Patent Application
20080167994
The present invention relates to a method and a device of enabling inheritance of a digital content item.
Recent developments in digital technologies, along with increasingly interconnected high-speed networks and decreasing prices for high-performance digital devices, have established digital content distribution as one of the most rapidly emerging trading activities and have created new methods for consumers to access, manage, distribute and pay for digital content. As a consequence of this trend and the success of one of the first online music shop—Apple's iTunes, a number of shops have been opened and both consumers and content providers have clearly shown high interest in electronic distribution of audio/video content.
On the other hand, the production of digital information has turned out to be low-priced and open to everyone. Nowadays, people create digital photos and home movies to an ever increasing extent. Furthermore, the advances in digital storage technology, which doubles storage capacity every year, make digitization, compression, archiving and streaming of image and video data popular and inexpensive. Consequently, people in general have to manage a huge amount of digital data including commercial as well as personal content.
An important aspect in dealing with digital content is how to regulate inheritance of digital property. A straightforward approach would be to adhere to a traditional method of creating a will and treat the digital content the same way other material goods (for example real estate) are treated. For example, a user creates a will in a traditional way and deposits the content with a trusted third party. However, this is a rather inefficient and static approach. Instead of choosing a trusted third party, e.g. a notary or a lawyer, to guarantee the execution of the will after the death of the user, a person may rely on his compliant device and/or other persons to take the role of the notary, e.g. family members. In this way, the process of creating a last will is easy, and the will is further easily maintainable and modifiable by the user.
Further, some content can be treated as confidential and therefore can be stored protected (encrypted) or used within a DRM system (e.g. commercial content or protected personal content), which makes it difficult to use a traditional method for inheritance. For commercial content, although the user is not the real owner of the commercial content, it might be possible in different business scenarios for him to see to it that his copy of the content is inherited by his successor. This actually means that his license (rights with respect to content usage) has to be bound to the inheritor. For example, if a person owns a piece of protected content within a person-based DRM system, the encrypted raw data is useless for the inheritor unless the (ownership) license is transferred from the original owner to him. In a DRM system which uses tokens for user authentication, a user can give to his successor the token which authorizes the successor to inherit all the content of the user (which is obviously unpractical). Further, a DRM system can use biometrics for user authentication, which will make a traditional inheritance method obsolete.
Another aspect to be considered is that digital content items may consist of medical or financial records, which may be highly confidential and therefore protected, for example by means of encryption or access control mechanisms. An owner of such content items will most likely want to be certain that his integrity is really protected after his death, so that no one else could decrypt the content.
US patent application having publication no. 20020019744 discloses a last will and testament service method is provided which enables people to draw up their wills before their death, and which wills are transferred after the death of a testator/testatrix. Will information and authentication information are produced by a testator terminal. The will information is registered on a last will and testament service terminal. Updating information and authentication information are transmitted by the testator terminal. The will information is updated by the last will and testament service terminal. A notice of death of the testator/testatrix is accepted by a public office terminal and is registered as “dead person information” and the dead person information is transmitted. When the dead person information is received by the last will and testament service terminal and, after the death of the testator is confirmed, the will information is transmitted. The will information is received by an heir terminal.
A problem with 20020019744 is that the method and system disclosed therein are not capable of handling encrypted digital wills and associated content items, e.g. encrypted private digital content and commercial content. In other words, when the testator is dead, his personal identity (e.g. a biometric identity) cannot be used by any individual. Consequently, no one can handle his personal encrypted content items.
The above stated problem is solved by embodiments of the present invention as defined by the following description and the attached claims.
To this end, there is provided a method and a device by which inheritance of a digital content item is enabled by means of acquiring an inheritance license for an encrypted digital content item. The inheritance license specifies operations that are allowed to be performed on the content item after the death of its proprietor. Further, a death certificate of the proprietor of the encrypted content item is accessed, wherein authorization is given to perform at least a subset of the operations specified in the inheritance license on the encrypted content item.
This has the advantage that a testator may specify operations that a party, e.g. a compliant device, a trusted third party or an individual, in possession of the inheritance license and the death certificate is allowed to perform on the encrypted content item. In the following, for reasons of simplicity, it is assumed that the party is a trusted third party (TTP). An operation that may be specified in the license is for instance the operation of deleting the content item to which the license is associated. As an effect, sensitive content items such as medical or financial records will be deleted after the death of the testator.
Possibly, the inheritance license is further arranged to comprise a content item decryption key. If a testator wishes to publish a content item after his death, he has to provide the decryption key such that the party in possession of the inheritance license is able to provide a clear text copy of the content item and thus make it public. Note that even though the possible content decryption key is deleted (or inaccessible in case keys based on biometrics is employed), someone who has access to the encrypted content item could be able to decrypt it by using brute force attack. It is therefore preferred, in case deletion is required, to make sure that the encrypted content item is also deleted, and not just the decryption key.
