A method and system for obtaining digital resources based on dynamic keys

Abstract

The application discloses a method for obtaining digital resources based on dynamic keys, which comprises the following steps: when receiving encrypted digital resources, obtaining the resource identification of the encrypted digital resources, and obtaining the current DRM version number corresponding to the encrypted digital resources from a DRM client based on the resource identification; generating a first request message for requesting a dynamic encryption token corresponding to the encrypted digital resources based on the current DRM version number, and sending the first request message to a service server; when obtaining the dynamic encryption token encrypted by the current encryption key from the service server, sending the dynamic encryption token to the DRM client, so that the DRM client obtains the current DRM key corresponding to the encrypted digital resources based on the dynamic encryption token; and decrypting the encrypted digital resources based on the current DRM key corresponding to the encrypted digital resources, to obtain the decrypted digital resources.

Description

Technical Field

[0001] This invention relates to the field of digital resource technology, and more specifically to a method, system, computer-readable storage medium, and electronic device for acquiring digital resources based on dynamic keys. Background Technology

[0002] In the internet age, the development level of the online copyright industry has increasingly become an important measure of digital economic competitiveness and is closely related to the construction of digital culture. Since 2013, with the continuous upgrading of the cultural industry, the market size of the online copyright industry has expanded year by year, with an annual growth rate generally maintained above 20%. In 2020, the market size reached 1,184.73 billion yuan, exceeding 10 trillion yuan for the first time, an increase of 23.6% year-on-year. In 2021, the losses caused by online literature piracy amounted to 6.2 billion yuan, with pirated online literature platforms, search engines, and app stores becoming the main channels for online literature piracy and infringement.

[0003] To prevent digital content piracy, various Digital Rights Management (DRM) solutions are currently available on the market, such as Google Widevine, Microsoft PlayReady, Apple FairPlay, and Adobe Primetime. These solutions all have clear platform attributes; in particular, the DRM solutions from Google, Microsoft, and Apple each dominate their respective business ecosystems. This situation leads to inconsistent standards and poor interoperability, causing significant inconvenience for content providers, and the solutions are often extremely expensive. Currently, many companies both domestically and internationally are involved in DRM businesses, such as Netflix, Hulu, iQiyi, and Bilibili. These companies typically develop their own scenario-specific DRM systems.

[0004] Currently, the DRM process is roughly as follows: Figure 1 As shown, the DRM management service (DRM management server) obtains the DRM key from the client's DRM module and sends it to the resource production server. The resource production server uses the DRM key to encrypt the digital resource, generating an encrypted digital resource. This encrypted digital resource is then sent to the object storage server and subsequently to the client's resource module via a Content Delivery Network (CDN). The client uses the DRM key to decrypt the encrypted digital resource in the resource module to obtain the digital resource.

[0005] Current DRM technology faces several challenges: 1. DRM client security, including the security of the hardware and software execution environment. For example, rooting some Android mobile devices and gaining root access may bypass DRM protection mechanisms. 2. Using hardware chips places high demands on devices, creating bottlenecks in cross-platform mobile applications and resulting in insufficient coverage. 3. The cost of replacing leaked DRM server-side keys or algorithms is high. In the mobile internet era, users typically use DRM platforms through mobile apps. If the DRM server-side key is leaked, enterprises cannot quickly replace it because they need to maintain outdated app versions. Summary of the Invention

[0006] To address the problems in existing technologies, this invention provides a method, system, computer-readable storage medium, and electronic device for acquiring digital resources based on dynamic keys. The technical solution of this invention relates to an end-to-end dynamically changeable encryption technology that enables hot key updates, supports rapid key replacement for DRM servers and clients, and allows for cross-platform, low-cost, and real-time hot-swap DRM key replacement.

[0007] To achieve the above-mentioned objectives, the technical solution adopted by the present invention is as follows:

[0008] 1. The client adds a token or label adapter component. The function of this component is to decrypt the DRM key information (hereinafter referred to as TOKEN) sent by the server into a DRM key used by the DRM module, and can dynamically distribute and update it.

[0009] 2. On the Android platform, the TOKEN adapter component uses nativeso's hot update technology, which prevents third-party tampering and cracking through encryption and signing;

[0010] 3. After encrypting and signing the FlutterDart package of the TOKEN adapter component on the iOS platform, it is sent to the client.

[0011] According to one aspect of the present invention, a method for acquiring digital resources based on a dynamic key is provided, the method comprising:

[0012] When an encrypted digital resource is received, the resource identifier of the encrypted digital resource is obtained, and the current DRM version number corresponding to the encrypted digital resource is obtained from the data rights management (DRM) client based on the resource identifier.

[0013] Based on the current DRM version number, generate a first request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and send the first request message to the business server.

[0014] When a dynamically encrypted token, encrypted using the current encryption key, is obtained from the business server, the dynamically encrypted token is sent to the DRM client, enabling the DRM client to obtain the current DRM key corresponding to the encrypted digital resource based on the dynamically encrypted token; and

[0015] Based on the current DRM key corresponding to the encrypted digital resource, the encrypted digital resource is decrypted to obtain the decrypted digital resource.

