Digital resource copyright protection method, electronic device and system

Abstract

The invention discloses a digital resource copyright protection method, electronic equipment and a system, and relates to the field of information security. Encrypting the digital resource files by using the content keys, wherein the digital resource files are in one-to-one correspondence with the content keys; encrypting the content key by adopting authorization certificates, wherein the authorization certificates are in one-to-one correspondence with the users; when the authorization certificate and the license are transmitted, a transmission key is adopted for encryption, and a corresponding transmission key is dynamically generated in each transmission; triple protection of content key, authorization certificate and transmission key is carried out on the digital resource file, layer-by-layer encryption is carried out, and powerful copyright protection is provided for digital resources.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a digital resource copyright protection method, electronic equipment and system. Background Art

[0002] Smartphones, smart watches, tablets and other terminal devices are used more and more frequently in daily life, and users have more and more personalized needs for terminal devices. For example, users may need to set personalized themes, wallpapers, fonts, dials, etc. on terminal devices.

[0003] Designers of digital resources such as themes, wallpapers, fonts, and dials can upload their works (digital resources) to the server. Users of terminal devices can download digital resources such as themes, wallpapers, fonts, and dials from the server and use the downloaded digital resources on the terminal device to achieve personalized settings.

[0004] Generally speaking, the works of designers are protected by copyright and are not allowed to be used or disseminated at will. How to better protect the copyright of designer works (digital resources) is an issue that needs to be considered. Summary of the invention

[0005] The embodiments of the present application provide a digital resource copyright protection method, electronic device, and system, which can achieve more secure copyright protection of digital resources and prevent the copyright-protected digital resources from being used and disseminated at will.

[0006] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0007] In a first aspect, a digital resource copyright protection method is provided, which is applied to a server, and the method includes: the server obtains a first digital resource file from a developer platform; the server encrypts the first digital resource file with a first content key to obtain the encrypted first digital resource file; the server transmits the encrypted first digital resource file to a terminal device; the server receives a first request message from the terminal device; the first request message is used to request the application of the first digital resource file; the first request message includes a first content identifier and a first user identifier, the content identifier is used to uniquely identify the digital resource file, and the user identifier is used to uniquely identify the user; the server generates a first authorization certificate corresponding to the first user identifier; the server generates a first license corresponding to the first content identifier and the first user identifier; the first license includes a first content key encrypted with the first authorization certificate; the server sends the first license encrypted with a first transmission key to the terminal device; the first transmission key is obtained by negotiation between the server and the terminal device; the server sends the first authorization certificate encrypted with a second transmission key to the terminal device; the second transmission key is obtained by negotiation between the server and the terminal device, and the second transmission key is different from the first transmission key; the encrypted first authorization certificate is used by the terminal device to decrypt the first content key encrypted in the first license.

[0008] In this method, the digital resource file is encrypted with a content key, and the digital resource file corresponds to the content key one by one; the content key is encrypted with an authorization certificate (authorization key), and the authorization certificate corresponds to the user one by one; the transmission key is used to encrypt when transmitting the authorization certificate and the license, and the corresponding transmission key is dynamically generated for each transmission; the digital resource file is triple-protected, with encryption layer by layer, providing strong copyright protection for the digital resources.

[0009] In combination with the first aspect, in a possible implementation, the first content key includes the first content identifier and version number information of the first digital resource file.

[0010] The content key includes the content identification, version number and other information of the digital resource. On the one hand, the uniqueness of the content key can be achieved; it can prevent the content keys of multiple digital resource files from being the same. If the content key of a digital resource file is stolen, the content key can be used to decrypt other digital resource files; thus improving the security of digital resource copyright protection. On the other hand, after the terminal device obtains the content key, it can extract the file header according to the content key to obtain the content identification, version number and other information of the digital resource. The terminal device can compare the content identification, version number and other information in the content key with the content identification, version number and other information of the downloaded digital resource file to verify whether the downloaded digital resource file is correct and whether the content key corresponds to the digital resource file.

[0011] In combination with the first aspect, in a possible implementation, the first user identifier is a user identifier who has successfully applied for a trial or successfully purchased the first digital resource. In other words, the first user identifier is a user who is authorized by the server to use the first digital resource.

[0012] In combination with the first aspect, in a possible implementation, the first transmission key and the second transmission key are generated using an Elliptic Curve Diffie-Hellman Key Exchange (ECDH) algorithm.

[0013] The ECDH algorithm is an asymmetric encryption algorithm with high security. Using the ECDH algorithm to generate transmission keys can better ensure security.

[0014] In combination with the first aspect, in a possible implementation, the first authorization certificate includes an authorization public key and an authorization private key, and the first content key encrypted using the first authorization certificate is the first content key encrypted using the authorization public key.

[0015] In a second aspect, a digital resource copyright protection method is provided, which is applied to a terminal device, and the method includes: the terminal device obtains an encrypted first digital resource file from a server; in response to a first user's application operation on the first digital resource, the terminal device sends a first request message to the server; the first request message is used to request the application of the first digital resource file; the first request message includes a first content identifier and a first user identifier, the content identifier is used to uniquely identify the digital resource file, and the user identifier is used to uniquely identify the user; the terminal device obtains a first license encrypted with a first transmission key from the server; the first license corresponds to the first content identifier and the first user identifier, the first license includes a first content key encrypted with a first authorization certificate; the first content key is used to The first authorization certificate is encrypted by the terminal device, and the first authorization certificate is the authorization certificate corresponding to the first user identifier; the first transmission key is obtained by negotiation between the terminal device and the server; the terminal device obtains the first authorization certificate encrypted by the second transmission key from the server; the second transmission key is obtained by negotiation between the terminal device and the server, and the second transmission key is different from the first transmission key; the terminal device decrypts the encrypted first authorization certificate by the second transmission key to obtain the first authorization certificate; the terminal device decrypts the encrypted first license by the first transmission key to obtain the first license; the terminal device decrypts the encrypted first content key in the first license by the first authorization certificate to obtain the first content key; the terminal device decrypts the encrypted first digital resource file by the first content key to obtain the first digital resource file.

[0016] In this method, the digital resource file is encrypted with a content key, and the digital resource file corresponds to the content key one by one; the content key is encrypted with an authorization certificate (authorization key), and the authorization certificate corresponds to the user one by one; the transmission key is used to encrypt when transmitting the authorization certificate and the license, and the corresponding transmission key is dynamically generated for each transmission; the digital resource file is triple-protected, with encryption layer by layer, providing strong copyright protection for the digital resources.

[0017] In combination with the second aspect, in a possible implementation, the first content key includes the first content identifier and version number information of the first digital resource file.

[0018] The content key includes the content identification, version number and other information of the digital resource. On the one hand, the uniqueness of the content key can be achieved; it can prevent the content keys of multiple digital resource files from being the same. If the content key of a digital resource file is stolen, the content key can be used to decrypt other digital resource files; thus improving the security of digital resource copyright protection. On the other hand, after the terminal device obtains the content key, it can extract the file header according to the content key to obtain the content identification, version number and other information of the digital resource. The terminal device can compare the content identification, version number and other information in the content key with the content identification, version number and other information of the downloaded digital resource file to verify whether the downloaded digital resource file is correct and whether the content key corresponds to the digital resource file.

[0019] In conjunction with the second aspect, in a possible implementation, the first user identifier is a user identifier who has successfully applied for a trial or successfully purchased the first digital resource. In other words, the first user identifier is a user who is authorized by the server to use the first digital resource.

