METHOD AND APPARATUS FOR MANAGING POLICIES FOR TIME-BASED LICENSES ON MOBILE DEVICES

• US 20090165083A1
• Filed: 12/24/2007
• Published: 06/25/2009
• Est. Priority Date: 12/24/2007
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: GEIB, Kenneth M., LUNDBLADE, Laurence, D'AMORE, Tianyu L., MCLEAN, Ivan H., KELLEY, Brian H.
• Granted Patent: US 8,544,105 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/1073 Conversion
• CPC Class Codes: G06F 21/725 operating on a secure reference time value

Abstract

Methods and devices provide for creating, managing, modifying, and/or enforcing flexible digital rights management license policies for protecting games, media, data, or other software with a time-based license. Embodiments are especially directed toward situations in which a source of time is unavailable, untrustworthy, or unreliable. Licenses are defined by a small number of parameters. Parameter values may be defined by and included with protected content or applications. The parameter values may be chosen to define and enforce a desired level of compromise between usability and security characteristics.

Claims

1. A method for limiting access to protected content on a mobile device, comprising:

storing a first parameter value on the mobile device representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time;

determining if the mobile device has access to the source of secure time;

granting access to the protected content if the mobile device has access to the source of secure time;

determining whether the first policy condition is satisfied if the mobile device does not have access to the source of secure time; and

providing access to the protected content so long as the first policy condition is satisfied.

2. The method of claim 1 wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

3. The method of claim 1, wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is within service network coverage.

4. The method of claim 1, wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is roaming.

5. The method of claim 1, wherein the first parameter value indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

6. The method of claim 1, wherein the first parameter value indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

7. The method of claim 1 further comprising:

querying a protected content provider server on a periodic basis to determine whether an update to the first parameter value exists;

downloading the update to the first parameter value if the update exists; and

storing the update to the first parameter value on the mobile device.

8. The method of claim 7 wherein the update to the first parameter is downloaded in an encrypted and authenticated file.

9. The method of claim 7, wherein the update to the first parameter is received in an SMS message.

10. The method of claim 1, further comprising storing multiple parameter values representing multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time

11. The method of claim 10, wherein one of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is out of service network coverage, and another of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is within service network coverage.

12. The method of claim 10, wherein one of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is roaming.

13. The method of claim 10, wherein one of the multiple parameter values indicates how the mobile device should treat access attempts when the mobile device is roaming.

14. The method of claim 10, wherein one of the multiple parameter values indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

15. The method of claim 10, wherein one of the multiple parameter values indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

16. The method of claim 10 further comprising:

querying a protected content provider server on a periodic basis to determine whether updates to the multiple parameter values exist;

downloading the updates to the multiple parameter values if the updates exist; and

storing the updates to the multiple parameter values in the memory of the mobile device, wherein the updates to the multiple parameter value represent multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

17. The method of claim 16 wherein the updates to the multiple parameters are downloaded in an encrypted and authenticated file.

18. The method of claim 16, wherein the updates to the multiple parameters are received as in a SMS message.

19. The method of claim 10, downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.

20. A method for limiting access to individual files of protected content on a mobile device, comprising:

storing at least a first parameter value on the mobile device representing a first policy condition controlling access to each individual file of protected content when the mobile device does not have access to a source of secure time;

determining if the mobile device has access to the source of secure time;

granting access to each individual file of protected content if the mobile device has access to the source of secure time;

determining whether the first policy condition for each individual file of protected content is satisfied if the mobile device does not have access to the source of secure time; and

providing access to each individual file of protected content so long as the first policy condition is satisfied.

21. The method of claim 20, wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

22. The method of claim 20, wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is within service network coverage.

23. The method of claim 20, wherein the first parameter value is a number of allowed grace period access attempts when the mobile device is roaming.

24. The method of claim 20, wherein the first parameter value indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

25. The method of claim 20, wherein the first parameter value indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

26. The method of claim 20, further comprising querying a protected content provider server on a periodic basis to determine whether an update to the first parameter value exists;

downloading the update to the first parameter value if the update exists; and

storing the update to the first parameter value in the memory of the mobile device, wherein the update to the first parameter value represents a first policy condition controlling access to each individual file of protected content when the mobile device does not have access to a source of secure time.

