Digital rights management system implemented on a scanner

Patent metadata

Field	Value
Publication number	US-9355226-B2
Application number	US-201414290626-A
Country	US
Kind code	B2
Filing date	May 29, 2014
Priority date	May 29, 2014
Publication date	May 31, 2016
Grant date	May 31, 2016

Abstract

In a digital rights management system where a scanner is connected to a rights management server, the process of applying digital rights protection is performed by the scanner, rather than the server, so that scanning and document protection can be done even when the server is not available. Upon scanning a document, the operator selects a rights management policy to be applied to the digital document. The scanner generates a document ID, embeds the document ID as metadata in the document, encrypts the document, and stores the document ID, policy ID of the selected policy, and encryption key as an entry in a local document-policy association table on the scanner. The scanner uploads the above information of the digital document to the server, which stores the information in a document-policy association table on server and uses it to perform document access control.

First claim

What is claimed is:

1. A method implemented in a system comprising a digital document generation apparatus connected to a digital rights management server via a network, the digital document generation apparatus being a scanner or a mobile device with a camera, for managing digital rights of digital documents generated by the digital document generation apparatus, the method comprising:
by the digital document generation apparatus:
(a) storing a plurality of right management policies in a storage device local to the digital document generation apparatus, each right management policy defining user access rights with respect to digital documents with which the policy is to be associated;
(b) generating a digital document by scanning a hardcopy document using the scanner or photographing a hardcopy document using the camera;
(c) receiving an operator input indicating a policy ID of a selected one of the plurality of rights management policies;
(d) generating a unique document ID for the digital document;
(e) embedding the document ID and information identifying the digital rights management server in metadata of the digital document;
(f) encrypting the digital document using an encryption key;
(g) storing the document ID, the policy ID and the encryption key as an entry in a local document-policy association table in the storage device local to the digital document generation apparatus;
(h) storing or transmitting the encrypted digital document to a user, without permitting any access to content of the digital document; and
(i) transmitting, after step (h), the document ID, the policy ID and the encryption key to the digital rights management server.

2. The method of claim 1 , further comprising:
by the server:
(j) storing a plurality of right management policies in a storage device of the server, each right management policy defining user access rights which specifies a plurality of users having access rights to digital documents with which the policy is to be associated;
(k) receiving the document ID, the policy ID and the encryption key from the digital document generation apparatus; and
(l) storing the document ID, the policy ID and the encryption key as an entry in a document-policy association table in the storage device of the server.

3. The method of claim 2 , further comprising:
by the server:
(m) receiving a request for access from a user computer, the request indicating a document ID of a digital document to be accessed and a user ID of a requesting user;
(n) determining a policy ID associated with the document ID by referring to the document-policy association table in the storage device of the server;
(o) determining an access permission of the requesting user by referring to the policy table using the policy ID and the user ID; and
(p) transmitting a reply to the user computer based on the access permission determined in step (o).

4. The method of claim 1 , wherein the digital document generation apparatus is a scanner device, and wherein step (b) comprises scanning a hardcopy document to generate the digital document.

5. The method of claim 4 , wherein step (c) includes:
displaying at least a subset of the stored plurality of rights management policies to an operator; and
receiving an operator input selecting one of the displayed policies.

6. The method of claim 5 , wherein the policies displayed to the operator are dependent on an operator ID of the operator.

7. The method of claim 2 , wherein in step (i), the digital document generation apparatus transmits the document ID and the policy ID to the digital rights management server via a message queue, and in step (k), the server receives the document ID and the policy ID from the digital document generation apparatus via the message queue.

8. A scanner connected to a digital rights management server via a network, comprising:
a scanning section for scanning hardcopy documents to generate digital documents;
a user interface for display information to and receiving input from a user;
a storage device storing a plurality of right management policies, a document-policy association table and a plurality of digital documents, the document-policy association table defining an association of each of the plurality of digital documents with one of the rights management policies, each right management policy defining user access rights with respect to digital documents with which the policy is associated;
a non-transitory memory storing computer-readable program code;
a processing section executing the program code stored in the non-transitory memory to perform a process which comprises:
(b) controlling the scanning section to scan a hardcopy document to generate a digital document;
(c) via the user interface, receiving an operator input indicating a policy ID of a selected one of the plurality of rights management policies;
(d) generating a unique document ID for the digital document generated in step (a);
(e) embedding the document ID and information identifying the digital rights management server in metadata of the digital document;
(f) encrypting the digital document using an encryption key;
(g) storing the document ID, the policy ID and the encryption key as an entry in the document-policy association table in the storage device;
(h) storing the digital document in the storage device or transmitting the digital document to a user, without permitting any access to content of the digital document; and
(i) transmitting, after step (h), the document ID, the policy ID and the encryption key to the digital rights management server.

9. The scanner of claim 8 , wherein step (b) includes:
displaying at least a subset of the stored plurality of rights management policies to an operator; and
receiving an operator input selecting one of the displayed policies.

10. The scanner of claim 9 , wherein the policies displayed to the operator are dependent on an operator ID of the operator.

11. A computer program product comprising a computer usable non-transitory medium having computer readable program code embedded therein for controlling a digital rights management server which is connected to a digital document generation apparatus via a network, the computer readable program code being configured to cause the digital rights management server to execute a process for managing digital rights of digital documents, wherein the process executed by the digital rights management server comprises:
(j) storing a plurality of right management policies in a storage device of the server, each right management policy defining user access rights which specifies a plurality of users having access rights to digital documents with which the policy is to be associated;
(k) receiving, from the digital document generation apparatus using a message queue, a document ID, a policy ID and a encryption key for a digital document generated by the digital document generation apparatus;
(l) storing the document ID, the policy ID and the encryption key as an entry in a document-policy association table in the storage device of the server;
(m) after step (l), receiving a request for access from a user computer, the request indicating a document ID of a digital document to be accessed and a user ID of a requesting user, wherein the digital document has been generated by the digital document generation apparatus;
(n) determining a policy ID associated with the document ID by referring to the document-policy association table in the storage device of the server;
(o) determining an access permission of the requesting user by referring to the policy table using the policy ID and the user ID; and
(p) transmitting a reply to the user c

Assignees

• Konica Minolta Lab Usa Inc

Inventors

• Pathak Rabindra

Classifications

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F2221/07

  Physics · mapped topic

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F2221/2117

  User registration · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title