SECURE CONTENT PRE-DISTRIBUTION TO DESIGNATED SYSTEMS

• US 20090252325A1
• Filed: 04/07/2008
• Published: 10/08/2009
• Est. Priority Date: 04/07/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Goertzel, Mario C., Cheng, Derek C. Y., Reus, Edward F., Sliger, Michael V.
• Granted Patent: US 8,171,560 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Described is a technology by which encrypted content is pre-distributed to recipients during a pre-distribution timeframe, for example to distribute protected content to many clients in a controlled manner. At a release moment, a key for decrypting the encrypted content is released. For example, a software update may be pre-distributed in this manner, whereby many clients may receive the updates over time but the update cannot be analyzed for hacking purposes, e.g., to use the update to figure out a prior vulnerability. By rapidly and widely disseminating the key at the release moment, the update is installed on a large percentage of client systems before those systems can be exploited. The content may be allowed to expire before the key is released, or may be canceled or replaced. The content may include a complete file, and/or a delta file that changes another file into a resultant piece of content.

Claims

1. In a digital communications environment, a method comprising:

pre-distributing encrypted content during a pre-distribution timeframe; and

making available a key package at a release moment, the key package comprising information for decrypting the encrypted content for use by a client recipient.

2. The method of claim 1 further comprising, digitally signing the encrypted content.

3. The method of claim 1 wherein the encrypted content comprises a software update or package, and further comprising pre-distributing metadata that describes the software update or package including applicability information as to which type or types of systems the software update or package applies.

4. The method of claim 3 further comprising encrypting at least part of the metadata.

5. The method of claim 3 wherein the metadata includes an expiration attribute corresponding to an expiration time, and further comprising, receiving the encrypted content, and deleting the encrypted content if an expiration time is achieved prior to receiving the key package.

6. The method of claim 1 further comprising, distributing a cancel package prior to the release moment.

7. The method of claim 1 further comprising, distributing a replace package prior to the release moment.

8. The method of claim 1 further comprising, wherein pre-distributing the encrypted content includes distributing an encrypted delta file containing at least one change to another file.

9. In a digital communications environment, a method comprising:

receiving encrypted content during a pre-distribution timeframe;

caching the encrypted content in anticipation of future use;

receiving a key after a key release moment; and

decrypting the encrypted content via the key into useable content.

10. The method of claim 9 wherein the encrypted content comprises a software update or package, and further comprising receiving metadata corresponding to the software update or package, and using at least some information in the metadata to install the software update or package.

11. The method of claim 10 further comprising decrypting at least some of the metadata.

12. The method of claim 9 further comprising validating a source of the content, or evaluating a hash of the content, or both validating a source of the content and evaluating a hash of the content.

13. The method of claim 9 wherein the encrypted content comprises delta content, and further comprising, decrypting the delta content and using the delta content to change another piece of content.

14. The method of claim 9 further comprising receiving another key, and further comprising, using the other key to decrypt other content.

15. The method of claim 9 further comprising replacing cached encrypted content.

16. One or more computer-readable media having computer-executable instructions, which when executed perform steps, comprising:

encrypting software data;

including the software data in a signed content package;

distributing the software data during a pre-distribution timeframe;

providing metadata associated with the software data; and

determining whether the software data is to be made available for use by recipients, and if so, releasing a key package at a release moment for use in decrypting the software data into useable software data.

17. The one or more computer-readable media of claim 16 having further computer-executable instructions comprising, determining whether the software data is to be canceled or replaced during the pre-distribution timeframe, and if so, distributing a package to cancel or replace the software data, respectively.

18. The one or more computer-readable media of claim 16 having further computer-executable instructions comprising, providing an expiration mechanism that expires the software data if determined that the software data is not to be made available for use.

19. The one or more computer-readable media of claim 16 wherein providing the metadata associated with the software data comprises providing information for use by recipients in determining whether the software data is applicable to each recipient'"'"'s system, and providing information corresponding to a hash of the software data.

20. The one or more computer-readable media of claim 16 wherein the content package, the metadata, or the key package, or any combination of the content package, the metadata, or the key package includes a delta file for modifying another piece of content.