Provisioning for digital content access control

• US 20040054629A1
• Filed: 09/13/2002
• Published: 03/18/2004
• Est. Priority Date: 09/13/2002
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard, Bostrom, Jon, Cooley, Aaron
• Application Number:
  US10/243,287
• Publication Number:
  US 20040054629A1
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method and apparatus for digital content access control method comprises receiving a digital content request comprising a request for digital content, determining whether a user associated with the digital content request is authorized to access the digital content, creating an authenticated digital content request if the user is authorized to access the digital content and sending the authenticated digital content request for use in accessing the digital content stored by a content repository.

Claims

1. A method for digital content access control, the method comprising:

receiving a digital content request comprising a request for digital content;

determining whether a user associated with said digital content request is authorized to access said digital content;

creating an authenticated digital content request if said user is authorized to access said digital content; and

sending said authenticated digital content request for use in accessing said digital content stored by a content repository.

2. The method of claim 1, further comprising synchronizing with said content repository if synchronization is enabled.

3. The method of claim 1 wherein

said digital content request comprises a Universal Resource Locator (URL);

said authenticated digital content request comprises a tokenized URL; and

said creating further comprises;

determining a token pool associated with said digital content;

determining a token in said token pool; and

creating a tokenized URL based at least in part on said token.

4. The method of claim 3 wherein said tokenized URL further comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

5. The method of claim 3 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

6. A method for digital content access control, the method comprising:

receiving a digital content request comprising a request for digital content;

determining whether a user associated with said digital content request is authorized to access said digital content; and

sending at least one deactivated token for use in accessing digital content stored by a content repository in response to said request if said user is authorized to access said digital content.

7. The method of claim 6, further comprising synchronizing with said content repository if said synchronizing is enabled.

8. The method of claim 6 wherein said digital content request comprises a Universal Resource Locator (URL).

9. The method of claim 8 wherein said deactivated token comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

10. The method of claim 6 wherein said deactivated token further comprises one of at least one token from a token pool associated with the location of digital content for which access is authorized.

11. A method for digital content access control, the method comprising:

step for receiving a digital content request comprising a request for digital content;

step for determining whether a user associated with said digital content request is authorized to access said digital content;

step for creating an authenticated digital content request if said user is authorized to access said digital content; and

step for sending said authenticated digital content request for use in accessing said digital content stored by a content repository.

12. The method of claim 11, further comprising step for synchronizing with said content repository if synchronization is enabled.

13. The method of claim 11 wherein

said digital content request comprises a Universal Resource Locator (URL);

said authenticated digital content request comprises a tokenized URL; and

said step for creating further comprises;

step for determining a token pool associated with said digital content;

step for determining a token in said token pool; and

step for creating a tokenized URL based at least in part on said token.

14. The method of claim 13 wherein said tokenized URL further comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

15. The method of claim 13 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

16. A method for digital content access control, the method comprising:

step for receiving a digital content request comprising a request for digital content;

step for determining whether a user associated with said digital content request is authorized to access said digital content; and

step for sending at least one deactivated token for use in accessing digital content stored by a content repository in response to said request if said user is authorized to access said digital content.

17. The method of claim 16, further comprising step for synchronizing with said content repository if said synchronizing is enabled.

18. The method of claim 16 wherein said digital content request comprises a Universal Resource Locator (URL).

19. The method of claim 18 wherein said deactivated token comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

20. The method of claim 16 wherein said deactivated token further comprises one of at least one token from a token pool associated with the location of digital content for which access is authorized.

21. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

determining whether a user associated with said digital content request is authorized to access said digital content;

creating an authenticated digital content request if said user is authorized to access said digital content; and

sending said authenticated digital content request for use in accessing said digital content stored by a content repository.

22. The program storage device of claim 21, the method further comprising synchronizing with said content repository if synchronization is enabled.

23. The program storage device of claim 21 wherein

said digital content request comprises a Universal Resource Locator (URL);

said authenticated digital content request comprises a tokenized URL; and

said creating further comprises;

determining a token pool associated with said digital content;

determining a token in said token pool; and

creating a tokenized URL based at least in part on said token.