[0016] Preferably, obtaining the current DRM version number corresponding to the encrypted digital resource from the data rights management (DRM) client based on the resource identifier includes:

[0017] A DRM query request for querying the DRM version number is generated based on the resource identifier, and the DRM query request is sent to the DRM client;

[0018] The DRM client obtains the resource identifier from the DRM query request and searches the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource.

[0019] Preferably, after sending the first request message to the business server, the method further includes:

[0020] The business server obtains the current DRM version number from the first request message;

[0021] A second request message is generated to request a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and the second request message is sent to a DRM server, so that the DRM server obtains the current DRM version number from the second request message and determines the current encryption key for encrypting the TOKEN based on the current DRM version number; and

[0022] Obtain a dynamically encrypted token from the DRM server, which is encrypted using the current encryption key.

[0023] Preferably, the DRM server determines the current encryption key for encrypting the token based on the current DRM version number, including:

[0024] Obtain the current DRM library version number and the current DRM serial number from the current DRM version number;

[0025] Determine whether the current DRM library version number is the latest DRM library version number. If it is the latest DRM library version number, determine the TOKEN of the current version based on the current DRM serial number and use the latest encryption key as the current encryption key.

[0026] Encrypt the current version of the token using the current encryption key to generate a dynamically encrypted token; and

[0027] Send the dynamic encrypted token to the business server.

[0028] Preferably, the DRM server determines the current encryption key for encrypting the token based on the current DRM version number, including:

[0029] Obtain the current DRM library version number and the current DRM serial number from the current DRM version number;

[0030] Determine whether the current DRM library version number is the latest DRM library version number. If it is not the latest DRM library version number, then determine whether the current DRM library version number is the adjacent previous DRM library version number.

[0031] If it is determined that the current DRM library version number is the adjacent previous DRM library version number, then determine whether the additional validity period of the previous DRM library version number has expired.

[0032] If it is determined that the additional validity period of the previous version of the DRM library version number has not expired, then the TOKEN of the current version is determined based on the current DRM serial number and the encryption key of the adjacent previous version is used as the current encryption key.

[0033] Encrypt the current version of the token using the current encryption key to generate a dynamically encrypted token; and

[0034] Send the dynamic encrypted token to the business server.

[0035] Preferably, encrypting the current version of the token using the current encryption key includes:

[0036] The current version of the token is encrypted using an asymmetric encryption algorithm.

[0037] Preferably, the method further includes, if it is determined that the current DRM library version number is not the adjacent previous DRM library version number, the DRM server returns a response message indicating that the DRM library version has expired.

[0038] Preferably, the method further includes, if it is determined that the additional validity period of the previous version of the DRM library version number has expired, the DRM server returns a response message indicating that the DRM library version has expired.

[0039] Preferably, the method further includes setting an additional validity period for the previous version of the DRM library when updating from an adjacent previous version of the DRM library to the latest DRM library;

[0040] During the additional valid time period, it is possible to use the encryption key of the previous version corresponding to the adjacent previous version of the DRM library version number or the latest encryption key corresponding to the latest DRM library version number.

[0041] When the additional validity period expires, the encryption key of the previous version corresponding to the adjacent previous version of the DRM library version number cannot be used; only the latest encryption key corresponding to the latest DRM library version number can be used.

[0042] Preferably, the step of decrypting the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource includes:

[0043] The encrypted digital resource is sent to the DRM client, prompting the DRM client to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

[0044] Preferably, the step of decrypting the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource includes:

[0045] Obtain the current DRM key corresponding to the encrypted digital resource from the DRM client, and decrypt the encrypted digital resource locally based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource.

[0046] Preferably, the method further includes,

[0047] Retrieve the current version number of the local algorithm library, and generate an algorithm library update request based on the current version number; and

[0048] The algorithm library update request is sent to the business server.

[0049] Preferably, after sending the algorithm library update request to the business server, the method further includes:

[0050] The business server obtains the current algorithm library version number from the algorithm library update request;

[0051] Based on the current algorithm library version number, determine whether the local algorithm library is the latest version of the algorithm library;

[0052] If it is determined that the local algorithm library is the latest version, a first response message indicating that the local algorithm library is the latest version is returned; if it is determined that the local algorithm library is not the latest version, a second response message is generated based on the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature.

[0053] Preferably, when the second response message is received, the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature are extracted from the second response message;

[0054] The second response message is verified based on the digital signature. Once the second response message is verified, the algorithm library is downloaded based on the address of the latest version of the algorithm library and the current version number of the local algorithm library is updated based on the algorithm library version number.

[0055] Preferably, the DRM client obtains the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token, including:

[0056] The DRM client decrypts the dynamically encrypted token based on the current decryption key, which is equivalent to the current encryption key, to obtain the current DRM key corresponding to the encrypted digital resource.

[0057] Preferably, the method further includes:

[0058] When a resource acquisition request for a digital resource is received, the resource production server encrypts the digital resource using the current DRM key to obtain the encrypted digital resource.

[0059] The encrypted digital resources are sent to the object storage server, which then sends them to the DRM client via a content delivery network.

