KR20010023967A - Copy protection by ticket encryption - Google Patents

Abstract

Encryption schemes are provided between the device carrying the data content and the oriented receiver of the content. This encryption applies to tickets carrying copy and display rights. To allow for carrying devices, the encryption scheme in the preferred embodiment is influential. The channel between the transmitting device and the receiving device is configured for exclusive use of these two devices, and this channel is then configured for exclusive use of another set of devices. To prevent the use of noncompliant devices in this system, the compliant device includes verifiable proof of reliability, and channels are established when each device for that channel proves the reliability of the other device.

Description

Copy protection by ticket encryption {COPY PROTECTION BY TICKET ENCRYPTION}

FIELD OF THE INVENTION The present invention relates to the field of entertainment systems, and more particularly to copy protection for copyrighted material.

Digital records have a unique characteristic that copies of recorded material have the same quality as the original. As such, an efficient copy protection method is particularly important for the protection of copyrighted materials recorded in a digital manner. Cost effective copy protection is described in detail by Jean-Paul Linnartz et al., In Philips Electronics Response to Call for Proposals Issued by the Data Hiding Subgroup Copy Protection Technical Working Group, July 1997 ("Linnartz"). The Linnartz approach works by attaching a "ticket" to the recorded material, which consists of verifiable "counts" that are reduced at each stage of the playback and recording process, making it difficult to calculate the increase. Processes that are difficult to calculate can be expected to require excessive time to complete, with respect to the potential benefits that can be realized by spending this time. The Linnartz method uses a hashing function that provides a hash value from the seed value in a way that is difficult to determine the seed value and the given hash value.

1 shows a Linnartz ticket system. Many examples for player 110 and recorder 120 illustrate the use of the same or another player 110 and record 120 with different inputs 101, 102, 111, 112, 122, 132. Used to bet. Protected recordings, such as DVD discs, may be encoded as "copy-never" 101 or "copy-once" 102. The data content C also includes an embedded watermark W, which is the hash value of the physical mark P. Like paper watermarks, the watermark W does not interfere with the rendering of the material, but is encoded in the recorded material in such a way that it cannot be removed from the data without adversely affecting the quality of the material. to be. The physical mark P is code that is inserted into the material of the disc medium that can be read by the disc player 110, and also cannot be removed from the disc medium without adversely affecting the quality of the disc medium. The copy inhibiting disk 101 may or may not include the ticket T. FIG. The copy disk 102 includes an insertion watermark W that is a four-times-hash of the physical mark P, and a ticket T that is an once-hash value of the physical mark P.

With the consent of one of the manufacturers, the insertion watermark W is a one-time hash of the physical mark P, the insertion watermark W is a three-time hash of the ticket T, or the insertion watermark W is one of the tickets T. Only in case of a hash, the compliant player 110 plays the recording including the insertion watermark W. The insertion watermark W, ticket T, and any other combination of physical marks P are considered illegal copies, and the compliant player 110 will not play the illegal copies. If the record is considered legitimate, the compliant player 110 provides as output the material C with its insertion watermark W and the modified ticket T ', which is a one-time hash of the incoming ticket T. As described, the compliant player 110 provides the output 111 from the copy-prohibited disk 101 because the insertion watermark W is equal to the one-time hash of the physical mark P, and the insertion watermark W is the ticket T. The output 112 is provided from the copy disk 102 because it is equal to the three hashes.

With the consent of one of the manufacturers, the compliant recorder 120 copies the record containing the insertion watermark W and the ticket T only if the insertion watermark W is a two-time hash of the ticket T. . The copy prohibit output 111 does not have the insertion watermark W, which is a two-time hash of the modified ticket T ', and therefore will not be recorded by the compliant recorder 120. The one-time copy output 112 includes an insertion watermark W that is a four-time hash of the physical mark P and a modified ticket T 'that is a one-time hash of the circular ticket T. Since the prototype ticket T is a one-time hash of the physical mark P, the modified ticket T 'is a two-time hash of the physical mark P, and thus the insertion watermark W is two times the hash of the modified ticket T'. . Since the insertion watermark W is a two-time hash of the modified ticket T 'that is input, the compliant recorder 120 copies 122 the copy material 112 once. Compliant recorder 120 appends a one-time hash of incoming ticket T 'as new ticket T' 'when copying 122. Since the incoming ticket T 'is two hashes of the physical mark P, the new ticket T' 'is three hashes of the physical mark P. The combination of the insertion watermark W, a one-time hash of the attached ticket, defines a "copy-no-more" record.

