Digital rights management engine systems and methods

• US 20070180519A1
• Filed: 10/18/2006
• Published: 08/02/2007
• Est. Priority Date: 10/18/2005
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Boccon-Gibod, Gilles, Boeuf, Julien
• Granted Patent: US 8,776,216 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/1013 to locations
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and methods are described for performing digital rights management. In one embodiment, a digital rights management engine is provided that evaluates license associated with protected content to determine if a requested access or other use of the content is authorized. In some embodiments, the licenses contain control programs that are executable by the digital rights management engine.

Claims

1. A method of authorizing access to a piece of electronic content on a host computer system, the method comprising:

receiving a request from a user of the host computer system to access the piece of electronic content;

retrieving a license associated with the piece of electronic content, the license comprising a control object, a controller object, a protector object, and a content key object;

retrieving a first control program from the control object; and

executing the first control program using a digital rights management engine running on the host computer system to determine if the request may be granted, wherein executing the control program includes evaluating one or more link objects, wherein each link object represents a relationship between two entities, wherein at least one of the one or more link objects comprises a second control program, and wherein evaluating the one or more link objects includes;

executing the second control program using the digital rights management engine in order to determine if the link is valid, the executing including determining whether one or more conditions expressed by the control program are satisfied.

2. The method of claim 1, in which the controller object is operable to securely bind the control object with the content key object.

3. The method of claim 1, in which the protector object is operable to securely bind the content key object with the piece of electronic content.

4. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that the current time be on before a predefined time.

5. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that the current time be after a certain time.

6. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that the second control program not have been previously executed more than a predefined number of times.

7. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that a counter stored in memory not exceed a predefined value.

8. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that a predefined event not have previously occurred.

9. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that the host computer system must have one or more predefined characteristics.

10. The method of claim 1, in which at least one of the one or more conditions comprises a requirement that software running on the host computer system for rendering the piece of electronic content be unable to export the piece of electronic content to a predefined interface.

11. A method of authorizing a given action to be performed on a piece of electronic content, the method comprising:

executing a first control program using a virtual machine running on a first digital rights management engine, the first control program being operable to determine whether the given action can be performed on the piece of electronic content, wherein the first control program is operable to evaluate a first set of one or more conditions that must be satisfied in order for performance of the given action to be authorized, and wherein at least one of the first set of one or more conditions comprises a requirement that one or more link objects be available to the digital rights management engine, the link objects logically linking a first node representing a first entity to a second node representing a second entity;

retrieving the one or more link objects, each of the link objects expressing a relationship between two entities, and at least one of the link objects including a second control program, wherein the second control program is operable to evaluate a second set of one or more conditions that must be satisfied in order for the at least one link object to be considered valid; and

using the digital rights management engine to execute the second control program.

12. The method of claim 11, in which the first set of one or more condition includes a time-based condition.

13. The method of claim 11, in which the second set of one or more condition includes a time-based condition.

14. The method of claim 11, in which at least one of the first set of conditions or the second set of conditions comprises a requirement that a counter stored in memory not exceed a predefined value.