Secure consumer distribution of content using subkeys for encryption and authentication

• US 20070179898A1
• Filed: 02/02/2006
• Published: 08/02/2007
• Est. Priority Date: 02/02/2006
• Status: Abandoned Application

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Medvinsky, Alexander, Sprunk, Eric
• Application Number:
  US11/347,704
• Publication Number:
  US 20070179898A1
• Time in Patent Office: Days
• US Class Current: 705/59
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

User-to-user (“superdistribution”) of digital content allows for management and control of the distribution by a content owner, content distributor or other owner or licensee of the content. Provisions are also available for identifying senders and receivers of content for purposes of compensating or encouraging distribution. A sending user generates a referral key that is used to encrypt all, or a portion of, the content, or to encrypt other mechanisms (e.g., another key, ticket, etc.) that will ultimately be used to allow access to the content. The sending user creates a content referral object that includes the restricted referral key, an identification of the license server and an identification of the content. A receiving user receives the content referral object and contacts the license server to identify the transaction (e.g., content being referred, access rights desired, etc.) and to receive information (e.g., a key or ticket) to use the referral key to access the content.

Claims

1. A method for distributing digital content, the method using a first user device in communication with a second user device and a License Server, the method comprising

using the first user device to generate a referral key;

securing the referral key so that the referral key can not be used unless information is obtained from the License Server;

creating an identifier for identifying the digital content; and

sending the secured referral key and the identifier to the second user device by using a digital object (a Content Referral Object or “

CRO”

);

sending the CRO from a user to the License Server

sending back a re-encrypted referral key from the License Server, wherein the re-encrypted referral key can be decrypted and utilized by the second user to decrypt the content.

2. The method of claim 1, wherein the step of securing the referral key includes a substep of

encrypting the referral key with a public key of the License Server'"'"'s public key, wherein a corresponding private key is stored in the License Server.

3. The method of claim 2, wherein the referral key is encrypted with a session key and the CRO includes both the encrypted session key and a ticket issued to the first user device with that same session key, where the ticket can only be decrypted by this specific server.

4. The method of claim 1, further comprising

sending an identification of the second user device.

5. The method of claim 1, further comprising

sending an identification of a user who has access to the second user device.

6. The method of claim 1, further comprising

transferring an encrypted copy of the digital content to the second user device.

7. The method of claim 1, further comprising

sending an identification of the first user device.

8. The method of claim 1, further comprising

sending an identification of a user who has access to the first user device.

9. The method of claim 1, wherein a session rights object obtained by the first user from an Origin Server includes a permission for use of the content at the second user device.

10. The method of claim 9, further comprising

providing the session rights object by an Origin Server to the first user prior to sending the secured referral key and the identifier to the second user device.

11. The method of claim 9, further comprising

providing the session rights object from an Origin Server to the second user;

and

sending both the session rights object and the CRO from the second user to the License Server, prior to the second user obtaining a re-encrypted referral key for decrypting content.

12. The method of claim 9, wherein the session rights object provided by an Origin Server to the first user includes Super Distribution Rights (SDR) with a separate authenticator that can be validated by the License Server.

13. The method of claim 12, further comprising

sending the CRO from the first user to the second user along with the SDR;

sending, from the second user, both the CRO and the SDR to a License Server; and

using the license server to validate the authenticator and the superdistribution rights contained in the SDR, decrypt and validate the CRO and return to the second user a re-encrypted referral key for decrypting content.

14. The method of claim 9, wherein an Origin Server is separate from the License Server.

15. The method of claim 9, wherein both the Origin Server and the License Server are co-hosted.

16. The method of claim 9, wherein both the Origin Server and the License Server are co-hosted and share the same principal name and service key used to decrypt tickets.

17. An apparatus for distributing digital content, the apparatus comprising

a first user device in communication with a second user device and a License Server;

a machine-readable medium in the first user device including

one or more instructions for using the first user device to generate a referral key;

one or more instructions for securing the referral key so that the referral key can not be used unless information is obtained from the License Server;

one or more instructions for creating an identifier for identifying the digital content; and

one or more instructions for sending the secured referral key and the identifier to the second user device.

18. A method for allowing content to be distributed among users, wherein the content is obtained from a first user and provided to a second user, the method comprising

operating a License Server for defining a record that indicates permitted use of the content by the second user;

and

issuing a record that renews the permitted use of the content by the second user.

19. The method of claim 18, further comprising

providing a list of content rights to be associated with copies of the content distributed by the first user to other users.

20. The method of claim 19, further comprising

including an indicator in the list of content rights to indicate that content rights for the second user are stored in a record at the License Server.

21. The method of claim 18, further comprising

receiving an indication from the first user of content access rights granted to the second user.

22. The method of claim 18, further comprising

receiving a signal from the second user to indicate a request to access the content;

and

granting permission for the second user to access the content.

23. The method of claim 22, further comprising

sending a referral key and identifier to the second user device.