US 20080133564 A1
Local storage on player instruments provides the ability for adding further amendments and most recent supplements to the optical disc content. A problem arising with this technically applicable possibility is the protection of copyrights bound to disc and supplement data. The present invention describes a technique to ensure a security framework that is able to handle this, by creating a virtual file system by merging optical disc data and local storage data based upon a common identifier.
1. Method for generating or updating a virtual file system using first data from first read-only storage medium and second data from second storage medium, comprising the steps of
determining from inserted first read-only storage medium first, second identifier and first data set;
receiving a command for generating or updating the virtual file system;
determining if on the second storage medium a first directory according to the first identifier, and under the first (disc_ID) are available, and if so, then performing the following steps of
reading from the second directory a second data set being a file, and extracting from the read second data set a list of files related to said application;
verifying said related files against at least one signature from the second storage medium under the first directory;
generating or updating the virtual file system to comprise said available related files.
2. Method according to
3. Method according to
4. Method according to
5. Method according to
6. Method according to
7. Method according to
8. Method for creating a virtual file system with data from first read-only storage medium and data from second storage medium, comprising the steps of
determining from inserted first storage medium first and second identifiers;
determining if on the second storage medium a directory according to the first identifier with a subdirectory according to the second identifier is available;
upon determining that such directory or subdirectory is not available, automatically creating on the second storage medium said directory or subdirectory;
retrieving from the first storage medium or via Internet a file containing a list of files, and storing it under the second directory; and
creating a virtual file system according to the list of files.
9. Method according to
10. Optical read-only disc comprising data certified as described in 9.
11. Device for generating or updating a virtual file system using first data from first read-only storage medium and second data from second storage medium, comprising the steps of
means for determining from an inserted first read-only storage medium a first identifier, a second identifier and a first data set;
means for receiving a command for generating or updating a virtual file system;
means for determining if on the second storage medium a first directory according to the first identifier, and under the first directory a second directory according to the second identifier are available, and if so, then enabling
means for reading from the second directory a second data set being a file, and extracting from the read second data set a list of files related to said application;
means for verifying said related files against at least one signature read from the second storage medium under the first directory; and
means for generating or updating the virtual file system to comprise said available related files.
12. Device according to
means for determining that the read-only storage medium is no longer accessible; and
means for removing the virtual file system, upon said determining.
This invention relates to a method and an apparatus for securely binding contents on a local storage medium to contents on a removable storage medium. In particular, the removable storage medium is a read-only optical disc.
Future optical disc formats will demand local storage on the player instruments. This is because content, carried e.g. on a read-only optical disc, very soon becomes outdated, and the content producing studios intend to increase the attractiveness of their products. Local storage on player instruments provides the ability for adding further amendments and most recent supplements to the optical disc content, without increasing the disc production costs, as would be necessary for writable discs. When connected to the Internet, it is possible to download supplements to the local storage, or to replace content of the read-only disc. E.g. it is possible to replace an outdated movie trailer by a new one, or to supplement disc content by further audio or subtitle tracks. Also executable code, like a game bound to a particular optical disc, can be downloaded and run on the instrument while the associated disc is in the player.
A problem arising with this technically applicable possibility is the protection of copyrights bound to disc and supplement data. It is desirable to preserve copyrights in such a way that downloaded supplement data can be exclusively used when the related optical disc is inserted within the playback instrument. Any usage of supplement data stemming from the content provider, also a usage independent from the dedicated optical disc, should be under the control of the content owner, i.e. the content provider. The content provider wants to be sure that all of his content, whether it comes from the disc or it has been stored on local storage, cannot be used illegally or accidentally without having the disc, or in any combination with other content.
Usually data from local storage and from optical disc storage are mounted together into a virtual file system (VFS) within a player. This is done only once, namely when inserting the disc and starting the first application. Any further application start is based upon that virtual file system. This is a security risk, because even when data access is restricted, content becomes visible to foreign applications.
The present invention describes a technique to ensure a security framework that is able to handle the described generalized scenario. Advantageously, it includes also cases in which applications from different authors are located on a single optical disc, e.g. DVD, Blu-ray disc or the like.