In the Linnartz scheme, it should be noted that "there are no restrictions on the number of plurals that can be made from the single copy disk 102. That is, the reproduction of the circular single copy disk 102 takes its insertion watermark W. It will always produce an output containing the data C possessed and the modified ticket T ', which is a one-time hash of the incoming ticket T. The prototype ticket T is a one-time hash of the physical mark P, and the modified ticket T' is the physical mark P. Since the two hashes of, the insertion watermark W will always be the two hashes of the modified ticket T 'and will therefore be readable. The mass creation of the one-time copy disc 102 results in the output 112 of the player 110. This can be achieved by simply operating multiple recorders 120 in parallel receiving each of the following: It should be noted that this mass generation can be performed using the recorder 120 according to Linnartz's ticketing scheme. .

As described above, the compliant player 110 may include the case where the insertion watermark W is a one-time hash of the physical mark P, the insertion watermark W is a three-time hash of the incoming ticket, or the insertion watermark W is the incoming ticket. The recording including the inserted watermark W is played only in the case of one hash of. Since the incoming ticket T '' from the no copy 122 is three times the hash of the physical mark P, and the insertion watermark W is four times the hash of the physical mark P, the insertion watermark W is one of the tickets T ''. It is a hash, and therefore a legally playable copy. Compliant player 110 plays a legal no longer copy prohibition 122 to include a modified ticket T '' 'which is the material content C, its insertion watermark W, and a hash of the incoming ticket T' '. Generate output 132. The modified ticket T '' 'of the output 132 is a four times hash of the physical mark P.

The compliant recorder 120 copies the recording including the insertion watermark W and the ticket T only when the insertion watermark W is a hash of the ticket T twice. No further copy-protected output 132 will be recorded by the compliant recorder 120 since it does not have an insertion watermark W that is a two-time hash of the modified ticket T '' '.

In the Linnartz scheme, it is assumed that the output of the compliant player is displayable on the display device. That is, there are no display restrictions on the display device. At the output 132 of the compliant player 110, the arrangement of the insertion watermark W and the ticket T is the insertion watermark W equivalent to the ticket T. As such, if there is a constraint on the display device based on the insertion watermark W and the ticket T, the insertion watermark and the ticket should be allowed to display the same output. Thus, restrictions on the display of copyrighted material based on the Linnartz embedded watermark and trademark schemes can be overcome only by replacement, even if the ticket is provided by copying the embedded watermark.

To complete, Figures 2 and 3 illustrate a conventional ticket processing scheme that controls the copying of copyrighted material delivered over a broadcast channel, such as a "pay-per-view" transmission from a service provider. Indicates the application of. 2 shows transmission of copy inhibiting broadcast 201, and FIG. 3 shows transmission of one copy broadcast 202. FIG. As is common in the art, the broadcasts 201 and 202 are encrypted. Conditional access decryptor 210 decrypts encrypted broadcasts 201 and 202 and provides decrypted outputs 211 and 212 including data content C, insertion watermark W, and ticket T. Conditional access decryptor 210, for example, after compromising with the service provider for payment of a fee associated with the receipt of material content C, or after plugging a "smart-card" into the cable box, A "cable box" that decrypts incoming broadcasts.

As shown in Fig. 2, if the transmission is copy-prohibited broadcast 201, the decrypted output 211 has data content C, an insertion watermark W such as a double-hash of physical mark P, and physical mark P. Will contain the ticket T as a double hash. In the case of a broadcast, the "physical" mark P is any code associated with the broadcast, which relates to the nature of the broadcast, such as a modulated signal within the broadcast. The origin of Mark P is somewhat arbitrary except that it should not be "publicly-available", ie it should not be easy to determine. Another method can be used to supply appropriate ticket values. The service provider may provide a ticket that is a single-hash of the physical mark P, and the conditional access decryptor 210 may enter the incoming ticket, as performed by a conventional conforming player 110. It can be configured to apply a single hash. Optionally, the service provider can directly provide a ticket with a double hash, and the conditional access decryptor 210 only passes the incoming ticket as an output ticket. As mentioned above, the compliant recorder 120 will only copy the watermarked material when the insertion watermark W is equal to two hashes of the incoming ticket. In this copy prohibition case, the insertion watermark W is equal to the pressure ticket T, so that the compliant recorder 120 will not copy this copy prohibition material 211. On the other hand, the compliant display device 220 will display the copy inhibiting material 211 because the insertion watermark is the same as the ticket.

