GY/T 277-2019Technical specification of digital rights management for video audio content distribution (English PDF)

5.1 Overview

This standard defines the end-to-end logical architecture of digital rights management for video and audio content distribution based on cryptographic technology, PKI technology and authorization technology, Content authorization, key management, security mechanisms, and trust models. Adopt the logical architecture, technical mechanism, basic format and protocol defined in this standard, can build an end-to-end digital rights management system for video and audio content distribution.

5.2 Logical architecture

Digital rights management system for digital distribution of video and audio content is logically divided into two parts, a DRM server and a DRM client, as shown in Figure 1.

The DRM server system includes core modules such as content encryption, key management, key gateway, and content authorization. Content encryption module uses content plus the secret key (CEK) encrypts and protects the video and audio content; the key management module is responsible for synchronizing the key to the secret after receiving the content encryption key Key gateway; the key gateway module secretly stores the content encryption key after receiving the synchronized key, and receives the secret from the content authorization module Key query; the content authorization module receives the request from the DRM client and will send the license containing the content encryption key and key usage rules securely.

To a legitimate DRM client. After the DRM client receives the license, it decrypts the content encryption key reasonably in accordance with the key usage rules and uses the content encryption key decrypts the content for playback.

Each module of the DRM server, DRM client, etc. establish a trust relationship based on PKI technology, and based on this trust relationship, secure each other.

Communication.

Content encryption

Key management key gateway content authorization Protected content license Protected CEK Rules of use Certificate management Client application DRM Client Live/on-demand CEK CEK DR M service CR OC SP DRM server DRM client CEK DRM Client certificate

Figure 1 Digital rights management logic architecture for video and audio content distribution

5.3 Content authorization

The audio and video content distribution digital rights management system implements the content authorization and authorization based on the mechanism of associating hierarchical keys with key usage rules.

Logically, the keys can be divided into multiple levels according to the order of their encryption protection. The key that encrypts the current key is called the superior key. At every level Keys have corresponding key usage rules, and the current key can only be decrypted under the conditions specified by the superior key usage rules; each key There may also be multiple key usage rules. Keys can only be used if they meet all their usage rules. Key and key usage the mechanism of rule association is shown in Figure 2.

Key1

Key2

KeyRules1

KeyRules2

KeyN KeyRulesN

Figure 2 Key and key usage rule association mechanism

Key usage rules generally include start time, deadline time, time period, number of times, cumulative time period, output rules, client security Level, etc. Different types of keys may also include special key usage rules.

The start time indicates that the key is not allowed to be used until a certain time.

The deadline indicates that the key is allowed to be used before a certain time.

The time period indicates that the key is allowed to be used for a certain period of time after the first use.

The number of times indicates the number of times the key was used. One successful decryption using the key counts as one. If the key is used to decrypt digital media, the body content key defaults to 1 successful decryption and playback count, that is, the DRM client completes 1 content decryption and exits securely.

The cumulative time period is the accumulation of the client player's time from playing to stopping.

Interval, this key is no longer allowed to be used; cumulative time periods are generally used for preview scenes, such as a movie with a duration of 90 minutes, cumulative playback is allowed After playing for 10 minutes, the user can choose to play the content anywhere in the movie, but the total cannot exceed 10 minutes.

The output rules specify whether the decoded content data is allowed to be output to other devices after the content is decrypted using the content encryption key, and Allowable output range and method. Without output rules, the output method is not limited.

The client security level requirement indicates that only DRM clients with a specific security level can access the content when using the content encryption key to decrypt the content.

Decryption playback, client security level requirements are divided into software security level, hardware security level, enhanced hardware security level, client security the level requirement is stored in the DRM client certificate. Only the security level in the DRM client certificate is equal to or higher than that specified in the key usage rules.

When the security level of the client is required, the content encryption key can be used to decrypt and play or output the content.

If there is no corresponding key usage rule, it means that there are no restrictions on the use of the key.

Video and audio content distribution digital rights management systems may contain multiple types of keys, such as content encryption keys, device keys, sessions Key, message verification code key.

a) Content encryption key A content encryption key is a key that encrypts digital media content; a content may have multiple content encryption keys. Content encryption the key usage rules of the key include. start time, deadline time, time period, number of times, cumulative time period, output rules, customers Security level requirements.

b) session key

The session key is a temporary key generated when the client applies for a license. This key is used to encrypt and protect the content encryption key.

c) Message verification code key the message captcha key is a temporary key that generates a message captcha to protect the integrity of the license.

d) device key

The device key refers to the key pair of the DRM client. The device key should be an asymmetric key. The data encrypted by the device public key is only A DRM client can decrypt it.

The DRM server uses the content encryption key to encrypt digital media content, and the content encryption key and other content-related keys (such as Key, message verification code key, etc.) are encrypted with hierarchical key encryption method and packaged with the key usage rules corresponding to each key the content authorization license is sent to the DRM client, and the DRM client uses the key in accordance with the usage rules of the key at each level in the hierarchical key system to implement Decrypted playback of digital media content. The content authorization mechanism of the digital rights management system for video and audio content distribution is shown in Figure 3.

Protected content

Protected CEK usage rules license CEK protected Session key Rules of use Content information DRM Client Public key is authorized Object digital signature content

Figure 3 Content authorization mechanism

5.4 Key Management

Video and audio content distribution digital rights management system DRM server and DRM client have their own asymmetric key pairs Code algorithm for license acquisition. The DRM server uses a symmetric cryptographic algorithm to encrypt the content.

The certificate can be sent to the DRM client. The key management mechanism of digital rights management system for video and audio content distribution is shown in Figure 4.