[0060] Preferably, the process further includes, before the digital resource is encrypted by the resource production server:

[0061] The resource production server obtains the current DRM key from the DRM management server.

[0062] Preferably, the DRM management server generates the current DRM key based on the current version of the token received from the DRM client.

[0063] According to another aspect of the present invention, a system for obtaining digital resources based on dynamic encryption is provided, the system comprising:

[0064] An acquisition device is used to acquire the resource identifier of the encrypted digital resource when the encrypted digital resource is received, and to acquire the current DRM version number corresponding to the encrypted digital resource from the data rights management (DRM) client based on the resource identifier;

[0065] The generation device is configured to generate a first request message based on the current DRM version number for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and send the first request message to the business server.

[0066] A communication device is configured to, upon receiving a dynamically encrypted token encrypted with the current encryption key from the service server, send the dynamically encrypted token to a DRM client, so that the DRM client can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamically encrypted token; and

[0067] A decryption device is used to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

[0068] According to another aspect of the present invention, a computer-readable storage medium is provided, characterized in that the storage medium stores a computer program for performing the method described in any of the above embodiments.

[0069] According to another aspect of the present invention, an electronic device is provided, comprising:

[0070] processor;

[0071] Memory used to store the processor's executable instructions;

[0072] The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the embodiments.

[0073] According to the technical solution of the present invention, when an encrypted digital resource is received, the resource identifier of the encrypted digital resource is obtained, and the current DRM version number corresponding to the encrypted digital resource is obtained from the Data Rights Management (DRM) client based on the resource identifier; based on the current DRM version number, a first request message is generated to request a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and the first request message is sent to the business server; when a dynamic encryption token encrypted with the current encryption key is obtained from the business server, the dynamic encryption token is sent to the DRM client, so that the DRM client obtains the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token; and based on the current DRM key corresponding to the encrypted digital resource, the encrypted digital resource is decrypted to obtain the decrypted digital resource. By building a token adapter, the encryption and decryption algorithms are dynamically distributed, realizing the dynamic encryption and decryption of resources (audio, video & e-books). This efficiently solves the difficulty of digital resource leakage caused by the leakage of DRM keys or algorithms. The technical solution of the present invention can protect cross-platform, low-cost, and high real-time DRM key replacement end-to-end dynamically changeable encryption technology. Attached Figure Description

[0074] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0075] Figure 1 This is a schematic diagram of existing technologies for acquiring digital resources based on DRM.

[0076] Figure 2 This is a schematic diagram of a technology for acquiring digital resources based on a dynamic key according to an embodiment of the present invention;

[0077] Figure 3 This is a timing diagram of acquiring digital resources based on dynamic keys according to an embodiment of the present invention;

[0078] Figure 4 This is a schematic diagram of a key replacement technique implemented by hot update according to an embodiment of the present invention;

[0079] Figure 5 A flowchart illustrating a method for acquiring digital resources based on a dynamic key according to an embodiment of the present invention; and

[0080] Figure 6 This is a schematic diagram of the structure of a system for acquiring digital resources based on a dynamic key according to an embodiment of the present invention. Detailed Implementation

[0081] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0082] Figure 2 This is a schematic diagram illustrating a technique for acquiring digital resources based on dynamic keys according to an embodiment of the present invention. A TOKEN adapter component is set up in the DRM client. The function of the TOKEN adapter component is to decrypt the DRM key information (hereinafter referred to as TOKEN) sent by the server to obtain the DRM key used by the DRM module, and to dynamically distribute and update it. Specifically, on the Android platform, the TOKEN adapter component uses nativeso's hot update technology, which prevents third-party tampering and cracking through encryption and signing. On the iOS platform, the TOKEN adapter component's flutterdart package is encrypted and signed before being distributed to the client.

[0083] In traditional solutions, when the key currently used by the DRM system is leaked, the DRM system will switch to a new key. During this update process, data processing needs to be paused for a period of time to allow all DRM clients to update to the new key. This is equivalent to a cold update, and in extreme cases, data processing can be impossible for a considerable period because one or more specific DRM clients may not update to the new key. This approach leads to a poor user experience for the DRM system. Some DRM clients that have already updated to the new key do not wish to wait for the DRM system's lengthy update process.

[0084] Therefore, this application employs hot-update technology. That is, when the key currently used by the DRM system is leaked, the DRM system will use a new key. Furthermore, the DRM system sets an additional validity period for the currently used key. During this additional validity period, DRM clients that have not updated to use the new key can use the currently used key. When the additional validity period expires, all DRM clients must use the new key. In this way, DRM clients can freely choose when to use the new key during the additional validity period, i.e., they can freely choose when to update their DRM database. Therefore, DRM clients can choose to update their DRM database and use the new key during idle or relatively idle times. This hot-update technology provides a very good user experience for DRM system users. In addition, the length of the additional validity period can be dynamically set or modified according to actual needs.

[0085] In one embodiment, the DRM management service issues token information, typically within 2kB in length, which can be encrypted using asymmetric encryption algorithms to increase the difficulty of cracking. Considering that hot updates require a cold start for users, and a full hot update also requires a transition period of up to a month, version compatibility needs to be monitored during this period. For example, if the AppX version uses token adapter v1, a hot update to token adapter v2 is now needed.

