Abstract:
The present invention particularly relates, but is not limited to, a technology that facilitates the identification of a consumed content item and a user who consumed that item, and there is provided a proxy server that is capable of communicating with a client and a content server storing content for which permission data is required for reproduction. The proxy server comprises, in particular, a content information retrieving unit that retrieves, from the content server, content information that identifies the content server and the content, and a generating unit that generates modified content information that identifies the proxy server and the content identified by the content information.

Description:
TECHNICAL FIELD 
       [0001]    The present invention generally relates to a proxy server, a method for controlling the proxy server, a content server, and a method for controlling the content server. The present invention particularly relates, but is not limited to, a technology that facilitates the identification of a consumed content item and a user who consumed that item. 
       BACKGROUND 
       [0002]    Currently, a so-called “virtual Digital Media Server (vDMS)” is known. One of the examples of the vDMS is TVersity Media Server, information about which may be found at http://tversity.com/. The vDMS is located between a content server and a Universal Plug and Play (UPnP)-enabled Digital Media Player (DMP), and provides the UPnP-enabled DMP with a UPnP Content Directory Service (CDS) regarding the content server. In other words, the UPnP-enabled DMP can obtain a content list of a content server via the vDMS. 
         [0003]    In addition, an IP Multimedia Subsystem (IMS) Gateway (IG), which is a kind of a User Equipment (UE), is known. The IG works as a Session Initiation Protocol (SIP) Back-to-back User Agent (B2BUA) and provides IMS-incapable devices (e.g., DMPs) with IMS connections. A basic configuration of an IG is proposed in, for example, WO 2006/045706. 
         [0004]    If the vDMS cooperates with the IG, the vDMS can provide a DMP with a content list of a content server via an IMS network. In other words, a combination of the vDMS and the IG enables the DMP to obtain the content list of the content server via the IMS network. In this scenario, a DMP first obtains a content list of a content server via the vDMS. When a certain content item is selected from the content list by a user, the DMP sends an HTTP GET message to the content server storing the selected content item in order to retrieve it. It should be noted that the HTTP GET message and the selected content item are exchanged between the DMP and the content server without going through the vDMS and the IMS network. 
         [0005]    Recently, content stored by a content server is often protected by means of a Digital Rights Management (DRM) technology such as Open Mobile Alliance (OMA) DRM 2.0. In the case of OMA DRM 2.0, a DMP receives a content item in the form of DRM Content Format (DCF). If the DMP receives a DCF content item, it acquires from a Rights Issuer a Rights Object (RO), which enables reproduction of the DCF content item, by means of OMA DRM Rights Object Acquisition Protocol (ROAP). When an RO is requested, the Rights Issuer authenticates the DMP based on the DMP&#39;s device certificate. Similar to the case of a content item, an RO is sent from a Rights Issuer to a DMP without going through the vDMS and the IMS network. 
         [0006]    Content providers often require the charging of a user of a DMP for consumption (typically, reproduction) of content. In particular, content providers often require that an IMS operator carry out charging on their behalf because the IMS operator usually has information regarding the user, which is sufficient to facilitate charging. 
         [0007]    However, because content items and ROs are received by a DMP without going through the vDMS and the IMS network as described above, it is quite difficult or impossible for the IMS operator to identify who consumed a given content item. Consequently, it is impossible for content providers to efficiently and appropriately charge users. 
       SUMMARY 
       [0008]    The present invention is intended to address the above-described problem, and it is a feature thereof to introduce a technology that facilitates the identification of a consumed content item and a user who consumed that item. 
         [0009]    According to a first aspect of the present invention, there is provided a proxy server that is capable of communicating with a client and a content server storing content for which permission data is required for reproduction, the proxy server comprising: 
         [0010]    a content information retrieving unit that retrieves, from the content server, content information that identifies the content server and the content; 
         [0011]    a generating unit that generates modified content information that identifies the proxy server and the content identified by the content information; 
         [0012]    a modified content information sending unit that sends the modified content information to the client; 
         [0013]    a content request receiving unit that receives, from the client, a request for the content identified by the modified content information; 
         [0014]    a permission server information retrieving unit that retrieves, from the content server identified by the content information identifying the requested content, permission server information that identifies a permission server capable of creating the permission data for the requested content, wherein the permission server information retrieving unit sends, to the content server, proxy server information that identifies the proxy server; 
         [0015]    a content information sending unit that sends the content information to the client as a response to the request for the content; 
         [0016]    a permission request receiving unit that receives, from the client, a request for the permission data for the requested content; 
         [0017]    a permission data retrieving unit that retrieves the requested permission data from the permission server; and 
         [0018]    a permission data sending unit that sends the requested permission data to the client as a response to the request for the permission data. 
