Separating Keys and Policy for Consuming Content

• US 20090265561A1
• Filed: 04/17/2008
• Published: 10/22/2009
• Est. Priority Date: 04/17/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Burns, Quintin S., Bromley, Dennis N.
• Granted Patent: US 8,353,049 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure

Abstract

In accordance with one or more aspects of the separating keys and policy for consuming content, content has a corresponding leaf license, and the leaf license has one or more associated root policy addenda. Each root policy addenda includes policy identifying when it is permissible to decrypt and consume the content, but excludes a content key to decrypt the content. The content can be decrypted and consumed only if the policy identifies that it is permissible to decrypt and consume the content.

Claims

1. One or more computer storage media having stored thereon multiple instructions that, when executed by one or more processors of a device, cause the one or more processors to:

receive a request to perform an action at the device with content;

identify one or more root policy addenda associated with a leaf license corresponding to the content;

if the one or more root policy addenda permit the action, then;

use a key associated with the device to decrypt a content key in the leaf license, the leaf license being separate from the one or more root policy addenda;

use the content key to decrypt the content; and

perform the action with the content; and

if the one or more root policy addenda do not permit the action then do not perform the action.

2. One or more computer storage media as recited in claim 1, wherein to identify the one or more root policy addenda is to access the leaf license and identify the one or more root policy addenda bound to the leaf license.

3. One or more computer storage media as recited in claim 2, wherein to identify the one or more root policy addenda bound to the leaf license is to obtain an identifier from the leaf license and identify the one or more root policy addenda that include the identifier.

4. One or more computer storage media as recited in claim 1, wherein the key associated with the device is a domain key for a domain of which the device is a part.

5. One or more computer storage media as recited in claim 1, wherein at least one of the one or more root policy addenda are associated with multiple leaf licenses corresponding to multiple different content.

6. One or more computer storage media as recited in claim 1, wherein each of the one or more root policy addenda includes policy identifying when it is permissible to decrypt and consume the content, but excludes the content key to decrypt the content.

7. One or more computer storage media as recited in claim 1, wherein the leaf license is embedded in the content.

8. One or more computer storage media as recited in claim 1, wherein the action comprises playback of the content at the device.

9. A method implemented on a device, the method comprising:

receiving a root policy addenda corresponding to content on the device, the root policy addenda including policy identifying when it is permissible to decrypt and consume the content but excluding a content key to decrypt the content, the root policy addenda being associated with a leaf license for the content, the leaf license including the content key to decrypt the content; and

storing the root policy addenda in a root policy addenda store.

10. A method as recited in claim 9, further comprising associating the root policy addenda with one or more additional leaf licenses corresponding to different content.

11. A method as recited in claim 9, further comprising:

identifying the leaf license corresponding to the content; and

associating the root policy addenda with the leaf license.

12. A method as recited in claim 9, wherein the content key is encrypted with a domain key for a domain of which the device is a part.

13. A method as recited in claim 9, wherein the leaf license is embedded in the content.

14. A device comprising:

a first store to store content for use on the device;

a second store to store a leaf license for content in the first store and one or more root policy addenda bound to the leaf license, each root policy addenda including policy identifying when it is permissible to decrypt and consume the content but excluding a content key to decrypt the content; and

a consumption module, coupled to the first store and the second store, the consumption module to consume the content only if the policy identifies that it is permissible to decrypt and consume the content.

15. A device as recited in claim 14, further comprising an update module to:

receive a new root policy addenda corresponding to the content, the new root policy addenda including policy identifying when it is permissible to decrypt and consume the content but excluding the content key to decrypt the content;

store the root policy addenda in the second store;

identify the leaf license; and

associate the new root policy addenda with the leaf license.

16. A device as recited in claim 14, wherein the one or more root policy addenda are bound to the leaf license by being encrypted using a key of the leaf license.

17. A device as recited in claim 14, wherein the leaf license is bound to a device key of the device, the leaf license includes the content key encrypted, and the consumption module can decrypt the content key using the device key.

18. A device as recited in claim 14, wherein at least one of the one or more root policy addenda are bound to multiple additional leaf licenses corresponding to multiple different content.

19. A device as recited in claim 14, wherein to consume the content is to playback audio/video content.

20. A device as recited in claim 14, wherein the leaf license includes a policy identifying the one or more root policy addenda.