System and method for dynamically enabling components to implement data transfer security mechanisms

• US 20040236943A1
• Filed: 05/21/2003
• Published: 11/25/2004
• Est. Priority Date: 05/21/2003
• Status: Active Grant

• Current Assignee: Gula Consulting Limited Liability Company (Intellectual Ventures LLC)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Smetters, Diana K., Smith, Trevor, Edwards, W. Keith, Sedivy, Jana Z., Newman, Mark W.
• Granted Patent: US 7,363,508 B2
• Time in Patent Office: Days
• US Class Current: 713/161
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A system and method for implementing data transfer security mechanisms. The method includes a first component transferring a data type handler object to a second component. The second interface invokes an interface accessible through the date type handler object which includes instructions that are executed by the second component to implement a data transfer security mechanism. Further, the data type handler interface can be encrypted, include cryptographic keys, and/or include digital signatures.

Claims

1. A system comprising:

an interface system on a first component that communicates with a data type handler module and accesses at least one interface provided by the data type handler module; and

a security system that accesses at least one interface provided by the data type handler module to obtain a data transfer security mechanism and implements the data transfer security mechanism.

2. The system as set forth in claim 1 wherein a portion of the data transfer security mechanism comprises cryptographic information and another portion of the data transfer security mechanism enables the first component to use the cryptographic information to decrypt encrypted content.

3. The system as set forth in claim 2 wherein the cryptographic information is modified by a second component in response to at least one encryption characteristic of the encrypted content being changed.

4. The system as set forth in claim 2 wherein the cryptographic information comprises at least one cryptographic key.

5. The system as set forth in claim 1 wherein the data transfer security mechanism instructs the first component to obtain cryptographic information from the first component or at least one other component.

6. The system as set forth in claim 1 wherein the data transfer security mechanism enables the first component to authenticate the data type handler module.

7. The system as set forth in claim 6 wherein the first component has access to at least one of a digital certificate, a public key and a shared secret that the first component uses to authenticate the data type handler module, the shared secret being a set of information known by just the first component and another component.

8. The system as set forth in claim 1 wherein the first component has access to cryptographic information and the data transfer security mechanism requests at least one portion of the cryptographic information from the first component to enable the first component to decrypt portions of encrypted content using the requested cryptographic information.

9. The system as set forth in claim 8 wherein the cryptographic information further comprises at least one cryptographic key located at the first component or at one or more other components.

10. The system as set forth in claim 1 wherein the data type handler module is digitally signed with a cryptographic signature, wherein the first component rejects the data type handler module if the first component determines that the cryptographic signature was not created nor endorsed by a trusted source component.

11. The system as set forth in claim 1 wherein the data type handler module is encrypted using a first cryptographic key of the first component, wherein a second cryptographic key of the first component is used by the first component to decrypt the data type handler module, the second cryptographic key is stored at a secure location that is securely accessible to the first component.

12. The system as set forth in claim 1 wherein the data transfer security mechanism enables the first component to interpret at least one content rights expression language statement associated with content, wherein the data transfer security mechanism forces the first component to abide by the interpreted content rights expression language statement.

13. A method comprising:

communicating with a data type handler module;

accessing at least one interface provided by the data type handler module to obtain a data transfer security mechanism; and

implementing the data transfer security mechanism.

14. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises:

obtaining cryptographic information from the data transfer security mechanism; and

decrypting encrypted content using the cryptographic information.

15. The method as set forth in claim 14 wherein the cryptographic information is modified by at least one component in response to at least one encryption characteristic of the encrypted content being changed.

16. The method as set forth in claim 14 wherein the cryptographic information comprises at least one cryptographic key.

17. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises obtaining cryptographic information from a first component or at least one other component.

18. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises authenticating the data type handler module.

19. The method as set forth in claim 18 wherein the authenticating the data type handler module further comprises using at least one of a digital certificate, a public key and a shared secret to perform the authenticating, the shared secret being a set of information known by just the first component and another component.

20. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises:

requesting from a first component cryptographic information that is accessible to the first component; and

decrypting portions of encrypted content using the requested cryptographic information.

21. The method as set forth in claim 20 wherein the cryptographic information further comprises at least one cryptographic key located at the first component or at one or more other components.

22. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises rejecting the data type handler module if the first component determines that the data type handler module is not digitally signed with a cryptographic signature which was either created or endorsed by a trusted source component.

23. The method as set forth in claim 13 wherein the data type handler module is encrypted at a first component using a first cryptographic key of the first component, and wherein the implementing the data transfer security mechanism further comprises:

storing a second cryptographic key of the first component at a secure location that is securely accessible to a second component; and

decrypting the data type handler module at the second component using the second cryptographic key of the first component.

24. The method as set forth in claim 13 wherein the implementing the data transfer security mechanism further comprises:

interpreting at a first component at least one content rights expression language statement associated with content; and

forcing the first component to abide by the interpreted content rights expression language statement.

25. A computer-readable medium having stored thereon instructions, which when executed by at least one processor, causes the processor to perform:

communicating with a data type handler module;

accessing at least one interface provided by the data type handler module to obtain a data transfer security mechanism; and

implementing the data transfer security mechanism.

26. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises:

obtaining cryptographic information; and

decrypting encrypted content using the cryptographic information.

27. The medium as set forth in claim 26 wherein the cryptographic information is modified by at least one component in response to at least one encryption characteristic of the encrypted content being changed.

28. The medium as set forth in claim 26 wherein the cryptographic information comprises at least one cryptographic key.

29. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises obtaining cryptographic information from a first component or at least one other component.

30. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises authenticating the data type handler module.

31. The medium as set forth in claim 30 wherein the authenticating the data type handler module further comprises using at least one of a digital certificate, a public key and a shared secret to perform the authenticating, the shared secret being a set of information known by just the first component and another component.

32. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises:

requesting from a first component cryptographic information that is accessible to the first component; and

decrypting portions of encrypted content using the requested cryptographic information.

33. The medium as set forth in claim 32 wherein the cryptographic information further comprises at least one cryptographic key located at the first component or at one or more other components.

34. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises rejecting the data type handler module if the first component determines that the data type handler module is not digitally signed with a cryptographic signature which was either created or endorsed by a trusted source component.

35. The medium as set forth in claim 25 wherein the data type handler module is encrypted at a first component using a first cryptographic key of the first component, and wherein the implementing the data transfer security mechanism further comprises:

storing a second cryptographic key of the first component at a secure location that is securely accessible to a second component; and

decrypting the data type handler module at the second component using the second cryptographic key of the first component.

36. The medium as set forth in claim 25 wherein the implementing the data transfer security mechanism further comprises:

interpreting at a first component at least one content rights expression language statement associated with content; and

forcing the first component to abide by the interpreted content rights expression language statement.