27. The method of claim 26, wherein the update to the first parameter is downloaded in an encrypted and authenticated file.

28. The method of claim 26, wherein the update to the first parameter is received in an SMS message.

29. The method of claim 20, further comprising storing multiple parameter values representing a multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

30. The method of claim 29, wherein one of the multiple parameter values stored in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

31. The method of claim 29, wherein one of the multiple parameter values stored in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

32. The method of claim 29, wherein one of the multiple parameter values stored in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

33. The method of claim 29, wherein one of the multiple parameter values stored in the memory of the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

34. The method of claim 29, wherein one of the multiple parameter values stored in the memory of the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

35. The method of claim 29, further comprising:

querying a protected content provider server on a periodic basis to determine whether updates to the multiple parameter values exist;

downloading the updates to the multiple parameter value if the updates exist; and

storing the updates to the multiple parameter values in the memory of the mobile device, wherein the updates to the multiple parameter value represent multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

36. The method of claim 35, wherein the updates to the multiple parameters are downloaded in an encrypted file.

37. The method of claim 35, wherein the updates to the multiple parameters are received in a SMS message.

38. The method of claim 29, further comprising querying each of the stored multiple parameters values representing the multiple policy conditions each time the mobile device is powered up to determine if any of the stored multiple parameter values indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

39. The method of claim 29, downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.

40. A mobile device, comprising:

a processor;

a wireless transceiver coupled to the processor and configured to connect to a wireless network; and

a memory coupled to the processor, the memory having stored therein software instructions configured to cause the processor to perform steps comprising;

storing a first parameter value on the mobile device representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time;

determining if the mobile device has access to the source of secure time;

granting access to the protected content if the mobile device has access to the source of secure time;

determining whether the first policy condition is satisfied if the mobile device does not have access to the source of secure time; and

providing access to the protected content so long as the first policy condition is satisfied.

41. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device utilize a first parameter value which is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

42. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device utilize a first parameter value which is a number of allowed grace period access attempts when the mobile device is within service network coverage.

43. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device utilize a first parameter value which is a number of allowed grace period access attempts when the mobile device is roaming.

44. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device utilize a first parameter value that indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

45. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device utilize a first parameter value that indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

46. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the steps of:

querying a protected content provider server on a periodic basis to determine whether an update to the first parameter value exists;

downloading the update to the first parameter value if the update exists; and

storing the update to the first parameter value in the memory of the mobile device.

47. The mobile device of claim 46, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of parsing and decrypting the downloaded update to the first parameter.

48. The mobile device of claim 47, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of receiving the update to the first parameter in an SMS message.

49. The mobile device of claim 40, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of storing multiple parameter values representing multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time

50. The mobile device of claim 49, wherein at least one of the multiple parameter values utilized by the software instructions in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

51. The mobile device of claim 49, wherein at least one of the multiple parameter values utilized by the software instructions in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

52. The mobile device of claim 49, wherein at least one of the multiple parameter values utilized by the software instructions in the memory of the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

53. The mobile device of claim 49, wherein at least one of the multiple parameter values utilized by the software instructions in the memory of the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

54. The mobile device of claim 49, wherein at least one of the multiple parameter values utilized by the software instructions in the memory of the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

55. The mobile device of claim 49 wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the steps of:

querying a protected content provider server on a periodic basis to determine whether updates to the multiple parameter values exist;

downloading the updates to the multiple parameter value if the updates exist; and

storing the updates to the multiple parameter values to the memory of the mobile device.

56. The mobile device of claim 55, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of parsing and decrypting the downloaded update to the first parameter.

57. The mobile device of claim 56, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of receiving the update to the first parameter in an SMS message.

58. The mobile device of claim 49, wherein the software instructions in the memory of the mobile device are further configured to cause the processor to perform the step of downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.

