WO2007042992A1

WO2007042992A1 - Balanced and controlled license transfer

Info

Publication number: WO2007042992A1
Application number: PCT/IB2006/053693
Authority: WO
Inventors: Robert P. Koster
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2005-10-13
Filing date: 2006-10-09
Publication date: 2007-04-19

Abstract

The present invention relates to a method of protecting content, wherein a license is associated with said content, and wherein said license comprises transfer parameters identifying transfer rights of said content, said transfer parameters comprising positively and negatively varying limiting indicators used for limiting the number of allowable transfers. Thereby a dynamic cap is put on the number of transfers, where the cap value can e.g. be varied based on time, number of uses etc. This strongly neutralizes and discourages automated sharing systems, e.g. in the form of P2P based exchange networks.

Description

Balanced and controlled license transfer

FIELD OF THE INVENTION

The present invention relates to a method and an apparatus for protecting content, wherein a license is associated with said content.

BACKGROUND OF THE INVENTION

Typically, in a DRM system wherein licenses are bound to persons or domains, multiple instances of a license may float around over various devices. These instances are typically called licenses, copies, sub-copies, AD (authorized domain) or domain licenses. In some cases one can distinguish a master license of which there is typically only one instance and from which the sub copies are derived. Other names for this master license are root copy or cross-domain (X-AD) license.

License transfer for digital content is the process in a DRM system where a content license that is associated with a certain entity is associated with another entity. Entities in this case may be persons, (authorized) domains (AD) or devices. License transfer enables a number of applications:

It enables 2nd hand gifting (or resale) of digital content, which is considered as an important value proposition for end-users by many parties in the value chain of electronic content distribution, including DRM vendors, content owners, service operators, etc. In case of people breaking up they need to divide their content among them, which is enabled by content transfer.

It enables transfer of content over different systems over time, i.e. people can switch to new systems that use new identities for users or new domain definitions. Transfer of licenses to these new identities enables such maintenance operations. Potentially the mechanism can also be used in DRM interoperability solutions and standards where licenses may be in multiple individual DRM systems.

In the prior art the following approaches are identified in order to be able to support transferability of content licenses: Allow gifting when all existing license sub-copies are collected (regardless of how this collecting is done).

Best effort license revocation, e.g. disabling all sub-copies in the old domain or guaranteeing that content does not play on any domain device once it gets the updated license revocation information.

License models as for the TomTom navigation products, where one may initially install a copy of the software on one device with the option to activate another device every 6 months to support transfer of the product to a new PDA, etc. With the TomTom license model all installations must be activated involving the TomTom registration service, which keeps a database of rights. Further, there is only a single instance of the activated software and not a multitude of (sub-) licenses as in the case for digital content.

X-AD rights could be transferred to another domain. This would typically be used in combination with other means, such as revocation or expiry of the corresponding AD licenses. A number of 'transfer rights' (in those situation typically called gift rights) are issued as part of the state information of a license, e.g. "this content may be gifted once" after which the system ensures that this 'transfer right' is only exercised once.

The current prior art solutions for license transfer indicated above do all have one or more disadvantages: They do not include any measure to prevent high distribution speeds of licenses, which could result in peer to peer networks that facilitate transfer of the same license at a very high rate/frequency, which would hurt the business models of the content owners seriously, since effectively a shared pool of licenses can be used by a large number of users. This disadvantage is also regularly used as a discouraging example in discussions on whether the first sale doctrine in US copyright law should also hold for digital content and licenses.

Many current solutions are based on revocation or collection of sub-copy licenses in the old domain as part of transferring the content to the new owner or domain. For both approaches it is very hard to guarantee that it will be 100% successful because of failing devices, missing connectivity, or malicious users interfering with the process. This leaves the choice to either accept the risk or to disallow the transfer, both of which are not very attractive options neither for the content owner nor the end-user. Solutions that are based on a X-AD or root license or a fixed number of 'transfer rights' have a single point of failure: if the license (or the device that manages it) gets lost, stolen or broken then the ability to transfer the license is generally lost.

