Abstract:
Disclosed is a computerized apparatus and method for version control and management. The apparatus includes a cryptography boot loader, a control module on key usage, and one or more agents. After the user&#39;s device is powered on, the cryptography boot loader stores a user key, and checks an operating system (OS) certificate for an OS and an application certificate for an application to determine whether these certificates are valid. Then, a right object is obtained with a user certificate through an agent. The control module on key usage compares the OS version and the application version with the version required by the right object. The permission access to the user key is determined by the comparison result. This invention associates the cryptography component with the boot loader to develop a security mechanism performed by OS and application for using a secret key.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention generally relates to a computerized apparatus and method for version control and management. 
       BACKGROUND OF THE INVENTION 
       [0002]    The information technology (IT) development allows the digitalization of many daily and business practices. Much information, such as documents, images, video, music and animations, is stored in PC, digital media or mobile devices. Internet enables further sharing of the digital information across borders and time restrictions. As a large amount of digital contents are created and shared, more and more digital contents are stolen and the privacy is violated. The security problem poses a real threat to the wider application of IT. The concept of digital right management (DRM) is a result of the need to regulate the authorization and sharing of information in order to provide protection over the information and related privacy issues. 
         [0003]    DRM technology championed by Open Mobile Alliance (OMA), called OMA DRM, can provide the protection and delivery management of the wireless digital contents. OMA DRM regulation ensures the use of digital contents on mobile devices, such as cell phones, follows the usage right of the object to protect the intellectual property (IP) right of high value digital contents. In other words, the use of OMA DRM allows the digital content providers to exercise the rights in accordance with the digital contents, for example, free examination of DRM content in advance, legitimate delivery of the DRM content according to the access rights, and new business model supporting DRM content. 
         [0004]    In other words, OMA DRM allows the digital content providers to use with the access rights configuration to perform content storage, protection and management so that the DRM mechanism can be added to the hand-held mobile devices, such as in Java, MMS, browser, and Email software as to provide content protection capability. 
         [0005]    Basically, it is important to allow both digital content providers and mobile device users to control the perspective responsibilities in terms of the use of the downloaded media objects. The object downloading is the important means for the media object delivery between mobile devices, and DRM is the important mechanism for controlling the use of media objects when downloading. DRM allows the digital content providers to define access rights of the use of the media objects, and establish the relation between an individual media object and different access rights. Furthermore, different pricing policies can be defined based on different access rights. 
         [0006]    Therefore, the digital content providers can provide users with the rights to free preview of media objects, and charge for different use of the objects. As the object price is determined by the use instead of the object itself, DRM can sell the rights to use instead of the media object itself, which makes more practical sense for media use as well as effective management of DRM. 
         [0007]    In the OMA DRM architecture, it relies on the DRM agent for controlling the right object (RO) rights. However, how the DRM agent controls the RO rights is not defined. Therefore, when a DRM agent checks the RO or executes the content object (CO), the conventional technique may face the following threats, for example, as disclosed in the following documents. 
         [0008]    William et. al. disclosed a bootstrap architecture, as shown in  FIG. 1 . The bootstrap architecture uses an Aegis ROM  101  to download an operating system  105  from a trusted network recovery host  103 . The bootstrap architecture is for secure OS, mainly to prevent the illegitimate users while neither addressing the issue of attack from the legitimate users nor the key usage mechanism. If the user removes the Aegis ROM and rewrites the hacking program, the system will be compromised. For example, an assembly language can be used to rewrite the program to skip the serial number checking or the access right checking block. 
         [0009]    U.S. Pat. No. 6,850,252 disclosed an intelligent electronic appliance system and method. The method to achieve DRM is to allow the intelligent electronic appliance to check the hardware before downloading, and the music or video provided by server is to be distorted for that hardware. Therefore, the music or the video can only be played on that hardware. However, if the user uses assembly language or similar method to rewrite the program, this DRM can be bypassed. 