[0086] Each DRM library provides a version number. Client-side DRM versions only support decryption for one version number. The server supports encryption and decryption from version 1 to the latest version. Each time a client requests an encrypted token, it includes the DRM version number. The server only processes encryption and decryption for the corresponding version; for versions outside the server's range, it returns an error message or a failure message.

[0087] Figure 3 This is a timing diagram of acquiring digital resources based on dynamic keys according to an embodiment of the present invention. Figure 3 As shown, when the application receives an encrypted digital resource, it obtains the resource identifier of the encrypted digital resource, generates a DRM query request based on the resource identifier to query the DRM version number, and sends the DRM query request to the DRM client. The DRM client obtains the resource identifier from the DRM query request and searches the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource.

[0088] The application (APP) generates a first request message based on the current DRM version number to request a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and sends the first request message to the business server. The business server retrieves the current DRM version number from the first request message; generates a second request message to request the dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and sends the second request message to the DRM server. This allows the DRM server to retrieve the current DRM version number from the second request message, determine the current encryption key for encrypting the token based on the current DRM version number, and obtain the dynamic encryption token encrypted using the current encryption key from the DRM server.

[0089] The DRM server retrieves the current DRM library version number and the current DRM serial number from the current DRM version number; determines whether the current DRM library version number is the latest DRM library version number; if it is the latest DRM library version number, it determines the current version of the TOKEN based on the current DRM serial number and uses the latest encryption key as the current encryption key; it encrypts the current version of the TOKEN using the current encryption key to generate a dynamically encrypted TOKEN; and sends the dynamically encrypted TOKEN to the business server.

[0090] In one embodiment, the DRM server obtains the current DRM library version number and the current DRM serial number from the current DRM version number; determines whether the current DRM library version number is the latest DRM library version number; if it is not the latest DRM library version number, it determines whether the current DRM library version number is the adjacent previous DRM library version number; if it is determined that the current DRM library version number is the adjacent previous DRM library version number, it determines whether the extra validity period of the previous DRM library version number has expired; if it is determined that the extra validity period of the previous DRM library version number has not expired, it determines the current version's token based on the current DRM serial number and uses the encryption key of the adjacent previous version as the current encryption key; encrypts the current version's token using the current encryption key to generate a dynamically encrypted token; and sends the dynamically encrypted token to the business server. In one embodiment, encrypting the current version's token using the current encryption key includes: encrypting the current version's token using an asymmetric encryption algorithm.

[0091] If it is determined that the current DRM library version number is not the adjacent previous DRM library version number, the DRM server returns a response message indicating that the DRM library version has expired. If it is determined that the additional validity period of the previous DRM library version number has expired, the DRM server returns a response message indicating that the DRM library version has expired.

[0092] When updating from an adjacent previous version of the DRM library to the latest DRM library, the DRM server sets an additional validity period for the previous version of the DRM library. During this additional validity period, either the encryption key corresponding to the previous version's version number (as opposed to the adjacent previous version of the DRM library) or the latest encryption key corresponding to the latest DRM library version number can be used. When the additional validity period expires, the encryption key corresponding to the previous version's version number (as opposed to the adjacent previous version of the DRM library) can no longer be used; only the latest encryption key corresponding to the latest DRM library version number can be used.

[0093] When a dynamically encrypted token, encrypted with the current encryption key, is obtained from the business server, it is sent to the DRM client so that the DRM client can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamically encrypted token.

[0094] The encrypted digital resource is sent to the DRM client, prompting the DRM client to decrypt the encrypted digital resource using the current DRM key corresponding to it, thus obtaining the decrypted digital resource. Alternatively, the current DRM key corresponding to the encrypted digital resource is obtained from the DRM client, and the encrypted digital resource is decrypted locally using the current DRM key corresponding to it, thus obtaining the decrypted digital resource.

[0095] The system retrieves the current version number of the local algorithm library and generates an algorithm library update request based on this version number. It then sends the update request to the business server. The business server retrieves the current algorithm library version number from the update request. Based on this version number, it determines whether the local algorithm library is the latest version. If it is, it returns a first response message indicating that the local algorithm library is the latest version. If it is not, it generates a second response message based on the latest version's algorithm library address, version number, and digital signature.

[0096] When the second response message is received, the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature are extracted from the second response message. The second response message is verified based on the digital signature. When it is determined that the second response message has passed the verification, the algorithm library is downloaded based on the address of the latest version of the algorithm library and the current algorithm library version number of the local algorithm library is updated based on the algorithm library version number.

[0097] The DRM client obtains the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token, including: the DRM client decrypts the dynamic encryption token based on the current decryption key equivalent to the current encryption key to obtain the current DRM key corresponding to the encrypted digital resource.

[0098] Furthermore, upon receiving a resource acquisition request for a digital resource, the resource production server encrypts the digital resource using the current DRM key to obtain the encrypted digital resource; the encrypted digital resource is then sent to the object storage server, which in turn sends it to the DRM client via the content delivery network. The resource production server obtains the current DRM key from the DRM management server. The DRM management server generates the current DRM key based on the current version of the token received from the DRM client.

