Digital rights management system and method

• US 20040111613A1
• Filed: 12/11/2003
• Published: 06/10/2004
• Est. Priority Date: 03/28/2001
• Status: Active Grant

• Current Assignee: Synamedia Limited
• Original Assignee: NDS Limited (Cisco Systems, Inc.)
• Inventors: Belenky, Yaacov, Tsuria, Yossi, Hibshoosh, Eliphaz, Shkedy, Zvi, Shen-Orr, Chaim, Benedek, Gyora, Solow, Hillel
• Granted Patent: US 7,512,986 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/101 by binding digital rights to specific entities
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G09G 2358/00 Arrangements for display data security
• CPC Class Codes: G09G 2360/18 Use of a frame buffer in a display terminal, inclusive of the display panel
• CPC Class Codes: G09G 5/00 Control arrangements or circuits for visual indicators common to cathode-ray tube indicators and other visual indicators image data processing or generation, in general G06T

Abstract

A system and a method for providing variable security mechanisms for securing digital content, in which a single security mechanism is not used for all content. Instead, at least one characteristic or feature of the security mechanism is varied between units, instances or categories of content Therefore, even if unauthorized access is gained to a single unit of content, the overall integrity and security of the system for content distribution is not compromised. Preferably, security is provided through a general mechanism, which is then varied in order to provide variable, dissimilar security schemes for different types of content. By “type of content”, it is meant any of a single unit of content, a single instance of content or a single category of content. For example, for a category of content, the content may be characterized according to the identity of the content itself, such as the title of a movie for example, and/or according to the owner of a particular copy of the content. Thus, different security schemes may optionally and preferably be generated from a particular root structure. Related apparatus and methods are also provided.

Claims

1. A method for protecting digital content, comprising:

protecting the content according to a content security scheme to form protected content;

constructing a descrambler to read said protected content; and

protecting said descrambler according to a variable descrambler security scheme to produce a protected descrambler, wherein said variable descrambler security scheme is varied according to at least one variable parameter.

2. The method of claim 1, and also comprising:

transmitting said protected content and said protected descrambler.

3. The method of claim 1 or claim 2, wherein said protected content and said descrambler are utilized at an end user device, such that said end user device is able to run said descrambler if said end user device is authorized, and such that said end user device is only able to read said protected content through said descrambler.

4. The method of claim 3, wherein reading comprises rendering said protected content in a clear format.

5. The method of claims 3 or 4, wherein reading comprises playing back said protected content through said end user device.

6. The method of claim 5, wherein said descrambler further comprises a player for playing back said protected content.

7. The method of any of claims 3-6, wherein said at least one variable parameter is at least partially determined according to a characteristic of said end user device.

8. The method of claim 7, wherein said characteristic includes at least one of a hardware identifier and a software identifier.

9. The method of claim 8, wherein said end user device comprises at least video display hardware and video display software, and wherein determining said at least one variable parameter comprises:

processing video data by the video display hardware and the video display software;

altering at least a portion of the video data during processing according to a characteristic of at least one of the video display hardware and the video display software to form altered data; and

forming said at least one variable parameter based, at least in part, on said altered data.

10. The method of claim 9, wherein said video data is contained within a stream of video data for being displayed at said end user device.

11. The method of any of claims 3-10, wherein said end user device is associated with a subscriber, and said at least one variable parameter is at least partially determined according to a characteristic of said end user device.

12. The method of claim 11, wherein a plurality of characteristics of said end user device comprise a subscriber profile, and at least one variable parameter is determined according to said subscriber profile.

13. The method of claims 11 or 12, wherein said variable descrambler security scheme includes a license, such that at least said protected descrambler is only accessible according to said license.

14. The method of claim 13, wherein said license includes a value for said at least one variable parameter.

15. The method of claims 13 or 14, wherein said license includes data for operating said variable descrambler security scheme.

16. The method of claim 15, wherein said protected descrambler is only executable with said data for operating said variable security scheme, such that said end user device is able to run said protected descrambler with said data.

17. The method of any of claims 13-16, wherein said license further comprises a restriction for a type of access for reading said protected content.

18. The method of claim 1, and also comprising:

transmitting said protected content, said protected descrambler and a license, wherein said license is required for operating said protected descrambler or reading said protected content, or a combination thereof.

19. The method of claim 18, wherein said license is transmitted before said protected content and said protected descrambler.

20. The method of claim 18 or claim 19, wherein said protected content, said license and said descrambler are utilized at an end user device, such that said end user device is able to run said descrambler if said end user device is authorized by said license, and such that said end user device is only able to read said protected content through said descrambler with said license.

