Application Server DRM Session Key One-Time Player
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IP Multimedia Subsystem (IMS) systems lack a digital rights management (DRM) mechanism to prevent digital media from being reused or redistributed after a session expires, particularly in 'pay-per-view' services.
Innovation Solution
An application server generates a session key associated with an existing session, encrypts media objects with this key, and provides a one-time player embedded with the session key to user equipment, ensuring that media objects cannot be reused or redistributed after the session expires.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IMS session authentication is used to allow media access, then authorized recipients can access media content, but authorized recipients can replay or redistribute media objects after session expiry
Solution Approach 1:
The solution segments the DRM protection into two distinct components: a one-time player (software component) and a session key (cryptographic component). The one-time player is distributed to authorized recipients and contains embedded instructions for accessing media, while the session key is generated per-session and used to encrypt media objects. This segmentation allows the system to provide strong copyright protection without requiring a completely complex centralized DRM infrastructure, as the one-time player can be independently distributed and executed.
Solution Approach 2:
The one-time player is prepared in advance and distributed to authorized recipients before media access is needed. The player contains pre-embedded session keys that are valid only for specific sessions. This preliminary distribution of authenticated players ensures that only authorized recipients can access media, while the session-specific key validation prevents replay attacks after session expiry, resolving the contradiction between access authorization and post-session protection.
2Reliability
If session keys are generated for each media session, then media can be encrypted and protected, but the system cannot prevent media reuse after session expiry
Solution Approach 1:
The one-time player acts as an intermediary component that mediates between the encrypted media and the decryption process. It contains the session key embedded within it and automatically validates whether the current session is still active before allowing decryption. This intermediary enforcement ensures that even if media files are copied or stored, they cannot be played after session expiry because the one-time player will refuse to decrypt them without a valid session, thus preventing media reuse while maintaining encryption security.
Solution Approach 2:
The system changes the temporal parameter of the session key validity by tying the cryptographic key's usefulness to the session lifecycle. The one-time player monitors session status and automatically invalidates the embedded session key when the session expires. This parameter change approach ensures that media encryption remains secure during active sessions while automatically preventing access after expiry, resolving the contradiction between maintaining security and limiting access duration.
3Ease of operation
If digital media is made available for streaming, then users can access content, but users can redistribute or replay content after session ends
Solution Approach 1:
The one-time player is designed as a disposable, short-lived software component that is distributed freely to authorized recipients but automatically becomes useless after its associated session expires. Each player is inexpensive to distribute and contains an embedded session key that is valid only for a specific time window. This approach maintains ease of operation by allowing wide distribution of players to authorized users while preventing harmful redistribution, as the players self-destruct after session expiry and cannot be reused or transferred to other users.
Data Source
AI summary
An application server (100) includes: receiving means (101) for receiving a request for a media object from a user equipment; verification means (102) for verifying the authenticity of the received request; first generation means (103) for generating a session key that is associated with an existing session if the authenticity of the request is successfully verified; first sending means (104) for sending the session key to a media server so that said media server encrypts the requested media object with the session key and sends the encrypted media object toward the user equipment; second generation means (105) for generating a one-time player in which the session key is embedded; and second sending means (106) for sending the one-time player to the user equipment, which enables said user equipment to decrypt and decode the encrypted media object that is sent from the media server.