Solutions that work with a fixed number of 'transfer rights' that are gone after use do not meet the expectations of the end-user since no reasonably estimate can be given as to how many times a content item would be legitimately transferred over its complete lifetime.

In principle the current state of the art is not sufficiently good with the consequence that the indicated functionality is not part of any current DRM system or standard although it is an attractive feature.

OBJECT AND SUMMARY OF THE INVENTION

It is an object of the present invention to solve the above mentioned problems

The invention relates to a method of protecting content, wherein a license is associated with said content, and wherein said license comprises transfer parameters identifying transfer rights of said content, said transfer parameters comprising positively and negatively varying limiting indicators used for limiting the number of allowable transfers.

Thereby a dynamic cap is put on the number of transfers, where the cap value could e.g. be varied based on time, number of uses etc. This strongly neutralizes and discourages automated sharing systems, e.g. in the form of P2P based exchange networks.

The varying of allowable license transfers could e.g. be time dependent or based on the number of times said content is rendered.

In an embodiment said decrease of allowable license transfers is transfer dependent. Further, said increase of allowable license transfers is time dependent. In an embodiment said limiting indicators comprise a level indicator (LI), said level indicator indicating the present number of allowable transfers of said license, wherein transferring of content from a first to a second identity is only allowable if said level indicator is above a predefined threshold, said time dependent limiting allowable license transfers being implemented by decreasing said level indicator when a transfer occurs and increasing said level indicator as a function of time.

In an embodiment said limiting indicators further comprise a capacity indicator (CI), said capacity indicator identifying the number of maximum allowable transfers of said license, wherein said level indicator is only increased until it equals said capacity indicator. The advantage of the above method is that it puts a cap on the number of subsequent transfers (over time). This strongly neutralizes and discourages automated sharing systems, e.g. in the form of P2P based exchange networks.

In an embodiment said level indicator is increased as a function of time, but only until said level indicator equals said capacity indicator. The advantage of increasing the level over time is to give the user a good experience and take no more than necessary, i.e. it ensures that an honest user does not loose his ability to transfer a license forever.

In an embodiment said transfer parameters further comprise: a fill rate, identifying how fast the level indicator is increased as a function of time.

The advantage of the fill rate is that it gives an opportunity to tune the system further when licenses are getting split. It is possible to split the fill rate over the two sub- copies with the advantage that the total fill rate over all sub copies stays equal.

In an embodiment said limiting indicators comprise a frequency indicator (FI) indicating allowable license transfers per time unit.

In an embodiment said limiting indicators indicate the moment in time that the next transfer may take place.

In an embodiment said limiting indicators comprise moments in time of previous transfers, which are used to derive when the next transfer may take place. In an embodiment copying of said content into a number of sub copies results in a number of sub copies where the parameters in the license before copying are split between each sub copy. The advantage of splitting the transfer related parameters is multitude. First, splitting/distributing transfer parameters prevents certain scenarios where a user keeps a sub-copy with no transfer rights, while having bundled all transfer rights in another sub-copy, which he transfers again. Second, distributing transfer parameters reduces the risk of a single point of failure when a sub-copy gets lost or destroyed.

The advantage of splitting, but keeping the sums equal, is that the transfer rights stay equal and certainly do not increase (which would be counterproductive).

In an embodiment the transfer parameters of licenses associated with sub copies originating from the same origin are accumulated before said content is transferred. The advantage of being able to combine sub-copies that all originate from one or more split operations is that this enables transfer together with the full transfer potential for the receiver. Furthermore, it is required in case so many sub-copies are created that none have a level/capacity above the threshold (the threshold always stays the same). The word split could e.g. be interpreted such that the value is split, whereby the sum stays equal, but alternatively, e.g. in case of time parameters, the value stays the same or increases.

In an embodiment when transferring content from a first to a second identity, any licenses associated with said content identifying the first identity are revoked. The advantage of revoking sub-copies that are not included in the transfer and remain is that the intent of transferring is followed closely, and that only the new recipient identity may be able to access the content, which may be a firm requirement by the content industry to allow license transfer at all.

The invention further relates to a computer-readable medium having stored therein instructions for causing a processing unit to execute a method according to the above.

