Installation of black box for trusted component for digital rights management (DRM) on computing device

• US 20070067645A1
• Filed: 09/06/2006
• Published: 03/22/2007
• Est. Priority Date: 10/21/2002
• Status: Active Grant

• Current Assignee: SZ DJI Technology Co., Ltd. (d/b/a DJI) (iFlight Technology Company Limited)
• Original Assignee: Microsoft Corporation
• Inventors: Gunyakti, Caglar, Dublish, Pratul, Lyndersay, Sean, Chase, Charlie
• Granted Patent: US 8,136,166 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client

Abstract

To install a black box on a computing device, an administrator has access to the computing device and queries same for machine properties thereof. The administrator sends the machine properties of the computing device to a black box server as part of a request for a new black box for the computing device. The black box server in response constructs the new black box based in part on the machine properties so as to tie the new black box to the computing device, and delivers the new black box to the administrator. The administrator thereafter installs the new black box on the computing device. The administrator may include an activation provider running on the computing device and an activation manager in communication with the activation provider. The administrator may also deactivate the black box if it determines that the black box is no longer trustworthy.

Claims

1. A system for installing a black box on a computing device, the black box operating in combination with a trusted component on the computing device, the trusted component employing the black box to decrypt encrypted content for being rendered on the computing device only when rights and restrictions specified in a license corresponding to the encrypted content so allow, the system comprising:

an administrator having access to the computing device for querying same for machine properties thereof,

a black box server in communication with the administrator, the administrator for sending the machine properties of the computing device to the black box server as part of a request for a new black box for the computing device, the black box server in response for constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device, the black box server for delivering the new black box to the administrator and the administrator for installing the new black box on the computing device.

2. The system of claim 1 wherein the administrator comprises an activation provider running on the computing device and an activation manager in communication with the activation provider, the activation provider for determining the machine properties of the computing device and sending same to the activation manager, the activation manager for sending the request to the black box server and receiving the new black box in response thereto, the activation provider for receiving the new black box from the activation manager and installing same on the computing device.

7. The system of claim 2 wherein the activation manager and the activation provider are constructed in accordance with a management implementation protocol that allows for system management of a computing device.

3-6. -6. (canceled)

8. A method for installing a black box on a computing device, the black box operating in combination with a trusted component on the computing device, the trusted component employing the black box to decrypt encrypted content for being rendered on the computing device only when rights and restrictions specified in a license corresponding to the encrypted content so allow, the method employing an administrator with access to the computing device and a black box server in communication with the administrator, the method comprising:

the administrator querying the computing device for machine properties thereof and receiving same;

the administrator sending the machine properties of the computing device to the black box server as part of a request for a new black box for the computing device;

the black box server in response constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device;

the black box server delivering the new black box to the administrator; and

the administrator installing the new black box on the computing device.

9. The method of claim 8 wherein the administrator comprises an activation provider running on the computing device and an activation manager in communication with the activation provider, the method comprising:

the activation manager querying the activation provider on the computing device for machine properties thereof;

the activation provider determining the machine properties of the computing device and sending same to the activation manager;

the activation manager sending the machine properties of the computing device to the black box server as part of a request for a new black box for the computing device;

the black box server in response constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device;

the black box server delivering the new black box to the activation manager;

the activation manager delivering the new black box to the activation provider; and

the activation provider installing the new black box on the computing device.

14. The method of claim 9 further comprising, prior to the activation manager querying the activation provider on the computing device for machine properties thereof:

the activation manager querying the activation provider to determine whether the computing device requires the new black box;

the activation provider in response collecting activation state information from the computing device and reporting same to the activation manager; and

the activation manager determining based on the activation state information whether the computing device requires the new black box.

15. The method of claim 14 comprising the activation provider collecting activation state information from the computing device including whether any black box is present on the computing device , and if so at least one of a version number thereof and a date of activation thereof.

16. The method of claim 14 comprising the activation manager determining whether the computing device requires the new black box based on a rules document setting out a plurality of rules.

17. The method of claim 9 comprising:

the black box server in response constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device;

the black box server creating a corresponding machine certificate certifying the created black box;

the black box server delivering the new black box and corresponding machine certificate to the activation manager;

the activation manager delivering the new black box and corresponding machine certificate to the activation provider; and

the activation provider installing the new black box and corresponding machine certificate on the computing device.

18. The method of claim 17 further comprising:

the black box server selecting a key pair (PR-BB, PU-BB) for the new black box;

the black box server hiding (PR-BB) in the new black box; and

the black box server placing (PU-BB) in the corresponding machine certificate and signing the certificate based on (PR-BB).

19. The method of claim 9 comprising the activation provider installing the new black box in a protected location on the computing device.

20. The method of claim 8 wherein the administrator comprises an activation provider running on the computing device and an activation manager in communication with the activation provider, the method comprising:

the activation sending a request for a new black box to the activation manager, the request including the machine properties;

the activation manager sending the machine properties of the computing device to the black box server as part of a request for a new black box for the computing device;

the black box server in response constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device;

the black box server delivering the new black box to the activation manager;

the activation manager delivering the new black box to the activation provider; and

the activation provider installing the new black box on the computing device.

25. The method of claim 20 comprising:

the black box server in response constructing the new black box based in part on the machine properties so as to tie the new black box to the computing device;

the black box server creating a corresponding machine certificate certifying the created black box;

the black box server delivering the new black box and corresponding machine certificate to the activation manager;

the activation manager delivering the new black box and corresponding machine certificate to the activation provider; and

the activation provider installing the new black box and corresponding machine certificate on the computing device.

26. The method of claim 25 further comprising:

the black box server selecting a key pair (PR-BB, PU-BB) for the new black box;

the black box server hiding (PR-BB) in the new black box; and

the black box server placing (PU-BB) in the corresponding machine certificate and signing the certificate based on (PR-BB).

27. The method of claim 20 comprising the activation provider installing the new black box in a protected location on the computing device.

10-13. -13. (canceled)

21-24. -24. (canceled)

28. A method for deactivating a black box on a computing device, the black box operating in combination with a trusted component on the computing device, the trusted component employing the black box to decrypt encrypted content for being rendered on the computing device only when rights and restrictions specified in a license corresponding to the encrypted content so allow, the method employing an activation provider running on the computing device and an activation manager in communication with the activation provider, the method comprising:

the activation manager querying the activation provider on the computing device for activation state information relating to a state of the black box on the computing device;

the activation provider in response collecting the activation state information from the computing device and reporting same to the activation manager; and

the activation manager determining based on the activation state information whether the black box on the computing device remains trustworthy; and

the activation manager directing the activation provider to deactivate the black box on the computing device if the activation manager determines based on the activation state information that the black box on the computing device does not remain trustworthy.

29. The method of claim 28 wherein the activation manager and the activation provider are constructed in accordance with a management implementation protocol that allows for system management of a computing device.

30. The method of claim 28 comprising the activation provider collecting activation state information from the computing device including at least one of a version number of the black box on the computing device and a date of activation of the black box on the computing device.

31. The method of claim 28 comprising the activation manager determining whether the black box on the computing device remains trustworthy based on a rules document setting out a plurality of rules that define an activation policy.

32. The method of claim 28 wherein the activation manager directs the activation provider to delete the black box from the computing device if the activation manager determines based on the activation state information that the black box on the computing device does not remain trustworthy.