Trusted Infrastructure Support Systems, Methods and Techniques for Secure Electronic Commerce, Electronic Transactions, Commerce Process Control and Automation, Distributed Computing, And Rights Management

• US 20100217994A1
• Filed: 05/05/2010
• Published: 08/26/2010
• Est. Priority Date: 02/13/1995
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Ginter, Karl L., Weber, Robert P., Spahn, Francis J., Shear, Victor H., Van Wie, David M.
• Granted Patent: US 8,190,528 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/023 the neutral party being a clearing house
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/123 Shopping for digital content
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 30/06 : Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/12 : Accounting
• CPC Class Codes: G06T 1/0021 : Image watermarking
• CPC Class Codes: G07F 9/026 : for alarm, monitoring and auditing in vending machines or means for indication, e.g. when empty
• CPC Class Codes: H04L 2209/56 : Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 : Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 : applying security measures for digital rights management
• CPC Class Codes: H04L 2463/102 : applying security measure for e-commerce
• CPC Class Codes: H04L 2463/103 : applying security measure for protecting copyright
• CPC Class Codes: H04L 63/068 : using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/23476 : by partially encrypting, e.g. encrypting the ending portion of a movie
• CPC Class Codes: H04N 21/235 : Processing of additional data, e.g. scrambling of additional data or processing content descriptors
• CPC Class Codes: H04N 21/2362 : Generation or processing of Service Information [SI]
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2543 : Billing , e.g. for subscription services payment schemes, architectures or protocols G06Q20/00; e-commerce G06Q30/00; arrangements for billing for the use of broadcast information or broadcast-related information H04H60/21
• CPC Class Codes: H04N 21/2547 : Third Party Billing, e.g. billing of advertiser
• CPC Class Codes: H04N 21/25875 : involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/4143 : embedded in a Personal Computer [PC]
• CPC Class Codes: H04N 21/4345 : Extraction or processing of SI, e.g. extracting service information from an MPEG stream
• CPC Class Codes: H04N 21/435 : Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4405 : involving video stream decryption
• CPC Class Codes: H04N 21/44204 : Monitoring of content usage, e.g. the number of times a movie has been viewed, copied or the amount which has been watched monitoring of user activities for profile generation for accessing a video database G06F16/739; protecting generic digital content where the protection is independent of the precise nature of the content G06F21/10; arrangements for monitoring the use made of the broadcast services in broadcast systems H04H60/31
• CPC Class Codes: H04N 21/443 : OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4753 : for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 21/6581 : Reference data, e.g. a movie identifier for ordering a movie or a product identifier in a home shopping application
• CPC Class Codes: H04N 21/8166 : involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/83555 : using a structured language for describing usage rules of the content, e.g. REL
• CPC Class Codes: H04N 21/8358 : involving watermark protecting executable software by watermarking G06F21/16; image watermarking in general G06T1/0021; watermarks inserted in still images for transmission purposes H04N1/32144; inserting watermarks during video coding H04N19/467
• CPC Class Codes: H04N 7/162 : Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
• CPC Class Codes: H04N 7/17309 : Transmission or handling of upstream communications

Abstract

An integrated, modular array of administrative and support services are provided for electronic commerce and electronic rights and transaction management. These administrative and support services supply a secure foundation for conducting transaction-related capabilities functioning over electronic networks can also be adapted to the specific needs of electronic commerce value chains. In one embodiment, a Distributed Commerce Utility having a secure, programmable, distributed architecture provides administrative and support services. The Distributed Commerce Utility may comprise a number of Commerce Utility Systems. These Commerce Utility Systems provide a web of infrastructure support available to, and reusable by, the entire electronic community and/or many of its participants. Different support functions can be collected together in hierarchical and/or networked relationships to suit various business models or other objectives. Modular support functions can be combined in different arrays to form different Commerce Utility Systems for different design implementations and purposes.

Claims

1-20. -20. (canceled)

21. A system comprising:

a first telecommunications switch;

a second telecommunications switch located remotely from the first telecommunications switch, the second telecommunications switch including a security checkpoint system, the security checkpoint system being operable to;

determine whether information received at the second telecommunications switch was routed through the first telecommunications switch; and

refuse to transfer the information upon determining that the information was not routed through the first telecommunications switch;

an end user node; and

a telecommunications network over which the first telecommunications switch, the second telecommunications switch, and the end user node are communicably coupled.

22. The system of claim 21, in which the first telecommunications switch is operable to associate a certificate with the information, and in which the security checkpoint system is operable to verify that the certificate is associated with the information.

23. The system of claim 22, in which the security checkpoint system is further operable to refuse to transmit the information upon determining that a certificate is not associated with the information.

24. The system of claim 21, in which the security checkpoint system is further operable to verify that the information was transmitted in accordance with one or more controls governing transmission of the information.

25. The system of claim 24, in which at least one of the one or more controls comprises a budget or limit associated with the information.

26. The system of claim 24, in which at least one of the one or more controls comprises a limit on the amount of information that can be sent from a given entity in a given amount of time.

27. The system of claim 21, in which the end user node is operable to securely govern access to or other use of the information in accordance with one or more controls securely associated with the information.

28. The system of claim 21, further comprising:

a certifying authority, the certifying authority being operable to certify security checkpoint systems.

29. The system of claim 28, in which the certifying authority is operable to certify a security checkpoint system'"'"'s membership in a particular class.

30. The system of claim 29, in which the security checkpoint system is further operable to verify that the information was transmitted in accordance with at least one control restricting transmission of the information, the at least one control including a requirement that the information be routed through a security checkpoint system certified to be a member of the particular class.

31. The system of claim 21, in which the security checkpoint system includes a first protected processing environment.

32. The system of claim 31, in which the end user node includes a second protected processing environment.

33. The system of claim 21, in which the security checkpoint system is further operable to record audit information related to the information.

34. The system of claim 33, in which the audit information relates to at least one of:

(i) an intended recipient of the information, (ii) a class to which the information belongs, (iii) a checksum or other data for use in validating the information, or (iv) a sender of the information.

35. A method comprising:

sending an electronic container from a first user'"'"'s electronic appliance over a telecommunications network comprising one or more telecommunications switches, the electronic container including protected information and control information for governing use of the protected information;

receiving the electronic container at a first telecommunications switch;

associating a first digital certificate with the electronic container at the first telecommunications switch;

receiving the electronic container at a second telecommunications switch;

verifying the first digital certificate and associating a second digital certificate with the electronic container;

receiving the electronic container at the second user'"'"'s electronic appliance;

verifying the second digital certificate; and

accessing the protected information in accordance with the control information.

36. The method of claim 35, further comprising:

at the first telecommunications switch, recording auditing information;

wherein the step of associating the first digital certificate is performed after completion of the step of recording auditing information.

37. The method of claim 36, in which the auditing information relates to at least one of:

(i) an intended recipient of the electronic container, (ii) a class of information to which the protected information belongs, (iii) a checksum or other data for use in validating the protected information, or (iv) a sender of the electronic container.

38. The method of claim 35, further comprising:

verifying information relating to routing of the electronic container over the telecommunications network;

wherein the step of associating the first digital certificate is performed after successful completion of the verifying information step.

39. The method of claim 35, in which at least one piece of control information associated with the protected information includes a requirement that the protected information pass through at least one certified security checkpoint system when transmitted from one user node to another user node.

40. The method of claim 39, further including:

at the second user'"'"'s electronic appliance, determining whether the protected information passed through at least one certified security checkpoint system prior to receipt at the second user'"'"'s electronic appliance.