The invention further relates to an apparatus for protecting content, wherein a license is associated with said content, and wherein said license comprises transfer parameters identifying transfer rights of said content, said apparatus being adapted for positively and negatively varying limiting indicators used for limiting the number allowable transfers.

These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS The following preferred embodiments of the invention will be described referring to the figures, where figure 1 illustrates a piece of content and its associated license, figure 2 illustrates a license where the level indicator is increased after the passing of a time interval, figure 3 illustrates the method of copying a license, figure 4 illustrates the copying of a license, figure 5 illustrates the methods of transferring a license, figure 6 illustrates the transferring of a license, figure 7 illustrates an apparatus according to the present invention, figure 8 illustrates a license going through different states.

DESCRIPTION OF PREFERRED EMBODIMENT

The essential feature of the present invention has two main aspects being: With each sub copy of the license a part of the transfer rights is distributed, thereby spreading the risk of losing/breaking devices (and subsequently licenses) i.e. removing the single point of failure and introducing a gradual scale for transferring licenses, i.e. if one can give a higher assurance that no licenses/rights stay with the old owner/holder, then more transfer rights are available.

The transfer rights are constructed in such a way that they prevent automated high speed serial transfers, while still allowing normal transfers that are useful to most of the cases that the end-user would like to use this for. A typical embodiment of this measure is that the transfer rights are made time dependent, i.e. a license may be transferred only a number of times per time unit.

In the following description of embodiment a license is defined as consisting of the following:

A reference to a holder, i.e. the entity that holds the rights on a piece of content A rights expression indicating what may be done with a piece of content, e.g. render it.

A reference to a content item.

A license indicator (optionally) i.e. a unique license identifier indicating which copies belong together. (This identifier is independent of holder entity identifiers or content identifiers etc.)

State information (e.g. number of times the content may be rendered - optional).

Typically, the first four parts are immutable and have the form of a digital certificate. State information is typically managed and integrity protected by compliant devices (and media). In the above listing it is to be noted that some typical license elements that are not relevant to the invention are omitted, e.g. the content key.

Further, stateless licenses can in theory be copied in an unmanaged way, e.g. their binary representation is simply duplicated outside the DRM system. Alternatively the copying of licenses is managed. Copying is an operation that happens a lot in so called domain or person based DRM systems, because the content can be used on a multitude of devices (even simultaneously) which require the licenses to be duplicated and distributed. Unmanaged copying typically only allows for best effort revocation for sub copies. Managed copying, i.e. licenses, are only duplicated under supervision of the DRM system, which typically allows for both best effort revocation and for perfect collection of sub copies, because it enables a better traceability of the existing sub copies, i.e. how many copies exist and potentially even their location. In the present embodiments it is assumed that managed copies are used. The use of managed copies enables that some administration is kept for each license instance. This is comparable to license state information. A copy gets the same 'license identifier' as the source, which is described later.

In figure 1 a piece of content and its associated license are illustrated. The piece of digital content 103 could e.g. be a text, a piece of music or a movie. To the piece of content a license 101 is associated comprising license state information. The license state information comprises: A user ID (UID) identifying the authorized user of the content, a capacity indicator (CI), identifying the number of maximum allowable transfers of said license, a level indicator (LI), identifying the present number of allowable transfers of the license, a fill rate (FR) indicator identifying the speed with which the level indicator may increase pr. time. E.g. 1 per month or 4 pr. hour, though the level indicator may not be larger than the capacity indicator.

Content may be transferred when 'level' is greater than 'threshold', which indicates the threshold level for a transfer. Alternative representations may be used for the given parameters here, e.g.:

Administering the date/time when a certain level was valid and calculating the update only when necessary. E.g. at time Tl level is stored as (Tl, LIl) and updated when necessary, typically when making copies or doing transfers, at time T2 as (T2, LI2) where LI2 equals Ll + (T2-T1) * fill rate. Replacing fill rate with a 'generation' parameter that indicates the effective fill rate for this license by calculating it based on the generation and a reference system defined fill rate parameter. A typical example would be when the system ensures that the following relation holds: effective fill rate for sub-copy equals start_system_fϊll rate / 2^Λ(generation).