         [0010]    U.S. Pa. No. 6,820,063 disclosed a method for controlling access to content based on certificates and access predicates, by using the association relation between CPU of the computer system and the operation system to ensure that computerized method will not be replaced. This method checks the correctness of access predicate, OS certificates, and rights manager certificate to control the content access. This particular association is not neither described nor regulated. How to upgrade or process when the bug exists in the OS is neither described nor regulated. The user may use the error in the OS to write a different program to access the CO of the executing DRM agent, or use the error in the OS to execute a memory dump to access the CO stored in the memory. 
         [0011]    U.S. Pat. No. 6,330,670 and U.S. Pat. No. 6,327,652 disclosed a DRM OS and a load and identify DRM OS, respectively. Both documents presented the establishment of trusted identity, whose technique is to hash the OS and store the hashed OS in the CPU. 
         [0012]    This type of trusted platform module (TPM) does not perform RSA encryption and identification; therefore, it cannot perform DRM rights protection stand-alone. 
         [0013]    In addition to the above threats, the conventional techniques do not provide any solution when there is error in the DRM agent or in the OS. 
       SUMMARY OF THE INVENTION 
       [0014]    In an exemplary embodiment, the present disclosure may provide a computerized apparatus and method for version control and management. The present invention is applicable to the DRM of digital contents. For key access management and version upgrade application, the present invention can effectively prevent the key from malicious access by either programs or users. 
         [0015]    In an exemplary embodiment, the present disclosure may provide DRM in a secured OS and application environment. The present invention uses cryptography component and boot loader to ensure only secured OS and secured application can access the secret key of the cryptography component. 
         [0016]    The computerized apparatus in an exemplary embodiment of the present disclosure comprises a cryptography boot loader (CBL) a control module on key usage, and one or more application agents. The control module on key usage may be implemented by software and bundled with OS, or hardware bundled with the cryptography component. 
         [0017]    The operation in an exemplary embodiment of the present disclosure includes how to load the OS and use the application agents, request the user to provide certificate, obtain RO, and check version. 
         [0018]    When the user powers on the apparatus in an exemplary embodiment of the present disclosure, CBL loads the OS and the OS certificate of the user&#39;s device, and stores a user key. Then, an RO can be obtained through a corresponding application agent. According to the OS certificate and an application certificate provided by certificate authority (CA), the RO is checked for OS version and application version to determine whether both OS version and application version are valid and are the version requested by the RO. Only when the loaded OS version and application version are both valid and meets the lowest version requirement requested by the RO, the user key can be accessed. 
         [0019]    In an exemplary embodiment, the present disclosure may also provide a time protocol so that DRM can perform time control. 
         [0020]    In an exemplary embodiment, the present disclosure uses OS certificate or application certificate checking, and version checking with upgrade enforcement to solve the possible problems during exercise rights, for example, the attacking program written by the user, memory dump or profiling for memory access, and other DRM or OS errors. 
         [0021]    The foregoing and other objects, features, aspects and advantages of the present invention will become better understood from a careful reading of a detailed description provided herein below with appropriate reference to the accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]      FIG. 1  is a block diagram of an exemplary conventional bootstrapping architecture. 
           [0023]      FIG. 2  shows a schematic view of a computerized apparatus for version control and management, consistent with certain disclosed embodiments. 
           [0024]      FIG. 3  is a flowchart illustrating an exemplary operation flow of a computerized apparatus, consistent with certain disclosed embodiments. 
           [0025]      FIG. 4A  is a diagram of an exemplary control module on key usage, consistent with certain disclosed embodiments. 
           [0026]      FIG. 4B  is a diagram of an exemplary cryptography component, consistent with certain disclosed embodiments. 
           [0027]      FIG. 5  is a diagram of exemplary application agents, consistent with certain disclosed embodiment. 
           [0028]      FIG. 6A  is a diagram of exemplary contents of the certificate issued by OS certificate authority, consistent with certain disclosed embodiments. 
           [0029]      FIG. 6B  is a diagram of exemplary contents of the certificate signed by OS vendor, consistent with certain disclosed embodiments. 