As in FIG. 3, if the transmission is a one-time copy broadcast 202, the decrypted output 212 may contain the data content C, an embedded watermark W, such as four hashes of physical mark P, and a double hash of physical mark P. Include a ticket T such as Since the insertion watermark W is equal to the two hashes of the incoming ticket T, the compliant recorder 120 will generate an authorized copy 222 of the decrypted output 212 and the compliant display 220 It will provide an indication of the decrypted output 212. The copy 122 from the recorder 120 includes a modified ticket T ', such as the material content C, its insertion watermark W, a single hash of the incoming ticket T. Since the incoming ticket T is two hashes of physical mark P, the modified ticket T 'is equivalent to three hashes of physical mark P.

It should be noted that, as in the ticketed disc manner described above, the plurality of compliant recorders 120 are configured to receive the output of the decryptor 210 and will produce a plurality of copies 222 corresponding thereto. . In addition, non-compliant “blind” copies of the material 212 may be made and then provided to any compliant recorder 120 for a number of unlimited copies 122. A "blind" copy is a "bit-for-bit" copy that has virtually no modification of the copied information. In the above-described ticketed disk scheme, since the physical mark P was not transmitted with the copied information being copied, the compliant device could not copy a single hash of the physical mark P or a copy with an insertion watermark different from the four hashes. Because of refusal, the use of blind copy was impossible if the physical mark P was on its own disk medium. However, in the broadcast example, if the physical mark P is delivered, it will be part of the broadcast information, and thus will be transmitted with the information during the blind copy.

If a copy 222 is provided to the player 110, the player will match the single hash of the insertion watermark W with the ticket T ', the single hash of the material content C, the insertion watermark W, and the incoming ticket T', or Will provide an output 232 that includes a modified ticket T " that is equally four hashes of physical mark P.

Since the insertion watermark W is not two hashes of the incoming ticket T '', the compliant recorder 120 will not be able to copy the output 232. Again, since the insertion watermark W is equal to the incoming ticket T '', the compliant display will display the output 230. The non-compliant player may have an authorized copy and an unauthorized copy of the material content C displayed by the compliance display device 220 only by providing a ticket T '', such as the insertion watermark W. It should be noted that

It is an object of the present invention to prevent the display of unauthorized copying of data on a compliant display device. Another object of the present invention is to prevent unauthorized copying of data on a compliant recording device. It is still another object of the present invention to prevent unauthorized copying of data on a noncompliant recording device and to render such unauthorized copying to the compliance display or recording device.

These objects and others are achieved by providing an encryption scheme between the device carrying the data content and the directional receiver of the content. This encryption applies to tickets carrying copy and display rights. In order to allow the carrying of the device, the encryption scheme in the preferred embodiment is predominant. The channel between the transmitting device and the receiving device is configured for exclusive use of these two devices, after which the channel can be configured for exclusive use of another set of devices. In order to prevent the use of noncompliant devices in the system, the compliant devices include verifiable proof of reliability, and channels are established only when each device for the channel proves the reliability of the other device.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1 shows a block diagram of a conventional ticket processing method for controlling copying of copyrighted material on a physical medium,

2 and 3 illustrate an application of a conventional ticket processing method for controlling the copying of copyrighted material delivered through a broadcast channel.

4 is a block diagram of a ticket processing method for controlling the display of copyrighted material according to the present invention;

5 is a block diagram of a ticket processing method for controlling copying of copyrighted material according to the present invention;

6 is a flowchart of a ticket processing method for controlling the display or copying of copyrighted material according to the present invention.

4 is a block diagram of a ticket processing method for controlling copying of copyrighted material according to the present invention. 4 shows a conditional access module 300 and a display device 400. The conditional access module receives the broadcast that is encrypted or cannot be encrypted and the broadcast 301 that cannot be copy protected or copy protected. The brackets {} used in FIG. 4 indicate items that may or may not exist in a particular broadcast 301. The broadcast decryptor 350 is a conventional broadcast decryptor that decrypts the broadcast 301 if the broadcast is encrypted, otherwise the output 351 of the broadcast decryptor has the data content C, its insertion watermark W, And deliver the broadcast when not changed to include the associated ticket T.

The ticket detector 340 separates the ticket T 341 from the output 351 to generate the material content C and its insertion watermark W, the signal 342, and converts the ticket 341 to the ticket encryptor 330. To pass on. According to the present invention, the ticket encryptor 330 encrypts the ticket T using a key K 321, which can only be decrypted by the display device 400 to be described after being in direct contact with the ticket encryptor. Create an encrypted ticket E _K (T) 331. The material content C and its embedding watermark W, signal 342, and encrypted ticket E _K (T) 331 are transmitted to display device 400 as transmitted signal 401.