[0020] In combination with the second aspect, in a possible implementation, the first transmission key and the second transmission key are generated using an Elliptic Curve Diffie-Hellman Key Exchange (ECDH) algorithm.

[0021] The ECDH algorithm is an asymmetric encryption algorithm with high security. Using the ECDH algorithm to generate transmission keys can better ensure security.

[0022] In combination with the second aspect, in a possible implementation, the first authorization certificate includes an authorization public key and an authorization private key, and the first content key encrypted using the first authorization certificate is the first content key encrypted using the authorization public key.

[0023] The terminal device decrypting the first content key encrypted in the first license by using the first authorization certificate includes: the terminal device decrypting the first content key encrypted in the first license by using the authorization private key.

[0024] In combination with the second aspect, in a possible implementation, the method further includes: the terminal device storing the first content key and the first authorization certificate in a key store Keystore.

[0025] Key information such as content keys and authorization private keys are stored in the keystore of the terminal device. Due to the security of the keystore, the security of key information such as content keys and authorization private keys can be guaranteed. In addition, since key information such as content keys and authorization private keys are stored locally on the terminal device, even if the terminal device is offline, the content key and authorization private key can be obtained, and the digital resource file can be successfully decrypted and obtained to apply the digital resource. Even in the case of weak network or no network, users can switch to apply different digital resources on the terminal device, which enhances the user experience.

[0026] In a third aspect, an electronic device is provided, which has the function of implementing the method described in the first aspect or the second aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0027] In a fourth aspect, an electronic device is provided, comprising: a processor and a memory; the memory is used to store computer execution instructions, and when the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to perform a method as described in any one of the first or second aspects above.

[0028] In a fifth aspect, an electronic device is provided, comprising: a processor; the processor is used to couple with a memory, and after reading instructions in the memory, execute a method as described in any one of the first aspect or the second aspect according to the instructions.

[0029] In a sixth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer can execute any of the methods in the first aspect or the second aspect.

[0030] In a seventh aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute any of the methods in the first or second aspect.

[0031] In an eighth aspect, a device (for example, the device may be a chip system) is provided, the device including a processor for supporting an electronic device to implement the functions involved in the first aspect or the second aspect. In one possible design, the device also includes a memory for storing program instructions and data necessary for the electronic device. When the device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.

[0032] Among them, the technical effects brought about by any design method in the third aspect to the eighth aspect can refer to the technical effects brought about by different design methods in the first aspect or the second aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of a system architecture applicable to the digital resource copyright protection method provided in the embodiment of the present application;

[0034] Figure 2 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application;

[0035] Figure 3 A flowchart of a digital resource copyright protection method provided in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0038] Figure 6 A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0039] Figure 7 A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0040] Figure 8 A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0041] Fig. 9 A schematic diagram of a specific implementation method of a system architecture for implementing the digital resource copyright protection method provided in an embodiment of the present application;

[0042] Fig.10 A flowchart of a digital resource copyright protection method provided in an embodiment of the present application;

[0043] Fig.11A schematic diagram of a scenario example of a digital resource copyright protection method provided in an embodiment of the present application;

[0044] Fig.12 A flowchart of a digital resource copyright protection method provided in an embodiment of the present application;

[0045] Fig.13 A flowchart of a digital resource copyright protection method provided in an embodiment of the present application;

[0046] Fig.14 A flowchart of a digital resource copyright protection method provided in an embodiment of the present application;

[0047] Fig.15 An example diagram of a specific implementation of the license provided in the embodiment of the present application;

[0048] Fig.16 An example diagram of a specific implementation of the keystore provided in the embodiment of the present application;

[0049] Fig.17 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and the appended claims of the present application, the singular expressions "a", "said", "above", "the" and "this" are intended to also include such expressions as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the following embodiments of the present application, "at least one", "one or more" refer to one or more (including two). The term "and / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist; for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are a kind of "or" relationship.

[0051] References to "one embodiment" or "some embodiments" etc. described in this specification mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Thus, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. The term "connection" includes direct connection and indirect connection, unless otherwise specified. "First" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated.

[0052] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0053] The digital resource copyright protection method provided in the embodiment of the present application can be applied to Figure 1 The system architecture is shown in Figure 1. Figure 1 As shown, the system includes a terminal device 10 and a server 20. The terminal device 10 and the server 20 can communicate via a wired communication method or a wireless communication method.

[0054] The server 20 is also called a cloud-side server, which is responsible for storing, managing, and distributing digital resources. The designer or copyright owner of the digital resources can upload the digital resources to the cloud-side server. For example, the digital resources may include themes, wallpapers, ringtones, always on display (AOD), fonts, dials, and other resources.

[0055] The server 20 may be a single server, or may include multiple independent servers or server clusters. For example, the server 20 includes a content server for storing digital resources; a distribution server for distributing digital resources; a management server for managing digital resources, etc. For example, the management server may include a theme cloud server responsible for managing theme applications, an operation management platform responsible for reviewing digital resources, etc. Of course, in other implementations, different functions may be merged into fewer servers, or some servers may be split according to actual conditions.

[0056] The terminal device 10 can download digital resources from the server 20 and install the digital resources. Exemplarily, the server 20 stores theme resources. The terminal device 10 can download theme resources from the server 20 and install the theme resources, and update the theme of the terminal device 10 according to the theme resources. Exemplarily, the server 20 stores wallpaper resources. The terminal device 10 can download wallpaper resources from the server 20 and install the wallpaper resources, and update the wallpaper of the terminal device 10 according to the wallpaper resources.

[0057] The above-mentioned terminal device 10 may include a mobile phone, a tablet computer, a laptop computer, a personal computer (PC), an ultra-mobile personal computer (UMPC), a handheld computer, a netbook, a wearable device (such as a smart watch, a smart bracelet, etc.), a smart home device (such as a smart TV, a smart screen, a large screen, a smart speaker, etc.), a personal digital assistant (PDA), a vehicle-mounted device, etc., and the embodiments of the present application do not impose any restrictions on this.

[0058] It is understandable that some digital resources can be applicable to different types of terminal devices 10. For example, the same ringtone resource can be applicable to both mobile phones and tablet computers. Some digital resources are applicable to specific types of terminal devices 10. For example, wallpaper resources include mobile wallpapers for mobile phones, tablet wallpapers for tablet computers, folding screen wallpapers for folding screen mobile phones, etc. The terminal device 10 can download and apply the digital resources that are applicable to it.

[0059] For example, Figure 2 1 is a structural diagram of the above-mentioned terminal device 10. The terminal device 10 may include: a processor 11, an external memory interface 12, an internal memory 13, a universal serial bus (USB) interface 14, a charging management module 15, a power management module 151, a battery 152, an antenna 1, an antenna 2, a mobile communication module 16, a wireless communication module 17, an audio module 18, a speaker 18A, a receiver 18B, a microphone 18C, an earphone interface 18D, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195. The terminal device 10 may also include: a sensor module, a key module, etc., wherein the sensor module may include a temperature sensor, an ambient light sensor, a touch sensor, etc.; the key module may include a power button, a volume button, etc.

[0060] It is to be understood that the structure illustrated in this embodiment does not constitute a specific limitation on the terminal device 10. In other embodiments, the terminal device 10 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0061] The processor 11 may include one or more processing units, for example, the processor 11 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0062] The controller may be the nerve center and command center of the terminal device 10. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0063] The processor 11 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 11 is a cache memory. The memory may store instructions or data that the processor 11 has just used or cyclically used. If the processor 11 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 11, and thus improves the efficiency of the system.