         [0019]    According to a second aspect of the present invention, there is provided a method for controlling a proxy server that is capable of communicating with a client and a content server storing content for which permission data is required for reproduction, the method comprising steps of: 
         [0020]    retrieving, from the content server, content information that identifies the content server and the content; 
         [0021]    generating modified content information that identifies the proxy server and the content identified by the content information; 
         [0022]    sending the modified content information to the client; 
         [0023]    receiving, from the client, a request for the content identified by the modified content information; 
         [0024]    retrieving, from the content server identified by the content information identifying the requested content, permission server information that identifies a permission server capable of creating the permission data for the requested content, wherein said step of retrieving sends, to the content server, proxy server information that identifies the proxy server; 
         [0025]    sending the content information to the client as a response to the request for the content; 
         [0026]    receiving, from the client, a request for the permission data for the requested content; 
         [0027]    retrieving the requested permission data from the permission server; and 
         [0028]    sending the requested permission data to the client as a response to the request for the permission data. 
         [0029]    According to a third aspect of the present invention, there is provided a content server that stores content for which permission data is required for reproduction and that is capable of communicating with a proxy server and a client, the content server comprising: 
         [0030]    a content information sending unit that sends, to the proxy server, content information that identifies the content server and the content; 
         [0031]    a permission server information request receiving unit that receives, from the proxy server, a request for permission server information that identifies a permission server capable of creating the permission data for the content, the request containing proxy server information that identifies the proxy server; 
         [0032]    a permission server information sending unit that sends the permission server information to the proxy server as a response to the request for the permission server information; 
         [0033]    a content request receiving unit that receives, from the client, a request for the content; and 
         [0034]    a proxy server information sending unit that sends, to the client, the proxy server information as a response to the request for the content. 
         [0035]    According to a fourth aspect of the present invention, there is provided a method for controlling a content server that stores content for which permission data is required for reproduction and that is capable of communicating with a proxy server and a client, the method comprising steps of: 
         [0036]    sending, to the proxy server, content information that identifies the content server and the content; 
         [0037]    receiving, from the proxy server, a request for permission server information that identifies a permission server capable of creating the permission data for the content, the request containing proxy server information that identifies the proxy server; 
         [0038]    sending the permission server information to the proxy server as a response to the request for the permission server information; 
         [0039]    receiving, from the client, a request for the content; and 
         [0040]    sending, to the client, the proxy server information as a response to the request for the content. 
         [0041]    The main advantage of the present invention is as follows. According to the present invention, the proxy server that is capable of retrieving a user identity intercepts acquisition of content and permission data. Accordingly, the acquisition of content and permission data can be associated with the user identity efficiently, and it becomes easier for a network operator to charge for the acquisition on behalf of content providers. 
         [0042]    Further features of the present invention will become apparent from the following description of exemplary embodiments with reference to the attached drawings, in which like reference characters designate the same or similar parts throughout the figures thereof. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0043]      FIG. 1  illustrates an overview of an IP Multimedia Subsystem (IMS) Gateway (IG) according to an embodiment of the present invention; 
           [0044]      FIG. 2  is a functional block diagram of a virtual Digital Media Server (vDMS) according to the embodiment of the present invention; 
           [0045]      FIG. 3  is a functional block diagram of an authentication proxy according to the embodiment of the present invention; 
           [0046]      FIG. 4  is a functional block diagram of a content server according to the embodiment of the present invention; 
           [0047]      FIG. 5  is a sequence diagram illustrating a procedure according to the embodiment of the present invention. 
           [0048]      FIG. 6  is a sequence diagram illustrating a procedure that follows  FIG. 5 ; 
           [0049]      FIG. 7  illustrates an XML schema of a Rights Object Acquisition Protocol (ROAP) Trigger; and 
           [0050]      FIG. 8  is a sequence diagram illustrating an alternative procedure that corresponds to  FIG. 6 . 
       
    
    
     DETAILED DESCRIPTION 
       [0051]    Embodiments of the present invention will now be described with reference to the attached drawings. Each embodiment described below will be helpful in understanding a variety of concepts from the generic to the more specific. 
         [0052]    It should be noted that the technical scope of the present invention is defined by the claims, and is not limited by each embodiment described below. In addition, not all combinations of the features described in the embodiments are always indispensable for the present invention. 
