Accessing for controlled delivery of digital content in a system for digital content access control

• US 20040059913A1
• Filed: 09/22/2003
• Published: 03/25/2004
• Est. Priority Date: 09/13/2002
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard K.
• Application Number:
  US10/668,867
• Publication Number:
  US 20040059913A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

Access to digital content may be controlled by sending a digital content request comprising a request for digital content, receiving an authenticated digital content request in response to the request, and sending the authenticated digital content request including one or more delivery parameters to a content repository that provides storage for the digital content, receiving encrypted digital content in response to sending the authenticated digital content request, and sending the encrypted digital content to a target device identified by the one or more delivery parameters and configured for decrypting the encrypted digital content and for rendering the decrypted digital content on the target device. According to one aspect, the encrypted digital content is sent directly from the content repository to the target device based at least in part on the one or more delivery parameters.

Claims

1. A method for digital content access control, comprising:

sending a digital content request comprising a request for digital content;

receiving an authenticated digital content request in response to said sending said digital content request;

sending said authenticated digital content request including one or more delivery parameters to a content repository that provides storage for said digital content, said one or more delivery parameters identifying a target device to receive digital content referenced by said authenticated digital content request;

receiving encrypted digital content in response to said sending said authenticated digital content request; and

sending said encrypted digital content to said target device, said target device for decrypting said encrypted digital content to create decrypted digital content and for rendering said decrypted digital content on said target device.

2. The method of claim 1 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

3. The method of claim 2 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

4. The method of claim 3, further comprising sending said token to said target device.

5. The method of claim 3 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

6. The method of claim 1 wherein said one or more delivery parameters comprises a serial number uniquely identifying said target device.

7. The method of claim 1 wherein said one or more delivery parameters comprises a master key indicator for use in decrypting an encrypted form of said digital content.

8. The method of claim 1 wherein said one or more delivery parameters comprises a key derivation process indicator for use in deriving a cryptographic key for decrypting an encrypted form of said digital content.

9. The method of claim 1 wherein said one or more delivery parameters comprises a cryptographic process indicator that specifies a cryptographic process supported by said target device.

10. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

sending a digital content request comprising a request for digital content;

receiving an authenticated digital content request in response to said sending said digital content request;

sending said authenticated digital content request including one or more delivery parameters to a content repository that provides storage for said digital content, said one or more delivery parameters identifying a target device to receive digital content referenced by said authenticated digital content request;

receiving encrypted digital content in response to said sending said authenticated digital content request; and

sending said encrypted digital content to said target device, said target device for decrypting said encrypted digital content to create decrypted digital content and for rendering said decrypted digital content on said target device.

11. The program storage device of claim 10 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

12. The program storage device of claim 11 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

13. The program storage device of claim 12, further comprising sending said token to said target device.

14. The program storage device of claim 12 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

15. The program storage device of claim 10 wherein said one or more delivery parameters comprises a serial number uniquely identifying said target device.

16. The program storage device of claim 10 wherein said one or more delivery parameters comprises a master key indicator for use in decrypting an encrypted form of said digital content.

17. The program storage device of claim 10 wherein said one or more delivery parameters comprises a key derivation process indicator for use in deriving a cryptographic key for decrypting an encrypted form of said digital content.

18. The program storage device of claim 10 wherein said one or more delivery parameters comprises a cryptographic process indicator that specifies a cryptographic process supported by said target device.

19. An apparatus for digital content access control, comprising:

means for sending a digital content request comprising a request for digital content;

means for receiving an authenticated digital content request in response to said sending said digital content request;

means for sending said authenticated digital content request including one or more delivery parameters to a content repository that provides storage for said digital content, said one or more delivery parameters identifying a target device to receive digital content referenced by said authenticated digital content request;

means for receiving encrypted digital content in response to said sending said authenticated digital content request; and

means for sending said encrypted digital content to said target device, said target device for decrypting said encrypted digital content to create decrypted digital content and for rendering said decrypted digital content on said target device.

20. The apparatus of claim 19 wherein

said digital content request comprises a Universal Resource Locator (URL);

and

said authenticated digital content request comprises a tokenized URL.

21. The apparatus of claim 20 wherein said tokenized URL further comprises a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content.

22. The apparatus of claim 21, further comprising means for sending said token to said target device.

23. The apparatus of claim 21 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

24. The apparatus of claim 19 wherein said one or more delivery parameters comprises a serial number uniquely identifying said target device.

25. The apparatus of claim 19 wherein said one or more delivery parameters comprises a master key indicator for use in decrypting an encrypted form of said digital content.

26. The apparatus of claim 19 wherein said one or more delivery parameters comprises a key derivation process indicator for use in deriving a cryptographic key for decrypting an encrypted form of said digital content.