           [0030]      FIG. 7  is a flow chart illustrating an exemplary time control process, consistent with certain disclosed embodiments. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0031]      FIG. 2  shows a schematic view of a computerized apparatus for version control and management, consistent with certain disclosed embodiments, where the computerized apparatus is applied to DRM of digital contents. Referring to  FIG. 2 , a computerize apparatus  200  for version control and management may include a cryptography boot loader (CBL)  201 , a control module on key usage  203 , and one or more application agents  205 . CBL  201  is installed in a user device  211 , and has a cryptography component  201   a . Each application agent  205  has an OS certificate  215   a  and a corresponding application certificate  215   b  provided by OS certificate authority (CA). 
         [0032]    With the structure of  FIG. 2 ,  FIG. 3  illustrates an exemplary operation flow of a computerized apparatus, consistent with certain disclosed embodiments. 
         [0033]    When user device  211  is powered on, CBL  201  stores a user key, and checks the validity of OS certificate  215   a  issued by certificate authority (CA), to an OS  221  to determine whether to load OS  221 , as shown in step  301 . The user key may be stored in cryptography component  201   a . The validity of application certificate  215   b  issued by OS vendor to an application  222  is checked to determine whether to load application  222 , as shown in step  302 . Step  303  is to obtain an RO through a corresponding application agent by using a user certificate. Control module on key usage  203  may compare whether the versions of loaded valid OS  221  and application  222  match the requirement requested by RO  223 , as shown in step  304 . If so, the control module on key usage  203  may access the user key, as shown in step  305 ; otherwise, the control module on key usage  203  may reject to access the user key, as shown in step  306 . There are many ways to reject the user key access, such as CBL  201  shuts down the function of using secret key, or inhibits the booting. 
         [0034]    In this manner, it may ensure that the versions of loaded OS and application are both valid, and match the requirement requested by the RO. Therefore, the present invention prevents the unchecked or uncertified OS or application from accessing the user key in the cryptography component, while allows the secured OS and application to access the user key in the cryptography component. 
         [0035]    Control module on key usage  203  may be implemented as software to be bounded together with OS  221  or implemented as hardware to be bounded with cryptography component  201   a . Cryptography component  201   a  may be bounded together with basic input/output system (BIOS), or CPU, as shown in  FIGS. 4A &amp; 4B  respectively. 
         [0036]    From the exemplary flow chart of  FIG. 3 , it shows that the operation of the present disclosure may include four parts: loading OS and application, requesting the provision of user certificate, obtaining R, and checking versions. 
         [0037]    Referring to  FIG. 5 , application agents  205   a  may include a DRM agent  505   a , an apply agent  505   b , and so on. Control module on key usage  203  may obtain RO through DRM agent  505   a , or through apply agent  505  to request DRM rights authority for user certificate. In addition, to allow the time control on the DRM of digital contents, application agents  205  may further include time agent  505   c . Time agent  505   c  may have a clock and a random number generator to execute a time control process to provide a time protocol. The time control process may start after user device  211  is booted. 
         [0038]    The following describes how to load OS and application, execute time control process, request the provision of user certificate, obtain RO, and check version. 
         [0039]    As discussed above, CBL  201  may be installed in user device  211 . Therefore, CBL  201  automatically stores the public key provided by OS certificate authority and DRM rights authority. After user device  211  is powered on, the public key provided by OS certificate authority is used to check the validity of certificate  215   a . Referring to  FIG. 6A , the contents of certificate  215   a  at least may include an OS title, an OS version, a hash value of OS, and an OS signature. The OS signature is a signature of using the private key of OS certificate authority on the hash value of OS and other related data. For OS version checking, the hash value of OS is compared with the actual OS loaded into user device  211 . 
         [0040]    Similarly, DRM agent  505   a , apply agent  505   b  and time agent  505   c  must all have a public key issued by OS certificate authority to the OS vendor and a certificate signed by OS vendor. Referring to  FIG. 6B , the signed certificate must at least include an application title, an application version, a hash value of application, and an application signature. The application signature is a signature of using the private key of application vendor on the hash value of application and other related data. The hash value of application is compared with the actual application loaded into user device  211 . 
         [0041]    After user device  211  is powered on, CBL  201  loads OS  211   a  and certificate  215   a  of user device  211  and with other applications if there is any. The loaded information will be handed to control module on key usage  203  for subsequent OS and application version comparison. 