24. The program storage device of claim 23 wherein said tokenized URL further comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

25. The program storage device of claim 23 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

26. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving a digital content request comprising a request for digital content;

determining whether a user associated with said digital content request is authorized to access said digital content; and

sending at least one deactivated token for use in accessing digital content stored by a content repository in response to said request if said user is authorized to access said digital content.

27. The program storage device of claim 26, the method further comprising synchronizing with said content repository if said synchronizing is enabled.

28. The program storage device of claim 26 wherein said digital content request comprises a Universal Resource Locator (URL).

29. The program storage device of claim 28 wherein said deactivated token comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

30. The program storage device of claim 26 wherein said deactivated token further comprises one of at least one token from a token pool associated with the location of digital content for which access is authorized.

31. An apparatus for digital content access control, the apparatus comprising:

means for determining whether a user associated with said digital content request is authorized to access said digital content;

means for creating an authenticated digital content request if said user is authorized to access said digital content; and

means for sending said authenticated digital content request for use in accessing said digital content stored by a content repository.

32. The apparatus of claim 31, further comprising means for synchronizing with said content repository if synchronization is enabled.

33. The apparatus of claim 31 wherein

said digital content request comprises a Universal Resource Locator (URL);

said authenticated digital content request comprises a tokenized URL; and

said means for creating further comprises;

means for determining a token pool associated with said digital content;

means for determining a token in said token pool; and

means for creating a tokenized URL based at least in part on said token.

34. The apparatus of claim 33 wherein said tokenized URL further comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

35. The apparatus of claim 33 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

36. A apparatus for digital content access control, the apparatus comprising:

means for receiving a digital content request comprising a request for digital content;

means for determining whether a user associated with said digital content request is authorized to access said digital content; and

means for sending at least one deactivated token for use in accessing digital content stored by a content repository in response to said request if said user is authorized to access said digital content.

37. The apparatus of claim 36, further comprising means for synchronizing with said content repository if said synchronizing is enabled.

38. The apparatus of claim 36 wherein said digital content request comprises a Universal Resource Locator (URL).

39. The apparatus of claim 38 wherein said deactivated token comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

40. The apparatus of claim 36 wherein said deactivated token further comprises one of at least one token from a token pool associated with the location of digital content for which access is authorized.

41. An apparatus for digital content access control, the apparatus comprising:

a memory for storing provisioning information for use in creating an authenticated digital content request that is based at least in part on a digital content request comprising a request for digital content; and

a content provisioner configured to;

receive said digital content request;

determine whether a user associated with said digital content request is authorized to access said digital content;

create said authenticated digital content request if said user is authorized to access said digital content; and

send said authenticated digital content request for use in accessing said digital content stored by a content repository.

42. The apparatus of claim 41 wherein said apparatus is further configured to synchronize with said content repository if synchronization is enabled.

43. The apparatus of claim 41 wherein

said digital content request comprises a Universal Resource Locator (URL);

said authenticated digital content request comprises a tokenized URL; and

said provisioner is further configured to;

determine a token pool associated with said digital content;

determine a token in said token pool; and

create a tokenized URL based at least in part on said token.

44. The apparatus of claim 43 wherein said tokenized URL further comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

45. The apparatus of claim 43 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

46. An apparatus for digital content access control, the apparatus comprising:

a memory for storing provisioning information for use in creating an authenticated digital content request that is based at least in part on a digital content request comprising a request for digital content; and

a content provisioner configured to;

receive a digital content request comprising a request for digital content;

determine whether a user associated with said digital content request is authorized to access said digital content; and

send at least one deactivated token for use in accessing digital content stored by a content repository in response to said request if said user is authorized to access said digital content.

47. The apparatus of claim 46 wherein said apparatus is further configured to synchronize with said content repository if synchronization is enabled.

48. The apparatus of claim 46 wherein said digital content request comprises a Universal Resource Locator (URL).

49. The apparatus of claim 48 wherein said deactivated token comprises a cryptogram based at least in part on an identifier that describes the location of said digital content.

