Licensing content for use on portable device

• US 20060235801A1
• Filed: 04/14/2005
• Published: 10/19/2006
• Est. Priority Date: 04/14/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Strom, Clifford P., Evans, Brian P., Siu, Michael Y.
• Granted Patent: US 8,738,536 B2
• Time in Patent Office: Days
• US Class Current: 705/59
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A computing device has encrypted content and a corresponding license having a decryption key for decrypting the content. The license allows the computing device to render the content thereon. The computing device may issue a sub-license based on the license to a portable device. The sub-license allows the portable device to render the content thereon and has the decryption key. The portable device has a digital device certificate including information thereon. The computing device receives from the portable device the device certificate thereof, and determines based on rules in the license and the information on the portable device in the device certificate whether the computing device can issue the sub-license to the portable device. If so, the computing device constructs such sub-license to include the decryption key (KD) and transmits the constructed sub-license to the portable device.

Claims

1. A method in connection with a computing device having encrypted digital content and a corresponding digital license having a decryption key (KD) for decrypting the encrypted content, the license allowing the computing device to render the content thereon, the method for the computing device to issue a digital sub-license based on the license to a portable device communicatively coupled thereto, the sub-license for allowing the portable device to render the content thereon and having the decryption key (KD), the portable device having a digital device certificate including information on the portable device, the method comprising:

the computing device receiving from the portable device a copy of the device certificate thereof;

the computing device determining based on rules in the license and also based on the information on the portable device as set forth within the device certificate whether the computing device can in fact issue the sub-license to the portable device; and

if the computing device can in fact issue the sub-license to the portable device, the computing device constructing such sub-license to include the decryption key (KD) and transmitting the constructed sub-license to the portable device.

2. The method of claim 1 wherein the computing device has a public-private key pair (PU-C, PR-C), the portable device has a public-private key pair (PU-PD, PR-PD), the license has the decryption key (KD) encrypted according to (PU-C) to result in (PU-C(KD)), and the device certificate includes the public key of the portable device (PU-PD) therein, and wherein the computing device constructing the sub-license comprises:

retrieving (PU-C(KD)) from the license;

applying (PR-C) to (PU-C(KD)) to reveal (KD);

retrieving (PU-PD) from the device certificate;

applying (PU-PD) to (KD) to result in (PU-PD(KD));

retrieving rules from the license regarding conditions that must be satisfied for the portable device to render the content; and

constructing the sub-license to include (PU-PD(KD)) and the rules for the portable device.

3. The method of claim 1 further comprising the computing device transmitting the encrypted content to the portable device.

4. The method of claim 1 comprising the computing device determining whether the device certificate has expired or been revoked, and issuing the sub-license to the portable device only if the device certificate in fact has not expired or been revoked.

5. The method of claim 1 comprising, if the rules in the license so require, the computing device determining from the device certificate whether the portable device has a set secure clock, and issuing the sub-license to the portable device only if the portable device in fact has a set secure clock.

6. The method of claim 1 comprising, if the rules in the license so require, the computing device determining from the device certificate whether the portable device has secure metering capabilities, and issuing the sub-license to the portable device only if the portable device in fact has secure metering capabilities.

7. The method of claim 1 wherein the sub-license has a particular type, the method comprising, if the rules in the license so require, the computing device determining from the device certificate whether the portable device supports the particular type of the sub-license, and issuing the sub-license to the portable device only if the portable device in fact supports the particular type of the sub-license.

8. The method of claim 1 wherein the portable device has an assigned security level indicative of a relative perceived level of security that the portable device can be expected to satisfy, the method comprising, if the rules in the license so require, the computing device determining from the device certificate the assigned security level of the portable device, and issuing the sub-license to the portable device only if the determined security level satisfies a security level requirement set within the license.

9. The method of claim 1 wherein the portable device has one or more assigned output protection levels, each output protection level indicative of a relative perceived level of output protection incumbent in the portable device with respect to a particular type of output thereof, the method comprising, if the rules in the license so require, the computing device determining from the device certificate one or more assigned output protection levels of the portable device, and issuing the sub-license to the portable device only if each determined output protection level satisfies an output protection level requirement set within the license.

