Abstract: This invention relates to a method of processing rights relating to content, that can be communicated between devices. Typically, a Digital Rights Management (DRM) system imposes limitations of use and distribution, imposed by the service provider, content provider or distributor. The method of the invention renders it possible for a user who has received DRM rights to restrict the right further. The invention is more particularly related to the receipt of DRM rights to Authorized Domain Digital Rights Management (AD-DRM) systems and the introduction of user attributed rights in the form of further restrictions introduced to the received DRM rights. The invention further relates to a Rights Program Template (RPT) facilitating the introduction of such further restrictions in a user friendly way. Finally, the invention relates to a system supporting the method of the invention.

Abstract: There is provided a sales promotion device (10) for modifying purchasing behavior. The device (10) is distinguished in that it includes spatially co-located first and second component parts (20, 30; 40, 50, 60). The first component part (20, 30) comprises a consumer product (20) and the second component part (40, 50, 60) is operable to encourage a purchaser of the device (10) to seek one or more further products (30), the second part (40, 50, 60) being electronically responsive when spatially presented by the purchaser at retailing premises (200) to enable the purchaser to gain access to and/or take possession of the one or more further products (30).

Abstract: The present invention relates to a method and a system for performing digital rights management. The idea of the invention is that a master right associated with a content is stored at a first authorised device (211). An authorised device is a device which can be considered trusted and performs actions with contents according to the associated rights. These devices enforce rights that are bound to contents, and perform the security tasks of the DRM system employed. A subright is derived from the master right, which subright controls what type of access a second authorised device (261) is given to the associated content. Finally, the subright is distributed to the second authorised device, given that the second device complies with predetermined distribution criteria associated with the master right. The device distributing the subright authenticates the device which is to receive the subright, ensuring that the second device can be trusted.

Abstract: The invention reduces addressing overhead for communication using a layered communication protocol. An improvement of the invention maintains security for the addressing information.

Abstract: When displaying display items representing a set of content items including items protected by a number of different digital rights management systems on the display of a content access system, the set of display items representing the content items includes icons associated at least with the display items for each protected content item. The icons indicate whether a respective content item is protected by a digital rights management system and, if so, which digital rights management system is employed to protect the respective content item, whether an executable digital rights management module for accessing the respective protected content item is accessible to the user, and whether the user is entitled to access the respective protected content item. The icons also serve as user controls either for accessing information regarding acquisition of, or initiating actual acquisition of, the digital rights management module, access rights, or both.

Abstract: The present invention relates to methods, devices, computer program products as well as a signal for providing privacy to a user in relation to data, which data can be a content identifier (cr_id) for identifying content. For that reason a usage right certificate (UR) generated in relation to the data, includes the data (cr_id), concealed user identifying information (for example by using (H(PK//RAN)) and random data (RAN)) enabling the verification of the user identity in the user identifying information. In this way a user is guaranteed privacy in relation to information, such as content he has purchased.

Abstract: A broadcast data stream that contains a stream of encrypted data and a stream of messages. Data in successive segments of the stream of encrypted data is decryptable with successive decryption information from the messages. The stream of encrypted data is stored upon reception. The items with decryption information for the encrypted data are stored independently retrievable from the stream. Additionally synchronization information is generated and stored to link respective points in the stored stream of encrypted data to respective ones of the items with decryption information. During replay of a stored part of the stream of encrypted data the items with decryption information for the points in said stored part are retrieved. The retrieved items with decryption information are combined with the stream during replay at times selected under control of the synchronization information.

Abstract: A decoder decrypts data from the stream of data, using decryption control words. A secure device is coupled to the decoder to supply the control words. The secure device has a memory space for storing at least two items of entitlement information with associated authorization keys. The secure device has an input for receiving messages from the apparatus. The message contains information for example about the source of the stream. The secure device contains an execution unit that responds to the messages by selecting from among die at least two items, if stored, dependent on a content of the messages. The execution unit enables sending of the control words to the decoder subject to the presence and validity of the selected one of the items of entitlement information, after decryption of the control word with a decryption key associated with the selected one of the items.

Abstract: Methods of and devices (D1) for authorizing an operation requested by a first user (P2) on a content item (C1) in accordance with a user right (UR1). The user right may identify the first user or a second user (P) and authorizes the user in question to perform the requested operation on the content item. If the user right identifies the second user, the operation is authorized upon receipt of information linking a user right of the first user and the user right of the second user. Preferably the information comprises one or more domain certificates (DC1, DC2) identifying the first and second users as members of the same authorized domain (AD). Preferably a content right (CR1) enabling the operation is used, whereby the user right authorizes the second user to employ the content right.

Abstract: A method of controlling access to a content item in a domain comprising a set of mutually authenticated devices, the method comprising deriving one or more domain-specific rights from a right associated with the content item, the one or more domain-specific rights being bound to the domain and allowing the devices in the domain aces to the content item. Also system comprising a set of mutually authenticated devices, said set making up a domain, the system comprising a central rights manager arranged for executing said method.

Abstract: A method of providing conditional access to a content item, which content item is protected by a particular security mechanism, comprising providing unconditional access to a sample content item (105) protected by the same particular security mechanism. The sample content item (105) could be e.g. a trailer for the content item (104). Preferably the protected content item (104) is formatted using a particular formatting scheme like MPEG-2, and the sample content item (105) is formatted using the same formatting scheme. If acquisition of rights by a client (120) is necessary for playback of the content item (104), this is preferably refused until the sample content item (105) has been accessed by said client (120).

Abstract: In CD systems utilizing digital rights management (DRM), a system and method for transferring rights data and pre-encrypted content from a source disc (200) to a destination disc (300) using one playback device (400) and while protecting the integrity of the rights data from replay attacks. The system and method are also applicable in other applications involving transfers of information using storage media and data transfer devices. A transaction identifier is assigned from a list of transaction identifiers stored in the playback device. The assigned transaction identifier and the rights data read from the destination disc are encrypted using a public/private key or a symmetrical key unique to the playback device (400). The encrypted transaction identifier is transferred along with the encrypted rights data to a intermediate secure storage area (500), which may be a hard disk drive, a separate security module, or a memory area within the playback device (400) itself.

Abstract: A conditional access system comprising a plurality of devices interconnected in a network, the devices being grouped in a first group and a second group, the devices of the first group operating in accordance with a first security framework and the devices of the second group operating in accordance with a second security framework, each device operating using a particular middleware layer, said middleware layer being arranged to authenticate another middleware layer of another device, said middleware layer being authenticated by the security framework in accordance with which the device operates.