50. The apparatus of claim 46 wherein said deactivated token further comprises one of at least one token from a token pool associated with the location of digital content for which access is authorized.

51. A method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens, said creating comprising;

applying a cryptographic process to one or more bits expressing an identifier in a series together with a token chain key; and

allocating one or more tokens in said token chain for access to digital content associated with said token chain.

52. The method of claim 51 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

53. The method of claim 51 wherein said allocating further comprises using a randomized process to select an unallocated token within said token chain.

54. The method of claim 51 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

55. The method of claim 51 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

56. The method of claim 51 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed and length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

57. A method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens created by;

replacing a predefined set of bits of a filler with one or more bits expressing an identifier in a series, said replacing creating a modified filler;

applying a cryptographic process to said modified filler together with a token chain key, said token chain key based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said token chain key; and

allocating one or more tokens in said token chain for access to said digital content.

58. The method of claim 57 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

59. The method of claim 57 wherein said allocating further comprises using a randomized process to select an unallocated token within said token chain.

60. The method of claim 57 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

61. A method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens, said token chain formed from successive applications of a cryptographic one-way function; and

allocating one or more tokens in said token chain for access to digital content associated with said token chain, said allocating in reverse order of the token creation order wherein the first-allocated token comprises the last-created token and the last-allocated token comprises the first-created token.

62. The method of claim 61, further comprising forming the first token in said token chain by applying a cryptographic process to a seed with a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

63. The method of claim 61, further comprising forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

64. The method of claim 61, further comprising forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key and a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool, said length value specifying the number of tokens in said token chain.

65. A method for digital content access control, the method comprising:

creating a token pool comprising one or more token chains comprising a predetermined number of tokens and formed from successive applications of a cryptographic one-way function; and

allocating one or more tokens in said token pool, each successive allocation originating from a token chain that is different than the token chain of the last-allocated token.

66. The method of claim 65 wherein allocation of tokens within a token chain proceeds in reverse order of the token creation order, the first-allocated token comprising the last-created token and the last-allocated token comprising the first-created token.

67. The method of claim 66 wherein token allocation proceeds in a diagonal fashion with respect to token chains of said token pool, wherein allocation of token n of token chain m is followed by allocation of token n−

1 of token chain m−

1 if token n of chain m is not the first-created token in token chain m and wherein allocation of token n of token chain m is followed by allocation of the last-created token of an unallocated token chain if token n of chain m is the first-created token in token chain m.

68. The method of claim 65 wherein said token pool comprises a plurality of smaller token pools.

69. The method of claim 68 wherein one of said plurality of smaller pools is selected based at least in part on the number of unredeemed tokens in a current pool.

70. The method of claim 68 wherein one of said plurality of smaller pools is selected based at least in part on the amount of time a current pool has been available for allocation in satisfying digital content access requests.

71. A method for digital content access control, the method comprising:

step for creating a token chain comprising one or more tokens, said creating comprising;

step for applying a cryptographic process to one or more bits expressing an identifier in a series together with a token chain key; and

step for allocating one or more tokens in said token chain for access to digital content associated with said token chain.

72. The method of claim 71 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

73. The method of claim 71 wherein said step for allocating further comprises step for using a randomized process to select an unallocated token within said token chain.

74. The method of claim 71 wherein said step for creating further comprises step for forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

75. The method of claim 71 wherein said step for creating further comprises step for forming said token chain key by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

76. The method of claim 71 wherein said step for creating further comprises step for forming said token chain key by applying a cryptographic process to a seed and length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

77. A method for digital content access control, the method comprising:

step for creating a token chain comprising one or more tokens created by;

replacing a predefined set of bits of a filler with one or more bits expressing an identifier in a series, said replacing creating a modified filler;

applying a cryptographic process to said modified filler together with a token chain key, said token chain key based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said token chain key; and

step for allocating one or more tokens in said token chain for access to said digital content.

78. The method of claim 77 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

79. The method of claim 77 wherein said step for allocating further comprises step for using a randomized process to select an unallocated token within said token chain.