The gist of the present invention is to create a virtual file system (VFS) by merging optical disc data and local storage data based upon a common identifier. This identifier is called herein “organization_ID”. It is used for certifying content. The creation of the VFS is executed dynamically before starting any application, e.g. playback of a title. Therefore VFS generation may vary during the presentation of an optical disc, because the included local storage data and optical disc data are changing according to the relations within a title. The location and handling of the organization_ID is embedded within a security framework, which in principle is application specific.
A local storage of a player instrument may contain data coming from different content providers. According to the invention, these data have different organization_IDs, indicating their respective content provider. In a more generalized application also the optical disc may contain titles coming from different content providers, and thus being certified with different organization_IDs. A VFS is generated according to the title that is played back on the playback instrument, immediately before starting the playback. In this way, any uncontrolled data combination is excluded, independent from if the data come from a local storage or from an optical disc, or removable storage device in general. The transparency for updates on local storage, as well as its dynamic usage for temporary data is preserved.
An apparatus that utilizes the method is disclosed in claim 2.
Advantageous embodiments of the invention are disclosed in the dependent claims, the following description and the figures.
Exemplary embodiments of the invention are described with reference to the accompanying drawings, which show in
The invention is based upon the usage of a security framework, which incorporates an organization_ID for the identification of matching files that may be distributed e.g. on a first, local storage medium, e.g. hard-disc drive (HDD), and on a second, removable medium. In the following, it is assumed that the second, removable storage medium is a read-only optical disc. It may however be any removable storage medium, e.g. flash memory or the like. When inserting the optical disc in the player instrument, a virtual file system (VFS) is compiled. The selection of files to compile is based upon the performed title and its organization_ID. In the following, the term “organization_ID” is used to explain the general concept. In other embodiments it is possible to define further sub-structures like e.g. disc_ID or application_ID, where parts of a disc can use a finer granularity of the organization_ID.
A typical security framework is based upon the usage of asymmetric encryption, the elements of signature and the certificate.
To avoid the effort of sending public keys around, which is again a security risk as well as a key management overhead, the technique of certification is used. As
The receptor (“Bob”) can verify if the senders public key is authentic if he has the CAs public key.
As shown in
Before starting the presentation of e.g. Title_1, the player compiles a virtual file system VFS. The compilation is ruled by the certificates certificate_ID#1,2 assigned to the signature belonging to the data on disc. In the example it is assumed that the signature signature_ID#1 attached to the title Title_1 is certified by organization_ID#1. Therefore, according to the invention, only data certified by organization_ID#1 may be assembled before starting the presentation of Title_1. Likewise, only data certificated by organization_ID#2 may be assembled for a VFS before starting the presentation of e.g. Title_2 that is certified by an organization_ID#2. The different organization_IDs may belong to different content creators or owners, i.e. content authors, studios, providers etc.
As depicted in
A possible exception is the treatment of AV stream files, because they need not necessarily have a signature file. This is because stream files are large, and the digest code (i.e. hash-code) calculation of a large file takes long. For the assembling of the VFS, signed AV stream files are treated in the same way as explained above for other files. But the assembling process will include also those AV stream files that are not signed at all, i.e. only those stream files are included that are either certified with the correct organization_ID, or have no signature at all. This treatment of AV stream files does not break the security chain, because any access to AV stream files is only possible by means of the MovieObject, PlayList and Clip files. Those files are always signed and certified, directly or indirectly.
In another embodiment of the invention, the organization_ID is applied for the whole disc. In this case, the VFS is generated only once before starting the disc presentation. The difference versus state-of-the-art systems becomes clear when the local storage is considered. According to the invention, the data that belongs to a disc and that is stored on the local storage medium is carrying a signature and a certificate, which includes the organization_ID. For AV stream files the above-mentioned exception remains valid. All uncertified data on local storage can only run separately, i.e. the virtual file system generated from it cannot include any certified, or differently certified, disc content. Thus, the content provider can be sure that his content is secure, and none of the data material on disc is misused.
In another embodiment of the invention, the organization_ID is used with local storage, as depicted in
After insertion of the disc, the virtual file system VFS is assembled according to the certificates located on the disc. In this example there is only one certificate on the disc, namely organization_ID#1, and therefore according to the present invention only such files are included into the VFS that are also certified with the matching identifier organization_ID#1. All other files remain invisible and inaccessible during the life cycle of the VFS. As the local storage in this case contains an update for the JavaObject file, i.e. a JavaObject file with the same name and same identifier (organization_ID#1) in its signature signature_ID#1, it supersedes the one on disc, and the Java application BD-jar2 from HDD is run instead of the original Java application from disc.