DRM Client

Private key

License acquisition

DRM Client

Public key

Session key

Content key

Content

encrypt and decode

encrypt and decode

encrypt and decode

DRM client DRM server license

Figure 4 Key management mechanism

The DRM server and DRM client certificates contain their own public keys. The DRM server and DRM client securely protect their own private certificates.

key.

Video and audio content is encrypted using a symmetric cryptographic algorithm; the DRM server generates a session key, and uses the session key to encrypt the content encryption key;

The DRM server uses the DRM client public key to encrypt the session key. If the content encryption key needs to be synchronized to the key gateway, the key gateway public is used.

Key encryption; the DRM server encapsulates the encrypted session key and encrypted content encryption key in a license and sends it to the DRM client;

It can be proved that the integrity of the license is guaranteed by the message verification code.

After receiving the license, the DRM client uses the private key of the DRM client to decrypt the session key, and then uses the decrypted session key to decrypt the content Encryption key. After the DRM client decrypts the content encryption key, it uses the content encryption key to decrypt the content to achieve content decoding and playback.

5.5 Security Mechanism

The digital rights management security mechanism for video and audio content distribution specified in this standard is as follows.

a) Data confidentiality Data confidentiality should be protected by encryption. Sensitive data includes at least protected content and content encryption keys.

b) identification

Identity authentication shall be implemented by verifying the validity of the digital certificate of the other party between the DRM client and the DRM server.

c) data integrity

Data integrity testing shall be verified by the digital signature of the protocol message and the message verification code on the license.

5.6 Trust Model

The trust model of AV rights digital rights management system is based on the PKI system. Core components of DRM server in DRM system, DRM customers the parties have applied to the certification center to obtain a digital certificate as a credential for their identity. The trust relationship between them is based on the Effectiveness. If the DRM client's certificate is validated by the DRM server, the DRM server trusts the DRM client.

Digital certificates are the basis for establishing a trust system in DRM systems. The DRM client needs to be associated with a digital certificate. Each DRM client should Carry at least one digital certificate. Each DRM client must have a unique identifier, this unique identifier should be in the appropriate field of the digital certificate Loading.

Video and audio content distribution digital rights management system trust chain includes root CA certificate, DRM service terminal CA certificate, DRM client sub CA certificate, DRM server certificate, DRM client certificate, and OCSP server certificate. The security trust mechanism is shown in Figure 5.

DRM Client

Child CA

DRM service terminal CA Root CA DRM service terminal CA DRM Client Child CA DRM server certificate DRM client certificate OCSP server certificate

Figure 5 Security and trust mechanism

After the trust chain is established, the DRM server securely stores the DRM server certificate and private key, the OCSP server certificate, and the DRM service terminal CA.

Certificate, root CA certificate; DRM client securely stores DRM client certificate and private key, DRM client sub CA certificate, root CA certificate.

The DRM server judges the validity of the DRM client certificate based on the DRM client certificate CRL list, and the DRM client judges based on the OCSP response the validity of the DRM server certificate.

This standard specifies digital certificate formats, online certificate authentication protocols, and certificate revocation in digital rights management systems for the distribution of video and audio content.

The format of the list is shown in Appendix A.

6.1 Overview

This chapter specifies content encryption methods and encrypted content packaging formats for digital rights management systems for the distribution of video and audio content. The encrypted content should Contains information necessary for content identification and obtaining a license. According to different application scenarios, different encrypted content packaging formats need to be defined.

6.2 Content encryption method

6.2.1 Overview

Video and audio content distribution digital rights management system encrypts the basic stream of video content and adds the content encryption information CEI is used to indicate how subsequent videos are encrypted. The CEI includes the encryption identifier, the current content encryption key identifier, the next content encryption key identifier and the initial vector corresponding to the current content encryption key. Before the next CEI appears, all the video data is encrypted in accordance with the methods specified in 6.2.2 to 6.2.4. The data to be encrypted in each video frame uses the initial data in the current CEI.

Starting vector. The CEI data syntax format is shown in Table 1.

Table 1 CEI data syntax format

Grammar

CEI_DATA () {

encryption_flag 1

next_key_id_flag 1

reserved 5

if (encryption_flag == 1) { current_key_id 128 if (next_key_id_flag == 1) { next_key_id 128 IV_length 8 IV IV_lengthx8 encryption_flag. Identifies whether the video data after this extended data is encrypted.

next_key_id_flag. Identifies whether the CEI data contains the next key identifier.

current_key_id. Identifies the key identifier used for subsequent video encryption.

next_key_id. Identifies the next key identifier that will be used for video encryption; this way, the terminal can advance to the server applies for this key.

IV_length. Initial vector length of the encryption algorithm.

IV. Initial vector of the encryption algorithm.

6.2.2 Advanced Audio and Video Encoding and Decoding and Efficient Audio and Video Encoding and Decoding for Radio and Television in the video stream formats specified by GY/T 257.1-2012 and GY/T 299.1-2016, CEI data is placed in sequence_header After extension_data. The following is described in the syntax format in GY/T 299.1-2016. The CEI data storage location is as follows.

extension_data (i) { while (next_bits (32) == extension_start_code) { extension_start_code if (i == 0) {/ * after the sequence header * /if (next_bits (4) == '1101')/* CEI * /CEI () the CEI syntax is shown in Table 2.

Table 2 CEI syntax

Grammar bit description CEI () { extension_id 4 '1101' reserved 4 CEI_DATA () see table 1 GY/T 299.1-2016 stipulates that the encryption of video coded content contains CEI data in extension_and_user_data (0) Extended information, which encrypts the strips in each frame of data. After encryption, only the header information of the first stripe is reta...