80. The method of claim 77 wherein said step for creating further comprises step for forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

81. A method for digital content access control, the method comprising:

step for creating a token chain comprising one or more tokens, said token chain formed from successive applications of a cryptographic one-way function; and

step for allocating one or more tokens in said token chain for access to digital content associated with said token chain, said allocating in reverse order of the token creation order wherein the first-allocated token comprises the last-created token and the last-allocated token comprises the first-created token.

82. The method of claim 81, further comprising step for forming the first token in said token chain by applying a cryptographic process to a seed with a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

83. The method of claim 81, further comprising step for forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

84. The method of claim 81, further comprising step for forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key and a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool, said length value specifying the number of tokens in said token chain.

85. A method for digital content access control, the method comprising:

step for creating a token pool comprising one or more token chains comprising a predetermined number of tokens and formed from successive applications of a cryptographic one-way function; and

step for allocating one or more tokens in said token pool, each successive allocation originating from a token chain that is different than the token chain of the last-allocated token.

86. The method of claim 85 wherein allocation of tokens within a token chain proceeds in reverse order of the token creation order, the first-allocated token comprising the last-created token and the last-allocated token comprising the first-created token.

87. The method of claim 86 wherein token allocation proceeds in a diagonal fashion with respect to token chains of said token pool, wherein allocation of token n of token chain m is followed by allocation of token n−

1 of token chain m−

1 if token n of chain m is not the first-created token in token chain m and wherein allocation of token n of token chain m is followed by allocation of the last-created token of an unallocated token chain if token n of chain m is the first-created token in token chain m.

88. The method of claim 85 wherein said token pool comprises a plurality of smaller token pools.

89. The method of claim 88 wherein one of said plurality of smaller pools is selected based at least in part on the number of unredeemed tokens in a current pool.

90. The method of claim 88 wherein one of said plurality of smaller pools is selected based at least in part on the number amount of time a current pool has been available for allocation in satisfying digital content access requests.

91. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens, said creating comprising;

applying a cryptographic process to one or more bits expressing an identifier in a series together with a token chain key; and

allocating one or more tokens in said token chain for access to digital content associated with said token chain.

92. The program storage device of claim 91 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

93. The program storage device of claim 91 wherein said allocating further comprises using a randomized process to select an unallocated token within said token chain.

94. The program storage device of claim 91 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

95. The program storage device of claim 91 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

96. The program storage device of claim 91 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed and length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

97. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens created by;

replacing a predefined set of bits of a filler with one or more bits expressing an identifier in a series, said replacing creating a modified filler;

applying a cryptographic process to said modified filler together with a token chain key, said token chain key based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said token chain key; and

allocating one or more tokens in said token chain for access to said digital content.

98. The program storage device of claim 97 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

99. The program storage device of claim 97 wherein said allocating further comprises using a randomized process to select an unallocated token within said token chain.

100. The program storage device of claim 97 wherein said creating further comprises forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

101. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

creating a token chain comprising one or more tokens, said token chain formed from successive applications of a cryptographic one-way function; and

allocating one or more tokens in said token chain for access to digital content associated with said token chain, said allocating in reverse order of the token creation order wherein the first-allocated token comprises the last-created token and the last-allocated token comprises the first-created token.

102. The program storage device of claim 101, said method further comprising forming the first token in said token chain by applying a cryptographic process to a seed with a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

103. The program storage device of claim 101, said method further comprising forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

104. The program storage device of claim 101, said method further comprising forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key and a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool, said length value specifying the number of tokens in said token chain.

105. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

creating a token pool comprising one or more token chains comprising a predetermined number of tokens and formed from successive applications of a cryptographic one-way function; and

allocating one or more tokens in said token pool, each successive allocation originating from a token chain that is different than the token chain of the last-allocated token.

106. The program storage device of claim 105 wherein allocation of tokens within a token chain proceeds in reverse order of the token creation order, the first-allocated token comprising the last-created token and the last-allocated token comprising the first-created token.

