System and method controlling access to digital works using a network

• US 20030191946A1
• Filed: 05/23/2003
• Published: 10/09/2003
• Est. Priority Date: 06/12/2000
• Status: Abandoned Application

• Current Assignee: Working Ventures CMDF Queen's Scientific Breakthrough Fund Incorporated
• Original Assignee: Working Ventures CMDF Queen's Scientific Breakthrough Fund Incorporated
• Inventors: Yeung, Eric C.H., Auer, Anthony R., Simmons, Stanley J.
• Application Number:
  US10/297,836
• Publication Number:
  US 20030191946A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Controlled access to digital works using a network employs a dynamically updated client identification code to uniquely identify the client to a server, a content identification code to identify digital work, and a client software module as an agent of the server. An encrypted secret or unencrypted authorization code allowing access to the data content is transmitted to the client. Transmitting an encrypted secret to the client over an insecure communications network supports encryption of the digital work. A database association provides for a software license environment for copies of different digital works and at least one machine. Distributing supplemental data content (e.g. advertising) from one or many servers to a client involves contacting an authentication server to determine whether access to the primary digital work should be provided to the client, retrieving from a data content server the supplemental data content and transmitting the supplemental data content to the client for display.

Claims

1. In an insecure communications network comprising a client and server communicating through said insecure communications network, a method of providing controlled access to digital works over said insecure network, said method comprising:

employing a client identification code that uniquely identifies said client to said server,

employing a content identification code to identify said digital work;

transmitting from said client to said server said client identification code; and

evaluating access rights of said client to said digital work at said server by checking said client identification against a database comprising access rights for a plurality of clients for said digital work; and

if said access is authorized, transmitting to said client a secret or authorization code used to gain access to said digital work.

6. The method of claim 1, further comprising:

providing a software module at the client for coordinating access-rights checking with the server, said software module being attached to form an integral part of any software-application digital works.

7. The method of claim 1, wherein the step of transmitting is performed when on-line connection to the authorization server is possible.

8. The method of claim 7, further comprising:

when on-line connection to an authorization server is not possible;

evaluating at the client a set of time-limited access rights stored locally, said locally stored access rights having been previously digitally signed and transmitted by the server, and if said access is authorized, allowing off-line access to the digital work.

9. The method of claim 1, further comprising:

updating the dynamic client identification code so that copied off-line access rights will be invalidated at subsequent server contacts.

10. The method of claim 1, further comprising:

leaving in local storage at the client a set of access rights digitally signed by the server to allow subsequent off-line usage.

11. The method of claim 1, further comprising:

encrypting the secret or authorization code prior to transmitting it.

2. A method for creating a client identification code by:

composing the identification code as a concatenation of a fixed identifier unique to a server, a changeable sequence number incremented by the server, and a changeable pseudo-random number; and

at every authorization contact of a client with the server, updating the client and server database with a modified identification code.

3. In an insecure communications network comprising a client and server communicating through said insecure communications network, a method of transmitting in encrypted fashion to said client a secret, said method comprising:

establishing a composite session key common to both said client and said server where said client and said server each provide one portion towards construction of the composite key, where said composite key cannot be constructed by any other party not knowing one of the two provided portions;

encrypting said secret with said composite session key to form an encrypted secret;

transmitting from said client to said server an authentication message, where said authentication message is known only to said client and said server within a time limit, and to no other party within said time limit;

transmitting said encrypted secret from said server to said client if and only if said authentication message is valid and is received by said server within said time limit; and

decrypting said encrypted secret at said client using said session key to recover said secret.

4. In a software license environment for multiple copies of different digital works and at least one machine, a database association comprising

a first record for a digital content license owner;

a second record for digital works licensed by said owner which have not yet been assigned to a machine;

a third set of records for machines controlled by said owner;

for each machine in said third set, a set of records of installed digital works associated with said each machine; and

for each record in said set of records of installed digital works a record for a license relating to said installed digital works,

wherein said database allows manipulation and access of records therein when (i) a record for said owner does exist in said database and a query is being made regarding status of said owner to said database;

(ii) a record for said owner exists in said database and said owner is attempting to access a digital work for which a record is not in said database; and

(iii) a record for said owner exists in said database and said owner is attempting to access a digital work for which there is a record in said database.

5. In a communications network where a client communicates with a plurality of types of servers, a method of distributing supplemental data content from said server to said client or other clients in said network, said method comprising:

when said client is executing a program, contacting an authentication server to determine as part of the license terms whether said supplemental data content should be provided to said client; and

retrieving from a data content server said data content and transmitting said data content to said client for display on said client.