Completely different means to represent the transfer rules, e.g.: A frequency identifier (FI) in the form of e.g. "max 2 transfers per month, 4 per year and 25 per 10 years". This non- linear behavior is intended to prevent automated transfers by exchange systems, while being still very reasonable for normal usage, i.e. it can happen that you have to transfer it a few times in a short time period for some reason, but the chance that this happens very often is very low. Also more complex rules may be required for creating sub-copies, since it is harder to 'distribute' this information (0.5 transfers per month has little meaning, although 1 per year still makes sense). non-linear transfer curves for fill rate, threshold, etc., similar to non-linear FI as above. Instead of pure time (clock) based approaches for fill rate and other parameters where appropriate (expressed in amount per time unit) other monotonic increasing counters could be used, e.g. operations on content or licenses as content render time, amount of plays, number of bought songs, etc. The update of LI could then for example become LI2 = LIl + fill rate * number_of_plays instead of LI2 = LIl + fill rate * time difference. In a first embodiment of the invention only the second of the two main aspects is used. In the embodiment automated high speed serial transfers of the same license are prohibited.

The additional step beyond X-AD or root copy approaches is the inclusion of the date/time of the last transfer in the state associated with the X-AD license. A license transfer in this scheme is only allowed in cases where the 'previous transfer' is long enough ago, typically expressed by a system parameter or indicated in the license. An example of this solution is: a license may be given away once every 6 months. Typically, this solution would be used in combination with a license revocation mechanism for the sub copies.

Alternatively, a more advanced scheme is used where a number of (or all) previous transfers are logged in the state information associated with the root license and subsequently used in the process of determining if a transfer is allowed. This scheme is compatible with the CI / LI / fill rate model introduced above but instead of keeping track of what is left of the capacity, i.e. LI, it is administered in a log how much of the capacity is used, i.e. LI used. LI used can be calculated from the log and can typically be converted in LI, LI=CI-LI_used.

In figure 2 a license is illustrated where the level indicator is increased after the passing of a time interval. Initially the level indicator (LI) has the value 10, but when the license is transferred, the level indicator is lowered to 7 (this is described later). Then after a time period, the level indicator (LI) is increased, taking the fill rate into account, to 10. In other words, initially the license may be transferred 2 (LI/penalty=7/3=2) times, but after the time period it may be transferred 3 (10/3=3) times.

License copying covers the process of distributing licenses to capable devices, whereby the same license is on more than one device (where the license state information may indicate the allowed rendering for each device). When a license is copied, e.g. a copy is distributed to another domain device, effectively the static part of the license is duplicated and both instances get an update of their state information. With respect to the state information affecting the speed of transferability, the following should hold. First, creating a copy should not make it more likely that transfers to others are made while still holding a personal copy. This is realized by adapting the parameters, e.g.: level = level / 2 capacity = capacity / 2 fill rate = fill rate / 2 This simply means that the overall transfer capability and also the current level stay the same, but that they are divided over the two licenses.

In figure 3 the generation of each copy is illustrated in general. Here a total number of copies is performed (#C) 301, and based on that both capacity indicator (CI), level indicator (LI) and fill rate (FR) are divided with the number of copies #C performed. Note that it may be possible that the capacity indicator belonging to the state of one of the license sub-copies drops below the threshold value, which remains the same. This implies that the license cannot be transferred unless it is merged again with another sub- copy during a collection process (see below). The effect of this is that if a user tries to withhold certain license copies in order to render the content, this would lower the available transfer rights.

In figure 4 a copying of a license according to the present invention is illustrated. In the figure the content 401 is copied resulting in two similar pieces of content 403 and 405. The number of copies is now two and two licenses are now present; one associated with each piece of content where the level indicator, capacity indicator and fill rate have been divided in two.

License transfer is the process where a license is transferred from one entity to another. Preferably the old entity cannot afterwards access the content anymore.

