Means for providing protecting for digital assets

• US 20050123137A1
• Filed: 07/01/2003
• Published: 06/09/2005
• Est. Priority Date: 12/13/2002
• Status: Abandoned Application

• Current Assignee: Executive Computing Holdings Pty Limited
• Original Assignee: Executive Computing Holdings Pty Limited
• Inventors: McCallum, Peter
• Application Number:
  US10/488,484
• Publication Number:
  US 20050123137A1
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A system for providing protection for identified digital assets, the system including: (1) a central control system (210); (2) a client terminal (220) able to communicate via a computer network (230) with the central control system (210); (3) client software (240) resident on each client terminal (220); (4) a master copy of a digital asset (250) stored on the central control system (210); (5) an encrypted copy of the digital asset (260) stored on the client terminal (220), with an encryption key for the encrypted copy of the digital asset stored on the central control system (210) and the client terminal (220); whereby, the client software (240) resident on the client terminal (220) controls access by a custodian (280) to the copy of the digital asset (260) stored on the client terminal (220), and the custodian'"'"'s level of access to the copy of the digital asset (260) stored on the client terminal (220) can be altered from the central control system (210). A method and computer readable medium of instructions are also disclosed.

Claims

1-52. -52. (canceled)

53. A system for providing protection for identified digital assets, the system including:

(1) a central control system;

(2) a client terminal able to communicate via a computer network with the central control system;

(3) client software resident on the client terminal;

(4) a master copy of a digital asset stored on the central control system;

(5) an encrypted copy of the digital asset stored on the client terminal, with an encryption key for the encrypted copy of the digital asset stored on the central control system and the client terminal;

whereby, the client software resident on the client terminal controls access by a custodian to the copy of the digital asset stored on the client terminal, and the custodian'"'"'s level of access to the copy of the digital asset stored on the client terminal can be altered from the central control system.

54. The system as claimed in claim 53, wherein when access is initially requested to the encrypted copy of the digital asset by the custodian the client software attempts to communicate with the central control system and authenticate the initial access request.

55. The system as claimed in claim 53, wherein when access is properly requested to the encrypted copy of the digital asset residing on the client, and the client terminal is disconnected from the central control system, the copy of the digital asset can be decrypted and used by the custodian with defence mechanisms active.

56. The system as claimed in claim 53, wherein the digital asset is assigned a level of protection, and the at least one custodian is assigned a level of authorisation.

57. The system as claimed in claim 56, wherein different levels of protection/authorisation allow varying use of each copy of the digital asset.

58. The system as claimed in claim 54, wherein:

(A) if the central control system authenticates an initial access request, a private decryption key is used to enable the encrypted copy of the digital asset to be decrypted;

or,

(B) if the central control system does not authenticate the initial access request, the decryption key is not available to be used to decrypt the encrypted copy of the digital asset.

59. The system as claimed in claim 53, wherein the central control system includes a communications controller and a encryption key register.

60. The system as claimed in claim 53, wherein the central control system includes a digital asset register to store current and previous master copies of the digital asset.

61. The system as claimed in claim 53, wherein the central control system includes a digital asset register to register and store each encrypted copy that has been distributed at the request of a properly authenticated client terminal.

62. The system as claimed in claim 53, wherein the central control system includes a digital asset log record.

63. The system as claimed in claim 60, wherein the central communications controller includes a client communications module and a central communications module.

64. The system as claimed in claim 53, wherein the central control system is provided by at least two physical servers.

65. The system as claimed in claim 64, wherein the communications controller is resident on a first server, and the encryption key register is resident on a second server.

66. The system as claimed in claim 65, wherein all functions other than the communications controller are resident on the second server.

67. The system as claimed in claim 60, wherein the encryption key register stores additional information for the authentication of any request to copy a digital asset.

68. The system as claimed in claim 67, wherein the additional information relates to the identity of the custodian and/or a specific authorised client terminal.

69. The system as claimed in claim 53, wherein each client software package uniquely controls the decryption process for a particular client terminal.

70. The system as claimed in claim 53, wherein the client software controls access and/or destruction of the copy of the digital asset.

71. The system as claimed in claim 53, wherein the client software includes a poison pill module.

72. The system as claimed in claim 71, wherein the poison pill module can cause the destruction of the copy of the digital asset.

73. The system as claimed in claim 71, wherein the poison pill module checks a retrieved value identifying the client terminal, or a component thereof, against an expected identification value.

74. The system as claimed in claim 71, wherein the poison pill module checks a component of a hash sum value, combined with custodian information, a client terminal and hardware reference against expected values.