As this example shows, the usage of an organization_ID within a certification that rules the generation of a virtual file system significantly improves the security for local storage, by prohibiting any uncontrolled data combination that might otherwise be possible with data coming from the local storage. An application generating data on local storage has to sign the generated files, and the signature has to point to the disc certification that carries the appropriate organization_ID. Otherwise the application will not be able to find the newly generated data again on the local storage. If the generated data is held in cache, it may remain usable for the VFS until the VFS is destroyed, which happens e.g. when the disc is removed from the player, when the player is switched off, when another title from the disc is selected or upon other events. The next time when the VFS is compiled, only such data from local storage will be included in the binding that are certified with the correct organization_ID.
This leads to the effect that data that are relating to a particular application and are signed correspondingly may not be used by foreign applications, e.g. from other content providers.
A further aspect of the invention is the subdivision of organization_ID into an organization structure. This can be done by adding further identifiers to the certificate, e.g. a disc_ID, application_ID etc. Another possibility is to use the “text” field within the “organization name” of
However, applying the corresponding certificate to those files, as described above, would require knowing the later usage in advance. A later certification, e.g. by adding a new certificate, is not possible, as it requires write access for the corresponding directories on the local storage. But these directories are not visible in the later VFS if the application then has another certificate. As a solution, it is proposed to span an umbrella in advance and decide at a later time, which application is allowed to go under this umbrella. The umbrella is spanned by the main part of the organization_ID defining a root directory.
This is depicted in
One aspect of the invention is to utilize an identifier, or organization_ID, to control the assembling of a virtual file system VFS.
One aspect of the invention is to apply the assembly of a virtual file system controlled by an identifier, or organization_ID, to a (local) storage medium, such as a HDD, wherein the respectively valid identifier that controls the assembly process is retrieved from a removable storage medium.
One aspect of the invention is to apply the identifier-controlled assembly of a virtual file system to an optical disc, wherein the respectively valid identifier is retrieved from the currently presented title on said disc.
One aspect of the invention is to store the identifier, or organization_ID, within a certificate that is defined within the security system framework.
One aspect of the invention is to subdivide a main directory tree on a local storage medium, wherein the main directory tree is certified with an organization_ID, into an organization structure including a plurality of subdirectories, and allowing access to a subdirectory by all other subdirectories of the same main directory.
One aspect of the invention is to sign and certify MovieObjects and/or JavaObjects.
One aspect of the invention is to create signatures for newly created files stored on a local storage medium, wherein the signatures point to the certification and identifier located on a removable storage medium, in particular an optical disc.
There may exist a rule saying e.g. that all AV stream files stored on local disc must be signed and certified with a particular organization_ID. This ensures that unauthorized manipulation of stream files on the local storage medium is impossible. This is possible when generating a face AV stream file that matches any existing clip file. Other security mechanisms can be taken to ensure this, e.g. encryption of the AV stream files. There may also exist a rule e.g. demanding all AV stream files to be encrypted by the same key, wherein the key is located on the removable disc, and that all not-encrypted AV stream files cannot be presented by the instrument.
When the VFS in constructed upon disc insertion, this is the easiest solution from the player implementation point of view, but then it is not possible to generate or download data while the disc is inserted.
A second possibility is to construct the VFS when either the disc is inserted or a new title is selected. This is a good solution from the users point of view, because when a title is changed there is an interruption, during which the new VFS can be generated without disturbing the user.
A third, possibility is to construct the VFS always when playback starts. This however requires, when MovieObjects or JavaObjects should be included in the binding, different mechanisms than when just PlayLists, ClipInfo and MPEG2-TS (transport stream) files shall be included. These are on a different logical level, and new MovieObject or JavaObject upon playback start may lead to confusion about which files are valid.
A fourth possibility can be applied when a programmable platform is available, such as a Java Virtual Machine JVM, namely to generate the VFS dynamically upon an Application Program Interface (API) call.
The construction of a VFS is called “binding”.
As mentioned above, the integrity of the VFS must be checked. This is discussed in
The invention can be used for recording and/or playback devices for removable storage media that have access to a further rewritable storage medium, such as a HDD. The invention is useful e.g. for high-density data carriers such as Blu-ray discs.