The display device 400 includes a ticket detector 440 which processes the document content C and its insertion watermark W, the signal 442 and the signal 401 transmitted to generate the extracted ticket 431. Include. As shown in FIG. 4, if the conditional access module 300 is a compliant device according to the present invention, the extracted ticket 431 would be the same as the encrypted ticket E _K (T) 331. If the transmitted signal 401 does not originate from the compliant conditional access module 300, the extracted ticket 431 will not be the same as the encrypted ticket E _K (T) 331. The ticket decryptor 430 decrypts the ticket 431 extracted based on the key K '421, and the resulting ticket only when the decryption key K' 421 corresponds to the encryption key K 321. T 441 matches circular ticket T 431. If a key decrypts an encryption generated by another one key corresponds to another key. In a symmetric key system, key K 321 and key K '421 are equal to each other. In an asymmetric key system, key K 321 and key K '421 are respective private and public keys of a private / public encryption key pair.

The display controller 460 controls the display of the signal content 442 and the decrypted ticket T 441 based on the relationship between the data content C and the insertion watermark W thereof, the insertion watermark W, and the decrypted ticket T 441. According to the present invention, the data content C can be displayed only when one of the following three conditions is satisfied.

-If there is no embed watermark,

The insertion watermark W is equal to the decrypted ticket T 441, or

The insertion watermark W is equal to two hashes of the decrypted ticket T 441.

The first condition corresponds to protected data content C that cannot be copied or displayed. As shown in Figs. 2 and 3, the second condition corresponds to the conventional ticketing copy prohibition 212 and the further copy prohibition 232 state, and the third condition is 1 of the conventional ticketing method. Corresponds to the state of copy 222. As described above, the insertion watermark W in the conventional ticketing scheme will be the same as the round-ticket T in the no-copy 212 and no-copy 232 state, and a circular ticket in the one-time copy 222 state. It would be the same as the two hashes of T 341. The decrypted ticket T 441 is protected because it is the same as the round ticket T 341 only when the display device has the key K '421 corresponding to the key K 321 in the conditional access module 300. The data content C will be displayed only when the conditional access module 300 and the display device 400 have a key K 321 and a key K '421 corresponding thereto. As such, when the blind copy of the transmitted signal 401 is performed, only the display device 400 including the key K '421 corresponding to the key K 321 may be displayed.

5 shows a corresponding recorder 500 according to the invention. The recorder 500 is substantially similar to the display device 400 except for using the copy controller 560 instead of the display controller 460. The copy controller 560 allows copying of the data content C to be made only when one of the following two conditions is satisfied.

-No embed watermark, or

The insertion watermark W is equal to two hashes of the decrypted ticket T 441.

The first condition corresponds to protected data content C that cannot be copied or displayed. The second condition corresponds to the one-time copy 222 state of the conventional ticketing scheme as shown in FIG. The decrypted ticket T 441 is circular because it is the same as the round ticket T 341 only if the display device has the key K '421 corresponding to the key K 321 in the conditional access module 300. The one-time copy material C having an insertion watermark W, such as two hashes of the ticket T 341, has the key K 321 and the key K '421 corresponding to the conditional access module 300 and the recorder 500 corresponding thereto. Will only be copied if you have As such, if blind copying of the transmitted signal 401 is performed, it will be possible to copy only on the recorder 500 including the key K '421 corresponding to the key K 321. Although multiple copies can be made by the same recorder 500 from blind copy of the transmitted signal 401, use of an encrypted ticket according to the present invention makes simultaneous copying of multiple copies impossible, Minimize the economic benefits that can be realized by co-generation.

Various techniques may generally be used to generate the corresponding encryption keys K 321, K ′ 421 (for ease of reference, the receivers 400, 500 may display the display device 400 or the recorder 500). Will be used to indicate). In the simplest case, each receiver 400, 500 has a private key associated with an identifier of the receiver 400, 500, and the conditional access module 300 has a public key corresponding to each identifier. I have a list. The public key forms a key K 321, and the private key forms a key K '421. In this embodiment, ticket encryptor 330 and decryptor 430 are asymmetrical encryptor / decryptor pairs. The same identifier and public / private key pair are assigned to multiple receivers 400 and 500, and if a unique public / private key pair is assigned to each receiver 400 and 500, then each public key is found to violate the copy right. May be abolished if so.

