Abstract: In Authorized Domains the management of which devices that can access content is a key issue. The Authorized Domain must be limited to a relatively small group of devices to get a solution that is acceptable to both content providers and users. However, current solutions are typically either to rigid to be future proof and user friendly or not effective enough in limiting the size of the Authorized Domain. This invention provides a user-friendly, flexible and yet effective method of managing the size of an Authorized Domain. The method proposes to group devices in the Authorized Domain into clusters, if a predetermined requirement is met, and to limit the number of clusters. Such a predetermined requirement could be a proximity requirement.

Abstract: The present invention relates to a method at an issuing authority (111) to anonymously provide an individual (121) with a certificate (C), a method of providing anonymous approval of the individual at a communicating party (101) by means of using the certificate, an issuing authority for anonymously providing an individual with a certificate and an approving device for anonymously approving the individual by means of using the certificate. A basic idea of the invention is to provide an individual anonymously with certificates at an issuing authority, which certificates subsequently can be used by an individual to anonymously prove membership in a group at a communicating party.

Abstract: A domain manager device for managing a network. The manager issues to a new device joining the network a number of symmetric authentication keys, and preferably a number of authentication tickets. Each respective authentication key allows the new device to communicate securely with one respective other device comprised in the network. Each respective authentication ticket allows a device with a first identifier to authenticate itself to a device with a second identifier. The new device receives those authentication tickets whose first identifier matches its identifier. The new device presents the ticket with second identifier ‘B’ to device ‘B’ to authenticate itself to ‘B’. Preferably the domain manager generates a number of master device keys and issues one to the new device. Then the authentication tickets can be encrypted with the master device key issued to device with the second identifier.

Abstract: To ensure that digital rights cannot be forged or tampered with, they can be digitally signed. However, this means that updating the digital rights is no longer possible, as this would invalidate the digital signature. The present invention proposes that the issuer of digital rights issues rights which are signed in elementary pieces, rather than as a whole. Rather than issuing a right to play back a piece of content three times, the provider issues for example three rights to play back the content once in a particular AD, of which two may be transferred to other domains. The digital rights are individually protected by signatures and it is no longer possible to forge digital rights. As an enhancement the rights that can be transferred are indicated as such and stored securely to prevent tampering. When the right is transferred, it must be signed by the person who originally received it.

Abstract: This invention relates to a system and a method of generating an Authorized Domain (AD) by selecting a domain identifier, and binding at least one user (P1, P, PN1), at least one device (D1, D2, . . . , DM), and at least one content item (C1, C2, . . . , CNZ) to the Authorized Domain (AD) given by the domain identifier (Domain ID). Hereby, a number of verified devices (D1, D2, . . . , DM) and a number of verified persons (P1, P2, . . . , PN1) that is authorized to access a content item of said Authorized Domain (100) is obtained. In this way, access to a content item of an authorized domain by a user operating a device is obtained either by verifying that the content item and the user is linked the same domain or by verifying that the device and the content item is linked to the same domain. Thereby, enhanced flexibility for one or more users when accessing content in an authorized domain is obtained while security of the content is still maintaining. This is further done in a simple, secure and reliable way.

Abstract: The invention relates to a system for improved copy protection comprising a record carrier like a CD-RW+ or a DVD storing copy-protected information and a device for reading from and/or writing to the record carrier. For that the record carrier (1) has a first area (3) storing information (data), which is at least partly stored in encrypted form (EAK(data)), this part being called an asset (EAK(data)), and which includes a first part of decryption information (HCK, EDNK(HCK)), and the record carrier (1) further has a second area (4) storing a second part of decryption information (UCID), wherein both the first (HCK) and second (UCID) parts of decryption information serve in decrypting an asset (EAK(data)). Such distribution of decryption information over at least two areas of the record carrier may further be combined with additional safety mechanisms as e.g. hidden channels, encrypted keys, counter mechanisms, and revocation lists.

Abstract: An apparatus stores (60), transmits (1, 1?), or receives (2) a signal (5, 5?) representing user desired content (10, 10?, 10?, 10??, 62) with device revocation information (4, 71) embedded in the user desired content. In a suitable transmitting embodiment (1, 1?), watermark content (20) including the device revocation information (4) is embedded in the user desired content (10, 10?, 10?, 10??) during encoding as an embedded watermark In a suitable receiving embodiment (2), an embedded watermark (20) is read from the signal (5) representing the user desired content (10). The device revocation information (4) is extracted from the embedded watermark (20).

Abstract: In an information delivery system, a security device (SD) manages an access to information (INF). The security device (SD) is capable of providing a pointer (PO) which indicates a location (LO) from which additional data (ADA) may be obtained. The additional data (ADA) may be a description of the information (INF) which is offered. For example, in a pay TV system, the information (INF) may be a particular movie of which the description is “James Bond, Dr. No, action category, 12 year and older, broadcast April 19, at 20H30.” In that case, the pointer (PO) may be used to inform a subscriber that his security device (SD) allows him to watch this particular movie. However, the additional data (ADA) contained in the location (LO) indicated by the pointer (PO), may also be software for various purposes such as, for example, playing games or configuring a receiver (REC) which co-operates with the security device (SD).

Abstract: A method of providing automatically verifiable trust in a content resolution process in which a PDR resolves a content reference identifier (CRID) identifying a content item using a resolution authority record (RAR) to obtain a locator identifying a location where the PDR can obtain the content item. Preferably, the measure comprises computing a digital signature over at least part of the contents of the CRID, the locator and/or the RAR. The method may also comprise encrypting at least a data portion of the CRID, RAR or locator. Digital rights needed to access the content item can be provided with the CRID, RAR or locator.