75. The system as claimed in claim 53, wherein the client software includes a power-on control monitor.

76. The system as claimed in claim 53, wherein the client software includes a communications interface.

77. The system as claimed in claim 53, wherein the client software includes an exception handler.

78. The system as claimed in claim 53, wherein the client software includes an encryption handler.

79. The system as claimed in claim 53, wherein the client software includes an I/O interruption handler.

80. The system as claimed in claim 57, wherein authorisation and protection levels can be updated on the central control system and transmitted to the client software on the client terminal.

81. The system as claimed in claim 53, wherein the master copy of the digital asset stored on the central control system is encrypted.

98. The method as claimed in claim 82, the method able to be performed utilising the system of claim 53.

82. A method of providing protection for digital assets, the method including the steps of:

(1) storing an encrypted master copy of a digital asset on a central control system;

(2) storing a separate encrypted copy of the digital asset on a client terminal provided with client software, the client terminal able to communicate via a computer network with the central control system;

(3) storing an encryption key for the encrypted copy of the digital asset on the central control system and the client terminal; and

,

(4) when access is properly requested by an authorised custodian to the encrypted copy of the digital asset residing on the client terminal, and the client terminal is disconnected from the central control system, the client software controls access to the copy of the digital asset.

83. The method as claimed in claim 82, wherein when access is initially requested to the encrypted copy of the digital asset by the custodian the client software attempts to communicate with the central control system and authenticate the initial access request.

84. The method as claimed in claim 82, wherein the digital asset is assigned a level of protection, and the custodian is assigned a level of authorisation.

85. The method as claimed in claim 84, wherein different levels of protection/authorisation allow varying use of the copy of the digital asset.

86. The method as claimed in claim 82, wherein the frequency of computer network connection is monitored by the client software.

87. The method as claimed in claim 82, wherein access restrictions to the digital asset can be varied from the central control system.

88. The method as claimed in claim 82, wherein the master copy of the digital asset is encrypted.

89. The method as claimed in claim 82, wherein a unique encryption key is created for each custodian and each distributed copy of the digital asset.

90. The method as claimed in claim 82, wherein if preset criteria are not met the client software can effect destruction of the encryption key, the copy of the digital asset on the client terminal, the contents of memory and/or storage facilities of the client terminal, and/or BIOS information for the client terminal.

91. The method as claimed in claim 82, wherein the copy of the digital asset is destroyed if successful network connection to the central control system is not achieved after a preset number of attempts and/or a preset time period.

92. The method as claimed in claim 82, wherein the central control system tracks the location of all copies of each digital asset.

93. The method as claimed in claim 82, wherein a newly created digital asset is uploaded to the central control system to create a master copy of the digital asset.

94. The method as claimed in claim 82, wherein the copy of the digital asset is periodically re encrypted and redistributed.

95. The method as claimed in claim 82, wherein a poison pill module is provided.

96. The method as claimed in claim 95, wherein the poison pill module can delete/overwrite the copy of the digital asset, destroy the client software, and/or inactivate the client terminal BIOS.

97. The method as claimed in claim 82, wherein print and copy functions of the client terminal can be optionally disabled by the client software.

99. A computer readable medium of instructions for providing protection for digital assets in a system including:

(1) a central control system;

(2) a client terminal able to communicate via a computer network with the central control system;

(3) a master copy of a digital asset stored on the central control system;

(4) an encrypted copy of the digital asset stored on the client terminal, with the encryption key for the encrypted copy of the digital asset stored on the central control system and the client terminal;

whereby the computer readable medium of instructions is adapted to control access by a custodian to the copy of the digital asset stored on the client terminal, and the custodian'"'"'s level of access to the copy of the digital asset stored on the client terminal can be altered from the central control system.

100. The computer readable medium of instructions as claimed in claim 99, wherein the computer readable medium of instructions is client software.

101. The computer readable medium of instructions as claimed in claim 100, wherein the client software controls the decryption process.

102. The client software as claimed in claim 99, wherein the client software controls access and/or destruction of the copy of the digital asset.

103. The client software as claimed in claim 99, wherein the client software includes a poison pill module.

104. The client software as claimed in claim 103, wherein the poison pill module checks a retrieved value identifying the client terminal, or a component thereof, against an expected identification value.

105. The client software as claimed in claim 99, wherein the client software includes:

a power on control monitor;

a communications interface;

an exception handler;

an encryption handler; and

/or,

an I/O interruption handler.