Optionally, FIG. 4 shows key generators 320 and 420 generating key K 321 and key K '421. The set of key generators 320 and 420 includes a "Diffie-Hellman" key exchange algorithm that is common in the art. In the Dieppe Hellman scheme, each key generator 320,420 may have a public exchange key parameter 325 containing a large prime n, a number g of initial mode n, and any large integer x, y. Choose.

The key generator 320 delivers X = g ^x mode n to the key generator 420, and the key generator 420 delivers Y = g ^y mode n to the key generator 320.

Key generator 320 calculates K = Y ^x mode n,

The key generator 420 calculates K '= X ^y mode n.

As such, both K and K 'are the same as g ^xy mode n. Since x and y remain private, the determination of keys K and K 'is numerically difficult. In this embodiment, ticket encryptor 330 and ticket decryptor 430 are each a symmetrical encryptor / decryptor pair that encrypts and decrypts ticket T using the same key value g ^xy mode n. .

The two receivers 400 and 500 will not generate the same key value as the conventional access module 300 unless they select the same arbitrary number y. In the preferred embodiment of the present invention, the receivers 400 and 500 are created with the minimum possibility of generating the same arbitrary number at the same time. As such, compared to conventional ticketing systems, placing the compliant recorder 500 parallel to the transmitted signal 401 would not allow copying material that is in the single copy 222 state. Similarly, as described above, creating blind copies of the transmitted signal 401 allows the compliant recorder 500 with the appropriate key K 'to generate multiple simultaneous copies.

Additional protection can be provided by a combination of optional protection schemes. 4 and 5 illustrate the selective use of pairs of authenticators 310, 410 corresponding to key generators 320, 420. Authenticator 310 initiates the authentication process upon receipt of trigger 346 from the ticket detector by requesting proof 411 from authenticator 410. Proof 411 is a verifiable digital proof that is provided by the manufacturer of the receiver and is common in the art to which the invention pertains, including the identification of a particular receiver. Authenticator 310 verifies the proof using conventional digital signature verification techniques, and passes the result 311 of the proof to key generator 320. As such, receivers 400 and 500 may be authenticated again upon receipt of each ticketed material 301. Thus, non-compliant receivers, or particular receivers 400 and 500 with revoked authentication, can prevent the receipt of ticketed material.

The determination or generation of the appropriate key K 321 to correspond to the key K '421 may occur periodically, randomly, or upon receipt of the ticketed material 301 as described above. Further, in the preferred embodiment, key determination or generation occurs whenever a communication path between the conditional access module 300 and the receivers 400 and 500 is newly established. As such, conditional access module 300 may be reallocated or bordered to different receivers 400 and 500 as needed. The conditional access module 300 in the preferred embodiment also includes a pair of key generators 320 and corresponding ticket encryptors 330 each associated with the channel. Since the output 401 of one channel is provided to the recorder 500 at the same time as the output 401 of the other channel is provided to the recorder 500, for example, an authorized copy of the protected material is authorized. Viewing can take place at the same time. In this embodiment, the output 401 of each channel has different encrypted tickets, depending on the receivers 400 and 500 attached to each output 401. For the sake of completeness, FIG. 6 shows a flow diagram of a compliant conditional access module 300 and receivers 400 and 500 in accordance with the present invention. In step 610, the broadcast material is received by the conditional access module 300. If the broadcast material includes encrypted material 620, it is decrypted in step 625, and if it includes a ticket 630, in step 635 the ticket using a key corresponding to the key in the receivers 400, 500; Encrypt In step 640, the decrypted data and the encrypted ticket are transmitted to the receivers 400, 500. Upon reception, receivers 400 and 500 determine whether the material includes a ticket. In step 650, if the received material has a ticket, in step 655 it is decrypted using the keys associated with the receivers 400, 500. In step 660, if receivers 400 and 500 are recorders 500, then in step 680 a test is applied to determine whether the material is copyable. If there is no embedded watermark W in the material, or if the inserted watermark W matches the two hashes of the decrypted ticket, then the material content and the inserted watermark W are taken from the decrypted ticket T, associated with the conventional ticketing scheme. It is copied in step 685 with the hash. Otherwise, in step 685, the copy is bypassed. In step 660, if the receivers 400 and 500 are the display device 400, the test is applied in step 670. If the material does not have any embedded watermark W, or if the inserted watermark W matches the decrypted ticket or the three hashes of the decrypted ticket, then at step 675, the material content C is displayed. Otherwise, the display is bypassed at step 675. After copying, displaying or bypassing, the process continues at step 690 and awaits reception of the next broadcast material at step 610.

