Method and system for secure communication
A method and system for secure communication is provided. The method for secure communication with devices includes: obtaining a parameter for protecting a content; authenticating each other by exchanging a certificate with the device; and exchanging a key with the device using a key authenticated through the certificate to establish a secure authenticated channel with the device. Accordingly, it is possible to establish the secure authenticated channel and perform secure communication by computing a secure authenticated channel key.
1. A secure communication method between devices, the method comprising:
obtaining, by a first device from a second device, a parameter for protecting a content;
performing, based on the obtained parameter, a mutual authentication with the second device which includes:
transmitting a first authentication message including a certificate of the first device to the second device;
receiving a second authentication message including a certificate of the second device and an on-line certificate status protocol server response indicating verification of the certificate of the second device, and
verifying the certificate of the second device using the on-line certificate status protocol server response;
authenticating the second device using the certificate of the second device;
exchanging a key with the second device, the key authenticated through the certificate of the second device to establish a secure authenticated channel with the second device; and
changing a content license protection mode corresponding to the content from a first content license protection mode to a second content license protection mode when the content is copied or moved from the second device;
wherein the content license protection mode includes any one of: a secure authenticated channel protection mode which protects the license using a secure authenticated channel key during transfer of the license, an authorized domain secret protection mode which protects the license using an authorized domain secret protection, a secure authenticated channel/authorized domain protection mode which protects the license through the secure authenticated channel and authorized domain secret protection, and a device key protection mode which protects the license using a device key during storage of the license.
2. The method of claim 1 , wherein exchanging the key with the device comprises computing a key value required to compute the secure authenticated channel key to be used in the secure authenticated channel, and transferring and receiving the key value to and from the device, respectively.
3. The method of claim 2 , wherein the parameter includes at least one of: identification information of the second device, type of an authentication, a security level for setting a level related to integrity and confidentiality during secure communication between the first device and the second device, and a license protection mode level required for the secure communication between the first device and the second device.
4. The method of claim 1 , wherein the license protection mode is set according to usage state information included in the license of the content, and the method further comprises:
confirming whether a license protection mode level of the parameter corresponds to the license protection mode included in the license of the content.
5. A secure communication system comprising:
a first device; and
a second device, which are interoperable with each other,
wherein the first device is configured to:
obtain from the second device a parameter for protecting a content,
perform, based on the obtained parameter, a mutual authentication with the second device by:
transmitting a first authentication message including a certificate of the first device to the second device,
receiving a second authentication message including a certificate of the second device and an on-line certificate status protocol server response indicating verification of the certificate of the second device, and
verify the certificate of the second device using the on-line certificate status protocol server response,
authenticate the second device using the certificate of the second device,
exchange a key with the second device, the key authenticated by the certificate of the second device to establish a secure authenticated channel between the first device and the second device, and
change a content license protection mode corresponding to the content from a first content license protection mode to a second content license protection mode when the content is copied or moved between the first device and the second device,
wherein the content license protection mode includes any one of: a secure authenticated channel protection mode which protects the license using a secure authenticated channel key during transfer of the license, an authorized domain secret protection mode which protects the license using an authorized domain secret protection, a secure authenticated channel/authorized domain protection mode which protects the license through the secure authenticated channel and authorized domain secret protection, and a device key protection mode which protects the license using a device key during storage of the license.
6. The system of claim 5 , wherein the first device and the second device compute key values required to compute the secure authenticated channel key to be used in the secure authenticated channel and exchange the key values with each other.
7. The system of claim 5 , wherein the parameter includes at least one of: identification information of the second device, type of an authentication, a security level for setting a level related to integrity and confidentiality during secure communication between the first device and the second device, and a license protection mode level required for the secure communication between the first device and the second device.