifying whether the first message is a message received from a registered mastering device by using a first electronic signature included in the first message. The method of claim 2, And a storage unit configured to store the received first message and the issued second message, and to store a certificate of at least one digital movie providing device including the second authentication key and the contract information. . The method of claim 4, wherein The key management unit, When the encryption key is requested from the digital movie providing device, the first key included in the first message stored in the storage unit is decrypted using the private key, and the decrypted encryption key is provided to the digital movie. Digital movie management device provided by the device. 6. The method according to any one of claims 1 to 5, The first message and the second message is a digital movie management device, characterized in that the KDM (Key Delivery Message) format. A digital movie management method of a device for relaying data transmission and reception between a mastering device for providing encrypted movie content and a digital movie providing device for playing the encrypted movie content, Generating a first authentication key and a private key matching the first authentication key; Receiving a first certificate for the generated first authentication key, wherein the first certificate includes the first authentication key, from the device issuing the certificate and registering it with the mastering device; Receiving a first message including a first key obtained by encrypting an encryption key for decrypting the encrypted movie content through the first authentication key and a first electronic signature of the mastering device from the mastering device; Decrypting the first key using the private key; Generating a second key encrypted using the decrypted first key using a second authentication key of the digital movie providing apparatus; And Generating and providing a second message including the second key and a second electronic signature to verify that the message is from the device to the digital movie providing device; Digital movie management method comprising a. The method of claim 7, wherein Providing the second message to the digital movie providing device, Confirming contract information on a contract period with the pre-stored digital movie providing device; And Generating a second message further including the period so that the digital movie providing device provides movie contents during the period when the contract period has not expired as a result of the checking; Digital movie management method comprising a. The method of claim 8, Receiving the first message, Verifying the first electronic signature included in the first message; And If the verification is successful, storing the first message Digital movie management method comprising a. The method according to any one of claims 7 to 9, The first message and the second message is a digital movie management method, characterized in that the KDM (Key Delivery Message) format. The method of claim 7, wherein Receiving a key request message for decoding first movie content from the digital movie providing device; Retrieving a key for decrypting the first movie content among a plurality of stored keys encrypted with the first authentication key; And Decoding the retrieved key using the private key and providing the retrieved key to the digital movie providing device; Digital movie management method further comprising. The method of claim 11, Prior to receiving the key request message, Authenticating a user of the digital movie providing device; Digital movie management method further comprising.

Images