[0064] In some embodiments, the processor 11 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0065] It is understandable that the interface connection relationship between the modules illustrated in this embodiment is only a schematic illustration and does not constitute a structural limitation on the terminal device. In other embodiments, the terminal device may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0066] The charging management module 15 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 15 may receive charging input from a wired charger through the USB interface 14. In some wireless charging embodiments, the charging management module 15 may receive wireless charging input through a wireless charging coil of the terminal device. While the charging management module 15 is charging the battery 152, it may also power the terminal device through the power management module 151.

[0067] The power management module 151 is used to connect the battery 152, the charging management module 15 and the processor 11. The power management module 151 receives input from the battery 152 and / or the charging management module 15, and supplies power to the processor 11, the internal memory 13, the external memory, the display screen 194, the camera 193, and the wireless communication module 17. The power management module 151 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 151 can also be set in the processor 11. In other embodiments, the power management module 151 and the charging management module 15 can also be set in the same device.

[0068] The wireless communication function of the terminal device 10 can be implemented through the antenna 1, the antenna 2, the mobile communication module 16, the wireless communication module 17, the modem processor and the baseband processor.

[0069] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in terminal device 10 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0070] The mobile communication module 16 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the terminal device 10. The mobile communication module 16 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 16 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 16 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 16 can be set in the processor 11. In some embodiments, at least some of the functional modules of the mobile communication module 16 can be set in the same device as at least some of the modules of the processor 11.

[0071] The modulation and demodulation processor may include a modulator and a demodulator, wherein the modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal, and the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal.

[0072] The wireless communication module 17 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the terminal device 10. The wireless communication module 17 can be one or more devices integrating at least one communication processing module. The wireless communication module 17 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering processing, and sends the processed signal to the processor 11. The wireless communication module 17 can also receive the signal to be sent from the processor 11, modulate the frequency of the signal, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0073] In some embodiments, the antenna 1 of the terminal device 10 is coupled to the mobile communication module 16, and the antenna 2 is coupled to the wireless communication module 17, so that the terminal device 10 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0074] The terminal device 10 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 11 may include one or more GPUs, which execute program instructions to generate or change display information.

[0075] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Mini-LED, Micro-OLED, Micro-OLED, quantum dot light-emitting diodes (QLED), etc.

[0076] The terminal device 10 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0077] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0078] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the terminal device may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0079] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the terminal device is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0080] Video codecs are used to compress or decompress digital videos. The terminal device 10 may support one or more video codecs. In this way, the terminal device can play or record videos in multiple coding formats, such as moving picture experts group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0081] The terminal device 10 can implement audio functions such as music playing and recording through the audio module 18, the speaker 18A, the receiver 18B, the microphone 18C, the headphone interface 18D, and the application processor.

[0082] The external memory interface 12 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device. The external memory card communicates with the processor 11 through the external memory interface 12 to implement a data storage function. For example, audio, video and other files are stored in the external memory card.

[0083] The internal memory 13 can be used to store computer executable program codes, which include instructions. The processor 11 executes various functional applications and data processing of the terminal device by running the instructions stored in the internal memory 13. For example, in an embodiment of the present application, the processor 11 can execute instructions stored in the internal memory 13, and the internal memory 13 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.). The data storage area can store data (such as video files) created during the use of the terminal device, etc. In addition, the internal memory 13 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0084] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. Indicator 192 can be an indicator light, which can be used to indicate the charging status, power changes, messages, missed calls, notifications, etc. SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the terminal device by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195. The terminal device can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. SIM card interface 195 can support Nano SIM card, Micro SIM card, SIM card, etc.

[0085] In the embodiment of the present application, the terminal device 10 is an electronic device that can run an operating system and install an App. Optionally, the operating system running on the terminal device 10 can be system, system, System, etc.

[0086] The digital resource copyright protection method provided by the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0087] The server is responsible for storing and distributing digital resources. After the terminal device downloads and installs the digital resources from the server, it can use the digital resources.

[0088] In some scenarios, it is necessary to perform copyright protection on digital resources to prevent them from being used and spread at will. Exemplarily, when the designer or copyright owner of the digital resource (collectively referred to as the developer in the embodiments of the present application) uploads the digital resource to the server, the digital resource can be set to be free or paid. If it is determined that the digital resource is set to be a paid digital resource, the paid digital resource is protected by copyright.

[0089] It should be noted that the embodiments of the present application are exemplified and described by copyright protection of paid digital resources. In other embodiments, the digital resource copyright protection method provided in the embodiments of the present application is also applicable to the scenario of copyright protection of free digital resources.

[0090] For example, Figure 3 A flow chart of a digital resource copyright protection method provided in an embodiment of the present application is shown.

[0091] like Figure 3 As shown, the method includes:

[0092] S1. The developer creates a new work on the management server through the developer platform. The management server returns the temporary authorized uniform resource locator (URL) of the work.

[0093] S2. The developer uploads the digital resource file to the content server using the URL through the developer platform. In this way, the digital resource file can be stored on the content server.

[0094] S3. The developer also submits the relevant information of the digital resource (eg, the authorization period, price, etc. of the digital resource) to the management server through the developer platform. Further, the developer submits the work to the management server through the developer platform.

[0095] S4. Upon receiving the work submission message, the management server pulls the digital resource file corresponding to the work from the content server, thereby obtaining the complete digital resource file and related information of the work.

[0096] For example, Figure 4 FIG. 1 shows a schematic diagram of a user interface for uploading digital resources in a developer platform. Figure 4 As shown, the user interface 401 of the developer platform is used to upload wallpaper resources. The user interface 401 includes a "mobile phone wallpaper" page 402, a "tablet wallpaper" page 403, and a "folding screen wallpaper" page 404; among which, the "mobile phone wallpaper" page 402 is used to upload wallpaper resources suitable for mobile phones, the "tablet wallpaper" page 403 is used to upload wallpaper resources suitable for tablet computers, and the "folding screen wallpaper" page 404 is used to upload wallpaper resources suitable for folding screen mobile phones.

[0097] refer to Figure 4 On the "Mobile Wallpaper" page 402, wallpaper resources uploaded by developers can be received; an interface for uploading copyright proof and setting payment can also be provided for developers. Developers can upload wallpaper resources and set wallpaper resource related information on the "Mobile Wallpaper" page 402.

[0098] Continue to refer Figure 3 In some embodiments, after the management server obtains the digital resource file and related information, if it is determined that the digital resource is a paid digital resource, S5 is executed.

[0099] S5. Encrypt the digital resource file using the content key, and transmit the encrypted digital resource file to the distribution server.

[0100] In one implementation, different content keys are used to encrypt different digital resources. That is, digital resources and content keys are in one-to-one correspondence. In this way, it can be avoided that after a user obtains the content key of a digital resource, the content key is used to decrypt another digital resource, thereby losing the copyright protection function of the digital resource.

[0101] Furthermore, the terminal device can obtain a file of a digital resource suitable for the terminal device from the server, install the digital resource file, and apply the digital resource. Exemplarily, the digital resource copyright protection method provided in the embodiment of the present application also includes:

[0102] S6. According to the user's download operation on a digital resource, the terminal device obtains a digital resource file from the distribution server. The digital resource file is a digital resource file encrypted with a content key.