The foregoing merely illustrates the principles of the invention. Those skilled in the art to which the present invention pertains may devise various apparatuses which, although not explicitly described or shown herein, embody the principles of the present invention and are within the spirit and scope thereof. For example, the above-described ticket encryption scheme in the conditional access module may receive the ticketed material from other devices, such as a conventional player 110, an unconditional access module, or a source, and send it to a directed receiver 400, In any other apparatus provided at 500), it may be implemented. Similarly, details of conventional ticketing schemes are presented above for illustrative purposes. Other ticketing schemes may also be implemented requiring only changes to specific ticket tests 675 and 685 to correspond to such schemes.

Certain features and structures in the drawings are provided for purposes of illustration. Alternative devices are viable. For example, the ticket encryptor 330 may be located at the location of the provider of the broadcast 301 such that the material 301 is a broadcast decryptor with a ticket that is properly encrypted for decryption with the receiver 400, 500. Is received at 350. In this embodiment, the conditional access module 300 will have means for conveying the identification of the receivers 400, 500 to the provider of the broadcast 301. As such, some or all of the components of the conditional access module 300 may be included in the receiver 400, 500 or other device. These and other system configurations and maximum utilization choices are apparent to those skilled in the art from the standpoint of the present invention and are included within the scope of the following claims.

Claims (19)

A ticket detector 340 for extracting a ticket 341 and a document content 342 having an embedded watermark W from a source, Encrypt the ticket 341 based on a key 321 dependent on the oriented receiver of the material content 342 to receive an encrypted ticket 331 which communicates with the material content 342 with an embedded watermark (W). A device (300) comprising a ticket encryptor (330) for providing the device (400, 500). The method of claim 1, Apparatus 300, further comprising a broadcast decryptor 430 that decrypts broadcast transmission 301 and forms a source of material content 342 with ticket 341 and embedded watermark (W). . The method of claim 1, And a key generator (320) for generating a key (321) that depends on the directed receiver. The method of claim 3, wherein The key generator (320) is characterized in that it comprises a Diffie-Hellman key exchange system. The method of claim 1, And an authenticator (310) for authenticating the receiver (400, 500) as a directed receiver. A ticket detector 340 for extracting an encrypted ticket 431 from a received delivery 401 comprising an encrypted ticket 431 and a material content 442 having an embedded watermark W; A ticket decryptor 430 that decrypts the encrypted ticket 431 to form a decrypted ticket 441; And a controller (460, 560) for determining at least one of an indication permission and a copy permission based on the insertion watermark (W) and the decrypted ticket (441). The method of claim 6, And a key generator (420) for generating a key (421) provided to the ticket decryptor (430) for decrypting the encrypted ticket (431) to form a decrypted ticket (441). 400, 500). The method of claim 7, wherein Key generator (420) is a receiver (400, 500) characterized in that it has a Diffie-Hellman key exchange system. The method of claim 6, Receiver 400, 500 further comprising an authenticator 410 for providing proof 411 to device 300 for providing a received delivery 401 to facilitate creation of an encrypted ticket. . The method of claim 6, And the controller (460, 560) determines at least one indication permission and copy permission based on at least one hash of the decrypted ticket (441). The method of claim 6, And at least one of an indication (400) and a copy (500). In how to deliver copyrighted material, Encrypting 635 the ticket 341 associated with the copyrighted material to form an encrypted ticket 331 based on the directed receiver; Delivering 640 an encrypted ticket 331 with copyright material to the receiver 400, 500 to facilitate copyright enforcement depending on whether the receiver 400, 500 is a directed receiver. How to feature. The method of claim 12, And generating a key (321) based on the directed receiver used when encrypting (635) the ticket (341). The method of claim 13, Generating the key 321, Causing a Dipee-Hellman key exchange. The method of claim 12, Further comprising authenticating the receiver (400, 500) as a directed receiver. In the method of protecting copyrighted material, Decrypting 655 the encrypted ticket 431 to form a decrypted ticket 441, Determining (670, 680) at least one of a display permission and a copy permission based on the decrypted ticket (441) and the watermark inserted in the copyrighted material. The method of claim 16, Generating a key (421) used when decrypting an encrypted ticket (431). The method of claim 17, Generating the key (421) includes causing a Deepie-Hellman key exchange. The method of claim 16, Determining (670, 680) at least one display permission and a copy permission is based on at least one hash of the decrypted ticket (441).