KEY-BASED CONTENT MANAGEMENT AND ACCESS SYSTEMS AND METHODS

• US 20090327739A1
• Filed: 06/30/2008
• Published: 12/31/2009
• Est. Priority Date: 06/30/2008
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Data Services LLC (Verizon Communications Inc.)
• Inventors: Relyea, Don, Roberts, Brian, Felt, Michelle
• Granted Patent: US 8,787,579 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00731 involving a digital rights management system for enforcing a usage restriction
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062

Abstract

An exemplary method includes receiving data representative of a content instance over a network from an access device associated with a user, storing the content instance, encrypting the content instance in response to a command initiated by the user, providing a key configured to facilitate decryption of the encrypted content instance, transmitting data representative of the encrypted content instance to a requesting access device, receiving data representative of a request to access the key from the requesting access device over the network, and performing a predefined action related to the key in response to the request and in accordance with at least one access rule, the at least one access rule based on at least one of a user profile and an access device profile.

Claims

1. A method comprising:

receiving data representative of a content instance over a network from an access device associated with a user;

storing said content instance;

encrypting said content instance in response to a command initiated by said user;

providing a key configured to facilitate decryption of said encrypted content instance;

transmitting data representative of said encrypted content instance to a requesting access device;

receiving data representative of a request to access said key from said requesting access device over said network; and

performing a predefined action related to said key in response to said request and in accordance with at least one access rule, said at least one access rule based on at least one of a user profile and an access device profile.

2. The method of claim 1, further comprising providing an interface configured to allow said user to specify said at least one access rule.

3. The method of claim 1, wherein said predefined action comprises transmitting said key to said requesting access device.

4. The method of claim 3, further comprising using said key to decrypt said encrypted content instance.

5. The method of claim 4, further comprising deleting data representative of said key from said requesting access device after said encrypted content instance is decrypted.

6. The method of claim 1, further comprising requiring said requesting access device to request said key over said network each time said requesting access device attempts to access said encrypted content instance.

7. The method of claim 1, wherein said predefined action comprises denying said requesting access device access to said key.

8. The method of claim 1, further comprising defining said at least one access rule to grant a user associated with said user profile at least one type of access to said encrypted content instance.

9. The method of claim 8, wherein said at least one type of access comprises at least one of a full access to said encrypted content instance, a read-only access to said encrypted content instance, and an expiring access to said encrypted content instance.

10. The method of claim 1, further comprising defining said at least one access rule to grant an access device associated with said access device profile at least one type of access to said encrypted content instance.

11. The method of claim 1, further comprising encrypting said key and providing another key configured to facilitate decryption of said key.

12. The method of claim 1, further comprising modifying said at least one access rule in response to another command initiated by said user.

13. The method of claim 12, wherein said modifying of said at least one access rule comprises revoking access to said encrypted content instance for a user associated with said requesting access device.

14. The method of claim 1, tangibly embodied as computer-executable instructions on at least one computer-readable medium.

15. A system comprising:

a content management subsystem configured to maintain data representative of a plurality of content instances; and

an access subsystem associated with a user and selectively and communicatively coupled to said content management subsystem over a network;

wherein said access subsystem is configured to

transmit data representative of a content instance to said content management subsystem, and

provide an interface configured to allow said user to specify at least one access rule corresponding to said content instance, said at least one access rule based on at least one user profile and at least one access device profile; and

wherein said content management subsystem is configured to

encrypt said content instance in response to a command initiated by said user,

provide a key configured to facilitate decryption of said encrypted content instance,

receive data representative of a request to access said key from a requesting access device, and

perform a predefined action related to said key in response to said request and in accordance with said at least one access rule.

16. The system of claim 15, wherein said predefined action comprises transmitting said key to said requesting access device.

17. The system of claim 15, wherein said predefined action comprises denying said requesting access device access to said key.

18. The system of claim 15, wherein said at least one access rule is configured to grant a user associated with said user profile at least one type of access to said encrypted content instance.

19. The system of claim 15, further wherein said at least one access rule is configured to grant an access device associated with said access device profile at least one type of access to said encrypted content instance.

20. The system of claim 15, wherein said content management subsystem is further configured to encrypt said key and provide another key configured to facilitate decryption of said key.

21. The system of claim 15, wherein said content management subsystem is further configured to modify said at least one access rule in response to another command initiated by said user.

22. A system comprising:

a communication facility configured to receive data representative of a content instance over a network from an access device associated with a user;

a data store configured to store said data representative of said content instance; and

a processing facility configured to encrypt said content instance in response to a command initiated by said user and provide a key configured to facilitate decryption of said encrypted content instance;

wherein said communication facility is further configured to transmit data representative of said encrypted content instance to a requesting access device and receive data representative of a request to access said key from said requesting access device over said network; and

wherein said processing facility is further configured to perform a predefined action related to said key in response to said request and in accordance with at least one access rule, said at least one access rule based on at least one of a user profile and an access device profile.

23. The system of claim 22, wherein said predefined action comprises directing said communication facility to transmit said key to said requesting access device.

24. The system of claim 22, wherein said predefined action comprises denying said requesting access device access to said key.

25. The system of claim 22, wherein said at least one access rule is configured to grant a user associated with said user profile at least one type of access to said encrypted content instance.