107. The program storage device of claim 106 wherein token allocation proceeds in a diagonal fashion with respect to token chains of said token pool, wherein allocation of token n of token chain m is followed by allocation of token n−

1 of token chain m−

1 if token n of chain m is not the first-created token in token chain m and wherein allocation of token n of token chain m is followed by allocation of the last-created token of an unallocated token chain if token n of chain m is the first-created token in token chain m.

108. The program storage device of claim 105 wherein said token pool comprises a plurality of smaller token pools.

109. The program storage device of claim 108 wherein one of said plurality of smaller pools is selected based at least in part on the number of unredeemed tokens in a current pool.

110. The program storage device of claim 108 wherein one of said plurality of smaller pools is selected based at least in part on the amount of time a current pool has been available for allocation in satisfying digital content access requests.

111. An apparatus for digital content access control, the apparatus comprising:

means for creating a token chain comprising one or more tokens, said means for creating comprising;

means for applying a cryptographic process to one or more bits expressing an identifier in a series together with a token chain key; and

means for allocating one or more tokens in said token chain for access to digital content associated with said token chain.

112. The apparatus of claim 111 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

113. The apparatus of claim 111 wherein said means for allocating further comprises means for using a randomized process to select an unallocated token within said token chain.

114. The apparatus of claim 111 wherein said means for creating further comprises means for forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

115. The apparatus of claim 111 wherein said means for creating further comprises means for forming said token chain key by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

116. The apparatus of claim 111 wherein said means for creating further comprises means for forming said token chain key by applying a cryptographic process to a seed and length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

117. An apparatus for digital content access control, the apparatus comprising:

means for creating a token chain comprising one or more tokens created by;

replacing a predefined set of bits of a filler with one or more bits expressing an identifier in a series, said replacing creating a modified filler;

applying a cryptographic process to said modified filler together with a token chain key, said token chain key based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said token chain key; and

means for allocating one or more tokens in said token chain for access to said digital content.

118. The apparatus of claim 117 wherein said allocating is ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

119. The apparatus of claim 117 wherein said means for allocating further comprises means for using a randomized process to select an unallocated token within said token chain.

120. The apparatus of claim 117 wherein said means for creating further comprises means for forming said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

121. An apparatus for digital content access control, the apparatus comprising:

means for creating a token chain comprising one or more tokens, said token chain formed from successive applications of a cryptographic one-way function; and

means for allocating one or more tokens in said token chain for access to digital content associated with said token chain, said allocating in reverse order of the token creation order wherein the first-allocated token comprises the last-created token and the last-allocated token comprises the first-created token.

122. The apparatus of claim 121, further comprising means for forming the first token in said token chain by applying a cryptographic process to a seed with a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

123. The apparatus of claim 121, further comprising means for forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

124. The apparatus of claim 121, further comprising means for forming the first token in said token chain by applying a cryptographic process to a seed together with a token pool key and a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool, said length value specifying the number of tokens in said token chain.

125. An apparatus for digital content access control, the apparatus comprising:

means for creating a token pool comprising one or more token chains comprising a predetermined number of tokens and formed from successive applications of a cryptographic one-way function; and

means for allocating one or more tokens in said token pool, each successive allocation originating from a token chain that is different than the token chain of the last-allocated token.

126. The apparatus of claim 125 wherein allocation of tokens within a token chain proceeds in reverse order of the token creation order, the first-allocated token comprising the last-created token and the last-allocated token comprising the first-created token.

127. The apparatus of claim 126 wherein token allocation proceeds in a diagonal fashion with respect to token chains of said token pool, wherein allocation of token n of token chain m is followed by allocation of token n−

1 of token chain m−

1 if token n of chain m is not the first-created token in token chain m and wherein allocation of token n of token chain m is followed by allocation of the last-created token of an unallocated token chain if token n of chain m is the first-created token in token chain m.

128. The apparatus of claim 126 wherein said token pool comprises a plurality of smaller token pools.

129. The apparatus of claim 128 wherein one of said plurality of smaller pools is selected based at least in part on the number of unredeemed tokens in a current pool.