         [0053]      FIG. 1  illustrates an overview of an IG  100  according to an embodiment of the present invention. The IG  100  comprises a Universal Integrated Circuit Card (UICC)  110  that stores IMS subscription information such as an IMS Private User Identity (IMPI). The UICC  110  is removable from the IG  100 . 
         [0054]    The IG  100  also comprises a proxy server  120 . The proxy server  120  comprises a vDMS  200  and an authentication proxy  300 . The proxy server  120  (more specifically, the vDMS  200  and the authentication proxy  300 ) is capable of communicating with a client such as a DMP via, for example, a UPnP network. Moreover, the proxy server  120  is capable of communicating with a content server via, for example, an IMS network with support from IMS functionality of the IG  100 . Alternatively, the proxy server  120  may communicate with a content server via the Internet without support from the IG  100 . 
         [0055]      FIGS. 2 and 3  are functional block diagrams of the vDMS  200  and the authentication proxy  300 , respectively. The operations of each block in the vDMS  200  and the authentication proxy  300  will be described later with reference to the sequence diagrams of  FIGS. 5 ,  6 , and  8 . It should be noted that the functionality of each block in the vDMS  200  and the authentication proxy  300  may be implemented by dedicated hardware, software executed by a processor (not shown) or a combination thereof. 
         [0056]      FIG. 4  is a functional block diagram of a content server  400  according to the embodiment of the present invention. The content server  400  is capable of communicating with the proxy server  120  (more specifically, the vDMS  200  and the authentication proxy  300 ) via, for example, an IMS network with support from IMS functionality of the IG  100 . Moreover, the content server  400  is capable of communicating with a client such as a DMP via, for example, the Internet. Furthermore, the content server  400  stores content protected by means of a DRM technology such as OMA DRM 2.0. In other words, permission data such as an RO is required for reproduction of the content stored in the content server  400 . 
         [0057]    In  FIG. 4 , the content server  400  comprises a permission server  410 , which is capable of creating ROs. However, the permission server  410  may be located separately from the content server  400 , as long as it can be accessed from the proxy server  120  (more specifically, the authentication proxy  300 ). The permission server  410  acts as a Generic Bootstrapping Architecture (GBA) Network Application Function (NAF), which is known to a person skilled in the art through, for example, 3GPP TS33.220 V7.3.0 (2006-03). In addition, the authentication proxy  300  acts as a GBA client. Accordingly, a communication channel between the permission server  410  and the authentication proxy  300  can be protected by GBA. In an alternative embodiment, the permission server  410  is located behind a GBA Authentication Proxy server, which is known to a person skilled in the art through, for example, 3GPP TS33.222 V7.1.0 (2006-03), and it is not necessary for the permission server  410  to act as a GBA NAF. 
         [0058]    The operations of each block in the content server  400  will be described later with reference to sequence diagrams of  FIGS. 5 ,  6 , and  8 . It should be noted that the functionality of each block in the content server  400  may be implemented by dedicated hardware, software executed by a processor (not shown) or a combination thereof. 
         [0059]      FIG. 5  is a sequence diagram illustrating a procedure according to the embodiment of the present invention. In the present embodiment, it is assumed that a DMP  500 , which is equipped with UPnP functionality, obtains content from the content server  400 . The DMP  500  comprises a DRM agent  501 , which obtains ROs from the permission server  410  so as to reproduce protected content. 
         [0060]    In step S 501 , the identity retrieving unit  301  of the authentication proxy  300  (see  FIG. 3 ) retrieves a user identity that identifies a user of the proxy server  120 . In the present embodiment, the user identity is an IMPI and retrieved from the UICC  110 . 
         [0061]    In step S 502 , the bootstrapping unit  302  performs bootstrapping procedure with a Bootstrapping Server Function (BSF)  520  using the IMPI. As a result of the bootstrapping procedure, a Bootstrap Transaction Identifier (B-TID) is shared between the authentication proxy  300  and the BSF  520 . 
         [0062]    In step S 503 , the DMP  500  executes a UPnP discovery to discover the vDMS  200 . 
         [0063]    In step S 504 , the DMP  500  sends a UPnP CDS::browse request to the vDMS  200 . 
