Method and apparatus for content protection in a secure content delivery system

• US 20050021613A1
• Filed: 07/13/2004
• Published: 01/27/2005
• Est. Priority Date: 11/16/1998
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Softricity (Microsoft Corporation)
• Inventors: Eichin, Mark W., Schmeidler, Yonah, Atkins, Derek, Rostcheck, David J.
• Granted Patent: US 7,690,039 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2872 Termination of subscriber connections
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04N 21/23106 involving caching operations prefetching while addressing of a memory level in which the access to the desired data or data block requires associative addressing means within memory systems or architectures G06F12/0862; caching at an intermediate stage in a data network H04L67/568
• CPC Class Codes: H04N 21/2312 Data placement on disk arrays data placement in general G06F3/0604
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/2402 Monitoring of the downstream path of the transmission network, e.g. bandwidth available traffic monitoring in data switching networks H04L43/00; monitoring data switching networks utilization H04L43/0876
• CPC Class Codes: H04N 21/2408 Monitoring of the upstream path of the transmission network, e.g. client requests monitoring data switching networks utilization H04L43/0876; scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25435 : involving characteristics of content or additional data, e.g. video resolution or the amount of advertising
• CPC Class Codes: H04N 21/26216 : involving the channel capacity, e.g. network bandwidth admission control, resource allocation in open networks H04L12/5692; flow control in packet networks H04L47/10; establishing a schedule or organising the servicing of application requests taking into account QoS H04L67/61
• CPC Class Codes: H04N 21/4331 : Caching operations, e.g. of an advertisement for later insertion during playback
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/47202 : for requesting content on demand, e.g. video on demand
• CPC Class Codes: H04N 21/8186 : specially adapted to be executed by a peripheral of the client device, e.g. by a reprogrammable remote control
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17318 : Direct or substantially direct transmission and handling of requests

Abstract

A system for secure delivery of on-demand content over broadband access networks utilizes a pair of servers and security mechanisms to prevent client processes from accessing and executing content without authorization. A plurality of encrypted titles are stored on a content server coupled to the network. An access server also coupled to the network contains the network addresses of the titles and various keying and authorization data necessary to decrypt and execute a title. A client application executing on a user'"'"'s local computer system is required to retrieve the address, keying and authorization data from the access server before retrieving a title from the content server and enabling execution of the title on a user'"'"'s local computer system.

Claims

1. A server apparatus connectable to one or more requestor processes and at least one a source of titles over a computer network comprising:

a processor;

a memory coupled to the processor;

a network interface coupled to the memory and processor;

conversion logic responsive to a unique identifier of a title and configured to convert the unique identifier of the title into a location identifier indicating an address on the computer network where the title may be accessed; and

activator generator logic responsive to the network interface and configured to generate an activator.

2. The server apparatus of claim 1 wherein the activator generation logic comprises program logic for receiving data identifying a requestor process and for generating an activator.

3. The server apparatus of claim 1 wherein an activator comprises cryptographic data useful to a requestor process for processing a title.

4. The server apparatus of claim 1 wherein the activator comprises a token containing data identifying a time period in which the requestor process may access the source.

5. The server apparatus of claim 1 wherein the conversion logic comprises program logic for comparing the unique identifier of a title with a plurality of location identifiers stored in the memory.

6. The server apparatus of claim 1 wherein the conversion logic further comprises a database for storing one or more location identifiers and database query logic for accessing the database.

7. A computer program product for use with a server apparatus having a processor, a memory and a network interface, the server apparatus connectable to one or more requester processes and at least one a source of titles over a computer network, the computer program product comprising a computer usable medium having computer usable program code embodied thereon, the computer program code comprising:

(a) network interface program code responsive to requests from a requestor process on the computer network;

(b) conversion program code responsive to a unique identifier of a title supplied by a requestor process and configured to convert the unique identifier of the title into a location identifier indicating an address on the computer network where the title may be accessed; and

(c) generator program code configured to generate an activator for a requestor process.

8. The computer program product of claim 7 wherein the activator comprises cryptographic data useful to a requestor process for processing title data.

9. The computer program product of claim 7 wherein the activator comprises a token containing data identifying a time period in which the requestor may access the source.

10. The computer program of claim 7 wherein the conversion program code comprises program code for comparing a unique identifier of a title with a plurality of location identifiers stored in the server apparatus memory.

11. The computer program code of claim 7 wherein the conversion program code further comprises database program code for storing one or more location identifiers and further comprises database query program code for accessing the database program code and the location identifiers contained therein.

12. In a server apparatus comprising a processor, memory and a network interface, and connectable to a computer network, a method for enabling requesting processes to access a title comprising:

(a) authenticating a launch string from a requesting process;

(b) converting a unique identifier of a title received from a requesting process to a location identifier indicating an address of a source on the computer network where the title may be accessed;

(c) generating an activator; and

(d) forwarding the activator to the requesting process over the computer network.

13. The method of claim 12 wherein the activator comprises cryptographic data useful to the requesting process for decrypting title data.

14. The method of claim 12 wherein the activator comprises program code for determining a fixed period of time in which the requesting process may access the source.

15. The method of claim 12 wherein the step of converting the unique identifier comprises:

(b.1) comparing the unique identifier with a plurality of unique identifiers stored in the memory; and

(b.2) retrieving a location identifier associated with the unique identifier, if a match occurs.

16. The method of claim 12 wherein the step of converting a unique identifier into a location identifier comprises:

(b.1) maintaining a plurality of unique identifiers within a database, selected of the unique identifiers having associated therewith a location identifier; and

(b.2) querying the database for a specific location identifier associated with a unique identifier received from a requesting process.

17. The method of claim 12 wherein step (c) comprises the step of combining cryptographic data with one or more byte codes.