59. A mobile device, comprising:

means for storing a first parameter value on the mobile device representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time;

means for determining if the mobile device has access to the source of secure time;

means for granting access to the protected content if the mobile device has access to the source of secure time;

means for determining whether the first policy condition is satisfied if the mobile device does not have access to the source of secure time; and

means for providing access to the protected content so long as the first policy condition is satisfied.

60. The mobile device of claim 59, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

61. The mobile device of claim 59, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

62. The mobile device of claim 59, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

63. The mobile device of claim 59, wherein the first parameter value stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

64. The mobile device of claim 59, wherein the first parameter value stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

65. The mobile device of claim 59, further comprising:

means for querying a protected content provider server on a periodic basis to determine whether an update to the first parameter value exists;

means for downloading the update to the first parameter value if the update exists; and

means for storing the update to the first parameter value on the mobile device.

66. The mobile device of claim 65, further comprising means to decrypt the downloaded update to the first parameter.

67. The mobile device of claim 65, further comprising means to receive and parse the update to the first parameter in an SMS message.

68. The mobile device of claim 59, further comprising means for storing multiple parameter values representing multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time

69. The mobile device of claim 68, wherein at least one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

70. The mobile device of claim 68, wherein at least one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

71. The mobile device of claim 68, wherein at least one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

72. The mobile device of claim 68, wherein at least one of the multiple parameter values stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

73. The mobile device of claim 68, wherein at least one of the multiple parameter values stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

74. The mobile device of claim 59, further comprising

means for querying a protected content provider server on a periodic basis to determine whether updates to the multiple parameter values exist;

means for downloading the updates to the multiple parameter value if the updates exist; and

means for storing the updates to the multiple parameter values on the mobile device, wherein the updates to the multiple parameter value represent multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

75. The mobile device of claim 74, further comprising means for decrypting the downloaded updates to the multiple parameters.

76. The mobile device of claim 74, further comprising means for receiving and parsing the updates to the multiple parameters in a SMS message.

77. The mobile device of claim 68, further comprising means for downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.

78. A mobile device, comprising:

means for storing at least a first parameter value on the mobile device representing a first policy condition controlling access to each individual file of protected content when the mobile device does not have access to a source of secure time;

means for determining if the mobile device has access to the source of secure time;

means for granting access to each individual file of protected content if the mobile device has access to the source of secure time;

means for determining whether the first policy condition for each individual file of protected content is satisfied if the mobile device does not have access to the source of secure time; and

means for providing access to each individual file of protected content so long as the first policy condition is satisfied.

79. The mobile device of claim 78, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

80. The mobile device of claim 78, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

81. The mobile device of claim 78, wherein the first parameter value stored on the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

82. The mobile device of claim 78, wherein the first parameter value stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

83. The mobile device of claim 78, wherein the first parameter value stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

84. The mobile device of claim 78, further comprising:

means for querying a protected content provider server on a periodic basis to determine whether an update to the first parameter value exists;

means for downloading the update to the first parameter value if the update exists; and

means for storing the update to the first parameter value in the means for storing of the mobile device, wherein the update to the first parameter value represents a first policy condition controlling access to each individual file of protected content when the mobile device does not have access to a source of secure time.

85. The mobile device of claim 84, further comprising means for decrypting the downloaded update to the first parameter.

86. The mobile device of claim 84, further comprising means for receiving and parsing the update to the first parameter in an SMS message.

87. The mobile device of claim 78, further comprising means for storing multiple parameter values representing a multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

88. The mobile device of claim 87, wherein one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

89. The mobile device of claim 87, wherein one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is within service network coverage.

90. The mobile device of claim 87, wherein one of the multiple parameter values stored on the mobile device is a number of allowed grace period access attempts when the mobile device is roaming.

