Enabling modification of control information, which controls the rights to content, where access to a key for decrypting the content requires a particular value that becomes modified when the control information is modified
A method of modifying a digital rights object including a first portion including a first key and a second portion including first control information for controlling the rights to content encrypted with a second key, the method including the steps of: a) calculating a first function from the first control information of the digital rights object; b) operating on the first key using the first function calculated in step a), to obtain the second key; c) modifying the first control information of the second portion to second control information; d) calculating a second function from the second control information of the digital rights object; and e) operating on the second key obtained in step b) using the second function calculated in step d), to obtain a third key for replacing the first key.
1. A method comprising
calculating, by a processor, a first value, using a first function, from first control information of a digital rights object wherein the digital rights object comprises a first portion and a second portion, wherein the first portion includes a first key and wherein the second portion includes the first control information which controls the rights to encrypted content wherein the encrypted content is encrypted with a second key;
obtaining, by the processor, the second key by operating on the first key using the first value
creating second control information of the digital rights object by the processor by modifying the first control information of the second portion;
calculating, by the processor, a second value, using a second function, from the second control information of the digital rights object;
obtaining, by the processor, a third key, by operating on the second key using the second value; and
replacing, by the processor, the first key in the first portion with the third key.
2. A method as claimed in claim 1 , wherein the first function and the second function are the same.
3. A method as claimed in claim 2 , wherein the first function is a HASH function.
4. A method as claimed in claim 1 , wherein obtaining the second key by operating on the first key by using the first value comprises decryption of the first key using the first value as a decryption key.
5. A method as claimed in claim 1 wherein obtaining the third key by operating on the second key using the second value comprises encryption of the second key using the second value as an encryption key.
6. A method as claimed in claim 1 wherein modifying the first control information comprises modification of a count value in the second portion of the rights object.
7. A method as claimed in claim 1 further comprising saving the rights object in the clear in a common unsecured memory.
8. A method as claimed in claim 1 , comprising receiving the rights object comprising the first key including the second key and comprising a second portion including first control information for controlling the rights to encrypted content wherein the encrypted content is encrypted with the second key, and replacing the second key with the first key in the first portion.
9. A method as claimed in claim 8 , further comprising, before the replacement of the second key by the first key:
calculating the first value from the first control information of the digital rights object; and
obtaining the first key by operating on the second key using the first value calculated from the first control information of the digital rights object; and
replacing the second key with the first key.
10. A method as claimed in claim 1 , wherein the content is decrypted before modification of the rights object using the second key.
11. A method as claimed in claim 1 , wherein the content is decrypted after modification of the rights object by:
calculating the second value from the second control information of the digital rights object;
obtaining the second key by operating on the third key in the second portion of the digital rights object using the calculated second value; and
decrypting the content using the second key.
12. A method as claimed in claim 1 , further comprising decrypting the first key using a device key prior to operating on the first key using the first value; and encrypting the third key using the device key.
13. An apparatus comprising:
a processor;
a memory storing computer program instructions that, when executed by the processor, cause the processor:
to calculate a first value, using a first function, from first control information of the digital rights object wherein the digital rights object comprises a first portion and a second portion, wherein the first portion includes a first key and wherein the second portion includes the first control information which controls the rights to encrypted content, wherein the encrypted content is encrypted with a second key;
to obtain the second key by operating on the first key from the first portion using the first value;
to create second control information of the digital rights object, by modifying the first control information of the second portion to second control information;
to calculate a second value, using a second function, from the second control information of the digital rights object;
to obtain a third key by operating on the second key using the second value; and
to replace the first key with the third key.
14. A computer readable medium encoded with a computer program executable to perform actions comprising:
calculating a first value, using a first function, from first control information of a digital rights object wherein the digital rights object comprises a first portion and a second portion, wherein the first portion includes a first key and wherein the second portion includes the first control information which controls the rights to encrypted content wherein the encrypted content is encrypted with a second key;
obtaining the second key by operating on the first key using the first value;
modifying the first control information of the second portion to second control information;
calculating a second value, using a second function, from the second control information of the digital rights object;
obtaining a third key by operating on the second key using the second value; and
replacing the first key with the third key.
15. An apparatus as claimed in claim 13 , wherein the first function and the second function are the same.
16. An apparatus as claimed in claim 13 , wherein the first function is a HASH function.
17. An apparatus as claimed in claim 13 , wherein the computer program instructions cause the processor to decrypt the first key using the first value as a decryption key.
18. An apparatus as claimed in claim 13 , wherein the computer program instructions cause the processor to encrypt the second key using the second value as an encryption key.
19. An apparatus as claimed in claim 13 , wherein the computer program instructions cause the processor to modify the count value in the second portion of the rights object.
20. An apparatus as claimed in claim 13 , wherein the computer program instructions cause the processor to save the rights object in the clear in a common unsecured memory.
21. The method as claimed in claim 1 , where modifying the first control information of the second portion comprises at least one of: modifying a playcount specifying a number of times an access permission may be granted, and modifying a validity date specifying when an access permission expires.
22. An apparatus as claimed in claim 13 , wherein the computer program instructions cause the processor to modify the first control information of the second portion by modifying at least one of: a playcount specifying a number of times an access permission may be granted, and a validity date specifying when an access permission expires.