21. The method of any of claims 18-20, wherein said at least one variable parameter is at least partially determined according to a characteristic of said end user device, wherein data for identifying said characteristic is contained in said license.

22. The method of claim 21, wherein said characteristic includes at least one of a hardware identifier and a software identifier.

23. The method of any of claims 18-22, wherein said end user device is associated with a subscriber, and said at least one variable parameter is at least partially determined according to a characteristic of said subscriber, wherein data for identifying said characteristic is contained in said license

24. The method of claim 23, wherein a plurality of characteristics of said subscriber comprise a subscriber profile, and at least one variable parameter is determined according to said subscriber profile.

25. The method of any of claims 3-24, further comprising:

receiving said protected content and said protected descrambler by said end user device;

forming an executable descrambler from said protected descrambler; and

reading said protected content with said executable descrambler.

26. The method of claim 25, wherein said protected descrambler comprises a first portion for descrambling said protected descrambler and a second portion for reading said protected content.

27. The method of claims 25 or 26, wherein said descrambler comprises a player portion for playing back said content, the method further comprising:

playing back said content.

28. The method of any of claims 1-27, wherein said at least one variable parameter includes a random component.

29. The method of any of claims 1-28, wherein said at least one variable parameter is at least partially determined according to a characteristic of said protected content.

30. The method of any of claims 1-29, wherein constructing said descrambler further comprises altering at least one portion of said descrambler according to said variable descrambler security scheme.

31. The method of claim 30, wherein said descrambler is constructed of a plurality of modules, such that altering said at least one portion of said descrambler is performed by substituting at least one module according to said variable descrambler security scheme.

32. The method of claim 31, wherein a function of at least one module is required during execution of said descrambler, such that if said at least one module is altered, said descrambler does not execute correctly.

33. The method of claim 32, wherein said function of said at least one module is as a data source for operating a BSG (byte source generator).

34. The method of claims 32 or 33, wherein said at least one module comprises a bit bucket.

35. The method of claims 30-34, wherein altering said portion of said descrambler is performed according to at least one instruction contained in a magazine, such that constructing said descrambler includes selecting said magazine.

36. The method of claim 35, wherein said magazine is randomly selected.

37. The method of claims 34-36, wherein at least one instruction is randomly selected from said magazine for altering at least a portion of said descrambler.

38. The method of claim 37, wherein said magazine includes at least one instruction for obscuring at least a portion of said descrambler.

39. The method of any of claims 35-38, wherein said magazine includes at least one instruction for substituting an inoperative module for at least a portion of said descrambler.

40. The method of any of claims 30-39, wherein constructing said descrambler comprises:

receiving a prototype descrambler; and

adjusting at least one characteristic of said prototype descrambler to construct said descrambler.

41. The method of claim 40, wherein said prototype descrambler includes at least one meta-directive for forming said descrambler.

42. The method of any of claims 30-41, wherein constructing said descrambler comprises:

producing a high level language code for said descrambler;

compiling said high level language code to form machine language code; and

altering at least one of said high level language code and said machine language code according to said variable descrambler security scheme.

43. The method of any of claims 1-42, wherein said protected descrambler and said protected content are transmitted substantially simultaneously.

44. The method of claim 43, wherein said protected descrambler and said protected content are combined to form a single data file for transmission.

45. The method of claim 44, wherein said protected descrambler and said protected content are interleaved in said single data file.

46. The method of any of claims 1-45, wherein said protected content is protected according to a variable descrambler security scheme, said variable descrambler security scheme being varied according to a variable parameter.

47. The method of claim 46, wherein said variable parameter includes at least one of the following:

a characteristic of an end user device for receiving said protected content;

a characteristic of a subscriber associated with said end user device; and

a license for controlling ability to read said protected content.

48. The method of claims 46 or 47, wherein said variable security scheme protects each instance of content separately, such that each variable security scheme is varied according to said instance of content.

49. The method of claim 48, wherein said instance includes at least one of a unit of content, a type of content and an identity of a recipient of said content.

50. The method of any of claims 1-49, wherein said protected content is at least partially protected according to a key and wherein a size of said key is at approximately as large as a size of the content.

51. The method of claim 50, wherein said key is at least partially generated according to information contained in the content.

52. The method of claims 50 or 51, wherein said key is at least partially generated according to information contained in a license transmitted with the content.

