Client-Side DRM Authorization via Embedded License Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content providers face logistical challenges in securely providing and managing licenses for digital rights management (DRM) systems, particularly in supporting license servers for content distribution over networks.
Innovation Solution
Implementing a content player that uses a global key to decrypt content keys only if a token meeting specific authorization conditions is present, allowing client-side content authorization without the need for server-side infrastructure, using tokens obtained through an out-of-band mechanism and embedded in the content stream.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a license server is used to control content access, then content protection is improved, but device complexity and operational burden increase
Solution Approach 1:
The patent extracts the license verification function from the content delivery server and places it in the client player. The server only needs to provide the encrypted content and embedded license data, while the client independently evaluates authorization conditions and decrypts content keys using stored global keys. This extraction eliminates the need for complex server-side license management infrastructure.
Solution Approach 2:
The client player performs self-authorization by evaluating license conditions and managing its own decryption keys. The player checks whether authorization conditions are met using embedded license data and stored global keys, then independently decrypts content without requiring server intervention. This self-service approach reduces server operational burden while maintaining security.
2Reliability
If server-side license verification is implemented, then content security is improved, but productivity and scalability worsen
Solution Approach 1:
The patent applies preliminary action by embedding license data directly in the content stream before delivery. The license contains authorization conditions that the client must satisfy before decryption. This preliminary embedding of licensing information eliminates the need for real-time server verification during content distribution, improving scalability.
Solution Approach 2:
The patent uses copying by distributing encrypted content with embedded license data to multiple clients simultaneously. Each client receives a copy of the content stream with its own license information, allowing independent authorization evaluation without requiring centralized server processing for each client request.
3Reliability
If license servers are deployed to manage DRM, then content protection is improved, but ease of operation worsens
Solution Approach 1:
The patent extracts the operational burden of license management from the content provider and transfers it to the client player. The provider simply embeds license data in the content stream, while the client handles all authorization evaluation and key management operations. This extraction significantly reduces provider operational complexity.
Data Source
AI summary
A computerized device can implement a content player to access a content stream using a network interface, the content stream comprising encrypted content and an embedded license comprising a content key encrypted according to a global key accessible by the content player. The content player determines whether a token meeting an authorization condition is present and uses the global key to decrypt the content key only if such a token is present. The authorization condition may be evaluated at least in part based on data included in the content stream. The authorization condition can include presence of a token having a content ID matching a corresponding ID in the license; presence of a token with a correct device ID; presence of a token signed according to a digital signature identified in the licenses; and/or presence of a token that is unexpired, with expiration evaluated based on a time-to-live indicator in the token.