         [0064]    In step S 505 , the content information retrieving unit  201  of the vDMS  200  (see  FIG. 2 ) sends, through the IMS network  510  to the content server  400 , a SIP SUBSCRIBE message that requests a content list of the content server  400 . The SIP SUBSCRIBE message is eventually received by the content information sending unit  401  of the content server  401  (see  FIG. 4 ). Note that the content server  400  can securely identify a source of the SIP SUBSCRIBE message by means of, for example, P-Asserted-Identity or any other identification mechanism agreed between the IMS operator and the content provider operating the content server  400 . 
         [0065]    In step S 506 , the content information sending unit  401  sends a SIP NOTIFY message including CDS data (i.e., the content list) to the vDMS  200 . The SIP NOTIFY message is eventually received by the content information retrieving unit  201 . 
         [0066]    In step S 507 , the generating unit  202  generates a modified content list. In the modified content list, content URLs in the CDS data, which identify (i.e., locate) the content server  400 , are altered so that they identify the vDMS  200 . For example, if an original content URL is http://ptv.example.com/content?cid=001, it is altered to http://192.168.1.1:8080/content?cid=001; “192.168.1.1:8080” is a listening IP address and port of the vDMS  200 . This step makes it possible for the vDMS  200  to intercept a request for content by the DMP  500  as described in step S 509 . 
         [0067]    In step S 508 , the modified content information sending unit  203  sends the modified content list to the DMP  500 . 
         [0068]    In step S 509 , the DMP  500  sends an HTTP GET message to one of the content URLs in the modified content list, which is selected by, for example, a user of the DMP  500 . The content request receiving unit  204  receives the HTTP GET message as a request for the selected content item. 
         [0069]    In step S 510 , the permission server information retrieving unit  205  sends a SIP INVITE message to the content server  400 . The SIP INVITE message contains QoS parameters, the requested content URL before modification (e.g., http://ptv.example.com/content?cid=001), and a URL of the authentication proxy  300  (e.g., http://192.168.1.1:7070/auth_proxy?sid=123); “sid=123” is a session identifier. It should be noted that the permission server information retrieving unit  205  can recognize the original content URL because both the original content URL and the modified content URL identify the same content item by means of “cid=001”. The SIP INVITE message is eventually received by the permission server information request receiving unit  402  of the content server  400 . The permission server information request receiving unit  402  stores the received URL of the authentication proxy  300  in association with the current content delivery session identified by, for example, a session identifier such as “session=456” assigned by the content server  400 . 
         [0070]    In step S 511 , the permission server information sending unit  403  sends a 200 OK message to the vDMS  200 . The 200 OK message contains QoS parameters, a Rights Object Acquisition Protocol (ROAP) URL that identifies the permission server  410  which is capable of creating an RO for the content item identified by the content URL in the SIP INVITE message (e.g., http://ro.example.com/roap?session=456), and a content URL indicating the content location associated with the content delivery session identified by “session=456” to which the DMP  500  is redirected later in step S 512  (e.g., http://ptv.example.com/content?cid=001&amp;session=456). The 200 OK message is eventually received by the permission server information retrieving unit  205  of the vDMS  200 . The permission server information retrieving unit  205  stores the received ROAP URL in association with the session identifier “sid=123” so that the authentication proxy  300  can identify this received ROAP URL later (step S 603  of  FIG. 6 ). 
         [0071]    In step S 512 , the content information sending unit  206  sends a  302  Redirection message to the DMP  500  as a response to the request of step S 509 . The  302  Redirection message contains the content URL received in step S 511  (i.e., http://ptv.example.com/content?id=001&amp;session=456). 
         [0072]    In step S 513 , the DMP  500  sends an HTTP GET message to the content URL received in step S 512 . The HTTP GET message is eventually received by the content request receiving unit  404  of the content server  400 . 
         [0073]      FIG. 6  is a sequence diagram illustrating a procedure that follows  FIG. 5 . 
         [0074]    In step S 601 , the proxy server information sending unit  405  sends a 200 OK message to the DMP  500  as a response to the HTTP GET message of step S 513 . The 200 OK message is in the form of multipart/related. One entity of the 200 OK message is a DCF content item and the other entity is a ROAP Trigger (an XML schema of which is shown in  FIG. 7 ) for use in RO acquisition. In the present embodiment, a ROAP URL contained in the ROAP Trigger is the URL of the authentication proxy  300  received in step S 510  (i.e., http://192.168.1.1:7070/auth_proxy?sid=123). It should be noted that the proxy server information sending unit  405  can recognize the ROAP URL which should be sent because the HTTP GET message of step S 513  contains a session identifier (e.g., “session=456”) and the session identifier is associated with the ROAP URL in step S 510 . The 200 OK message is eventually received by the DRM agent  501  of the DMP  500 . 