53. Protected digital content, produced according to the method of any of claims 152.

54. A method for protecting digital content, comprising:

providing a general security scheme for protecting the content;

varying said general security scheme according to each type of content to form a variable scheme, wherein said general security scheme is varied according to at least one random parameter; and

altering at least one characteristic of the content according to said variable scheme to form protected content.

55. The method of claim 54, wherein said variable scheme is applied only to said protected content.

56. The method of claims 54 or 55, wherein said varying said general security scheme according to each type of content to form a variable scheme comprises:

constructing a scrambler/descrambler to protect said content; and

varying at least a portion of said scrambler/descrambler according to said variable parameter;

wherein said at least one characteristic of the content is altered by said scrambler/descrambler.

57. The method of claims 54-56, wherein said variable parameter includes at least one of a characteristic of an end user device for receiving said protected content, a characteristic of a subscriber associated with said end user device, and a license for controlling an ability to read said protected content.

58. The method of claims 54-57, wherein said variable security scheme protects each type of content separately, such that each variable security scheme is varied according to said type of content.

59. The method of claim 58, wherein said type includes at least one of a unit of content, an instance of content and an identity of a recipient of said content.

60. A system for protecting digital content for transmission, comprising:

(a) a compiler for receiving a general security scheme and for varying said general security scheme to form a variable security scheme;

(b) a packager for scrambling the content according to said variable security scheme to form scrambled content, wherein said variable security scheme is varied separately for each type of content; and

(c) an end user device for receiving said scrambled content and for reading said scrambled content according to at least one authorization.

61. The system of claim 60, wherein said packager further scrambles a player component for playing back said content, such that said end user device receives both said player component and said scrambled content to be able to play back said content.

62. The system of claim 61, wherein said player component further comprises a descrambling component for descrambling said scrambled content.

63. The system of claims 61 or 62, wherein said player component features a plurality of modules, and said compiler varies at least one module according to said variable security scheme to form said player component.

64. The system of any of claims 60-63, wherein said end user device further comprises a pre-installed module for at least initiating reading of said scrambled content.

65. The system of any of claims 60-64, further comprising:

(d) a license generator for generating a license, wherein said license is required for reading said scrambled content by said end user device.

66. The system of any of claims 60-65, wherein said compiler generates a plurality of different versions of protected compiled code, each version being produced according to said variable security scheme.

67. The system of claim 66, wherein said variable security scheme comprises a basic code and at least one meta-language directive, wherein said compiler performs at least one transformation to said basic code according to said at least one meta-language directive.

68. The system of claim 67, wherein said compiler further comprises a pre-compiler for receiving said at least one meta-language directive and for interpreting said at least one meta-language directive for performing said at least one transformation to said basic code.

69. The system of claim 68, wherein said compiler further comprises a higher language pre-compiler and a higher language compiler, and a lower level pre-compiler and a lower level compiler, wherein at least one of said higher language pre-compiler and said lower level pre-compiler converts said at least one meta-language directive into a comment.

70. The system of claims 67-69, wherein said compiler performs a plurality of transformations to said basic code and wherein said plurality of transformations is performed sequentially for debugging said protected compiled code.

71. The system of claims 67-70, wherein each version is sufficiently variable to provide a zero learning curve for attempting unauthorized execution of said protected compiled code.

72. The system of any of claims 67-71, wherein the code contains at least one essential algorithm, and said at least one transformation causes said protected compiled code to produce a similar result for each version, such that said similar result is identical for said at least one essential algorithm for each version.

73. The system of any of claims 67-72, wherein the code contains a plurality of algorithms, and at least a portion of said plurality of algorithms is varied in tandem in each version.

74. The system of claim 67, wherein said compiler receives at least one meta-language directive and interprets said at least one meta-language directive for performing said at least one transformation to said basic code.

75. A method for protecting a portion of software code, comprising:

selecting the portion to be protected; and

altering the portion to a non-accessible format, wherein a remainder of the software code is not altered to said non-accessible format, and wherein the portion in said non-accessible format is not removed, such that said remainder of the software code is functional.

76. The method of claim 75, wherein the software code performs at least a first function at a first stage, and wherein the software code performs at least a second function at a second stage, wherein said at least a first function is altered to said non-accessible format, and wherein said at least a second function is operational at said second stage.

77. A method for generating a signature for an end user device, the end user device comprising at least video display hardware and video display software, the method comprising:

processing video data by the video display hardware and the video display software;

altering at least a portion of the video data during processing according to a characteristic of at least one of the video display hardware and the video display software to form altered data; and

forming the signature based, at least in part, on said altered data.

