SYSTEMS AND METHODS FOR SECURE TRANSACTION MANAGEMENT AND ELECTRONIC RIGHTS PROTECTION

• US 20110145602A1
• Filed: 02/16/2011
• Published: 06/16/2011
• Est. Priority Date: 02/13/1995
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Ginter, Karl L., Spahn, Francis J., Shear, Victor H., Van Wie, David M.
• Granted Patent: US 8,533,854 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/454 Content or additional data filtering, e.g. blocking advertisements
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08

Abstract

The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node. These techniques may be used to support an all-electronic information distribution, for example, utilizing the “electronic highway.”

Claims

1. A method comprising:

receiving a first electronic container, the first electronic container comprising an encrypted first content object, the first electronic container further comprising first control information specifying one or more permissions relating to access to or other use of the first content object, the first control information further comprising an encrypted first key for use in decrypting the first content object;

using tamper-resistant software to decrypt the first key, use the first key to decrypt the first content object, and govern access to or other use of the first content object in accordance with the one or more permissions specified by the first control information;

receiving a second electronic container, the second electronic container comprising an encrypted second content object or a reference thereto;

receiving, separately from the second electronic container, second control information specifying one or more permissions relating to access to or other use of the second content object, the second control information further comprising an encrypted second key for use in decrypting the second content object; and

using the tamper-resistant software to decrypt the second key, use the second key to decrypt the second content object, and govern access to or other use of the second content object in accordance with the one or more permissions specified by the second control information.

2. The method of claim 1, in which the second electronic container comprises a reference to the second content object, the reference comprising an identifier of a remote location at which the second content object is stored, the method further comprising:

obtaining the encrypted second content object from the remote location.

3. A method comprising:

receiving a request for usage information at a first electronic appliance, the first electronic appliance comprising a protected processing environment for governing access to or other use of electronic content;

validating that the request is from a trusted source;

retrieving usage information related to access to or other use of one or more pieces of electronic content by the electronic appliance; and

sending the usage information to a second electronic appliance, the second electronic appliance being located remotely from the first electronic appliance.

4. The method of claim 3, further comprising:

receiving an acknowledgement from the second electronic appliance, the acknowledgement indicating receipt of the usage information;

modifying or deleting the usage information on the first electronic appliance at least in part in response to having received the acknowledgement.

5. The method of claim 3, further comprising:

encrypting and/or digitally signing the usage information prior to the sending step.

6. The method of claim 4, further comprising:

determining that a predefined amount of time has transpired after sending the usage information, but before an acknowledgement has been received; and

resending the usage information to the second electronic appliance.

7. The method of claim 3, further comprising:

receiving a secure container comprising electronic content;

receiving control information associated with the electronic content; and

using the protected processing environment to apply the control information to govern access to or other use of the electronic content.

8. The method of claim 7, further comprising:

recording, in accordance with the control information, usage information related to access to or other use of the electronic content.