When a license is transferred, i.e. bound to another entity, the following should happen: all sub-copies of the license should be collected and their state information merged as indicated below. it is verified that the resulting 'level' is greater than 'threshold' (optional) remaining sub-copies are revoked from the entity (domain or user, etc.). Alternatively, a delayed collection is initiated. The latter could be used to add it in a later stage with the license of the new holder. the static part of the license should be changed such that the new holder replaces the old holder. How this is exactly done is not part of this invention, but could be done locally by reissuing, extending the existing license or by involving a third party that reissues the license with a new holder. the state information concerning the transferability is updated as indicated below. the old license and the associated state cease to exist.

(typically) the license and state are transferred to a device of the new holder (entity).

Note that many of these steps may be performed at the device containing the original license, the device receiving the transferred license, a third device or an online server equipped with the required functionality.

The state information that is associated with the license of the new holder is determined as follows with respect to transfer rights: level indicator = level indicator - penalty capacity indicator = capacity indicator (unchanged) fill rate = fill rate (unchanged)

In typical situations 'penalty' will be equal to 'threshold'. The rationale for 'penalty' is to limit the distribution speed. Furthermore, the new holder only gets what the old owner is able to give. This provides an incentive as well as an upper bound. Preferably licenses are transferred 'complete'. In a typical situation the capacity indicator will stay unchanged during a transfer as indicated above for best user experience. However, it can be chosen to decrease the capacity a bit for each transfer. This would simulate the 'wear and tear' model that current optical media are subject to limiting their effective lifetime. Decreasing the capacity in any way suffers to some extent from the same disadvantages as transfer rights that cannot increase anymore, i.e. its user-unfriendliness, though content owners may consider it as an advantage.

Before the license is transferred to its new holder all the sub-copies of the license that are associated with the old owner must be collected and merged. This merger is done one by one until no more licenses can be collected and one license with associated state remains.

To ensure optimal working of the invention and prevent certain kinds of misuse only licenses should be merged that have an equal 'license indicator'. In this way only licenses that originate from the same source license but having been split in the past for a copying operation can be merged together. In this way, it is for example not possible to merge two licenses for the same content item that were originally issued to two completely different persons.

The merger of two licenses with associated state with respect to transferability is done as follows: level = level 1 + Ievel2 capacity = capacity 1 + capacity2 fill rate = fill ratel +fill rate2

Simply said, the state with respect to transferability is the sum of all the individual licenses. This process is the opposite of the split process done for copying.

In figure 5 the main aspect of the method of transferring a license is illustrated, here the transferring from a first user to a second user is initiated in 501, then all sub copies are detected and their parameters level indicator, capacity indicator and fill rate are summed in 503 and finally the license is transferred in 505 by subtracting a penalty value from the level indicator.

In figure 6 the transferring of a license is illustrated. Two copies 601, 603 of the piece of content and its associated license exist. These are collected by summing the license parameters, and afterwards the license is transferred from user A to user B. A penalty of 3 is subtracted from the license indicator (LI). Note that in order to perform a good collection, no licenses should be thrown away without a good reason. It is better to have a managed deletion that ensures that if possible the license and associated state is merged with another license. This is not hard to realize in many cases, e g for portables that act as tethered devices to a PC and are synchronized regularly. In a certain way the transfer can be considered as a degradation process where somebody who is very careful keeps its licenses in a better condition because he will ensure that the collection process is 100% successful and all transfer rights are maintained and transferred. In figure 7 an apparatus according to the present invention is illustrated. The apparatus 701 comprises data processing means 703 enabled to process data. The apparatus could in an embodiment comprise a receiver 705 and a transmitter 707 for receiving and transmitting content and associated licenses. The data processing means comprises a microprocessor 709 and memory 711 interconnected via a communication bus. The apparatus could then perform actions according to algorithms in a computer program stored in the memory 711 relating to handling of licenses as described above.

In figure 8 a license is illustrated going through different states. Initially at 801 the level indicator is increased based on the passing of time defined by the fill rate, then at 803 the license is copied resulting in two licenses where all parameters are divided by two. At 805 one of the copies is lost, and then at 807 the remaining copy is copied in two. At 809 the copies are collected where the parameters are summed, and at 811 the license is transferred to user B from A and a penalty of 3 is subtracted from the level indicator LI. Finally at 813 the level indicator is increased based on the passing of time defined by the fill rate.