[0099] Suppose the encryption key or algorithm on the DRM server has been leaked. Since different resources in the DRM system use different encryption tokens, we can dynamically update the token adapter, modifying the token's algorithm and dynamically sending it to the client. This allows us to dynamically change the DRM encryption method. The detailed method is as follows:

[0100] For each version requested by a client, the server returns the corresponding DRM encrypted token. The backend itself does not need to store the token; it needs to dynamically generate a DRM token adapter through DRM. Each latest DRM only needs to encrypt and decrypt its own version of the token; it does not process tokens of other versions and directly reports an error. For example, currently the Android DRM implementation is implemented in C / C++, and the iOS DRM implementation is implemented in Dart. It should be understood that the implementation method can reasonably change for different systems in the future.

[0101] Figure 4 This is a schematic diagram illustrating a technique for key replacement using a hot update method according to an embodiment of the present invention. Figure 4 As shown, the application (APP) requests the latest algorithm library from the server (e.g., a business server or a DRM server). The server returns the algorithm library address, version, and signature. The DRM client or application downloads the algorithm library from the server. If the algorithm library update fails, an older version of the algorithm library or an older DRM version is used for the request; if the algorithm library update succeeds, a newer version of the algorithm library or a newer DRM version is used for the request.

[0102] The system retrieves the current version number of the local algorithm library and generates an algorithm library update request based on this version number. It then sends the update request to the business server. The business server retrieves the current algorithm library version number from the update request. Based on this version number, it determines whether the local algorithm library is the latest version. If it is, it returns a first response message indicating that the local algorithm library is the latest version. If it is not, it generates a second response message based on the latest version's algorithm library address, version number, and digital signature.

[0103] Upon receiving the second response message, extract the latest version of the algorithm library address, algorithm library version number, and digital signature from it. Verify the second response message based on the digital signature. Once the second response message is verified, download the algorithm library based on the latest version's address and update the current algorithm library version number on the local machine. The client's locally cached token needs to be refreshed to the corresponding version upon the next network connection.

[0104] Figure 5 This is a flowchart of a method for acquiring digital resources based on a dynamic key according to an embodiment of the present invention. Method 500 includes:

[0105] Step 501: When an encrypted digital resource is received, obtain the resource identifier of the encrypted digital resource, and obtain the current DRM version number corresponding to the encrypted digital resource from the data copyright management (DRM) client based on the resource identifier.

[0106] In one embodiment, obtaining the current DRM version number corresponding to the encrypted digital resource from the data rights management (DRM) client based on the resource identifier includes: generating a DRM query request for querying the DRM version number based on the resource identifier, and sending the DRM query request to the DRM client; the DRM client obtaining the resource identifier from the DRM query request, and searching in the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource.

[0107] Step 502: Based on the current DRM version number, generate a first request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and send the first request message to the business server.

[0108] In one embodiment, after sending the first request message to the business server, the method further includes: the business server obtaining the current DRM version number from the first request message; generating a second request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and sending the second request message to the DRM server, so that the DRM server obtains the current DRM version number from the second request message, determines the current encryption key for encrypting the TOKEN based on the current DRM version number; and obtaining the dynamic encryption TOKEN encrypted using the current encryption key from the DRM server.

[0109] In one embodiment, the DRM server determines the current encryption key for encrypting the token based on the current DRM version number, including: obtaining the current DRM library version number and the current DRM serial number from the current DRM version number; determining whether the current DRM library version number is the latest DRM library version number; if it is the latest DRM library version number, determining the current version of the token based on the current DRM serial number and using the latest encryption key as the current encryption key; encrypting the current version of the token using the current encryption key to generate a dynamically encrypted token; and sending the dynamically encrypted token to the business server.

[0110] In one embodiment, the DRM server determines the current encryption key for encrypting the token based on the current DRM version number, including: obtaining the current DRM library version number and the current DRM serial number from the current DRM version number; determining whether the current DRM library version number is the latest DRM library version number; if it is not the latest DRM library version number, determining whether the current DRM library version number is the adjacent previous DRM library version number; if it is determined that the current DRM library version number is the adjacent previous DRM library version number, determining whether the extra validity period of the previous DRM library version number has expired; if it is determined that the extra validity period of the previous DRM library version number has not expired, determining the current version of the token based on the current DRM serial number and using the encryption key of the adjacent previous version as the current encryption key; encrypting the current version of the token using the current encryption key to generate a dynamically encrypted token; and sending the dynamically encrypted token to the business server. In one embodiment, encrypting the current version of the token using the current encryption key includes: encrypting the current version of the token using an algorithm such as asymmetric encryption. It should be understood that any suitable encryption algorithm or method can be used.

[0111] In one embodiment, method 500 further includes, if it is determined that the current DRM library version number is not the DRM library version number of the adjacent previous version, the DRM server returns a response message indicating that the DRM library version has expired.

[0112] In one embodiment, method 500 further includes, if it is determined that the additional validity period of the previous version of the DRM library version number has expired, the DRM server returns a response message indicating that the DRM library version has expired.

