METHOD OF IMPLEMENTING A STATE TRACKING MECHANISM IN A COMMUNICATIONS SESSION BETWEEN A SERVER AND A CLIENT SYSTEM

• US 20080077938A1
• Filed: 09/21/2007
• Published: 03/27/2008
• Est. Priority Date: 09/21/2006
• Status: Active Grant

• Current Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Original Assignee: Irdeto Access B.V. (MultiChoice Group Ltd.)
• Inventors: Wajs, Andrew
• Granted Patent: US 8,006,249 B2
• Time in Patent Office: Days
• US Class Current: 719/313
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A method of implementing a state tracking mechanism in a communications session between a server and a client system, wherein, in the course of the communications session, application data is provided to the client system in accessible form only if the client system has a valid value of state tracking information, includes transmitting a message carrying a new value of the state tracking information to the client system. It further includes calculating the value of the state tracking information valid after transmission of the message using as input at least the new value carried in the message and a datum maintained at the client system.

Claims

1. A method of implementing a state tracking mechanism in a communications session between a server and a client system,

wherein, in the course of the communications session, application data is provided to the client system in accessible form only if the client system has a valid value of state tracking information, the method including:

transmitting a message carrying a new value of the state tracking information to the client system; and

calculating the value of the state tracking information valid after transmission of the message using as input at least the new value carried in the message and a datum maintained at the client system.

2. A method according to claim 1, including obtaining the datum maintained at the client system in the form of a nonce.

3. A method according to claim 2, wherein the server is aware of the nonce of the client system.

4. A method according to claim 1, including calculating at least one of the new value carried in the message and the value of the state tracking information valid after transmission of the message using as input at least the value of the state tracking information valid when carrying out the calculation.

5. A method according to claim 1, wherein the client system is provided with a set of identifiers of entitlements to decrypt encrypted information associated with the respective entitlements, including

maintaining a record reflecting the entitlements corresponding to the set of identifiers, and

calculating the value of the state tracking information valid after transmission of the message using as a further input data corresponding to at least parts of each of the identifiers in the set provided to the client system.

6. A method according to claim 1, including calculating the value of the state tracking information valid after transmission of the message using a network address of the client system on a network via which communications between the server and the client system are effected.

7. A method according to claim 1, including

calculating the new value carried in the message using as input at least a nonce established and maintained by the server, wherein the nonce is communicated to the client system on commencement of the communication session.

8. A method according to claim 1, wherein the application data is provided to the client system upon receipt of a request message from the client system carrying data corresponding to the valid value of the state tracking information.

9. A method according to claim 1, wherein the application data is provided in encrypted form, encrypted so as to permit decryption under a key derivable using at least part of the valid value of the state tracking information.

10. A method according to claim 1, wherein the client system is provided with a set of content data, encrypted to permit decryption under a key, wherein the application data includes values of the key.

11. A server system, including a data processing unit and memory, arranged to carry out a method including:

transmitting a message carrying a new value of state tracking information to a client system; and

calculating the value of the state tracking information valid after transmission of the message using as input at least the new value carried in the message and a datum maintained at the client system.

12. A method of conducting a communications session with a server implementing a state tracking mechanism, the method including:

maintaining state tracking information at a client system conducting the communications session, wherein, in the course of the communications session, application data is received from the server and rendered accessible to a target application on a client system only if the state tracking information maintained at the client system corresponds in value to a valid value, and

receiving a new value of the state tracking information in a message from the server,

calculating a further value of the state tracking information using as input at least the new value in the message and a datum stored at the client system, and

replacing the state tracking information maintained at the client system by the further value.

13. A method according to claim 12, including

obtaining the datum stored at the client system in the form of a nonce on commencement of the communications session.

14. A method according to claim 13, including generating the nonce at the client system by generating a random number and communicating the nonce to the server on commencement of the communications session.

15. A method according to claim 12, wherein the client system maintains a set of identifiers of entitlements to decrypt encrypted information associated with the respective entitlements, wherein the method includes

calculating the further value of the state tracking information using as a further input data corresponding to at least parts of each of the identifiers in the set.

16. A method according to claim 12, wherein communications between the server and the client system are effected via a network, and wherein the client system has an address on the network, hard-wired into equipment used by the client system, wherein the method includes

calculating the further value of the state tracking information using as a further input data corresponding to at least part of the network address.

17. A method according to claim 12, including

receiving a message carrying a nonce established by the server on commencement of the communications session, and

calculating an expected value of the new value of the state tracking information received in the message from the server using at least the nonce established by the server as input,

wherein the further value of the state tracking information is only calculated upon determining that the expected value matches the value received in the message from the server.

18. A method according to claim 12, including

calculating an expected value of the new value of the state tracking information received in the message from the server using as input at least the value of the state tracking information maintained at the client system at receipt of the message,

wherein the further value of the state tracking information is only calculated upon determining that the expected value matches the value received in the message from the server.

19. A method according to claim 12, including

requesting transmission of the application data by sending a message including data corresponding to at least part of the state tracking information maintained at the client system.

20. A method according to claim 12, including

receiving the application data in encrypted form, and

using the state tracking information maintained at the client system to derive a key for decrypting the encrypted application data.

21. A method according to claim 12, including

receiving a stream of encrypted content data, and

obtaining a key to decrypt the encrypted content data from the application data received from the server.

22. A client system, including a data processing unit and memory, arranged to carry out a method including:

maintaining state tracking information at the client system conducting the communications session, wherein, in the course of the communications session, application data is received from the server and rendered accessible to a target application on a client system only if the state tracking information maintained at the client system corresponds in value to a valid value, and

receiving a new value of the state tracking information in a message from the server,

calculating a further value of the state tracking information using as input at least the new value in the message and a datum stored at the client system, and

replacing the state tracking information maintained at the client system by the further value.

23. A computer program, including a set of instructions capable, when incorporated in a machine readable medium, of causing a system having information processing capabilities to perform a method including:

transmitting a message carrying a new value of state tracking information to a client system; and

calculating the value of the state tracking information valid after transmission of the message using as input at least the new value carried in the message and a datum maintained at the client system.