10. The method of claim 1 comprising, if the rules in the license so require, the computing device determining from the device certificate an identifier of the portable device, whether such identifier is on a list for special handling of a particular type, and if so handling issuance of the sub-license to the portable device in accordance with the particular type.

11. A computer-readable medium having stored thereon computer-executable instructions implementing a method in connection with a computing device having encrypted digital content and a corresponding digital license having a decryption key (KD) for decrypting the encrypted content, the license allowing the computing device to render the content thereon, the method for the computing device to issue a digital sub-license based on the license to a portable device communicatively coupled thereto, the sub-license for allowing the portable device to render the content thereon and having the decryption key (KD), the portable device having a digital device certificate including information on the portable device, the method comprising:

the computing device receiving from the portable device a copy of the device certificate thereof;

the computing device determining based on rules in the license and also based on the information on the portable device as set forth within the device certificate whether the computing device can in fact issue the sub-license to the portable device; and

if the computing device can in fact issue the sub-license to the portable device, the computing device constructing such sub-license to include the decryption key (KD) and transmitting the constructed sub-license to the portable device.

12. The medium of claim 11 wherein the computing device has a public-private key pair (PU-C, PR-C), the portable device has a public-private key pair (PU-PD, PR-PD), the license has the decryption key (KD) encrypted according to (PU-C) to result in (PU-C(KD)), and the device certificate includes the public key of the portable device (PU-PD) therein, and wherein the computing device constructing the sub-license comprises:

retrieving (PU-C(KD)) from the license;

applying (PR-C) to (PU-C(KD)) to reveal (KD);

retrieving (PU-PD) from the device certificate;

applying (PU-PD) to (KD) to result in (PU-PD(KD));

retrieving rules from the license regarding conditions that must be satisfied for the portable device to render the content; and

constructing the sub-license to include (PU-PD(KD)) and the rules for the portable device.

13. The medium of claim 11 wherein the method further comprises the computing device transmitting the encrypted content to the portable device.

14. The medium of claim 11 wherein the method comprises the computing device determining whether the device certificate has expired or been revoked, and issuing the sub-license to the portable device only if the device certificate in fact has not expired or been revoked.

15. The medium of claim 11 wherein the method comprises, if the rules in the license so require, the computing device determining from the device certificate whether the portable device has a set secure clock, and issuing the sub-license to the portable device only if the portable device in fact has a set secure clock.

16. The medium of claim 11 wherein the method comprises, if the rules in the license so require, the computing device determining from the device certificate whether the portable device has secure metering capabilities, and issuing the sub-license to the portable device only if the portable device in fact has secure metering capabilities.

17. The medium of claim 11 wherein the sub-license has a particular type, the method comprising, if the rules in the license so require, the computing device determining from the device certificate whether the portable device supports the particular type of the sub-license, and issuing the sub-license to the portable device only if the portable device in fact supports the particular type of the sub-license.

18. The medium of claim 11 wherein the portable device has an assigned security level indicative of a relative perceived level of security that the portable device can be expected to satisfy, the method comprising, if the rules in the license so require, the computing device determining from the device certificate the assigned security level of the portable device, and issuing the sub-license to the portable device only if the determined security level satisfies a security level requirement set within the license.

19. The medium of claim 11 wherein the portable device has one or more assigned output protection levels, each output protection level indicative of a relative perceived level of output protection incumbent in the portable device with respect to a particular type of output thereof, the method comprising, if the rules in the license so require, the computing device determining from the device certificate one or more assigned output protection levels of the portable device, and issuing the sub-license to the portable device only if each determined output protection level satisfies an output protection level requirement set within the license.

20. The medium of claim 11 wherein the method comprises, if the rules in the license so require, the computing device determining from the device certificate an identifier of the portable device, whether such identifier is on a list for special handling of a particular type, and if so handling issuance of the sub-license to the portable device in accordance with the particular type.