[0103] For example, Figure 5As shown, the digital resource is a dial resource as an example. The mobile phone 10 displays a download interface 501, and the download interface 501 includes a "download" button 502. The user can click the "download" button 502 to download the "sunny mood" dial resource. Exemplarily, in response to the user's click operation on the "download" button 502, the mobile phone 10 downloads the "sunny mood" dial resource file from the distribution server. The "sunny mood" dial resource file obtained by the mobile phone 10 is a digital resource file encrypted with a content key. In this example, the mobile phone 10 receives the user's click operation on the "download" button 502, that is, receives the user's download operation on the digital resource.

[0104] It is understandable that in some implementations, a digital resource can be purchased first and then the digital resource file can be downloaded. In other implementations, the digital resource file can be downloaded directly. If it is a free digital resource, the directly downloaded digital resource file is unencrypted and can be directly installed and applied; if it is a paid digital resource, it is necessary to obtain a content key, use the content key to decrypt the encrypted digital resource file, obtain the unencrypted digital resource file, and then install and apply it.

[0105] S7. If the terminal device receives a user's trial operation for a digital resource, the terminal device applies to the management server for a trial of the digital resource. Alternatively, if the terminal device receives a user's purchase operation for a digital resource, the terminal device purchases the digital resource from the management server.

[0106] For example, Figure 6 As shown, the digital resource is a dial resource as an example. The mobile phone 10 displays a purchase interface 601, and the purchase interface 601 displays the pattern, style, name, price, designer, size and other information of the dial resource "Sunny Mood". Exemplarily, the purchase interface 601 includes a "Buy" button 602. The user can click the "Buy" button 602 to purchase the "Sunny Mood" dial resource. Exemplarily, in response to the user's click operation on the "Buy" button 602, the mobile phone 10 displays a "Pay" page 603, and the "Pay" page 603 is used to receive the user's payment operation. After determining that the user has successfully paid, the dial resource is successfully purchased. In this example, the mobile phone 10 receives the user's click operation on the "Buy" button 602, that is, receives the user's purchase operation on the digital resource.

[0107] For example, Figure 7As shown, the digital resource is a theme resource as an example. The mobile phone 10 displays a purchase interface 604, which displays the pattern, style, name, price, designer, size and other information of the theme resource. Exemplarily, the purchase interface 604 includes a "buy" button 605 and a "try" button 606. The user can click the "buy" button 605 to purchase the theme resource; the user can click the "try" button 606 to try the theme resource. Exemplarily, in response to the user's click operation on the "buy" button 605, the mobile phone 10 displays a "payment" page 607, and the "payment" page 607 is used to receive the user's payment operation. After determining that the user has successfully paid, the theme resource is successfully purchased. In this example, the mobile phone 10 receives the user's click operation on the "buy" button 605, that is, receives the user's purchase operation on the digital resource; the mobile phone 10 receives the user's click operation on the "try" button 606, that is, receives the user's trial operation on the digital resource.

[0108] In one implementation, the theme application is used to obtain theme resources on the terminal device, and the theme application is integrated on the terminal device in the form of a software development kit (SDK). The watch dial market is used to obtain dial resources on the terminal device, and the watch dial market is integrated on the terminal device in the form of a web page. It should be noted that the digital resource copyright protection method provided in the embodiment of the present application can be applied to the digital resource copyright protection method provided in the embodiment of the present application when the digital resource is obtained on the terminal device side in the form of an SDK, a web page or other forms.

[0109] S8. The management server issues a license to the terminal device.

[0110] In some embodiments, for example, for paid digital resources, the distribution server sends to the terminal device a digital resource file encrypted with a content key. The terminal device needs to decrypt with the corresponding content key to obtain the unencrypted digital resource file and then use the digital resource.

[0111] For paid digital resources, after the terminal device successfully applies for trial or purchases the digital resource, the user can perform an operation of applying the digital resource on the terminal device. In one implementation, in response to the user's operation of applying a digital resource, the terminal device requests the management server to obtain the content key of the digital resource.

[0112] For example, Figure 8As shown, taking the digital resource as a dial resource as an example. Mobile phone 10 displays an application interface 801, and application interface 801 is used to start applying the dial resource "Sunny Mood". Application interface 801 includes an "Apply" button 802. The user can click the "Apply" button 802 to install the dial resource "Sunny Mood" to the watch, that is, to make the watch apply the dial resource "Sunny Mood". In this example, the terminal device receives the user's click operation on the "Apply" button 802, that is, receives the user's operation to apply the dial resource (digital resource). In one implementation, during the process of installing the dial resource on the watch, the terminal device reads the installation progress of the watch in real time, and displays the installation progress of the watch in the application interface 801. Exemplarily, as Figure 8 As shown, the text on the "Apply" button 802 displays the progress of the watch dial resource installation in real time.

[0113] In one implementation, after receiving the request from the terminal device, the management server issues a license to the terminal device.

[0114] S9. The terminal device obtains the content key according to the license, and uses the content key to decrypt the encrypted digital resource file to obtain the unencrypted digital resource file.

[0115] The terminal device can obtain the content key according to the license.

[0116] In one implementation, the license includes a content key encrypted with an authorization certificate. After the terminal device obtains the license, it can read the content key encrypted with the authorization certificate from the license. The terminal device needs to obtain the authorization certificate to decrypt the encrypted content key and obtain the unencrypted content key.

[0117] In one implementation, the management server allocates an authorization certificate to each user account that has purchased the digital resource, that is, the authorization certificate corresponds to the user account one by one.

[0118] In summary, the license contains the content key encrypted with the authorization certificate. The content key corresponds to the digital resource one-to-one, and the authorization certificate corresponds to the user account one-to-one; that is, for each digital resource, each user account that purchased the digital resource corresponds to a license.

[0119] Since the authorization voucher is associated with the user account, rather than being bound to the hardware of the terminal device, it is possible to purchase once and use it everywhere. In other words, after a user purchases a digital resource using one user account, the digital resource can be used on different terminal devices that log in to the same user account.

[0120] Exemplarily, user account 1 is logged in on mobile phone 1, and theme 1 (theme resource) is purchased using user account 1. Theme 1 corresponds to content key 1, and user account 1 corresponds to authorization voucher 1; the management server allocates license 1 according to content key 1 and user account 1 (authorization voucher 1). Afterwards, user account 1 is logged in on mobile phone 2, and mobile phone 2 downloads theme 1 encrypted with content key 1 from the distribution server. Mobile phone 2 can also obtain license 1 and authorization voucher 1 from the management server through user account 1. In this way, mobile phone 2 uses authorization voucher 1 to decrypt content key 1 encrypted in license 1 and obtain content key 1. Mobile phone 2 can then use content key 1 to decrypt encrypted theme 1 and obtain unencrypted theme 1.

[0121] The digital resource copyright protection method provided in the embodiment of the present application uses an authorization certificate corresponding to user information (user account) to encrypt the content key used to encrypt the digital resource. What the server sends to the terminal device is not the content key, but a license, which carries the content key encrypted with the authorization certificate. For unauthorized users (user accounts that are not assigned authorization certificates), since they have not obtained the authorization certificate, even if they obtain the encrypted digital resource file and license, they cannot be successfully decrypted; the security of the content key is improved, the probability of the content key being stolen is reduced, and a safer copyright protection for digital resources is achieved. In addition, the authorization certificate is bound to the user account, the user account that has purchased the digital resource can obtain the authorization certificate, and the user account that has not purchased the digital resource cannot obtain the authorization certificate; for the user account that has purchased the digital resource, the authorization certificate can be used on different terminal devices, so that one-time purchase can be used everywhere; the rights and interests of the purchasing user are protected.