Advantageously, with the above described approach, dynamic creation and automatic execution of a will or testament is enabled. An owner of a content item is thus allowed in an easy and on-the-fly manner to specify inheritors of the content item. Further, the testament may be amended with regular intervals.
In an embodiment of the present invention, the inheritance license is arranged to provide an identity of an intended inheritor of the encrypted content item. Further, the operations that are allowed to be performed on the content item after the death of its proprietor may comprise the operation of establishing transfer of ownership to the intended inheritor that is identified in the license. In order for a claimant to the content item to obtain access to it, the device on which the encrypted content item is stored checks whether a matching criteria is satisfied for an identity of the claimant to the encrypted content and the identity provided by the inheritance license. In case the matching criteria is considered to be satisfied, i.e. the identity of the claimant matches the identity of the inheritance license, a content item decryption key is distributed to the claimant. Hence, the claimant may employ the key to decrypt the encrypted content item and access the resulting clear text copy of the content item.
The identity of an intended inheritor of the encrypted content item may be provided in different ways.
For instance, the identity may be provided by means of including a public key of the intended inheritor in the inheritance license, and the matching criteria is considered to be satisfied if a public key of the claimant is identical to the public key included in the license. Possibly, the content item decryption key comprised in the inheritance license may be encrypted with the public key of the intended inheritor before it is distributed.
In another example, the inheritance license is encrypted with a public key of the intended inheritor, wherein the identity is provided by means of the actual encryption of the inheritance license, and the matching criteria is considered to be satisfied if a successful decryption of the inheritance license is made with a private key that corresponds to the public key of the claimant. Hence, if the claimant has access to a private key that corresponds to the public key comprised in the license, the claimant is considered to be authorized to perform, on the content item, the operations contained in the inheritance license.
The present invention defined by means of exemplifying embodiments allows for completing inheritance transactions of private (encrypted) content in a secure and easy way. When the last will in the form of an inheritance license is posthumously opened, the intended inheritor(s) will receive licenses and/or rights for transferring ownership, and appliances in the form of compliant devices and/or trusted third parties (TTPs) will securely complete the transactions. Further, it is possible to provide the inheritance license with non-repudiated evidence, if required by the law or the testator. The testator has the option to choose a trusted executor, e.g. a family members instead of an embowered attorney in the form of e.g. a lawyer.
In another embodiment of the present invention, the operations that are allowed to be performed on the content item after the death of its proprietor, which operations are defined in the inheritance license, are defined by which access rights an intended inheritor has to the encrypted content item. For instance, the access rights may define operations such as “play”, “copy”, “distribute”, “play for 48 hours”, etc.
In a further embodiment of the present invention, an ownership license is issued to the claimant for the content item in case the matching criteria is satisfied, which ownership license specifies the claimant as a new proprietor of the encrypted content item. Possibly, a timestamp representing time of issuing is included in the ownership license.
A detailed description of preferred embodiments of the present invention will be given in the following with reference made to the accompanying drawings, in which:
With reference made to
At the moment the device accesses (step 3) the death certificate, it will enforce deletion/publication (step 4) of all content items with which the inheritance license is associated. Hence, the compliant device is authorized to perform the operations specified in the inheritance license 104 on the encrypted content item. In case publication of the encrypted content item is to be performed, it is, as previously described, necessary to include a content item decryption key in the inheritance license. Hence, the compliant device 102 is able to perform decryption to provide a clear text copy of the content item.
In another embodiment, which is illustrated in
With reference to
To provide non-repudiation and integrity, the license is possibly signed by the owner. The license is stored (step 1) on the owner's compliant device 202, which comprises a microprocessor 220. Alternatively, the owner can copy the inheritance license and deposit it with a TTP (not shown). After the death of the testator, his device (or a TTP, if he has sent a copy of the inheritance license to the TTP) could prompt (step 2) the inheritors to initiate the transfer of ownership of the encrypted content item. The inheritor requests transfer of the ownership and presents (step 3) the death certificate 201 to the compliant device 202. The testator's device (or the TTP) will effect the transfer (step 4) of ownership in accordance with the inheritance license 204, which specifies inheritance information. In an exemplifying embodiment of the present invention, which also is illustrated in
This new ownership license 207 specifies the inheritor as a new owner. After the transfer, the testator's device may delete the inheritance license, since the inheritance process has been completed. It should be noted that transfer of data in steps 3 and 4 may be made directly between the inheritor 205 and the compliant device 202 (or the TTP). In
In the example illustrated with
With reference to
The approach of employing a usage license as described in connection to
In yet another embodiment of the present invention shown in
Another exemplifying embodiment of the invention, which is shown in
Appropriate usage of private keys by rights processors in the system enables secure authentication. The rights processor 507 of the testator 505 is required to conceal the testator's private key from being observed by any other entity, including himself. The inheritance license 504 is typically signed by a testator 505 of the encrypted content item 503. Typically, software in the form of a testament agent program running on the compliant device 502 is employed, which helps the testator 505, the executor 508 and the intended inheritor 511 to prepare, execute and complete the inheritance process, i.e. the transaction of the encrypted content item. When the testator wants to create his inheritance license, the agent program uses his rights processor 507 and his private key to create it.