78. The method of claim 77, wherein the video data is contained within a stream of video data.

79. The method of claims 77 or 78, wherein the video data is for being displayed.

80. A protected digital content package, comprising:

(a) digital content protected according to a key, said key being generated according to a variable security scheme for each instance of content; and

(b) reading software for reading said digital content at least partially by generating said key, said reading software being protected according to said variable security scheme.

81. The protected digital content package of claim 80, wherein said reading software comprises at least a descrambler for descrambling said digital content to a clear format with said key.

82. The protected digital content package of claim 81, wherein said reading software further comprises a player for playing back said digital content in said clear format.

83. The protected digital content package of claims 81 or 82, further comprising:

(c) a license for being used by said reading software for generating said key.

84. The protected digital content package of any of claims 80-83, wherein each component of the package is transmitted separately over a network.

85. The protected digital content package of any of claims 80-84, wherein said digital content is further protected by being in a non-standard format.

86. The protected digital content package of claim 85, wherein a format of said digital content features a syntax, and wherein said syntax is at least partially varied in said non-standard format.

87. The protected digital content of any of claims 80-86, wherein said digital content and said reading software are interleaved in a package.

88. A compiler for protecting code, comprising a compiler for generating a plurality of different versions of protected compiled code, each version being produced according to a security scheme being received by said compiler.

89. The compiler of claim 88, wherein said security scheme comprises a basic code and at least one meta-language directive, wherein said compiler performs at least one transformation to said basic code according to said at least one meta-language directive.

90. The compiler of claim 89, wherein said compiler further comprises a pre-compiler for receiving said at least one meta-language directive and for interpreting said at least one meta-language directive for performing said at least one transformation to said basic code.

91. The compiler of claim 90, wherein said compiler further comprises a higher language pre-compiler and a higher language compiler, and a lower level pre-compiler and a lower level compiler, wherein at least one of said higher language pre-compiler and said lower level pre-compiler converts said at least one meta-language directive into a comment.

92. The compiler of any of claims 89-91, wherein said compiler performs a plurality of transformations to said basic code and wherein said plurality of transformations is performed sequentially for debugging said protected compiled code.

93. The compiler of any of claims 89-92, wherein each version is sufficiently variable to provide a zero learning curve for attempting unauthorized access to said protected compiled code.

94. The compiler of any of claims 89-93, wherein the code contains at least one essential algorithm, and said at least one transformation causes said protected compiled code to produce a similar result for each version, such that said similar result is identical for said at least one essential algorithm for each version.

95. The compiler of any of claims 89-94, wherein the code contains a plurality of algorithms, and at least a portion of said plurality of algorithms is varied in tandem in each version.

96. The compiler of any of claims 89-95, wherein said basic code is a skeletal code, such that said at least one meta-language directive provides data for completing said skeletal code to form functional code.

97. In a system for transmitting protected content, the system comprising a builder and a head-end, the head-end transmitting the protected content, providing a method for protecting the content, the method comprising:

protecting a descrambler to read said protected content according to a variable descrambler security scheme to produce a protected descrambler, wherein said variable descrambler security scheme is varied according to at least one variable parameter, by the builder;

protecting the content according to a content security scheme to form protected content by the head-end; and

packaging said protected content and said protected descrambler by the head-end for transmission.

98. The method of claim 97, wherein packaging said protected content and said protected descrambler comprises interleaving said protected content and said protected descrambler.

99. The method of claim 97, wherein packaging said protected content and said protected descrambler comprises packaging said protected content with information for downloading at least a portion of said protected descrambler.

100. In a method for protecting software code, the method protecting the software code by obfuscating at least a portion of the software code, the improvement comprising providing a plurality of magazines, each magazine comprising at least one instruction for obfuscating at least the portion of the software code, such that a plurality of versions of the software code is produced according to said plurality of magazines.

101. The method of claim 100, wherein said plurality of versions of the software code is varied according to said plurality of magazines for causing a zero learning curve for access by an unauthorized user.

102. The method of claims 100 or 101, wherein said plurality of magazines is provided to a compiler, such that said compiler produces said plurality of versions of the software code.

103. The method of any of claims 100-102, wherein the software code features a plurality of random algorithms, and wherein said plurality of magazines contains at least one instruction for varying said plurality of random algorithms in tandem.

104. Protected digital content, comprising digital content intimately connected to both information and software code required for accessing said digital content, wherein said connection is formed according to a variable security scheme.

105. The protected digital content of claim 104, wherein said information comprises a license for determining access.