[0113] In one embodiment, method 500 further includes setting an additional validity period for the previous version of the DRM library when updating from an adjacent previous version to the latest DRM library. During this additional validity period, either the encryption key corresponding to the version number of the adjacent previous version of the DRM library or the latest encryption key corresponding to the version number of the latest DRM library can be used. Upon expiration of the additional validity period, the encryption key corresponding to the version number of the adjacent previous version of the DRM library can no longer be used; only the latest encryption key corresponding to the version number of the latest DRM library can be used.

[0114] Step 503: When the dynamic encryption token encrypted with the current encryption key is obtained from the business server, the dynamic encryption token is sent to the DRM client so that the DRM client can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token.

[0115] Step 504: Decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource.

[0116] In one embodiment, decrypting an encrypted digital resource based on a current DRM key corresponding to the encrypted digital resource to obtain a decrypted digital resource includes: sending the encrypted digital resource to a DRM client to prompt the DRM client to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource.

[0117] In one embodiment, decrypting an encrypted digital resource based on a current DRM key corresponding to the encrypted digital resource to obtain a decrypted digital resource includes: obtaining a current DRM key corresponding to the encrypted digital resource from a DRM client, and decrypting the encrypted digital resource locally based on the current DRM key corresponding to the encrypted digital resource to obtain a decrypted digital resource.

[0118] In one embodiment, method 500 further includes obtaining the current algorithm library version number of the local algorithm library, generating an algorithm library update request based on the current algorithm library version number, and sending the algorithm library update request to the business server.

[0119] In one embodiment, after sending the algorithm library update request to the business server, the process further includes the business server obtaining the current algorithm library version number from the algorithm library update request; determining whether the local algorithm library is the latest version based on the current algorithm library version number; if it is determined that the local algorithm library is the latest version, returning a first response message indicating that the local algorithm library is the latest version; and if it is determined that the local algorithm library is not the latest version, generating a second response message based on the latest version algorithm library address, algorithm library version number, and digital signature.

[0120] In one embodiment, when a second response message is received, the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature are extracted from the second response message; the second response message is verified based on the digital signature; and when it is determined that the second response message has passed verification, the algorithm library is downloaded based on the address of the latest version of the algorithm library and the current algorithm library version number of the local algorithm library is updated based on the algorithm library version number.

[0121] In one embodiment, the DRM client obtains the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token, including: the DRM client decrypts the dynamic encryption token based on the current decryption key equivalent to the current encryption key to obtain the current DRM key corresponding to the encrypted digital resource.

[0122] In one embodiment, method 500 further includes: when a resource acquisition request for a digital resource is received, the resource production server encrypts the digital resource using the current DRM key to obtain the encrypted digital resource; the encrypted digital resource is sent to the object storage server, and the object storage server sends it to the DRM client via a content delivery network.

[0123] In one embodiment, before the digital resource is encrypted by the resource production server, the method further includes: the resource production server obtaining the current DRM key from the DRM management server.

[0124] In one embodiment, the DRM management server generates the current DRM key based on the current version of the token received from the DRM client.

[0125] Figure 6 This is a schematic diagram of a system for acquiring digital resources based on a dynamic key according to an embodiment of the present invention. The system includes: an acquisition device 601, a generation device 602, a communication device 603, and a decryption device 604.

[0126] The acquisition device 601 is used to acquire the resource identifier of the encrypted digital resource when the encrypted digital resource is received, and to obtain the current DRM version number corresponding to the encrypted digital resource from the data rights management (DRM) client based on the resource identifier.

[0127] In one embodiment, the acquisition device 601 is specifically used to generate a DRM query request for querying the DRM version number based on the resource identifier, and send the DRM query request to the DRM client; the DRM client obtains the resource identifier from the DRM query request, and searches in the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource.

[0128] The generation device 602 is used to generate a first request message based on the current DRM version number to request a dynamic encryption token TOKEN corresponding to the encrypted digital resource, and send the first request message to the business server.

[0129] In one embodiment, the generating device 602 is specifically configured to: obtain the current DRM version number from the first request message; generate a second request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource; and send the second request message to the DRM server, so that the DRM server obtains the current DRM version number from the second request message and determines the current encryption key for encrypting the TOKEN based on the current DRM version number; and obtain the dynamic encryption TOKEN encrypted using the current encryption key from the DRM server.

[0130] In one embodiment, the generating device 602 is specifically configured to obtain the current DRM library version number and the current DRM serial number from the current DRM version number; determine whether the current DRM library version number is the latest DRM library version number; if it is the latest DRM library version number, determine the current version of the TOKEN based on the current DRM serial number and use the latest encryption key as the current encryption key; encrypt the current version of the TOKEN using the current encryption key to generate a dynamically encrypted TOKEN; and send the dynamically encrypted TOKEN to the business server.