As shown in
The inheritance license may in exemplifying embodiments of the present invention use attached digital containers that contain special rights transferring licenses or messages of each encrypted content item 503 for an intended inheritor 511. An example of a container is presented in (1). Using a container, the testator 505 can associate extra conditions to open the container, as shown in (3). For instance, a condition that may have to be complied with is that the intended inheritor is older than 18. The testator can establish one or more containers for an intended inheritor. Each container is encrypted with a container key, and the container key is stored in two container access messages (AMs), one for the testator 505 and one for the executor 508. The testator needs his AM to check and modify the container and the AM for the executor. The executor needs his AM to open the container posthumously and to deliver rights-transferring licenses or messages to the intended inheritor.
The AM for the executor is presented in (2). A first public key PubKexecutor of the executor states that the executor is the user of the AM, and a second public key PubKtestator of the testator states that the testator is the owner of the AM. The AM has two identical rights blocks: one is encrypted with PubKexecutor and the other is encrypted with PubKtestator. The details of the rights block is shown in (3), which include the container ID and key, usage rights and associated conditions. The AM is signed using the private key PKtestator of the testator, so that the integrity of the AM can be verified using the public key of the testator. The testator can check the AM and the conditions inside, using his private key. The rights processor 509 of the executor can decrypt and read the executor's rights block using the executor's private key: First, the conditions to open the container are checked. Then, after the processor has received proper certificates of meeting the conditions, the processor will return the container key to the compliant device 502 to decrypt the container.
Container={EcontainerK└{LicencesRights-transferring}, {Rights−messagesownership-transferring}┘} (1)
AMexecutor={PubKexecutor,PubKtestator,EPubK
RightsB={ContainerID,Rights=Open|conditions,ContainerK} (3)
The AM for the testator is presented in (4), in which the testator 505 is both the owner and the user of this message. Its rights blocks contain owner rights, as presented in (5). Using this owner rights-message, the testator can modify the container and the AM for the executor.
AMTestator={PubKtestator,PubKtestator, EPubK
RightsB={ContainerID, Rights=Owner, ContainerK} (5)
Note that it is possible to combine equations (4) and (5) to create an access message.
The inheritance license may in embodiment of the invention, as shown in (6), contain a header, a list of control blocks for each container, and all the containers. The header, as shown in (7), has information pertaining to the testator, the executor, and the date of the last modification of the inheritance license. As shown in (8), the control block of a container comprises the container ID, the container access message AMtestator for the testator and the container access message AMexecutor for the executor, and information about the encrypted content item and intended inheritor in the container. The testator can use this information to announce content item assignment to the inheritor or legal authorities (e.g. a local tax office), which are in the noti field. The control block list is encrypted with the inheritance license key TestamentK, which has as an effect that the blocks are not accessible to the intended inheritor and the executor, before the inheritance license is posthumously open. The inheritance license contains a signature of the header and the encrypted control block information, which is made by the private key of the testator. Based on the signature, the integrity of the information in the inheritance license can be checked using the public key of the testator.
Inh.lic.={{Header,ETestamentK[List(CtrlBscontainer)]}SignPK
Header={TestamentID, PubKTestator, PubKExecutor, DateLastModification} (7)
CrtlB={containerID,AMTestator,AMExecutor,List[item(ID,PubKinheritor,abstr,noti)]} (8)
The inheritance license key TestamentK is stored in two testament access messages, one for the executor and the other for the testator, with the same format of the container access messages as in (2) and (4).
The inheritance license AM for the executor states that the testator is the owner of the testament, and the executor is the user. Its rights block contains the right of posthumous opening for the executor, which requires the death certificate of the testator, as shown in (9).
RightsBexecutor={TestamentID,Rights=Open|death(testator),TestamentK} (9)
RightsBtestator={TestamentID, Rights=Owner, TestamentK} (10)
The inheritance license AM for the testator states that the testator is both the owner and the user of the testament. Its rights block contains the owner rights as shown in (10). Because the testator is the owner, he can open the testament whenever he wants to check or change it.
