ENHANCED DIGITAL RIGHT MANAGEMENT FRAMEWORK

• US 20110035577A1
• Filed: 03/26/2007
• Published: 02/10/2011
• Est. Priority Date: 03/26/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Yang, Jie, Lin, Yunbiao, Song, Chuan
• Granted Patent: US 8,572,400 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/1077 Recurrent authorisation
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Machine-readable media, methods, apparatus and system for enhanced digital right management framework are described. A server platform may receive a request of downloading content and first attestation information from a client platform. The server platform may examine if the client platform attests to a client platform characteristic that affects integrity of the client platform by using the attestation information, and then encrypt and download the content to the client platform if the client platform attests to the client platform characteristic. The server platform may further receive a request of viewing the content and second attestation information from the client platform. The server platform may then examine if the client platform attests to its integrity by using the second attestation information; and then send a content key to the client platform if the client platform attests to its integrity, so that the client platform can decrypt and view the content.

Claims

1. A machine-readable medium comprising a plurality of instructions which when executed result in a server platform:

receiving, from a client platform, a request of downloading content;

receiving, from the client platform, first attestation information;

examining if the client platform attests to a client platform characteristic that affects integrity of the client platform by using the attestation information; and

encrypting and downloading the content to the client platform, if the client platform attests to the client platform characteristic.

2. The machine-readable medium of claim 1, wherein the plurality of instructions further result in the server platform:

checking if a predetermined policy allows downloading the content from the server platform to the client platform.

3. The machine readable medium of claim 2, wherein the plurality of instructions that result in the server platform encrypting and downloading, further result in the server platform:

encrypting and downloading the content to the client platform, if the predetermined policy allows downloading the content from the server platform to the client platform.

4. The machine-readable medium of claim 1, wherein the content is encrypted with a content key owned by the server platform.

5. The machine readable medium of claim 1, wherein the client platform characteristic reflects whether the client platform is vulnerable to malicious attacks.

6. The machine readable medium of claim 1, wherein the client platform characteristic comprises a hash value for a standard software application.

7. The machine readable medium of claim 1, wherein the client platform characteristic comprises a hash value for a protected software application.

8. The machine-readable medium of claim 1, wherein the plurality of instructions further result in the server platform:

receiving, from the client platform, a request of viewing the content;

receiving, from the client platform, second attestation information;

examining if the client platform attests to the client platform characteristic that affects integrity of the client platform by using the second attestation information; and

sending a content key to the client platform if the client platform attests to the client platform characteristic, so that the client platform can decrypt and view the content.

9. The machine-readable medium of claim 8, wherein the plurality of instructions further result in the server platform:

checking if a predetermined policy allows the client platform to view the content.

10. The machine readable medium of claim 9, wherein the plurality of instructions that result in the server platform sending, further result in the server platform:

sending the content key to the client platform, if the predetermined policy allows the client platform to view the content.

11. A machine-readable medium comprising a plurality of instructions which when executed result in a client platform:

sending, to a server platform, a request of downloading content;

sending, to the server platform, first attestation information; and

receiving, from the server platform, the content that is encrypted with a content key owned by the server platform, if the client platform attests to a client platform characteristic that affects integrity of the client platform.

12. The machine-readable medium of claim 11, wherein the plurality of instructions further result in the client platform:

measuring a component of the client platform on whether the component is vulnerable to a malicious attack, to provide a result of measurement;

signing the result with a key owned by the client platform, to provide the client platform characteristic; and

sending the client platform characteristic to the server platform.

13. The machine-readable medium of claim 11, wherein the plurality of instructions further result in the client platform:

obtaining a first hash value through executing a first software application on the client platform;

generating the first attestation information based upon the first hash value.

14. The machine-readable medium of claim 11, wherein the plurality of instructions further result in the client platform:

sending, to the server platform, a request of viewing the content;

sending, to the server platform, second attestation information; and

receiving, from the server platform, the content key to decrypt the content, if the client platform attests to the client platform characteristic that affects the integrity of the client platform.

15. The machine-readable medium of claim 11, wherein the plurality of instructions further result in the client platform:

obtaining a second hash value through executing a second software application on the client platform;

generating the second attestation information based upon the second hash value.