Management of secure access to a secure digital content in a portable communicating object
View Patent ↗The invention concerns a terminal (T) comprising an agent (AS) for processing a secure content encrypted with a key (KCN) and transmitted by a first server (SCN). In order to manage a secure access to the secure content, an application (AG) of a portable communicating object, such as a chip card, associated with a terminal stores one type of related digital right (TDN) and a certificate and transmitted by the agent and stores an access right (DA) and the key (KCN) related to the secure content transmitted from a second server (SAD). The application adapts the access right and the key and modifies the secure content, based on the type of right, and produces a secure access file based on the adapted access right and the key and on the certificate, the produced file being accessible by the terminal so that the agent may process the modified content.
1. A method for managing secure access to a secure digital content enciphered with a key in a portable communicating object associated with a terminal, the terminal comprising an agent for processing the secure digital content that is transmitted by a first server to the terminal through a communications network, said method comprising the following steps executed, in the portable communicating object:
accessing a certificate relating to the agent and a type of digital right used by the agent,
storing the key and an access right relating to the secure digital content, transmitted from a second server,
comparing the type of digital right used by the agent and the received access right relating to the secure digital content,
adapting the key and the received access right and modifying the secure digital content, according to the type of digital right used by the agent, if the type of digital right used by the agent and the received access right relating to the secure digital content are different, and
producing a secure access file according to the adapted access right, the adapted key and the accessed certificate, the secure access file being accessible to the terminal so that the agent processes the secure digital content modified according to the secure access file, if the type of digital right used by the agent and the received access right relating to the secure digital content are different.
2. A method according to claim 1 , wherein the adapting and modifying step also comprises, in the portable communicating object, the steps of:
generating a key adapted to the digital right type,
deciphering the secure digital content with the key, and
enciphering the deciphered secure digital content with the generated key.
3. A method according to claim 2 , wherein the adapting and modifying step also comprises, in the portable communicating object, a formatting of the deciphered secure digital content in a manner compatible with the security agent, so that the formatted secure digital content is enciphered with the generated key.
4. A method according to claim 1 , also comprising the steps of:
accessing from the agent a second certificate relating to the portable communicating object,
in the portable communicating object, signing the secure access file with a private key relating to the second certificate so that the agent validates the signed secure access file with the second certificate.
5. A method according to claim 1 , wherein the secure access file comprises an enciphered key and the adapted access right, the enciphered key being produced by applying the adapted key to an algorithm whose key is a public key of the certificate relating to the agent.
6. A method according to claim 1 , also comprising, when the portable communicating object is associated with a second terminal, the steps of:
accessing a certificate relating to an agent of the second terminal and a type of digital right used by the agent of the second terminal,
adapting the key and access right and modifying the secure digital content, according to the type of digital right used by the agent of the second terminal, and
producing a second secure access file according to the formatted access right, formatted key and certificate relating to the second terminal, the second secure access file being accessible to the second terminal so that the agent of the other terminal processes the secure digital content modified according to the second secure access file.
7. A system for managing secure access to a secure digital content enciphered with a key in a portable communicating object associated with a terminal, the terminal comprising an agent for processing the secure digital content that is transmitted by a first server to the terminal over a communication network, the system comprising:
a means in the portable communicating object for accessing a certificate relating to the agent and a type of digital right used by the agent,
a means in the portable communicating object for storing the key and an access right, both relating to the secure digital content, transmitted from a second server,
a means in the portable communicating object for comparing the type of digital right used by the agent and the received access right relating to the secure digital content,
a means in the portable communicating object for adapting the key and the received access right and modifying the secure digital content, according to the type of digital right used by the agent, if the type of digital right used by the agent and the received access right relating to the secure digital content are different, and
a means in the portable communicating object for producing a secure access file according to the adapted access right, the adapted key and the accessed certificate, the secure access file being accessible to the terminal so that the agent processes the secure digital content modified according to the secure access file, if the type of digital right used by the agent and the received access right relating to the secure digital content are different.
8. A system according to claim 7 , in which the communication network comprises a radio communication network.
9. A portable communicating object for managing secure access to a secure digital content enciphered with a key, the portable communicating object being associated with a terminal, comprising an agent for interpreting the secure digital content that is transmitted by a first server to the terminal over a communication network, and further comprising:
a means for accessing a certificate relating to the agent and a type of digital right used by the agent,
a means for storing the key and an access right both relating to the secure digital content, transmitted from a second server,
a means for comparing the type of digital right used by the agent and the received access right relating to the secure digital content,
a means for adapting the key and the received access right and modifying the secure digital content, according to the type of digital right used by the agent, if the type of digital right used by the agent and the received access right relating to the secure digital content are different, and
a means for producing a secure access file according to the adapted access right, the adapted key and the accessed certificate, the secure access file being accessible to the terminal so that the agent processes the secure digital content modified according to the secure access file, if the type of digital right used by the agent and the received access right relating to the secure digital content are different.
10. A portable communicating object according to claim 9 , wherein said portable communicating object comprises a chip card.
11. A non-transitory computer-readable medium having encoded thereon a computer program able to be used in a portable communicating object for managing secure access to a secure digital content enciphered with a key, the portable communicating object being associated with a terminal comprising an agent for processing the secure digital content that is transmitted by a first server to the terminal through a communication network, the program comprising instructions that, when the program is executed in said portable communicating object, performs the steps of:
accessing a certificate relating to the agent and a type of digital right used by the agent,
storing the key and an access right both relating to the secure digital content, transmitted from a second server,
comparing the type of digital right used by the agent and the received access right relating to the secure digital content,
adapting the key and the received access right and modifying the secure digital content, according to the type of digital right used by the agent, if the type of digital right used by the agent and the received access right relating to the secure digital content are different, and
producing a secure access file according to the adapted access right, the adapted key and the accessed certificate, the secure access file being accessible to the terminal so that the agent processes the secure digital content modified according to the secure access file, if the type of digital right used by the agent and the received access right relating to the secure digital content are different.