A testator could also choose to have a multi-person executor (e.g. some or all of the family members). In this way, he makes sure that all executors gather to open the testament. To support this, the presented method is adjusted to support secret sharing. Thus, the testator splits the testament key TestamentK into different shares. Therefore, instead of storing the whole TestamentK, only a share of the key is stored in the license inheritance AM (9) for one person (executor). Consequently, the PubKexecutor fields in (7) will contain a set of public keys of the executors. Therefore, the inheritance license can only be reconstructed when the shares are combined (individual shares are of no use on their own). Analogously, if the testator chooses a multi-person executor for a container in his inheritance license, the field of the ContainerK in (3) will store a share of the ContainerK (instead of the complete key) in the AM for one person (executor), and the AMexecutor field in (8) will contain a set of container AMs for all the openers.
When the testator is dead, the testament agent program running on the compliant device 502 is employed by the executor 508 to complete the inheritance. The rights processor 509, using the private key of the executor, can decrypt the inheritance license access message to get the testament key, if it receives the death certificate of the testator. The content cryptographic processor 501 uses this testament key to decrypt the container control blocks. The information about the container, encrypted content item, the inheritor and conditions is open for the executor and the inheritor. When the executor 508 sends licenses/certificates for meeting the conditions of a container to his rights processor 509, the rights processor will deliver the container key to the content cryptographic processor 501 to decrypt the container. Note that the data integrity of the inheritance license 504 and the AM is checked based on signatures before they are decrypted.
All rights-transferring messages are then delivered to the inheritor 511. The rights processor 512 with the private key of the inheritor can use the received rights-transferring message to complete the inheritance. If the testator so requires (or if enforced by law), the agent can generate and sign a list of inherited content items during the transferring of the rights. The agent then sends this list to an authority as evidence of the inheritance. Advantageously, the intended inheritor can, after the transfer of ownership of the encrypted content item is completed, provide a message (not shown) with a digital signature to indicate that he has received and accepted the content item. This is important if there is e.g. a legal or tax issue involved in the inheritance.
As has been described in embodiments of the present invention hereinabove, when a compliant device or testament agent receives the death certificate of the testator, the executor of the testament can open the inheritance license, and then the intended inheritors can perform operations specified therein or use transfer-ownership messages, ownership licenses or some of the other licenses described to complete the inheritance process. Possibly a non-repudiable evidence that the inheritor has received and accepted the encrypted content item is provided. However, if an intended inheritor is dead before the process of inheritance is completed, or if he is not willing to accept the inheritance, the ownership of an encrypted content item cannot be transferred to him, even if other members of the testator's family could and are willing to inherit the content item.
In a further embodiment of the present invention, a queue of inheritors is introduced in the inheritance license 504, so that the ownership of an encrypted content item 503 still can be transferred to an inheritor 514, if a previously mentioned inheritor 511 in the inheritance licenses can/will not accept the content item. For example, in the inheritance license, a list of intended inheritors 511, 514 is specified, as well as operations that the respective intended inheritor is allowed to perform on the encrypted content item. The content item to be inherited is typically provided in one single (encrypted) copy, and a separate inheritance license is provided for each intended inheritor. The content item is encrypted with the asset key, and each inheritor has access to his own rights block (which contains the asset key) in the rights transferring license or message encrypted with his public key. An alternative solution is that each inheritor has his own container, which contains his particular rights transferring license.
For example, assume that there are two intended inheritors 511, 514 listed in the inheritance license 504. A right of a first inheritor 511 may for instance be to acquire ownership of the encrypted content item 503 associated with the license. A right of a second inheritor 514 may be to acquire the ownership on condition that the first inheritor refuses the content item, or that the first inheritor is deceased.
If the first inheritor 511 refuses the encrypted content item, a trusted compliant device 502 will generate a certificate 515 signed with a private key of the first inheritor, which certificate states he has refused the content item. The second inheritor 514 may use his private key to decrypt the rights transferring license 504, which previously has been encrypted with the public key of the second inheritor, if the trusted device 502 receives the certificate (of death in case of the first inheritor has deceased or of refusal 515 in case the first inheritor does not accept the content item) of the first inheritor. Then, the second inheritor is allowed to acquire the ownership of the content item. If neither the first 511 nor the second inheritor 514 can/will accept the encrypted content item 503, the trusted device 502 (which has its public key listed in the inheritance license) may create a clear text copy of the encrypted content item and publish it, if the testator 505 states so in the inheritance license.
The idea of enabling inheritance by multiple inheritors may be combined with the idea of introducing a queue of inheritors in the inheritance license. For example, if a man wants his wife to inherit a content item, but she is not able to do so, he may want his children to inherit it. Hence, instead of having a straight queue, the inheritance license may defined a queue in the form of a tree structure.
Even though the invention has been described with reference to specific exemplifying embodiments thereof, many different alterations, modifications and the like will become apparent for those skilled in the art. The described embodiments are therefore not intended to limit the scope of the invention, as defined by the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 05106755.1 | Jul 2005 | EP | regional |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/IB2006/052297 | 7/7/2006 | WO | 00 | 1/22/2008 |