[0131] In one embodiment, the generating device 602 is specifically configured to: obtain the current DRM library version number and the current DRM serial number from the current DRM version number; determine whether the current DRM library version number is the latest DRM library version number; if it is not the latest DRM library version number, determine whether the current DRM library version number is the adjacent previous DRM library version number; if it is determined that the current DRM library version number is the adjacent previous DRM library version number, determine whether the extra validity period of the previous DRM library version number has expired; if it is determined that the extra validity period of the previous DRM library version number has not expired, determine the current version's token based on the current DRM serial number and use the encryption key of the adjacent previous version as the current encryption key; encrypt the current version's token using the current encryption key to generate a dynamically encrypted token; and send the dynamically encrypted token to the business server. In one embodiment, encrypting the current version's token using the current encryption key includes: encrypting the current version's token using an asymmetric encryption algorithm.

[0132] In one embodiment, if it is determined that the current DRM library version number is not the adjacent previous DRM library version number, the DRM server returns a response message indicating that the DRM library version has expired. If it is determined that the additional validity period of the previous DRM library version number has expired, the DRM server returns a response message indicating that the DRM library version has expired.

[0133] In one embodiment, the generation device 602 is specifically configured to, when updating from an adjacent previous version of the DRM library to the latest DRM library, set an additional validity period for the previous version of the DRM library. During this additional validity period, either the encryption key corresponding to the version number of the adjacent previous version of the DRM library or the latest encryption key corresponding to the version number of the latest DRM library can be used. Upon expiration of the additional validity period, the encryption key corresponding to the version number of the adjacent previous version of the DRM library can no longer be used; only the latest encryption key corresponding to the version number of the latest DRM library can be used.

[0134] The communication device 603 is used to send the dynamic encryption token to the DRM client when it obtains the dynamic encryption token encrypted with the current encryption key from the business server, so that the DRM client can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token.

[0135] The decryption device 604 is used to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

[0136] In one embodiment, the decryption device 604 is specifically used to send the encrypted digital resource to the DRM client, so as to prompt the DRM client to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

[0137] In one embodiment, the decryption device 604 is specifically used to obtain the current DRM key corresponding to the encrypted digital resource from the DRM client, and decrypt the encrypted digital resource locally based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource.

[0138] In one embodiment, the decryption device 604 is further configured to obtain the current algorithm library version number of the local algorithm library, generate an algorithm library update request based on the current algorithm library version number, and send the algorithm library update request to the business server.

[0139] In one embodiment, the business server obtains the current algorithm library version number from the algorithm library update request; based on the current algorithm library version number, it determines whether the local algorithm library is the latest version; if it is determined that the local algorithm library is the latest version, it returns a first response message indicating that the local algorithm library is the latest version; if it is determined that the local algorithm library is not the latest version, it generates a second response message based on the latest version algorithm library address, algorithm library version number, and digital signature. When the second response message is received, the latest version algorithm library address, algorithm library version number, and digital signature are extracted from the second response message; the second response message is verified based on the digital signature; if the second response message passes verification, the algorithm library is downloaded based on the latest version algorithm library address, and the current algorithm library version number of the local algorithm library is updated based on the algorithm library version number.

[0140] In one embodiment, the DRM client obtains the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token, including: the DRM client decrypts the dynamic encryption token based on the current decryption key equivalent to the current encryption key to obtain the current DRM key corresponding to the encrypted digital resource.

[0141] In one embodiment, when a resource acquisition request for a digital resource is received, the resource production server encrypts the digital resource using the current DRM key to obtain the encrypted digital resource; the encrypted digital resource is then sent to the object storage server, which in turn sends it to the DRM client via a content delivery network.

[0142] In one embodiment, the resource production server obtains the current DRM key from the DRM management server. The DRM management server generates the current DRM key based on the current version of the token received from the DRM client.

[0143] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. In a typical configuration, the device of this application includes one or more processors (one of a CPU, FPGA, or MCU), an input / output user interface, a network interface, and memory.

[0144] Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] Therefore, this application also proposes a computer-readable medium on which a computer program is stored, which, when executed by a processor, implements the steps of the method of any embodiment of this application. For example, the memory of this invention may include non-permanent memory in a computer-readable medium, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM.

[0146] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0147] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0148] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for acquiring digital resources based on dynamic keys, characterized in that, The method includes the following steps: When the application receives encrypted digital resources, it obtains the resource identifier of the encrypted digital resources, generates a DRM query request for querying the DRM version number based on the resource identifier, and sends the DRM query request to the DRM client. The DRM client searches the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource. The current DRM version number includes the DRM database version number and the DRM serial number. The application APP generates a first request message based on the current DRM version number to request a dynamic encryption token TOKEN corresponding to the encrypted digital resource, and sends the first request message to the business server. The business server obtains the current DRM version number from the first request message, generates a second request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and sends the second request message to the DRM server. The DRM server obtains the current DRM version number from the second request message. The current DRM version number includes the current DRM library version number and the current DRM serial number. The DRM server determines the current encryption key for encrypting the TOKEN based on the current DRM version number. The business server obtains a dynamic encryption token encrypted with the current encryption key from the DRM server and sends the dynamic encryption token to the token adapter component of the DRM client, so that the token adapter component can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token. The DRM client decrypts the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, thereby obtaining the decrypted digital resource.

