METHOD AND APPARATUS FOR POLICY-BASED CONTENT SHARING IN A PEER TO PEER MANNER USING A HARDWARE BASED ROOT OF TRUST

• US 20130283392A1
• Filed: 12/08/2011
• Published: 10/24/2013
• Est. Priority Date: 12/08/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Mirashrafi, Mojtaba, Hazra, Mousumi M., Pendakur, Ramesh, Nemiroff, Daniel
• Granted Patent: US 9,990,473 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/1085 Content sharing, e.g. peer-to-peer [P2P]
• CPC Class Codes: G06F 21/1087 Synchronisation
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client

Abstract

Securely sharing content between a first system and a second system is provided. A hardware-based root of trust is established between the first system and a server. Content requested by a user and an encrypted license blob associated with the content is received by the first system from the server. A first agent on the first system connects with a second agent on the second system. The encrypted license blob and a sub-license request are sent from the first agent to a security processor on the first system. The first security processor decrypts the encrypted license blob, validates the sub-license request, and if allowed, creates a sub-license to allow the second system to play the content. The first security processor sends the sub-license to a security processor on the second system. The first system provides access to the content to the second system for future playback according to the sub-license.

Claims

1. A method of securely sharing content between a first client computing system and a second client computing system, comprising:

establishing a hardware-based root of trust between the first client computing system and a service provider server,

receiving from the service provider server, by the first client computing system, content requested by a user and an encrypted license blob associated with the content;

connecting a first sharing agent on the first client computing system with a second sharing agent on the second client computing system;

sending the encrypted license blob and a sub-license request from the first sharing agent to a first security processor on the first client computing system;

decrypting the encrypted license blob by the first security processor, validating the sub-license request, and if allowed, creating a sub-license to allow the second client computing system to play the content;

sending the sub-license by the first security processor to a second security processor on the second client computing system; and

providing, by the first client computing system, access to the content to the second client computing system.

2. The method of claim 1, wherein the encrypted license blob comprises sub-license information, the sub-license information comprising policies defining restrictions on sharing the content between the client computing systems.

3. The method of claim 1, further comprising creating, by the first sharing agent and the second sharing agent, a secure communications session between the first security processor and the second security processor before sending the sub-license.

4. The method of claim 3, wherein creating the secure communications session comprises using the Enhanced Privacy ID (EPID) signature verification protocol.

5. The method of claim 1, further comprising modifying the license blob by the first security processor to reflect sharing of the content, re-encrypting the license blob, and returning the re-encrypted license blob to the first sharing agent, by the first security processor when the sub-license transfer is successful.

6. The method of claim 1, further comprising:

encrypting a received sub-license by the second security processor and sending the encrypted sub-license to the second sharing agent; and

storing, by the second sharing agent, the encrypted sub-license in a memory of the second client computing system.

7. The method of claim 1, further comprising playing the content by the second client computing system according to the sub-license.

8. A first client computing system for securely sharing content with a second client computing system comprising:

a first component to establish a hardware-based root of trust between the first client computing system and a service provider server, and to receive from the service provider server content requested by a user and an encrypted license blob associated with the content;

a first security processor; and

a first sharing agent to connect with a second sharing agent on the second client computing system, and to send the encrypted license blob and a sub-license request to the first security processor;

wherein the first security processor is to decrypt the encrypted license blob, validate the sub-license request, and if allowed, create a sub-license to allow the second client computing system to play the content, and to send the sub-license to a second security processor on the second client computing system; and

wherein the first component is to provide access to the content to the second client computing system.

9. The first client computing system of claim 8, wherein the encrypted license blob comprises sub-license information, the sub-license information comprising policies defining restrictions on sharing the content between the client computing systems.

10. The first client computing system of claim 8, wherein the first sharing agent is to create a secure communications session between the first security processor and the second security processor before sending of the sub-license.

11. The first client computing system of claim 10, wherein the first sharing agent is to create the secure communications session using the Enhanced Privacy ID (EPID) signature verification protocol.

12. The first client computing system of claim 8, wherein the first security processor is to modify the license blob to reflect sharing of the content, re-encrypt the license blob, and return the re-encrypted license blob to the first sharing agent, when the sub-license transfer is successful.

13. A computer-readable storage medium comprising one or more instructions that when executed by a processor of a first client computing system configures the client computing system to securely share content with a second client computing system by

establishing a hardware-based root of trust between the first client computing system and a service provider server,

receiving from the service provider server content requested by a user and an encrypted license blob associated with the content;

connecting a first sharing agent on the first client computing system with a second sharing agent on the second client computing system;

sending the encrypted license blob and a sub-license request from the first sharing agent to a first security processor on the first client computing system;

causing the decrypting of the encrypted license blob by the first security processor, validating the sub-license request, and if allowed, creating a sub-license to allow the second client computing system to play the content, and causing the sending of the sub-license by the first security processor to a second security processor on the second client computing system; and

providing access to the content to the second client computing system.

14. The computer-readable storage medium of claim 13, wherein the encrypted license blob comprises sub-license information, the sub-license information comprising policies defining restrictions on sharing the content between the client computing systems.

15. The computer-readable storage medium of claim 13, further comprising instructions to create a secure communications session between the first security processor and the second security processor before sending the sub-license.

16. A system for securely sharing content comprising:

a first client computing system including

a first component to establish a hardware-based root of trust between the first client computing system and a service provider server, and to receive from the service provider server content requested by a user and an encrypted license blob associated with the content;

a first security processor; and

a first sharing agent to connect with a second sharing agent on a second client computing system, and to send the encrypted license blob and a sub-license request to the first security processor;

wherein the first security processor is adapted to decrypt the encrypted license blob, validate the sub-license request, and if allowed, create a sub-license to allow the second client computing system to play the content, and to send the sub-license to a second security processor on the second client computing system; and

wherein the first component is adapted to provide access to the content to the second client computing system; and

a second client computing system including

a memory;

a second sharing agent; and

a second security processor;

wherein the second security processor is adapted to receive the sub-license from the first security processor, to encrypt the received sub-license, and to send the encrypted sub-license to the second sharing agent;

wherein the second sharing agent is adapted to store the encrypted sub-license in the memory.

17. The system of claim 16, wherein the second client computing system further comprises a second component to play the content according to the sub-license.

18. The system of claim 16, wherein the encrypted license blob comprises sub-license information, the sub-license information comprising policies defining restrictions on sharing the content between the client computing systems.

19. The system of claim 16, wherein the first sharing agent and the second sharing agent are adapted to create a secure communications session between the first security processor and the second security processor before sending the sub-license.

20. The system of claim 19, wherein the secure communications session uses the Enhanced Privacy ID (EPID) signature verification protocol.

21. The system of claim 16, wherein the first security processor is adapted to modify the license blob to reflect sharing of the content, re-encrypt the license blob, and return the re-encrypted license blob to the first sharing agent, when the sub-license transfer is successful.