         [0075]    In step S 602 , the DRM agent  501  sends an HTTP POST message to the ROAP URL contained in the ROAP Trigger of step S 601 . The HTTP POST message contains a RORequest, which requests for the RO specified by the ROAP Trigger. The HTTP POST message is eventually received by the permission request receiving unit  303  of the authentication proxy  300  (see  FIG. 3 ). 
         [0076]    In step S 603 , the permission data retrieving unit  304  forwards the HTTP POST of the RORequest to the permission server  410  identified by the ROAP URL received in step S 511  together with the B-TID obtained in step S 502  and an authentication information associated with the B-TID. The HTTP POST message is eventually received by the permission request receiving unit  411  of the permission server  400 . It should be noted that the permission data retrieving unit  304  can identify the permission server  410  because the HTTP POST message of step S 602  contains the session identifier (i.e., “sid=123”), which is associated with the ROAP URL that identifies the permission server  410  in step S 511 . 
         [0077]    In step S 604 , the permission request receiving unit  411  authenticates the authentication proxy  300  based on one of the defined mechanisms for GBA Ua authentication defined by 3GPP TS24.109 V7.3.0 (2006-06). For example, the permission request receiving unit  411  verifies the authentication information and the B-TID received in step S 603  by inquiring the BSF  520 . This authentication enables the permission server  410  to associate the RO acquisition with the IMPI of the IG  100  in a trusted and secure manner. Accordingly, it becomes easier for the IMS operator of the IMS network  510  to charge for the RO acquisition on behalf of the content provider. In step S 604 , permission request receiving unit  411  also authenticates the source of the RORequest (i.e., the DMP  500 ) based on the digital signature and deyice certificate attached to the RORequest. 
         [0078]    In step S 605 , the permission data sending unit  412  sends, by use of a HTTP 200 OK message, a ROResponse that contains the requested RO to the authentication proxy  300  as a response to the request of step S 603 . The 200 OK message is eventually received by the permission data retrieving unit  304 . It should be noted that the permission data sending unit  412  may not send the RO if the authentication of step S 604  fails. 
         [0079]    In step S 606 , the permission data sending unit  305  forwards the ROResponse to the DRM agent  501 . 
         [0080]    In step S 607 , the DMP decrypts the DCF content by using a content encryption key in the RO and starts reproduction of the content. 
         [0081]    In the present embodiment, it is assumed that a DCF content item and an RO are separately delivered in step S 601  and S 606 . However, the content server  400  may be configured to deliver the DCF content item and the RO together. 
         [0082]      FIG. 8  is a sequence diagram illustrating an alternative procedure that corresponds to  FIG. 6 . In  FIG. 8 , steps in which the same operations are performed as those in  FIG. 6  have the same reference numerals as steps in  FIG. 6 , and a description thereof is omitted. 
         [0083]    In step S 801 , different from step S 601 , the 200 OK message does not contain a DCF content. 
         [0084]    In steps S 805  and S 806 , the HTTP 200 OK message contains a DCF content that is requested in step S 513  in addition to an RO. 
         [0085]    In the above embodiments, it is assumed that the proxy server  120  communicates with the content server  400  via the IMS network  510 . However, the proxy server  120  may communicate with the content server  400  via the Internet, without going through the IMS network  510 . In this case, the IG  100  is not necessary to implement the present invention as long as the proxy server  120  can retrieve a user identity such as an IMPI in step S 501 . Moreover, message types are modified accordingly; for example, the SIP messages of steps S 505 , S 506 , S 510 , and S 511  can be HTTP messages while these HTTP messages may be authenticated through GBA in the same manner as steps S 603  and S 604  where necessary. Even if the IMS network  510  does not involve communication between the proxy server  120  and the content server  400 , the content server  400  (more specifically, the permission server  410 ) can associate the RO acquisition with the IMPI because the B-TID, which is associated with the IMPI, is received in step S 603  of  FIG. 6  or  FIG. 8 . 
         [0086]    (Advantages of the Present Invention) 
         [0087]    According to the present invention, as described above with reference to various embodiments, the proxy server that is capable of retrieving a user identity intercepts acquisition of content and permission data. Accordingly, the acquisition of content and permission data can be associated with the user identity efficiently, and it becomes easier for a network operator to charge for the acquisition on behalf of content providers. 
         [0088]    While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions.