Repositing for digital content access control

• US 20040054915A1
• Filed: 09/13/2002
• Published: 03/18/2004
• Est. Priority Date: 09/13/2002
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Jong, Eduard de, Bostrom, Jon, Cooley, Aaron
• Granted Patent: US 7,240,365 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and apparatus for digital content access control comprises receiving an authenticated digital content request based at least in part on a digital content request comprising a request for digital content, validating the authenticated digital content request and providing the digital content if the authenticated digital content request is valid. The validating comprises indicating the authenticated digital content request is valid if the authenticated digital content request is validly associated with the digital content and if the authenticated digital content request authenticates the digital content request, and indicating the authenticated digital content request is invalid if the authenticated digital content request is not validly associated with the digital content.

Claims

1. A method for digital content access control, the method comprising:

receiving an authenticated digital content request based at least in part on a digital content request comprising a request for digital content;

validating said authenticated digital content request, said validating comprising;

indicating said authenticated digital content request is valid if said authenticated digital content request is validly associated with said digital content and if said authenticated digital content request authenticates said digital content request; and

indicating said authenticated digital content request is invalid if said authenticated digital content request is not validly associated with said digital content; and

providing said digital content if said authenticated digital content request is valid.

2. The method of claim 1, further comprising synchronizing with a content provisioner if said synchronizing is enabled.

3. The method of claim 1 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

4. The method of claim 3 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

5. The method of claim 4 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

6. The method of claim 1 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been fully redeemed, said token being fully redeemed if the number of token redemptions equals a predetermined amount; and

incrementing a token redemption count associated with said token and indicating said token is valid if said token is found within said token pool and said token has not been fully redeemed.

7. The method of claim 1 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not associated with an partially redeemed or unredeemed offset within a token offset window, said token offset window comprising one or more offset entries identified by a base number and an offset from said base number, said one or more offset entries associated with a token in a token pool formed by applying a cryptographic process to the sum of said base number and said offset from said base number, together with a token chain key, said token pool associated with said digital content; and

updating the offset entry associated with said token and indicating said received token is valid if said token is associated with a partially redeemed offset or unredeemed offset within said token offset window.

8. The method of claim 1 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been redeemed, said token pool formed from successive applications of a cryptographic one-way function;

indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

invalidating tokens in said token chain that were generated after said received token.

9. The method of claim 1 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a portion of a token pool comprising unredeemed tokens, said token pool formed from successive applications of a cryptographic one-way function;

indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

reordering tokens in said token pool after said indicating said token is valid, said reordering based at least in part on whether the tokens have been redeemed.

10. The method of claim 1 wherein said validating further comprises:

receiving a token;

initializing a current token to said received token;

applying a cryptographic one-way function to said current token to create a result;

assigning said result to said current token;

repeating said applying until said current token matches a last redeemed token or until all tokens in said pool generated after said received token have been examined;

indicating said token is valid if said current token matches said last redeemed token; and

indicating said token is invalid if said current token does not match said last redeemed token and if all tokens in said pool generated after said received token have been examined.

15. The method of claim 4 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

25. The program storage device of claim 4 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

35. The apparatus of claim 4 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

45. The apparatus of claim 4 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

11. A method for digital content access control, the method comprising:

step for receiving an authenticated digital content request based at least in part on a digital content request comprising a request for digital content;

step for validating said authenticated digital content request, said validating comprising;

step for indicating said authenticated digital content request is valid if said authenticated digital content request is validly associated with said digital content and if said authenticated digital content request authenticates said digital content request; and

step for indicating said authenticated digital content request is invalid if said authenticated digital content request is not validly associated with said digital content; and

step for providing said digital content if said authenticated digital content request is valid.

12. The method of claim 11, further comprising step for synchronizing with a content provisioner if said synchronizing is enabled.

13. The method of claim 11 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

14. The method of claim 13 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

16. The method of claim 11 wherein said step for validating further comprises:

step for receiving a token;

step for indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been fully redeemed, said token being fully redeemed if the number of token redemptions equals a predetermined amount; and

step for incrementing a token redemption count associated with said token and indicating said token is valid if said token is found within said token pool and said token has not been fully redeemed.

17. The method of claim 11 wherein said step for validating further comprises:

step for receiving a token;

step for indicating said token is invalid if said token is not associated with an partially redeemed or unredeemed offset within a token offset window, said token offset window comprising one or more offset entries identified by a base number and an offset from said base number, said one or more offset entries associated with a token in a token pool formed by applying a cryptographic process to the sum of said base number and said offset from said base number, together with a token chain key, said token pool associated with said digital content; and

step for updating the offset entry associated with said token and indicating said received token is valid if said token is associated with a partially redeemed offset or unredeemed offset within said token offset window.

18. The method of claim 11 wherein said step for validating further comprises:

step for receiving a token;

step for indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been redeemed, said token pool formed from successive applications of a cryptographic one-way function;

step for indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

step for invalidating tokens in said token chain that were generated after said received token.

19. The method of claim 11 wherein said step for validating further comprises:

step for receiving a token;

step for indicating said token is invalid if said token is not found within a portion of a token pool comprising unredeemed tokens, said token pool formed from successive applications of a cryptographic one-way function;

step for indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

step for reordering tokens in said token pool after said indicating said token is valid, said reordering based at least in part on whether the tokens have been redeemed.

20. The method of claim 11 wherein said step for validating further comprises:

step for receiving a token;

step for initializing a current token to said received token;

step for applying a cryptographic one-way function to said current token to create a result;

step for assigning said result to said current token;

step for repeating said applying until said current token matches a last redeemed token or until all tokens in said pool generated after said received token have been examined;

step for indicating said token is valid if said current token matches said last redeemed token; and

step for indicating said token is invalid if said current token does not match said last redeemed token and if all tokens in said pool generated after said received token have been examined.

21. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving an authenticated digital content request based at least in part on a digital content request comprising a request for digital content;

validating said authenticated digital content request, said validating comprising;

indicating said authenticated digital content request is valid if said authenticated digital content request is validly associated with said digital content and if said authenticated digital content request authenticates said digital content request; and

indicating said authenticated digital content request is invalid if said authenticated digital content request is not validly associated with said digital content; and

providing said digital content if said authenticated digital content request is valid.

22. The program storage device of claim 21, the method further comprising synchronizing with a content provisioner if said synchronizing is enabled.

23. The program storage device of claim 21 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

24. The program storage device of claim 23 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

26. The program storage device of claim 21 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been fully redeemed, said token being fully redeemed if the number of token redemptions equals a predetermined amount; and

incrementing a token redemption count associated with said token and indicating said token is valid if said token is found within said token pool and said token has not been fully redeemed.

27. The program storage device of claim 21 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not associated with an partially redeemed or unredeemed offset within a token offset window, said token offset window comprising one or more offset entries identified by a base number and an offset from said base number, said one or more offset entries associated with a token in a token pool formed by applying a cryptographic process to the sum of said base number and said offset from said base number, together with a token chain key, said token pool associated with said digital content; and

updating the offset entry associated with said token and indicating said received token is valid if said token is associated with a partially redeemed offset or unredeemed offset within said token offset window.

28. The program storage device of claim 21 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been redeemed, said token pool formed from successive applications of a cryptographic one-way function;

indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

invalidating tokens in said token chain that were generated after said received token.

29. The program storage device of claim 21 wherein said validating further comprises:

receiving a token;

indicating said token is invalid if said token is not found within a portion of a token pool comprising unredeemed tokens, said token pool formed from successive applications of a cryptographic one-way function;

indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

reordering tokens in said token pool after said indicating said token is valid, said reordering based at least in part on whether the tokens have been redeemed.

30. The program storage device of claim 21 wherein said validating further comprises:

receiving a token;

initializing a current token to said received token;

applying a cryptographic one-way function to said current token to create a result;

assigning said result to said current token;

repeating said applying until said current token matches a last redeemed token or until all tokens in said pool generated after said received token have been examined;

indicating said token is valid if said current token matches said last redeemed token; and

indicating said token is invalid if said current token does not match said last redeemed token and if all tokens in said pool generated after said received token have been examined.

31. An apparatus for digital content access control, the apparatus comprising:

means for receiving an authenticated digital content request based at least in part on a digital content request comprising a request for digital content;

means for validating said authenticated digital content request, said validating comprising;

indicating said authenticated digital content request is valid if said authenticated digital content request is validly associated with said digital content and if said authenticated digital content request authenticates said digital content request; and

indicating said authenticated digital content request is invalid if said authenticated digital content request is not validly associated with said digital content; and

means for providing said digital content if said authenticated digital content request is valid.

32. The apparatus of claim 31, further comprising means for synchronizing with a content provisioner if said synchronizing is enabled.

33. The apparatus of claim 31 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

34. The apparatus of claim 33 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

36. The apparatus of claim 31 wherein said means for validating further comprises:

means for receiving a token;

means for indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been fully redeemed, said token being fully redeemed if the number of token redemptions equals a predetermined amount; and

means for incrementing a token redemption count associated with said token and indicating said token is valid if said token is found within said token pool and said token has not been fully redeemed.

37. The apparatus of claim 31 wherein said means for validating further comprises:

means for receiving a token;

means for indicating said token is invalid if said token is not associated with an partially redeemed or unredeemed offset within a token offset window, said token offset window comprising one or more offset entries identified by a base number and an offset from said base number, said one or more offset entries associated with a token in a token pool formed by applying a cryptographic process to the sum of said base number and said offset from said base number, together with a token chain key, said token pool associated with said digital content; and

means for updating the offset entry associated with said token and indicating said received token is valid if said token is associated with a partially redeemed offset or unredeemed offset within said token offset window.

38. The apparatus of claim 31 wherein said means for validating further comprises:

means for receiving a token;

means for indicating said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been redeemed, said token pool formed from successive applications of a cryptographic one-way function;

means for indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

means for invalidating tokens in said token chain that were generated after said received token.

39. The apparatus of claim 31 wherein said means for validating further comprises:

means for receiving a token;

means for indicating said token is invalid if said token is not found within a portion of a token pool comprising unredeemed tokens, said token pool formed from successive applications of a cryptographic one-way function;

means for indicating said token is valid if said token is found within said token pool and said token has not been redeemed; and

means for reordering tokens in said token pool after said indicating said token is valid, said reordering based at least in part on whether the tokens have been redeemed.

40. The apparatus of claim 31 wherein said means for validating further comprises:

means for receiving a token;

means for initializing a current token to said received token;

means for applying a cryptographic one-way function to said current token to create a result;

means for assigning said result to said current token;

means for repeating said applying until said current token matches a last redeemed token or until all tokens in said pool generated after said received token have been examined;

means for indicating said token is valid if said current token matches said last redeemed token; and

means for indicating said token is invalid if said current token does not match said last redeemed token and if all tokens in said pool generated after said received token have been examined.

41. An apparatus for digital content access control, the apparatus comprising:

a memory for storing validation information for use in validating an authenticated digital content request that is based at least in part on a digital content request comprising a request for digital content; and

a content repository configured to;

receive an authenticated digital content request based at least in part on a digital content request comprising a request for digital content;

validate said authenticated digital content request, said content repository further configured to;

indicate said authenticated digital content request is valid if said authenticated digital content request is validly associated with said digital content and if said authenticated digital content request authenticates said digital content request; and

indicate said authenticated digital content request is invalid if said authenticated digital content request is not validly associated with said digital content; and

provide said digital content if said authenticated digital content request is valid.

42. The apparatus of claim 41 wherein said apparatus is further configured to synchronize with a content provisioner if said synchronizing is enabled.

43. The apparatus of claim 41 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

44. The apparatus of claim 43 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

46. The apparatus of claim 41 wherein said content repository is further configured to:

receive a token;

indicate said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been fully redeemed, said token being fully redeemed if the number of token redemptions equals a predetermined amount; and

increment a token redemption count associated with said token and indicate said token is valid if said token is found within said token pool and said token has not been fully redeemed.

47. The apparatus of claim 41 wherein said content repository is further configured to:

receive a token;

indicate said token is invalid if said token is not associated with an partially redeemed or unredeemed offset within a token offset window, said token offset window comprising one or more offset entries identified by a base number and an offset from said base number, said one or more offset entries associated with a token in a token pool formed by applying a cryptographic process to the sum of said base number and said offset from said base number, together with a token chain key, said token pool associated with said digital content; and

update the offset entry associated with said token and indicate said received token is valid if said token is associated with a partially redeemed offset or unredeemed offset within said token offset window.

48. The apparatus of claim 41 wherein said content repository is further configured to:

receive a token;

indicate said token is invalid if said token is not found within a token pool associated with said digital content or if said token has been redeemed, said token pool formed from successive applications of a cryptographic one-way function;

indicate said token is valid if said token is found within said token pool and said token has not been redeemed; and

invalidate tokens in said token chain that were generated after said received token.

49. The apparatus of claim 41 wherein said content repository is further configured to:

receive a token;

indicate said token is invalid if said token is not found within a portion of a token pool comprising unredeemed tokens, said token pool formed from successive applications of a cryptographic one-way function;

indicate said token is valid if said token is found within said token pool and said token has not been redeemed; and

reorder tokens in said token pool after said indicate said token is valid, said reordering based at least in part on whether the tokens have been redeemed.

50. The apparatus of claim 41 wherein said content repository is further configured to:

receive a token;

initialize a current token to said received token;

apply a cryptographic one-way function to said current token to create a result;

assign said result to said current token;

repeat said applying until said current token matches a last redeemed token or until all tokens in said pool generated after said received token have been examined;

indicate said token is valid if said current token matches said last redeemed token; and

indicate said token is invalid if said current token does not match said last redeemed token and if all tokens in said pool generated after said received token have been examined.

51. A method for digital content access control, the method comprising:

receiving a portion of a tokenized Universal Resource Locator (URL), said portion comprising a token indicator that specifies a token that may be validated to gain access to said digital content at a content repository associated with said digital content; and

granting access to said digital content based at least in part on whether said token is associated with said digital content.

52. The method of claim 51 wherein said portion further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

53. The method of claim 52 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

54. The method of claim 52 wherein said one or more delivery parameter indicators specify a destination address.

55. The method of claim 52 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

56. The method of claim 51 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

57. The method of claim 51 wherein

said portion further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

58. The method of claim 57 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

59. A method for digital content access control, the method comprising:

step for receiving a portion of a tokenized Universal Resource Locator (URL), said portion comprising a token indicator that specifies a token that may be validated to gain access to said digital content at a content repository associated with said digital content; and

step for granting access to said digital content based at least in part on whether said token is associated with said digital content.

60. The method of claim 59 wherein said portion further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

61. The method of claim 60 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

62. The method of claim 60 wherein said one or more delivery parameter indicators specify a destination address.

63. The method of claim 60 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

64. The method of claim 59 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

65. The method of claim 59 wherein

said portion further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

66. The method of claim 65 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

67. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving a portion of a tokenized Universal Resource Locator (URL), said portion comprising a token indicator that specifies a token that may be validated to gain access to said digital content at a content repository associated with said digital content; and

granting access to said digital content based at least in part on whether said token is associated with said digital content.

68. The program storage device of claim 67 wherein said portion further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

69. The program storage device of claim 68 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

70. The program storage device of claim 68 wherein said one or more delivery parameter indicators specify a destination address.

71. The program storage device of claim 68 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

72. The program storage device of claim 67 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

73. The program storage device of claim 67 wherein

said portion further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

74. The program storage device of claim 73 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

75. An apparatus for digital content access control, the apparatus comprising:

means for receiving a portion of a tokenized Universal Resource Locator (URL), said portion comprising a delivery scheme indicator that specifies a protocol for accessing said digital content;

means for granting access to said digital content based at least in part on whether said token is associated with said digital content.

76. The apparatus of claim 75 wherein said portion further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

77. The apparatus of claim 76 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

78. The apparatus of claim 76 wherein said one or more delivery parameter indicators specify a destination address.

79. The apparatus of claim 76 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

80. The apparatus of claim 75 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

81. The apparatus of claim 75 wherein

said portion further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

82. The apparatus of claim 81 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

83. An apparatus for digital content access control, the apparatus comprising:

a token acceptor configured to receive a portion of a tokenized Universal Resource Locator (URL), said portion comprising a token indicator that specifies a token that may be validated to gain access to said digital content at a content repository associated with said digital content; and

a repository manager configured to grant access to said digital content based at least in part on whether said token is associated with said digital content.

84. The apparatus of claim 83 wherein said portion further comprises one or more delivery parameter indicators that specify a method for delivering said digital content to an entity using said tokenized URL to request said digital content.

85. The apparatus of claim 84 wherein said one or more delivery parameter indicators specify a cryptographic protection protocol.

86. The apparatus of claim 84 wherein said one or more delivery parameter indicators specify a destination address.

87. The apparatus of claim 84 wherein said one or more delivery parameter indicators specify a process to perform on said digital content before delivering said digital content to said entity.

88. The apparatus of claim 83 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.

89. The apparatus of claim 83 wherein

said portion further comprises a content item indicator that specifies a pathname for digital content located at said access domain;

and

said token indicator specifies a token that may be validated to gain access to digital content within a context associated with said token.

90. The apparatus of claim 89 wherein said portion further comprises a servlet indicator that specifies the pathname of a servlet at said access domain, said servlet capable of processing said tokenized URL.