130. The apparatus of claim 128 wherein one of said plurality of smaller pools is selected based at least in part on the amount of time a current pool has been available for allocation in satisfying digital content access requests.

131. An apparatus for digital content access control, the apparatus comprising:

a memory for storing a token chain comprising one or more tokens comprising the result of applying a cryptographic process to one or more bits expressing an identifier in a series together with a token chain key; and

a token issuer for allocating one or more tokens in said token chain for access to digital content associated with said token chain.

132. The apparatus of claim 131 wherein said token issuer is further configured to allocate tokens ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

133. The apparatus of claim 131 wherein said token issuer is further configured to use a randomized process to select an unallocated token within said token chain.

134. The apparatus of claim 131 wherein said token issuer is further configured to form said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

135. The apparatus of claim 131 wherein said token issuer is further configured to form said token chain key by applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

136. The apparatus of claim 131 wherein said token issuer is further configured to form said token chain key by applying a cryptographic process to a seed and length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

137. An apparatus for digital content access control, the apparatus comprising:

a memory for storing a token chain comprising one or more tokens created by;

replacing a predefined set of bits of a filler with one or more bits expressing an identifier in a series, said replacing creating a modified filler;

applying a cryptographic process to said modified filler together with a token chain key, said token chain key based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said token chain key; and

a token issuer for allocating one or more tokens in said token chain for access to said digital content.

138. The apparatus of claim 137 wherein said token issuer is further configured to allocate tokens ordered according to the token creation order wherein the first-allocated token comprises the first-created token and the last-allocated token comprises the last-created token.

139. The apparatus of claim 137 wherein said token issuer is further configured to use a randomized process to select an unallocated token within said token chain.

140. The apparatus of claim 137 wherein said token issuer is further configured to form said token chain key by applying a cryptographic process to a seed that is based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed.

141. An apparatus for digital content access control, the apparatus comprising:

a memory for storing a token chain comprising one or more tokens, said token chain formed from successive applications of a cryptographic one-way function; and

a token issuer for allocating one or more tokens in said token chain for access to digital content associated with said token chain, said allocating in reverse order of the token creation order wherein the first-allocated token comprises the last-created token and the last-allocated token comprises the first-created token.

142. The apparatus of claim 141 wherein the first token in said token chain comprises the result of applying a cryptographic process to a seed with a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said length value specifying the number of tokens in said token chain.

143. The apparatus of claim 141 wherein the first token in said token chain comprises the result of applying a cryptographic process to a seed together with a token pool key, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool.

144. The apparatus of claim 141 wherein the first token in said token chain comprises the result of applying a cryptographic process to a seed together with a token pool key and a length value, said seed based at least in part on a portion of a Universal Resource Locator (URL) that defines digital content that may be accessed using a token from a token pool based at least in part on said seed, said token pool key used to create a token chain key for one or more token chains of a token pool, said length value specifying the number of tokens in said token chain.

145. An apparatus for digital content access control, the apparatus comprising:

a memory for storing a token pool comprising one or more token chains comprising a predetermined number of tokens and formed from successive applications of a cryptographic one-way function; and

a token issuer for allocating one or more tokens in said token pool, each successive allocation originating from a token chain that is different than the token chain of the last-allocated token.

146. The apparatus of claim 145 wherein said token issuer is configured to allocate tokens within a token chain in reverse order of the token creation order, the first-allocated token comprising the last-created token and the last-allocated token comprising the first-created token.

147. The apparatus of claim 146 wherein said token issuer is configured to allocated tokens in a diagonal fashion with respect to token chains of said token pool, wherein allocation of token n of token chain m is followed by allocation of token n−

1 of token chain m−

1 if token n of chain m is not the first-created token in token chain m and wherein allocation of token n of token chain m is followed by allocation of the last-created token of an unallocated token chain if token n of chain m is the first-created token in token chain m.

148. The apparatus of claim 145 wherein said token pool comprises a plurality of smaller token pools.

149. The apparatus of claim 148 wherein said token issuer is further configured to select one of said plurality of smaller pools based at least in part on the number of unredeemed tokens in a current pool.