[0122] In some embodiments, when the management server sends the license and authorization certificate to the terminal device, the transmission key is used to encrypt the transmission content (license or authorization certificate). A transmission key is dynamically assigned for each transmission, which reduces the risk of the transmission content (license or authorization certificate) being stolen, improves the security of the license and authorization certificate transmission process, and further improves the security of the content key.

[0123] For example, Fig. 9 A specific implementation method of a system architecture for implementing the digital resource copyright protection method provided in an embodiment of the present application is shown.

[0124] exist Fig. 9 In the example shown, the digital resource is a theme resource or a dial resource, and accordingly, the management server is a theme cloud server. It is understandable that if the digital resource is other resources, such as ringtones, AOD, etc., the management server can be a server that provides corresponding services.

[0125] like Fig. 9As shown, the system architecture includes a developer platform, a server 20, and a terminal device 10. The server 20 includes a content server, a distribution server, and a theme cloud server, and the terminal device 10 uses (downloads, installs) theme resources (referred to as theme clients in this embodiment).

[0126] The developer platform is used to provide developers with a platform for generating digital resources (such as theme resources). After the developer generates digital resource (such as theme resource) files through the developer platform, the digital resource files are uploaded to the content server. The theme cloud server is used to manage digital resources. In one example, the theme service of the theme cloud server pulls the digital resource files from the content server and encrypts the digital resource files through the digital rights management (DRM) service. The DRM service calls the key management service to generate a key (for generating a content key), and the DRM service can also query the key management service for the key. In this way, the DRM service can use the content key to encrypt the digital resource file. After encrypting the digital resource file, the theme service transmits the encrypted digital resource file to the distribution server for distribution and storage. In one implementation, the theme service saves the content key corresponding to each digital resource file.

[0127] The theme client can query the theme cloud server for applicable digital resources, and can also apply for trial or purchase of digital resources from the theme cloud server. If the application for trial or purchase of digital resources is successful, the theme cloud server authorizes the user account that logs in to the theme client. In one example, the theme service calls the DRM service to authorize the user account. The DRM service calls the key management service to generate a key (for generating an authorization certificate), and the DRM service calls the authorization center module to generate a license. The DRM service can also query the authorization center module for the license. After the theme cloud server generates the authorization certificate and license, the theme client (through the DRM agent) can obtain the authorization certificate and license from the theme service. In this way, after the theme client downloads the encrypted digital resource file from the distribution server, it can use the authorization certificate to decrypt the encrypted content key in the license, obtain the content key, and use the content key to decrypt the encrypted digital resource file to obtain the unencrypted digital resource file.

[0128] Optionally, the server 20 also includes an operation management platform for auditing digital resources. For example, the operation management platform can perform resource management (security audit) on digital resource files, such as auditing whether the digital resource files include unauthorized content. For example, the operation management platform can perform order management on digital resource files, such as ranking digital resources according to the number of downloads of digital resource files.

[0129] Next, combine Fig. 9The specific architecture shown is used to introduce in detail the implementation process of the digital resource copyright protection method provided in the embodiment of the present application.

[0130] Developers can upload digital resource files and digital resource related information through the developer platform. The management server encrypts the digital resource files and performs the first level of copyright protection on the digital resources. For example, Fig.10 As shown, the digital resource copyright protection method provided in the embodiment of the present application may include:

[0131] S1001. The developer platform uploads digital resource files to the content server.

[0132] According to the developer's upload operation, the developer platform uploads digital resource files to the content server. The digital resource files may include theme resource files, wallpaper resource files, ringtone resource files, always on display (AOD) resource files, font resource files, dial resource files, etc.

[0133] S1002. The content server returns confirmation information to the developer platform.

[0134] After receiving the digital resource file, the content server returns confirmation information to the developer platform.

[0135] S1003. The developer platform sends digital resource related information to the theme service.

[0136] After receiving the confirmation information, the developer platform sends the digital resource related information to the theme service based on the digital resource related information submitted by the developer.

[0137] Exemplarily, the digital resource related information includes source, authorization period, price, introduction, etc.

[0138] S1004: The theme service creates digital resource content information based on the received digital resource related information.

[0139] The digital resource content information includes content identification, price, source, authorization period, introduction, etc. Among them, the content identification is used to uniquely identify a digital resource.

[0140] S1005. The theme service notifies the developer that the platform digital resource has been successfully created.

[0141] After the digital resource content information is successfully created, the theme service notifies the developer platform that the digital resource has been successfully created.

[0142] S1006: The theme service requests the content server to obtain the digital resource file.

[0143] The theme service requests the content server to obtain the digital resource file according to the digital resource content information.

[0144] S1007. The content server transmits the digital resource file to the theme service.

[0145] S1008. The subject service performs security audits on digital resources.

[0146] Optionally, the theme service calls the operation management platform to conduct a security audit on the digital resources, for example, to audit whether the digital resource file includes unauthorized content; for example, to audit whether the developer owns the copyright of the digital resource.

[0147] S1009. The theme service calls the DRM service to encrypt the digital resource file.

[0148] In some embodiments, if the theme service determines that the digital resource is paid (for example, the price value in the digital resource content information is greater than 0), the digital resource file is encrypted.

[0149] In one example, the steps may include:

[0150] S10091. The theme service calls the DRM service to encapsulate the digital resource file.

[0151] S10092. The DRM service notifies the key management service to generate an encryption key.

[0152] S10093. The key management service generates an encryption key.

[0153] In one implementation, the key management service uses an advanced encryption standard (AES) algorithm to generate encryption keys.

[0154] S10094. The key management service returns the encryption key to the DRM service.

[0155] S10095. The DRM service generates a content key based on the encryption key.

[0156] In one implementation, the DRM service adds a file header before the encryption key to generate a content key; the file header includes the content identifier, version number, etc. of the digital resource. In this case, the content key includes the content identifier, version number and encryption key of the digital resource; the content key corresponds to the digital resource file one by one.

[0157] For example, Fig.11 As shown, the DRM service generates content key 1 for digital resource 1, generates content key 2 for digital resource 2, generates content key 3 for digital resource 3, and ... generates content key n for digital resource n.

[0158] The content key includes the content identification, version number and other information of the digital resource. On the one hand, the uniqueness of the content key can be achieved; it can prevent the content keys of multiple digital resource files from being the same. If the content key of a digital resource file is stolen, the content key can be used to decrypt other digital resource files; thus improving the security of digital resource copyright protection. On the other hand, after the terminal device obtains the content key, it can extract the file header according to the content key to obtain the content identification, version number and other information of the digital resource. The terminal device can compare the content identification, version number and other information in the content key with the content identification, version number and other information of the downloaded digital resource file to verify whether the downloaded digital resource file is correct and whether the content key corresponds to the digital resource file.

[0159] S10096. The DRM service returns the content key to the theme service.

[0160] S10097. The theme service uses the content key to encrypt the digital resource file.

[0161] S1010. The theme service transmits the encrypted digital resource file to the distribution server.

[0162] S1011. The distribution server returns confirmation information to the theme service.

[0163] S1012. The theme service updates the content information of the digital resource.

[0164] For example, the subject service updates the status of the digital resource to encrypted and distributed.

[0165] In this implementation, the theme service uses the content key to encrypt the digital resource file and transmits the encrypted digital resource file to the distribution server. Furthermore, the terminal device downloads the encrypted digital resource file from the distribution server and cannot obtain the unencrypted digital resource file at will, thus achieving the first level of protection for the digital resource.