27. The apparatus of claim 19 wherein said one or more delivery parameters comprises a cryptographic process indicator that specifies a cryptographic process supported by said target device.

28. An apparatus for digital content access control, the apparatus comprising:

a memory for storing said digital content; and

a processor configured to;

send a digital content request comprising a request for digital content;

receive an authenticated digital content request in response to said sending said digital content request;

send said authenticated digital content request including one or more delivery parameters to a content repository that provides storage for said digital content, said one or more delivery parameters identifying a target device to receive digital content referenced by said authenticated digital content request;

receive encrypted digital content in response to said sending said authenticated digital content request; and

send said encrypted digital content to said target device, said target device for decrypting said encrypted digital content to create decrypted digital content and for rendering said decrypted digital content on said target device.

29. The apparatus of claim 28 wherein said processor is further configured to receive said digital content in response to said authenticated digital content request.

30. The apparatus of claim 28 wherein said apparatus comprises a smart card.

31. The apparatus of claim 30 wherein said smart card comprises a Java Card™

technology-enabled smart card.

32. The apparatus of claim 30 wherein said smart card comprises a CDMA (Code Division Multiple Access) technology-enabled smart card.

33. The apparatus of claim 30 wherein said smart card comprises a SIM (Subscriber Identity Module) card.

34. The apparatus of claim 30 wherein said smart card comprises a WIM (Wireless Interface Module).

35. A method for digital content access control, comprising:

receiving a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content;

preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

receiving encrypted digital content;

decrypting said encrypted digital content using said session key to create decrypted digital content; and

rendering said decrypted digital content.

36. The method of claim 35 wherein said preparing is performed on a smart card.

37. The method of claim 35 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

38. A method for digital content access control, comprising:

receiving a tokenized URL comprising a token having a cryptogram based at least in part on an identifier that describes the location of said digital content;

preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

receiving encrypted digital content;

decrypting said encrypted digital content using said session key to create decrypted digital content; and

rendering said decrypted digital content.

39. The method of claim 38 wherein said preparing is performed on a smart card.

40. The method of claim 38 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

41. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content;

preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

receiving encrypted digital content;

decrypting said encrypted digital content using said session key to create decrypted digital content; and

rendering said decrypted digital content.

42. The program storage device of claim 41 wherein said preparing is performed on a smart card.

43. The program storage device of claim 41 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

44. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for digital content access control, the method comprising:

receiving a tokenized URL comprising a token having a cryptogram based at least in part on an identifier that describes the location of said digital content;

preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

receiving encrypted digital content;

decrypting said encrypted digital content using said session key to create decrypted digital content; and

rendering said decrypted digital content.

45. The program storage device of claim 44 wherein said preparing is performed on a smart card.

46. The program storage device of claim 44 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

47. An apparatus for digital content access control, comprising:

means for receiving a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content;

means for preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

means for receiving encrypted digital content;

means for decrypting said encrypted digital content using said session key to create decrypted digital content; and

means for rendering said decrypted digital content.

48. The apparatus of claim 47 wherein said means for preparing comprises a smart card.

49. The apparatus of claim 47 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

50. An apparatus for digital content access control, comprising:

means for receiving a tokenized URL comprising a token having a cryptogram based at least in part on an identifier that describes the location of said digital content;

means for preparing a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

means for receiving encrypted digital content;

means for decrypting said encrypted digital content using said session key to create decrypted digital content; and

means for rendering said decrypted digital content.

51. The apparatus of claim 50 wherein said means for preparing comprises a smart card.

52. The apparatus of claim 50 wherein said token is from a token pool associated with the location of digital content for which access is authorized.

53. An apparatus for digital content access control, the apparatus comprising:

a memory for storing said digital content; and

a processor configured to;

receive a token comprising a cryptogram based at least in part on an identifier that describes the location of said digital content;

prepare a session key, said preparing comprising applying a cryptographic process to a key based at least in part on said token together with a target key to create said session key, said target key based at least in part on a master key and a target ID, said target ID identifying a target device;

receive encrypted digital content;

decrypt said encrypted digital content using said session key to create decrypted digital content; and

render said decrypted digital content.

54. The apparatus of claim 53 wherein said apparatus comprises a smart card.

55. The apparatus of claim 54 wherein said smart card comprises a Java Card™

technology-enabled smart card.

56. The apparatus of claim 54 wherein said smart card comprises a CDMA (Code Division Multiple Access) technology-enabled smart card.

57. The apparatus of claim 54 wherein said smart card comprises a SIM (Subscriber Identity Module) card.

58. The apparatus of claim 54 wherein said smart card comprises a WIM (Wireless Interface Module).