91. The mobile device of claim 87, wherein one of the multiple parameter values stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

92. The mobile device of claim 87, wherein one of the multiple parameter values stored on the mobile device indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

93. The mobile device of claim 87, further comprising

means for querying a protected content provider server on a periodic basis to determine whether updates to the multiple parameter values exist;

means for downloading the updates to the multiple parameter value if the updates exist; and

means for storing the updates to the multiple parameter values on the mobile device, wherein the updates to the multiple parameter value represent multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

94. The mobile device of claim 93, further comprising means for decrypting the downloaded update to the first parameter.

95. The mobile device of claim 93, further comprising means for receiving and parsing the update to the first parameter in an SMS message.

96. The mobile device of claim 87, further comprising means for querying each of the stored multiple parameters values representing the multiple policy conditions each time the mobile device is powered up to determine if any of the stored multiple parameter values indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

97. The mobile device of claim 87, further comprising means for downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.

98. A server for providing protected content to a mobile device comprising:

a mass storage memory having stored therein individual files of protected content and a database containing at least a first parameter value representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time;

a processor coupled to the mass storage memory and configured to connect to a wireless network, wherein the processor is configured by processor-executable software instructions to perform the steps of;

receiving a request to download protected content by the mobile device;

transmitting to the mobile device the protected content in response to the request; and

transmitting to the mobile device at least a first parameter value representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time.

99. The server of claim 98, wherein the at least first parameter value is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

100. The server of claim 98, wherein the at least first parameter value is a number of allowed grace period access attempts when the mobile device is within service network coverage.

101. The server of claim 98, wherein the at least first parameter value is a number of allowed grace period access attempts when the mobile device is roaming.

102. The server of claim 98, wherein the at least first parameter value indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

103. The server of claim 98, wherein the at least first parameter value indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

104. The server of claim 98, wherein the processor is configured by processor-executable software instructions to access the mass storage memory to update the at least first parameter value representing a first policy condition controlling access to the protected content when the mobile device does not have access to a source of secure time.

105. The server of claim 104, wherein the processor is further configured by processor-executable software instructions to perform the steps of:

receiving query requests from the mobile device to determine whether an update to the at least first parameter value exists in the mass storage memory; and

transmitting to the mobile device making the update to the at least first parameter value if the update exists.

106. The server of claim 105, wherein the processor is configured by processor-executable software instructions to transmit the update to the at least first parameter as an encrypted and authenticated file.

107. The server of claim 105, the processor is configured by processor-executable software instructions to generate a SMS message and to transmit the update to the at least first parameter as an SMS message.

108. The server of claim 104, wherein the processor is further configured by processor-executable software instructions to perform the steps of transmitting the update to the at least first parameter value if the update exists as soon as the update is made to the mobile device.

109. The server of claim 98, wherein the mass storage memory contains multiple parameter values representing multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

110. The server of claim 109, wherein one of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is out of service network coverage.

111. The server of claim 109, wherein one of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is within service network coverage.

112. The server of claim 109, wherein one of the multiple parameter values is a number of allowed grace period access attempts when the mobile device is roaming.

113. The server of claim 109, wherein one of the multiple parameter values indicates whether the mobile device must access a remote source of secure time each time access to the protected content is granted.

114. The server of claim 109, wherein one of the multiple parameter values indicates whether the mobile device must access a remote source of secure time each time the mobile device is powered up.

115. The server of claim 109, wherein the processor is configured by processor-executable software instructions to access the mass storage memory to update the each of the multiple parameter values representing multiple policy conditions controlling access to the protected content when the mobile device does not have access to a source of secure time.

116. The server of claim 115, wherein the processor is further configured by processor-executable software instructions to perform the steps of:

receiving query requests from the mobile device to determine whether an update to any of the multiple parameter value exists in the mass storage memory; and

transmitting to the mobile device making the query request the update to the multiple parameter values if the update exists.

117. The server of claim 116, wherein the processor is configured by processor-executable software instructions to transmit the update to the multiple parameter values in an encrypted file.

118. The server of claim 116, wherein the processor is configured by processor-executable software instructions to generate a SMS message, and to transmit the update to the multiple parameter values as an SMS message.

119. The server of claim 109, wherein the processor is further configured by processor-executable software instructions to perform the step of downloading updates to the multiple parameter values in conjunction with a purchase of new protected content.