[0166] Combination Fig.10 ,refer to Fig.12 The digital resource copyright protection method provided in the embodiment of the present application may also include:

[0167] S1101. The theme client requests the theme service to apply for trial or purchase of digital resources. The trial or purchase request message includes the content identifier and user identifier of the digital resource.

[0168] The content identifier is used to uniquely identify a digital resource; the user identifier is used to uniquely identify a user, for example, the user identifier is a user account.

[0169] S1102: The theme service executes the process of applying for trial or purchasing digital resources.

[0170] In one implementation, the theme service records the user ID (user account) that successfully applies for a trial or purchases a digital resource, and the user ID (user account) that successfully applies for a trial or purchases a digital resource is the authorized user ID (user account).

[0171] S1103: The theme client requests the theme service to apply the digital resource. The application request message includes the content identifier and user identifier of the digital resource.

[0172] In some embodiments, after receiving a user's application operation on a digital resource, the theme client requests the theme service to apply the digital resource. Figure 8 As shown, the application interface 801 includes an "Apply" button 802. The terminal device (theme client) receives the user's click operation on the "Apply" button 802, that is, receives the user's operation of applying the dial resource (digital resource), that is, receives the user's application operation on a digital resource.

[0173] S1104: The theme service determines whether the user ID is an authorized user ID based on the content ID and the user ID.

[0174] If it is an unauthorized user ID, the theme service returns a failure to the theme client. If it is an authorized user ID, continue to execute S1105.

[0175] S1105. The theme service calls the DRM service to authorize the user ID.

[0176] In one implementation, the authorization type is carried therein; for example, the authorization type includes permanent authorization, temporary authorization, term authorization (such as authorization for one month), and the like.

[0177] S1106: The DRM service determines whether there is an authorization certificate for the user ID.

[0178] The authorization credential and the user identification (eg, user account) correspond one to one. If the user identification has been assigned an authorization credential in a previous process (eg, when applying other digital resources, or when applying the digital resource before), a corresponding authorization credential exists.

[0179] If the user ID does not have an authorization certificate, execute S1107, S1108, and then execute S1109; if the user ID has an authorization certificate, directly execute S1109. The DRM service generates an authorization certificate for each user ID, and the user ID can be used to log in to different terminal devices.

[0180] The authorization credential and the user identifier (such as a user account) correspond one to one. For example, Fig.11 As shown, the DRM service generates authorization certificate 1 for user account 1, generates authorization certificate 2 for user account 2, generates authorization certificate 3 for user account 3, ... generates authorization certificate m for user account m.

[0181] S1107. The DRM service notifies the key management service to generate an authorization certificate corresponding to the user identifier.

[0182] S1108. The key management service generates an authorization certificate corresponding to the user identifier.

[0183] In one implementation, the key management service generates a set of asymmetric authorized public and private keys for the user identity.

[0184] S1109: The key management service returns the authorization certificate corresponding to the user identifier to the DRM service.

[0185] S1110. The DRM service notifies the authorization center module to generate a license, which carries a content identifier, a user identifier, an authorization certificate, and the like.

[0186] In one implementation, the authorization certificate is a set of asymmetric authorization public and private keys, and the DRM service sends the authorization public key to the authorization center module.

[0187] S1111. The authorization center module generates a license.

[0188] In one implementation, the authorization center module generates a license based on information such as content identification, user identification, authorization credentials, etc. In one example, the license includes content identification, user identification, and a content key encrypted by an authorization public key.

[0189] The content identifier corresponds to the digital resource one by one, the authorization public key corresponds to the user identifier one by one, and the content identifier (content key) and the user identifier (authorization public key) uniquely determine a license. Fig.11As shown, user account 1 purchased digital resource 1, and the license allocated to user account 1 by the DRM service includes digital resource 1, user account 1, and content key 1 encrypted by authorization public key 1; user account 1 purchased digital resource 2, and the license allocated to user account 1 by the DRM service includes digital resource 2, user account 1, and content key 2 encrypted by authorization public key 1; user account 1 purchased digital resource n, and the license allocated to user account 1 by the DRM service includes digital resource n, user account 1, and content key n encrypted by authorization public key 1. User account 2 purchased digital resource 1, and the license allocated to user account 2 by the DRM service includes digital resource 1, user account 2, and content key 1 encrypted by authorization public key 2. User account 3 purchased digital resource 1, and the license allocated to user account 3 by the DRM service includes digital resource 1, user account 3, and content key 1 encrypted by authorization public key 3.

[0190] S1112. The authorization center module returns the license generation result to the DRM service.

[0191] For example, the license generation results include success or failure.

[0192] S1113. The DRM service returns the authorization result to the theme service.

[0193] The authorization result includes success or failure.

[0194] S1114. The theme service returns the execution result to the theme client.

[0195] The execution results include success or failure.

[0196] The management server generates a corresponding license for a combination of a digital resource and a user ID. The subject client uses the authorization certificate to decrypt the license and obtain the content key corresponding to the digital resource.

[0197] Furthermore, the digital resource copyright protection method provided in the embodiment of the present application also includes:

[0198] S1115. The theme client calls the DRM agent to synchronize the authorization certificate.

[0199] S1116. The DRM agent determines whether there is an authorization certificate locally.

[0200] If the theme client has not obtained the authorization certificate from the management server, then the authorization certificate does not exist locally. For example, if the current user ID uses the digital resource for the first time after logging into the theme client and has not obtained the authorization certificate from the management server, then the authorization certificate does not exist locally.

[0201] If it is determined that the authorization certificate does not exist locally, execute S1117-S1121; if it is determined that the authorization certificate exists locally, execute S1121.

[0202] S1117. The DRM agent generates a temporary public and private key pair on the terminal side.

[0203] S1118. The DRM agent carries the temporary public key on the client side and requests the DRM service to obtain the authorization certificate.

[0204] S1119, the DRM service generates a temporary public-private key pair on the cloud side; the DRM service negotiates with the DRM agent to generate a transmission key. The DRM service carries the temporary public key on the cloud side and returns an authorization certificate encrypted with the transmission key to the DRM agent.

[0205] In one implementation, the DRM service and the DRM agent use the elliptic curve Diffie-Hellman key exchange (ECDH) algorithm to generate a transmission key. The ECDH algorithm is an asymmetric encryption algorithm with high security. Using the ECDH algorithm to generate a transmission key can better ensure security.

[0206] Exemplarily, the DRM service uses a temporary private key on the cloud side and a temporary public key on the terminal side, and adopts an ECDH algorithm to negotiate and generate a transmission key.

[0207] After the DRM agent obtains the temporary public key on the cloud side, it uses the temporary private key on the client side and the temporary public key on the cloud side to negotiate and generate the transmission key using the ECDH algorithm.

[0208] In this way, the DRM service and the DRM agent generate the same transmission key.

[0209] The DRM service returns the authorization certificate encrypted with the transmission key to the DRM agent. The corresponding transmission key is generated during each transmission process, which can prevent the authorization certificate from being stolen and improve the security of authorization certificate transmission.

[0210] In one example, authorization credential=user identification+authorization private key.

[0211] S1120. The DRM agent uses the transmission key to decrypt and verify the authorization certificate to obtain the authorization certificate.

[0212] In one implementation, the DRM agent stores the authorization private key in the authorization certificate in a keystore. Keystore is a secure storage space provided by the operating system (such as Android), which reduces the chance of the authorization private key being stolen and increases the security of the authorization certificate.