Potentially this invention can be combined with write once media such as optical disks: part of the transfer rights would be put on the compliant optical media, which also implies that these cannot be collected anymore and not be used for transfer purposes, except possibly using the form where the optical disk itself is given away or sold. The method could be extended with a simple form of fraud (hack) detection in case of malicious users hacking devices. Whenever a device is successfully used to duplicate state information related to transfer rights, this could be detected as part of the collection and merging process. This can be done by verifying if the accumulated transfer rights (capacity parameter) exceed the maximum possible capacity (potentially stored in the immutable static part of the license). A compliant device can then disallow the transfer and report identities of devices and users involved.

To prevent that risks of losing/breaking devices go to one device, it could be possible to level the transfer rights over the different sub copies of the license, e.g. make them all equal as far as possible since devices must have communication means to do so. This could be done for the level indicator, capacity indicator and fill rate parameters.

This leveling could also depend on the device class of certain devices. It may be advantageous for example to ensure that a significant part, but not sufficient to give away an instance, of the transfer rights is distributed to cheap devices, since it is more likely that these devices are given away as a whole and never returned. This addresses a threat called 'content filling station'.

The invention can be used in DRM solutions and standards that want to support one of the facets of transfer of licenses between entities, i.e. change ownership. Examples of this are 2nd hand gifting of content licenses, dividing content between people after a split up or simply maintenance operations (e.g. somebody changing from one system to another wanting to transfer his content into the new system).

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word 'comprising' does not exclude the presence of other elements or steps than those listed in a claim. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a system claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS:

1. A method of protecting content, wherein a license is associated with said content and wherein said license comprises transfer parameters identifying transfer rights of said content, said transfer parameters comprising positively and negatively varying limiting indicators used for limiting the number of allowable transfers.

2. A method according to claim 1, wherein said decrease of allowable license transfers is transfer dependent.

3. A method according to claim 1-2, wherein said increase of allowable license transfers is time dependent.

4. A method according to claim 1-3, wherein said increase of allowable license transfers is based on the number of operations on said content.

5. A method according to claim 1-4, wherein said limiting indicators comprises a level indicator (LI), said level indicator indicating the present number of allowable transfers of said license, wherein transferring of content from a first to a second identity is only allowable if said level indicator is above a predefined threshold, said limiting allowable license transfers being implemented by decreasing said level indicator when a transfer occurs and increasing said level indicator as a function of time.

6. A method according to claim 5, wherein said limiting indicators further comprise a capacity indicator (CI), said capacity indicator identifying the number of maximum allowable transfers of said license, wherein said level indicator is only increased until it equals said capacity indicator.

7. A method according to claim 5-6, wherein said level indicators are updated when a transfer is to be performed.

8. A method according to claim 5-7, wherein said limiting indicators further comprise: a fill rate parameter identifying how fast the level indicator is increased as a function of time.

9. A method according to claim 8, wherein said fill rate parameter is determined by calculating it based on a license specific generation parameter and a reference system defined fill rate parameter.

10. A method according to claim 1-3, wherein said limiting indicators comprise a frequency indicator (FI) indicating allowable license transfers per time unit.

11. A method according to claim 1-3 and 10, wherein said limiting indicators indicate the moment in time that the next transfer may take place.

12. A method according to claim 1-3 and 10, wherein said limiting indicators comprise moments in time of previous transfers which are used to derive when the next transfer may take place.

13. A method according to claim 1-12, wherein copying of said content into a number of sub copies results in a number of sub copies where at least some of the limiting indicators in the license before copying are split between each sub copy.

14. A method according to claim 1-13, wherein the transfer parameters of licenses associated with sub copies originating from the same origin are accumulated before said content is transferred.

15. A method according to claim 1-14, wherein, when transferring content from a first to a second identity, any licenses identifying the first identity are revoked.

16. A computer-readable medium having stored therein instructions for causing a processing unit to execute a method according to claim 1-15.

17. An apparatus for protecting content, wherein a license is associated with said content, and wherein said license comprises transfer parameters identifying transfer rights of said content, said apparatus being adapted for positively and negatively varying limiting indicators used for limiting the number allowable transfers.