Method and apparatus for automatically deploy security components in a content distribution system

• US 20030196121A1
• Filed: 04/30/2003
• Published: 10/16/2003
• Est. Priority Date: 08/28/2000
• Status: Active Grant

• Current Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Original Assignee: ContentGuard Holdings, Inc. (Pendrell Corporation)
• Inventors: Wu, Hsi-Cheng, Raley, Michael, Ta, Thanh, Chen, Daniel
• Granted Patent: US 7,237,125 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04N 21/4788 communicating with other users, e.g. chatting arrangements for providing for computer conferences, e.g. chat rooms, to substation in data switching networks H04L12/1813; distributed application using peer-to-peer [P2P] networks H04L67/104
• CPC Class Codes: H04N 21/632 using a connection between clients on a wide area network, e.g. setting up a peer-to-peer communication via Internet for retrieving video segments from the hard-disk of other client devices broadcast-related systems characterised by transmission among terminal devices H04H60/80; distributed application using peer-to-peer [P2P] networks H04L67/104

Abstract

A system and method for securely distributing content by automatically deploying security components. The system includes a server having content stored thereon, a client device having a standard application program for accomplishing a task related to the content, and a rights management module operatively coupled to the server and said client device and configured, upon a request to access the content, to determine if security components are coupled to the application program. The rights management module downloads and installs the security components on the client device if the security components are not coupled to the application program.

Claims

1. A system for securely distributing content, said system comprising:

a server having content stored thereon;

a client device having a standard application program for accomplishing a task related to the content; and

a rights management module operatively coupled to said server and said client device and configured, upon a request to access the content, to determine if security components are coupled to the application program;

wherein said rights management module is further operative to download and install the security components on said client device if the security components are not coupled to the application program.

2. A system as recited in claim 1, wherein the application program comprises a rendering engine for rendering the content and wherein rights management module is operative to attach the security components to the rendering engine.

3. A system as recited in claim 2, wherein the content is protected with usage rights associated with the content.

4. A system as recited in claim 3, wherein the usage rights specify a manner of use of the content.

5. A system as recited in claim 4, wherein the usage rights further specify conditions that must be satisfied to exercise the manner of use.

6. A system as recited in claim 2, wherein said rights management module is operative to determine if said client device is missing any security components based on a predetermined configuration required for managing protection of the content.

7. A system as recited in claim 2, wherein said rights management module is operative to check the content to determine if requested content requires a client side security component and to disengage the client side security component from the rendering engine if the requested content does not require a client side security component.

8. A system as recited in claim 2, wherein the content comprises executable software.

9. A system as recited in claim 2, wherein said rights management module is operative to determine if security components are installed on said client device by determining if a request for content from said client device includes a signature component and is operative to send a response to said client device to load the security components is the request does not include a signature component.

10. A system as recited in claim 2, wherein the application software is a Web browser.

11. A system as recited in claim 10, wherein the response is a Web page including an executable software component for installing the security components.

12. A system as recited in claim 2, wherein the security components include a software agent operative to validate that the client device is secure.

13. A system as recited in claim 11, wherein the Web page includes information relating to the location of the security components.

14. A system as recited in claim 7, wherein said rights management module checks the content by determining if the content includes a marker that the content requires the security components.

15. A system as recited in claim 14, wherein the marker is a signature.

44. A method as recited in claim 7, wherein said checking step comprises checking the content by determining if the content includes a marker that the content requires the security components.

45. A method as recited in claim 44, wherein the marker is a signature.

16. A server adapted to distribute content protected with a protection mechanism, said server comprising:

means for receiving a request for the content; and

a rights management module configured to examine the received request and determine if security components are coupled to an application program installed on a client device associated with the request and to download and install the security components on the client device if the security components are not coupled to the application program.

17. A server as recited in claim 16, wherein the application program comprises a rendering engine for rendering the content and wherein rights management module is operative to attach the security components to the rendering engine.

18. A server as recited in claim 17 wherein said protection mechanism comprises usage rights associated with the protected content.

19. A server as recited in claim 16, wherein the content is stored on the server.

20. A server as recited in claim 18, wherein the usage rights specify a manner of use of the content and conditions for exercising the manner of use.

21. A server as recited in claim 17, wherein said rights management module is operative to determine if the client device is missing any security component software based on a predetermined configuration required for managing security of requested content and if said at least one client unit is missing any security component software based on said predetermined configuration, said rights management module is operative to provide said missing security component software to the client device.

22. A server as recited in claim 17, wherein said rights management module is operative to check the content to determine if requested content requires a client side security component and to disengage the client side security component from the rendering engine if the requested content does not require a client side security component.

23. A server as recited in claim 17, wherein the protected content comprises executable software.

24. A server as recited in claim 17, wherein said rights management module is operative to determine if security components are installed on the client device by determining if a request for content from said client device includes a signature component and is operative to send a response to the client device to load the security components is the request does not include a signature component.

25. A server as recited in claim 24, wherein the application software is a Web browser.

26. A server as recited in claim 25, wherein the response is a Web page including an executable software component for installing the security components.

27. A server as recited in claim 17, wherein the security components include a software agent operative to validate that the client device is secure.

28. A server as recited in claim 26, wherein the Web page includes information relating to the location of the security components.

29. A server as recited in claim 17, wherein said rights management module checks the content by determining if the content includes a marker that the protected content requires the security components.

30. A server as recited in claim 29, wherein the marker is a signature.

31. A method for securely distributing content, said system comprising:

receiving a request for access to content;

in response to the request, determining if security components for controlling access to the content are coupled to an application program of a client device to access the content; and

downloading and installing the security components on the client device if the security components are not coupled to the application program.

32. A method as recited in claim 31, wherein the application program comprises a rendering engine for rendering the content and wherein said downloading and installing step comprises attaching the security components to the rendering engine.

33. A method as recited in claim 32, wherein the content is protected with usage rights associated with the content.

34. A method as recited in claim 33, wherein the usage rights specify a manner of use of the content.

35. A method as recited in claim 34, wherein the usage rights further specify conditions that must be satisfied to exercise the manner of use.

36. A method as recited in claim 32, wherein said determining step comprises determining if the client device is missing any security components based on a predetermined configuration required for managing protection of the content.

37. A method as recited in claim 32, further comprising checking the content to determine if requested content requires a client side security component and to disengage the client side security component from the rendering engine if the requested content does not require a client side security component.

38. A method as recited in claim 32, wherein the content comprises executable software.

39. A method as recited in claim 32, wherein said determining step comprises determining if security components are installed on the client device by determining if a request for content from the client device includes a signature component and sending a response to the client device to load the security components if the request does not include a signature component.

40. A method as recited in claim 32 wherein the application software is a Web browser.

41. A method as recited in claim 39, wherein the response is a Web page including an executable software component for installing the security components.

42. A method as recited in claim 32, wherein the security components include a software agent operative to validate that the client device is secure.

43. A method as recited in claim 41, wherein the Web page includes information relating to the location of the security components.