2. The method according to claim 1, wherein, The step of the DRM server determining the current encryption key for encrypting the token based on the current DRM version number specifically includes: Obtain the current DRM library version number and the current DRM serial number from the current DRM version number; Determine whether the current DRM library version number is the latest DRM library version number. If it is the latest DRM library version number, determine the TOKEN of the current version based on the current DRM serial number and use the latest encryption key as the current encryption key. Encrypt the current version of the token using the current encryption key to generate a dynamically encrypted token; and Send the dynamic encrypted token to the business server.

3. The method according to claim 1, wherein, The step of the DRM server determining the current encryption key for encrypting the token based on the current DRM version number specifically includes: Obtain the current DRM library version number and the current DRM serial number from the current DRM version number; Determine whether the current DRM library version number is the latest DRM library version number. If it is not the latest DRM library version number, then determine whether the current DRM library version number is the adjacent previous DRM library version number. If it is determined that the current DRM library version number is the adjacent previous DRM library version number, then determine whether the additional validity period of the previous DRM library version number has expired. If it is determined that the additional validity period of the previous version of the DRM library version number has not expired, then the TOKEN of the current version is determined based on the current DRM serial number and the encryption key of the adjacent previous version is used as the current encryption key. Encrypt the current version of the token using the current encryption key to generate a dynamically encrypted token; and Send the dynamic encrypted token to the business server.

4. The method according to claim 2 or 3, wherein encrypting the current version of the token using the current encryption key comprises: The current version of the token is encrypted using an asymmetric encryption algorithm.

5. The method according to claim 3, further comprising: if it is determined that the current DRM library version number is not the adjacent previous DRM library version number, then the DRM server returns a response message indicating that the DRM library version has expired.

6. The method of claim 3, further comprising, if it is determined that the additional validity period of the previous version of the DRM library version number has expired, the DRM server returns a response message indicating that the DRM library version has expired.

7. The method according to claim 1, wherein when updating from an adjacent previous version of the DRM library to the latest DRM library, the DRM server sets an additional validity period for the previous version of the DRM library; in, During the additional valid time period, it is possible to use the encryption key of the previous version corresponding to the adjacent previous version of the DRM library version number or the latest encryption key corresponding to the latest DRM library version number. When the additional validity period expires, the encryption key of the previous version corresponding to the adjacent previous version of the DRM library version number cannot be used; only the latest encryption key corresponding to the latest DRM library version number can be used.

8. The method according to claim 1, wherein decrypting the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource comprises: The encrypted digital resource is sent to the DRM client, prompting the DRM client to decrypt the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

9. The method according to claim 1, wherein decrypting the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource comprises: Obtain the current DRM key corresponding to the encrypted digital resource from the DRM client, and decrypt the encrypted digital resource locally based on the current DRM key corresponding to the encrypted digital resource to obtain the decrypted digital resource.

10. The method according to claim 1, further comprising: Retrieve the current version number of the local algorithm library, and generate an algorithm library update request based on the current version number; and The algorithm library update request is sent to the business server.

11. The method according to claim 10, further comprising, after sending the algorithm library update request to the business server, The business server obtains the current algorithm library version number from the algorithm library update request; Based on the current algorithm library version number, determine whether the local algorithm library is the latest version of the algorithm library; If it is determined that the local algorithm library is the latest version, a first response message indicating that the local algorithm library is the latest version is returned; If it is determined that the local algorithm library is not the latest version, a second response message is generated based on the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature.

12. The method according to claim 11, wherein when the second response message is received, the address of the latest version of the algorithm library, the algorithm library version number, and the digital signature are extracted from the second response message; The second response message is verified based on the digital signature. Once the second response message is verified, the algorithm library is downloaded based on the address of the latest version of the algorithm library and the current version number of the local algorithm library is updated based on the algorithm library version number.

13. A system for acquiring digital resources based on dynamic encryption, the system comprising: The acquisition device is used to acquire the resource identifier of the encrypted digital resource when the application APP receives the encrypted digital resource, generate a DRM query request for querying the DRM version number based on the resource identifier, and send the DRM query request to the DRM client. The DRM client searches the DRM database based on the resource identifier to determine the current DRM version number corresponding to the encrypted digital resource. The current DRM version number includes the DRM database version number and the DRM serial number. The generation device is configured to generate a first request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource based on the current DRM version number of the application (APP), and send the first request message to the business server. The business server obtains the current DRM version number from the first request message, generates a second request message for requesting a dynamic encryption token (TOKEN) corresponding to the encrypted digital resource, and sends the second request message to the DRM server. The DRM server obtains the current DRM version number from the second request message. The current DRM version number includes the current DRM library version number and the current DRM serial number. The DRM server determines the current encryption key for encrypting the TOKEN based on the current DRM version number. When the business server obtains a dynamic encryption token encrypted with the current encryption key from the DRM server, it sends the dynamic encryption token to the DRM client so that the DRM client can obtain the current DRM key corresponding to the encrypted digital resource based on the dynamic encryption token. as well as The DRM client includes a decryption device for decrypting the encrypted digital resource based on the current DRM key corresponding to the encrypted digital resource, so as to obtain the decrypted digital resource.

14. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that causes a processor to perform the method according to any one of claims 1-12.

15. An electronic device comprising: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method of any one of claims 1-12.

Images