         [0042]    To allow time control for the DRM on digital contents, time agent  505   c  may also execute a time control process to provide a time protocol.  FIG. 7  is a flow chart illustrating an exemplary time control process, consistent with certain disclosed embodiments. Referring to  FIG. 7 , step  701  is to generate a random number Z 1 , record a starting time start_time of a clock, and transmit both to a time authority. Step  702  is to receive a time certificate returned by the time authority. The time certificate at least may include a random number Z 2 , a current time T, and the signature signed by the time authority. Step  703  is to record the ending time end_time of the clock and compute the time length L, that is L=end_time_start_time. Finally, step  704  is to determine whether the clock is set to the current time T of the time certificate. 
         [0043]    In step  704 , only when L is less than a pre-determined threshold, such as 1 minute, and random number Z 1  and random number Z 2  match, the clock will be set as the current time T on time certificate. 
         [0044]    Whether the time process should execute may be implemented as follows. CBL  201  includes a flag, referred to Flag_TrustedTime. After system&#39;s booting, if Flag_TrustedTime of CBL is false, time agent  505   c  is activated when the system is first connected to Internet and executes time control process. 
         [0045]    As discussed above, control module on key usage  203  may obtain RO through DRM, or request to DRM right authority for user certificate through apply agent  505   b . Referring to  FIG. 7 , the user may use apply agent  505   b  to generate a pair of keys. The key pair may include a user public key and a user private key. The user public key is used for requesting the DRM right authority for user certificate. 
         [0046]    With the user certificate, the user may obtain a corresponding RO from a right issuer through the DRM agent. The RO may include the key information for encrypting the content object (CO), user related information and the minimum version requirement requested by right issuer on OS version and application version. The user may decrypt with the corresponding private key. 
         [0047]    Only when the version of OS and application on user device  211  meet the minimum version requirements in the RO, control module on key usage  203  may access the user key. 
         [0048]    If the OS version or the application version is invalid or lower than the version requirement, the user key maynot be accessed. One way to enforce the user to upgrade the OS or application version is to disable the user from using the new RO. 
         [0049]    Because OS or application may have errors, to upgrade and patch the errors, cryptography component  201   a  may be bounded together with BIOS, and control module on key usage  203  may be bounded together with OS, as shown in  FIG. 7 . At the core of the OS or BIOS, there exists an error-free zone. This zone is important to the DRM. Control module on key usage  203  may use this zone to check version by using a simple program. In other words, the version checking on OS and application is executed in the zone in the core of OS. The checking program may also be limited to a certain length, such as within a few hundred lines of codes, to ensure the low probability of errors in control module on key usage  203 . 
         [0050]    Control module on key usage  203  may use this zone for version checking to ensure that the user upgrades the OS and application to meet the version requirement by the RO in order to use the new RO and the CO. 
         [0051]    Therefore, the present disclosure may solve the problem encountered during exercising rights. For example, when the user rewrites attacking program, the present disclosure checks the OS and application certificates. When memory is profiled or dumped and an error occurs in OS, the present disclosure may use version checking to enforce the version upgrade. When other application accesses CO and an error occurs in OS, the present disclosure may use version checking to enforce version upgrade. Or, when DRM application, other applications, or OS encounter errors, the present disclosure may use version checking to enforce version upgrade. 
         [0052]    In summary, the present disclosure may provide a method for DRM in a secured OS and application environment. By integrating cryptography component and boot loader, the present disclosure ensures that only secured OS and secured application may access the secret key in the cryptography component. To prevent errors from occurring in OS or application, the control module on key usage of the present disclosure uses a special program zone to check versions, discover errors and enforce version upgrade. In addition, a time protocol may be provided to the DRM for time control in the present disclosure. 
         [0053]    Although the present disclosure has been described with reference to the preferred embodiments, it will be understood that this invention is not limited to the details described thereof. Various substitutions and modifications have been suggested in the foregoing description, and others will occur to those of ordinary skill in the art. Therefore, all such substitutions and modifications are intended to be embraced within the scope of the invention as defined in the appended claims.