[0213] S1121. The DRM agent returns the authorization certificate to the subject client.

[0214] For free digital resources, or digital resources that have been successfully applied for trial or purchased, the theme client can download the digital resource files from the distribution server.

[0215] Exemplary, reference Fig.13 The digital resource copyright protection method provided in the embodiment of the present application may also include:

[0216] S1201. The theme client requests the distribution server to download a digital resource.

[0217] S1202: The distribution server returns the digital resource file to the subject client.

[0218] In some embodiments, if the application for trial or purchase of digital resources has been successful, the distribution server returns an encrypted digital resource file to the subject client. The subject client needs to decrypt the encrypted digital resource file to obtain the unencrypted digital resource file.

[0219] Further, combined with Fig.10 , Fig.12 and Fig.13 ,refer to Fig.14 The digital resource copyright protection method provided in the embodiment of the present application may also include:

[0220] S1301. The theme client calls the DRM agent to decrypt the encrypted digital resource file.

[0221] In some embodiments, after receiving a user's application operation on a digital resource, the theme client needs to obtain an unencrypted digital resource file in order to install the digital resource file. Figure 8 As shown, the application interface 801 includes an "Apply" button 802. The terminal device (theme client) receives the user's click operation on the "Apply" button 802, that is, receives the user's operation of applying the dial resource (digital resource), that is, receives the user's application operation on a digital resource.

[0222] The theme client obtains the digital resource file encrypted with the content key from the distribution server. The encrypted digital resource file can only be decrypted after obtaining the content key.

[0223] In some embodiments, the subject client obtains a license from a management server. The license carries a content key encrypted with an authorization certificate. The subject client decrypts the encrypted content key in the license according to the authorization certificate to obtain the content key, thereby obtaining an unencrypted digital resource file.

[0224] S1302: The DRM agent determines whether the digital resource file and the license corresponding to the user currently logged in to the theme client exist locally.

[0225] The content identifier is used to uniquely identify a digital resource file, and the user identifier is used to uniquely identify a user. The DRM agent can determine whether the digital resource file and the license corresponding to the user currently logged in to the subject client exist locally based on the content identifier and the user identifier.

[0226] If the license corresponding to the digital resource file does not exist locally, execute S1303-S1311; if the license corresponding to the digital resource file exists locally, directly execute S1310-S1311.

[0227] S1303: The DRM agent generates a temporary public and private key pair on the terminal side.

[0228] S1304: The DRM agent carries the content identifier, user identifier, and the temporary public key on the terminal side and requests the DRM service to obtain a license.

[0229] S1305. The DRM service carries the content identifier and the user identifier and searches the authorization center module for a license.

[0230] S1306: The authorization center module returns the license corresponding to the content identifier and the user identifier to the DRM service.

[0231] S1307, the DRM service generates a temporary public-private key pair on the cloud side; the DRM service negotiates with the DRM agent to generate a transmission key. The DRM service carries the temporary public key on the cloud side and returns the license encrypted with the transmission key to the DRM agent.

[0232] In one implementation, the ECDH algorithm is used between the DRM service and the DRM agent to generate a transmission key. Exemplarily, the DRM service uses the cloud-side temporary private key and the end-side temporary public key to negotiate and generate the transmission key using the ECDH algorithm. After the DRM agent obtains the cloud-side temporary public key, it uses the end-side temporary private key and the cloud-side temporary public key to negotiate and generate the transmission key using the ECDH algorithm. In this way, the DRM service and the DRM agent generate the same transmission key.

[0233] The DRM service returns the license encrypted with the transmission key to the DRM agent. The corresponding transmission key is generated during each transmission process, which can prevent the license from being stolen and improve the security of license transmission.

[0234] In one implementation, the license includes a content identifier, a user identifier, and a content key encrypted using an authorization certificate.

[0235] S1308, the DRM agent uses the transmission key to decrypt the encrypted license and verifies the license to obtain the license. The DRM agent uses the authorization certificate (authorization private key) to decrypt the content key in the license encrypted by the authorization certificate to obtain the content key.

[0236] S1309. The DRM agent saves the content key.

[0237] In one implementation, for a successful purchase of a digital resource, the DRM agent stores the content key in a keystore. Keystore is a secure storage space provided by an operating system (such as Android), which reduces the chance of content keys being stolen and increases the security of content keys. The DRM agent can also record the licensing information of the digital resource, such as the authorization period.

[0238] S1310. The DRM agent uses the content key to decrypt the encrypted digital resource file to obtain an unencrypted digital resource file.

[0239] S1311. The DRM agent returns the unencrypted digital resource file to the theme client.

[0240] In one implementation, after the subject client obtains the digital resource file, it can compare the content identifier, version number and other information in the content key with the content identifier, version number and other information of the digital resource file to verify the accuracy and completeness of the obtained digital resource file.

[0241] If the digital resource file passes the verification, the theme client can install the digital resource file and apply the digital resource.

[0242] For example, Fig.15 An example of a specific implementation of the license provided in the embodiment of the present application is shown.

[0243] like Fig.15 As shown, the license includes a license index, content identifier, user identifier, content key information, content key usage rules, transmission key, digital signature, etc. Among them, the license index is used to uniquely identify a license; the content key information includes information such as key type, encryption algorithm, encrypted content key, etc.; the content key usage rules are used to specify the usage rules of the content key information, for example, the content key usage rules include key index, effective time, expiration time, time period, effective times, etc. The digital signature is used to authenticate the license information. For example, the hashed message authentication code (HMAC) can be calculated for the license index, content identifier, user identifier, content key information, content key usage rules, transmission key, etc. to obtain a digital signature.

[0244] For example, Fig.16 An example of a specific implementation method of the keystore provided in an embodiment of the present application is shown.

[0245] Referring to 16, in the embodiment of the present application, the terminal device stores key information such as the content key, the authorization certificate (authorization private key) in a keystore, for example, Fig.16 The Android Keystore is shown in the figure. The Android Keystore is a secure storage space with features such as secure import, protection against extraction, authorized use, and support for multiple encryption algorithms, which can ensure that the Android Keystore is not stolen.

[0246] Exemplarily, Table 1 shows a storage solution of a terminal device.

[0247] Table 1

[0248] information Data Source Storage Solutions Remark Content Key license Android Keystore Authorized private key Authorization Credentials Android Keystore Authorization attributes license Encrypted using authorized public key and stored locally Authorization type, deadline, etc.

[0249] Key information such as content keys and authorization private keys are stored in the keystore of the terminal device. Due to the security of the keystore, the security of key information such as content keys and authorization private keys can be guaranteed. In addition, since key information such as content keys and authorization private keys are stored locally on the terminal device, even if the terminal device is offline, the content key and authorization private key can be obtained, and the digital resource file can be successfully decrypted and obtained to apply the digital resource. Even in the case of weak network or no network, users can switch to apply different digital resources on the terminal device, which enhances the user experience.

[0250] The digital resource copyright protection method provided in the embodiment of the present application uses a content key to encrypt a digital resource file, and the digital resource file corresponds to the content key one by one; uses an authorization certificate (authorization key) to encrypt the content key, and the authorization certificate corresponds to the user one by one; uses a transmission key to encrypt when transmitting the authorization certificate and the license, and dynamically generates a corresponding transmission key for each transmission, and uses the ECDH algorithm to generate the transmission key; the digital resource file is triple-protected and encrypted layer by layer, providing strong copyright protection for the digital resources.

[0251] It is understandable that the terminal device and management server provided in the embodiment of the present application include hardware structures and / or software modules corresponding to the execution of each function in order to realize the above functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiment of the present application.

[0252] The embodiment of the present application can divide the functional modules of the terminal device and the management server according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0253] In one example, see Fig.17 , which shows a possible structural diagram of the terminal device or management server involved in the above embodiment. The electronic device 1700 includes: a processing unit 1710, a storage unit 1720 and a communication unit 1730.

[0254] The processing unit 1710 is used to control and manage the actions of the electronic device 1700. The storage unit 1720 is used to store program codes and data of the electronic device 1700. The communication unit 1730 is used to support the electronic device 1700 to communicate with other devices.

[0255] Of course, the unit modules in the above-mentioned electronic device 1700 include but are not limited to the above-mentioned processing unit 1710, storage unit 1720 and communication unit 1730.

[0256] Optionally, the electronic device 1700 may further include an image acquisition unit, and the image acquisition unit is used to acquire images.

[0257] Optionally, the electronic device 1700 may also include an audio unit, which is used to collect audio, play audio, etc.

[0258] Among them, the processing unit 1710 can be a processor or a controller, for example, a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The storage unit 1720 can be a memory. The communication unit 1730 can include a mobile communication unit and / or a wireless communication unit. The image acquisition unit can be a camera, etc. The audio unit can include a microphone, a speaker, etc.

[0259] For example, the processing unit 1710 is a processor (such as Figure 2 The processor 11 shown in FIG. 17 ), the storage unit 1720 may be a memory (eg, Figure 2 The internal memory 13 shown in FIG. 17 ), the communication unit 1730 may include a mobile communication unit (such as Figure 3 The mobile communication module 16 shown) and the wireless communication unit (such as Figure 3 The wireless communication module 17 shown in the figure). The above-mentioned processor, memory, mobile communication unit, wireless communication unit, etc. can be connected together, for example, through a bus.

[0260] The embodiment of the present application also provides a chip system, which includes at least one processor and at least one interface circuit. The processor and the interface circuit can be interconnected by lines. For example, the interface circuit can be used to receive signals from other devices (such as a memory of a terminal device). For another example, the interface circuit can be used to send signals to other devices (such as a processor). Exemplarily, the interface circuit can read instructions stored in the memory and send the instructions to the processor. When the instructions are executed by the processor, the terminal device can execute the various steps in the above embodiments. Of course, the chip system can also include other discrete devices, which are not specifically limited in the embodiment of the present application.

[0261] An embodiment of the present application also provides a computer-readable storage medium, which includes computer instructions. When the computer instructions are executed on the above-mentioned electronic device, the electronic device executes each function or step executed by the mobile phone in the above-mentioned method embodiment.

[0262] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute each function or step executed by the mobile phone in the above method embodiment.

[0263] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0264] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0265] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0266] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0267] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0268] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A digital resource copyright protection method, applied to a server, characterized in that: The method comprises: The server obtains a first digital resource file from a developer platform; The server encrypts the first digital resource file using the first content key to obtain the encrypted first digital resource file; The server transmits the encrypted first digital resource file to the terminal device; The server receives a first request message from the terminal device; the first request message is used to request application of the first digital resource file; the first request message includes a first content identifier and a first user identifier, the content identifier is used to uniquely identify the digital resource file, and the user identifier is used to uniquely identify the user; The server generates a first authorization credential corresponding to the first user identifier; The server generates a first license corresponding to the first content identifier and the first user identifier; the first license includes a first content key encrypted by the first authorization certificate; The server sends a first license encrypted with a first transmission key to the terminal device; the first transmission key is obtained through negotiation between the server and the terminal device; The server sends a first authorization certificate encrypted with a second transmission key to the terminal device; the second transmission key is obtained by negotiation between the server and the terminal device, and the second transmission key is different from the first transmission key; the encrypted first authorization certificate is used by the terminal device to decrypt the first content key encrypted in the first license.

2. The method according to claim 1, characterized in that The first content key includes the first content identifier and version number information of the first digital resource file.

3. The method according to claim 1 or 2, characterized in that: The first user ID is a user ID that has successfully applied for a trial or successfully purchased the first digital resource.

4. The method according to any one of claims 1 to 3, characterized in that: The first transmission key and the second transmission key are generated using an elliptic curve Diffie-Hellman key exchange ECDH algorithm.

5. The method according to any one of claims 1 to 4, characterized in that: The first authorization certificate includes an authorization public key and an authorization private key, and the first content key encrypted by using the first authorization certificate is the first content key encrypted by using the authorization public key.

6. A digital resource copyright protection method, applied to a terminal device, characterized in that: The method comprises: The terminal device obtains the encrypted first digital resource file from the server; In response to the first user's application operation on the first digital resource, the terminal device sends a first request message to the server; the first request message is used to request the application of the first digital resource file; the first request message includes a first content identifier and a first user identifier, the content identifier is used to uniquely identify the digital resource file, and the user identifier is used to uniquely identify the user; The terminal device obtains a first license encrypted with a first transmission key from the server; the first license corresponds to the first content identifier and the first user identifier, and the first license includes a first content key encrypted with a first authorization certificate; the first content key is used to encrypt the first digital resource file, and the first authorization certificate is an authorization certificate corresponding to the first user identifier; the first transmission key is obtained by negotiation between the terminal device and the server; The terminal device obtains, from the server, a first authorization certificate encrypted with a second transmission key; the second transmission key is obtained through negotiation between the terminal device and the server, and the second transmission key is different from the first transmission key; The terminal device uses the second transmission key to decrypt the encrypted first authorization certificate to obtain the first authorization certificate; The terminal device decrypts the encrypted first license using the first transmission key to obtain the first license; The terminal device uses the first authorization certificate to decrypt the first content key encrypted in the first license to obtain the first content key; The terminal device uses the first content key to decrypt the encrypted first digital resource file to obtain the first digital resource file.

7. The method according to claim 6, characterized in that The first content key includes the first content identifier and version number information of the first digital resource file.

8. The method according to claim 6 or 7, characterized in that: The first user ID is a user ID that has successfully applied for a trial or successfully purchased the first digital resource.

9. The method according to any one of claims 6 to 8, characterized in that: The first transmission key and the second transmission key are generated using an elliptic curve Diffie-Hellman key exchange ECDH algorithm.

10. The method according to any one of claims 6 to 9, characterized in that: The first authorization certificate includes an authorization public key and an authorization private key, and the first content key encrypted by using the first authorization certificate is the first content key encrypted by using the authorization public key.

11. The method according to claim 10, characterized in that The terminal device using the first authorization certificate to decrypt the first content key encrypted in the first license includes: The terminal device uses the authorization private key to decrypt the first content key encrypted in the first license.

12. The method according to any one of claims 6 to 11, characterized in that: The method further comprises: The terminal device stores the first content key and the first authorization certificate in a key store.

13. A server, characterized in that: include: Processor and memory; One or more computer programs are stored in the memory, and the one or more computer programs include instructions. When the instructions are executed by the server, the server executes the method according to any one of claims 1 to 5.

14. A terminal device, characterized in that: include: Processor and memory; One or more computer programs are stored in the memory, and the one or more computer programs include instructions. When the instructions are executed by the terminal device, the terminal device executes the method according to any one of claims 6 to 12.

15. A computer-readable storage medium, characterized in that: The method comprises computer instructions; when the computer instructions are executed on an electronic device, the electronic device executes the method as claimed in any one of claims 1 to 12.

Images