150. The apparatus of claim 148 wherein said token issuer is further configured to select one of said plurality of smaller pools based at least in part on the amount of time a current pool has been available for allocation in satisfying digital content access requests.

151. A method for digital content access control, the method comprising:

receiving a request for access to digital content; and

creating a tokenized Universal Resource Locator (URL) in response to said request, said tokenized URL comprising;

a delivery scheme indicator that specifies a protocol for accessing said digital content;

an access domain indicator that specifies a content repository associated with said digital content; and

a token indicator that specifies a token that may be validated to gain access to said digital content at said content repository.

152. The method of claim 151 wherein said tokenized URL further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

153. The method of claim 152 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

154. The method of claim 152 wherein said one or more delivery parameter indicators specify a destination address.

155. The method of claim 152 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

156. The method of claim 151 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

157. The method of claim 151 wherein

said tokenized URL further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

158. The method of claim 157 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

159. A method for digital content access control, the method comprising:

step for receiving a request for access to digital content; and

step for creating a tokenized Universal Resource Locator (URL) in response to said request, said tokenized URL comprising;

a delivery scheme indicator that specifies a protocol for accessing said digital content;

an access domain indicator that specifies a content repository associated with said digital content; and

a token indicator that specifies a token that may be validated to gain access to said digital content at said content repository.

160. The method of claim 159 wherein said tokenized URL further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

161. The method of claim 160 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

162. The method of claim 160 wherein said one or more delivery parameter indicators specify a destination address.

163. The method of claim 160 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

164. The method of claim 159 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

165. The method of claim 159 wherein

said tokenized URL further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

166. The method of claim 165 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

167. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving a request for access to digital content; and

creating a tokenized Universal Resource Locator (URL) in response to said request, said tokenized URL comprising;

a delivery scheme indicator that specifies a protocol for accessing said digital content;

an access domain indicator that specifies a content repository associated with said digital content; and

a token indicator that specifies a token that may be validated to gain access to said digital content at said content repository.

168. The program storage device of claim 167 wherein said tokenized URL further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

169. The program storage device of claim 168 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

170. The program storage device of claim 168 wherein said one or more delivery parameter indicators specify a destination address.

171. The program storage device of claim 168 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

172. The program storage device of claim 167 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

173. The program storage device of claim 167 wherein

said tokenized URL further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

174. The program storage device of claim 173 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

175. An apparatus for digital content access control, the apparatus comprising:

means for receiving a request for access to digital content; and

means for creating a tokenized Universal Resource Locator (URL) in response to said request, said tokenized URL comprising;

a delivery scheme indicator that specifies a protocol for accessing said digital content;

an access domain indicator that specifies a content repository associated with said digital content; and

a token indicator that specifies a token that may be validated to gain access to said digital content at said content repository.

176. The apparatus of claim 175 wherein said tokenized URL further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

177. The apparatus of claim 176 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

178. The apparatus of claim 176 wherein said one or more delivery parameter indicators specify a destination address.

179. The apparatus of claim 176 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

180. The apparatus of claim 175 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

181. The apparatus of claim 175 wherein

said tokenized URL further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

182. The apparatus of claim 181 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

183. An apparatus for digital content access control, the apparatus comprising:

a token issuer configured to receive a request for access to digital content; and

a download manager configured to create a tokenized Universal Resource Locator (URL) in response to said request, said token issuer in communication with said download manager, said tokenized URL comprising;

a delivery scheme indicator that specifies a protocol for accessing said digital content;

an access domain indicator that specifies a content repository associated with said digital content; and

a token indicator that specifies a token that may be validated to gain access to said digital content at said content repository.

184. The apparatus of claim 183 wherein said tokenized URL further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

185. The apparatus of claim 184 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

186. The apparatus of claim 184 wherein said one or more delivery parameter indicators specify a destination address.

187. The apparatus of claim 184 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

188. The apparatus of claim 183 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

189. The apparatus of claim 183 wherein

said tokenized URL further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

190. The apparatus of claim 189 wherein said tokenized URL further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.