SYSTEM AND METHOD FOR ACCESSING PRIVATE DIGITAL CONTENT

• US 20120246743A1
• Filed: 11/23/2010
• Published: 09/27/2012
• Est. Priority Date: 12/04/2009
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Kolesnikov, Vladimir Y., Mullender, Sape, Daenen, Koen, Bosch, Hendrikus G.P., Theeten, Bart Antoon Rika
• Granted Patent: US 8,739,306 B2
• Time in Patent Office: Days
• US Class Current: 726/29
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Method for providing access to private digital content installed on a content server C(s), wherein a content manager server C(a) has a number of clients potentially interested in the private content; the method comprising the following steps performed at the content management server C(a):

• • establishing a first communication channel with a client C(b) of the number of clients;
  • receiving a query for private digital content from the client C(b) and sending an appropriate response, causing the client to establish a second communication channel with the content server;
  • establishing a secure session with the content server C(s) over the first and second communication channel;
  • establishing a new session key for the secure session and transmitting said new session key to the client C(b), so that the client can obtain the queried private digital content from the content server as if the client is the content management server.

Claims

1. A method for providing access to private digital content installed on a content server, wherein a content manager server has a number of clients potentially interested in the private content;

the method comprising the steps of;

establishing a first communication channel with a client of the number of clients;

receiving a query for private digital content from the client and sending an appropriate response, causing the client to establish a second communication channel with the content server;

establishing a secure session with the content server over the first and second communication channel;

establishing a new session key for the secure session and transmitting said new session key to the client, so that the client can obtain the queried private digital content from the content server as if the client is the content management server.

2. The method of claim 1, further comprising the step of sending a data request to the content server through the secure session established over the first and second communication channel.

3. The method of claim 1, wherein the establishing of the secure session further comprises establishing one of the following secure tunnels:

a Secure Sockets Layer (SSL)/Transport Layer Security (TLS) tunnel or an Encapsulating Security Payload (ESP) tunnel.

4. The method of claim 1, wherein the establishing of the first and/or second communication channel further comprises establishing a first and/or a second TCP/IP session.

5. The method of claim 1, wherein the web server maintains a client authentication mechanism enabled for Secure Sockets Layer (SSL)/Transport Layer Security (TLS), and wherein the establishing of the secure session with the content server comprises authenticating the client node.

6. The method of claim 5, wherein the authenticating of the client node is made possible by re-using the client'"'"'s certificate when requested by the content server by requesting the client to sign the final SSL/TLS protocol message before transmitting said final SSL/TLS protocol message to the content server.

7. The method of claim 5, wherein the authenticating of the client node is made possible by using a new certificate signed by the client and held by the content management server, such that the content server can verify the authenticity of the new certificate.

15. A non-transitory computer-readable medium having computer-executable instructions for performing the method of claim 1.

8. A method for obtaining private digital content by a client of a content management server, where private content is installed on a content server, comprising the steps of:

establishing a first communication channel with the content management server;

sending a query for the private digital content to the content management server;

establishing a second communication channel with the content server, said query causing the content management server to set up with the content server a secure session over the first and second communication channel;

receiving a new session key established for the second secure session; and

obtaining the queried private digital content from the content server using the new session key as if the client is the content management server.

9. The method of claim 8, wherein said query further causes the content management server to send a data request to the content server through said secure session.

10. The method of claim 8, wherein a first secure session is established between the client and the content management server, and the new session key is received through said first secure session.

11. The method of claim 10, wherein the secure session over the first and second communication channel uses the first secure session.

12. A content management server for organizing private digital content of a plurality of clients, adapted

to establish a secure session with the content management server after having received a query for private digital content from a client, and

to establish a new session key for the secure session and transmit said new session key to the client, so that the client can obtain the queried private digital content from the content management server as if the client is the content management server.

13. The content management server of claim 12, wherein the content management server is a content aggregator such as a Personal Content MANagement (PeCMan) server.

14. A system for accessing private digital content, comprising:

the content management server according to claim 12;

a content server with digital private content; and

a number of clients, wherein a client is adapted to receive said new session key and to use said new session key to obtain digital private content from the content server.