Protecting digital media of various content types

• US 20070038873A1
• Filed: 08/11/2005
• Published: 02/15/2007
• Est. Priority Date: 08/11/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Klemets, Anders, Bhatt, Sanjay, Paka, Anand, Oliveira, Eduardo, Alkove, James
• Granted Patent: US 8,321,690 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1083 Partial license transfers
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/64322 IP
• CPC Class Codes: H04N 21/6437 Real-time Transport Protocol [RTP]
• CPC Class Codes: H04N 21/8193 dedicated tools, e.g. video decoder software or IPMP tool
• CPC Class Codes: H04N 21/8355 involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/8456 by decomposing the content in the time domain, e.g. in time segments

Abstract

Systems and/or methods (“tools”) are described that enable a digital rights management policy to be associated with digital media having an arbitrary content type or transfer control protocol. In some embodiments, the tools encrypt data segments of a media file and add a descriptor to each of those segments. These descriptors can enable a receiver of the encrypted media file to decrypt the file and consume it according to the correct digital rights management policy.

Claims

1. A computer-implemented method comprising:

encrypting data segments of a media file having an arbitrary content type to provide encrypted data segments; and

adding descriptors to the encrypted data segments, each encrypted data segment'"'"'s descriptor indicating an associated digital rights management policy for the encrypted data segment and Key ID usable to decrypt the encrypted data segment.

2. The method of claim 1, wherein the act of encrypting encrypts the data segments using an AES in counter mode.

3. The method of claim 1, wherein the descriptors comprise Initialization Vectors, each encrypted data segment'"'"'s Initialization Vector associated with the content key usable to decrypt the encrypted data segment.

4. The method of claim 1, wherein each descriptor has a Key ID that is also in its associated digital rights management policy.

5. The method of claim 1, wherein each encrypted data segment'"'"'s descriptor comprises a length indicator enabling differentiation between the encrypted data segment and its descriptor.

6. The method of claim 1, wherein the media file comprises a first portion and a second portion, the first portion associated with a first digital rights management policy and the second portion associated with a second digital rights management policy, and wherein the act of adding adds a first descriptor indicating the first digital rights management policy to encrypted data segments of the first portion and adds a second descriptor indicating the second associated digital rights management policy to encrypted data segments of the second portion.

7. The method of claim 1, wherein the encrypted data segment comprises a packet conforming to an RTP data protocol or a frame conforming to an HTTP protocol.

8. The method of claim 7, wherein the act of adding concatenates the descriptor to the end of the encrypted data segment if the encrypted data segment comprises a packet conforming to an RTP protocol or the beginning of the encrypted data segment if the encrypted data segment comprises a frame conforming to an HTTP protocol.

9. A system comprising one or more computer-readable media, the computer-readable media comprising a digital media file comprising data segments, each data segment added to a descriptor and comprising encrypted payload data, each data segment'"'"'s descriptor having encryption parameters enabling decryption of the data segment'"'"'s payload data and association of the data segment'"'"'s payload data with a digital rights management policy.

10. The system of claim 9, wherein each descriptor'"'"'s encryption parameters comprise a Key ID also comprised by the digital rights management policy.

11. The system of claim 9, wherein each data segment'"'"'s payload data is encrypted using a content key and the data segment'"'"'s descriptor comprises a Key ID associated with the content key, the content key usable to decrypt the payload data.

12. The system of claim 9, wherein the digital media file further comprises first and second portions, the first portion having first data segments and the second portion having second data segments, at least one of the first data segment'"'"'s descriptors enabling the first portion to be associated with a first digital rights management policy and at least one of the second data segment'"'"'s descriptors enabling the second portion to be associated with a second digital rights management policy.

13. The system of claim 9, wherein each data segment'"'"'s payload data is encrypted and its descriptor is not.

14. The system of claim 9, wherein the digital media file further comprises a data segment added to a descriptor and comprising clear payload data, the data segment'"'"'s descriptor enabling association of the data segment'"'"'s clear payload data with another digital rights management policy.

15. The system of claim 9, wherein the digital media file is streaming media.

16. A computer-implemented method comprising:

transmitting an encrypted media file having a first portion and a second portion to a receiver;

enabling the receiver of the encrypted media file to decrypt the first portion and the second portion; and

enabling the receiver to associate the first portion with a first rights policy indicating permitted usage of the first portion, and the second portion with a second rights policy indicating permitted usage of the second portion.

17. The method of claim 16, further comprising transmitting the first rights policy and the second rights policy to the receiver.

18. The method of claim 16, wherein the act of enabling the receiver to associate builds a first descriptor into the first portion and a second descriptor into the second portion, the first descriptor indicating that the first portion is associated with the first rights policy and the second descriptor indicating that the second portion is associated with the second rights policy.

19. The method of claim 18, wherein the act of enabling the receiver to decrypt builds a first Key ID into the first descriptor and a second Key ID into the second descriptor, the first Key ID usable to decrypt the first portion and the second Key ID usable to decrypt the second portion.

20. The method of claim 16, further comprising receiving a media file of an arbitrary content type and encrypting the media file to provide the encrypted media file.