System and method for access data control

• US 5,703,951 A
• Filed: 06/07/1995
• Issued: 12/30/1997
• Est. Priority Date: 09/14/1993
• Status: Expired due to Term

• Current Assignee: SPEX Technologies, Inc.
• Original Assignee: Spyrus, Inc.
• Inventors: Dolphin, Janet L.
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/474,306
• Time in Patent Office: 937 Days
• Field of Search: 380/4, 380/23, 380/25
• US Class Current: 705/51
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems

Abstract

The system and method of the present invention provides the support of high density removable media, such as CD-ROM or MO, to be used as a distributed media for storing data where access thereto is securely restricted. Through this system and method, the secure periodic distribution of several different sets of data information to the end user is achieved with access control selectively performed by at the user'"'"'s site through communication with the billing/access center. User billing is based on the purchase of the decryption access codes as indicated by the access code attributes encoded on the media. Access code availability is further controlled by selectively providing for updates of decryption access codes.

Claims

1. A system for controlling access by a user to a plurality of sets of data, comprising:

a processor for processing said data;

a data storage unit for storing each of said plurality of sets of data in a manner such that a predetermined access code is required for accessing each of said plurality of sets of data;

a controller, said controller adapted for communication with said processor and a remote location, for receiving from the remote location a signal representative of one of said predetermined access codes and for sending to the processor a signal which enables access by said processor to a set of data stored on said storage unit;

a remote authorization unit located at a location remote from said processor and said controller, said remote authorization unit for transmitting an access code to said controller from said remote location in response to an authorization request signal sent by the user to said remote authorization unit; and

wherein said data storage unit stores update instructions and an update counter value for enabling said controller to use said transmitted access code to automatically generate an updated access code for enabling access to a previously inaccessible one of said sets of data stored on said data storage unit.

2. A system as recited in claim 1 wherein each of said access codes corresponds to an identifying code and wherein said authorization request includes said identifying code.

3. A system as recited in claim 2 wherein said identifying code is representative of an attribute.

4. A system as recited in claim 3 wherein said attribute is representative of a use of said data.

5. A system as recited in claim 1 wherein said controller is a hardware means for performing the functions of the controller.

6. A system as recited in claim 1 wherein said controller is a software means for performing the functions of the controller.

7. A system as recited in claim 1 wherein said data stored on said data storage unit including identifying codes for identifying said data.

8. A system as recited in claim 7 wherein said identifying codes are codes associated with attributes.

9. A system as recited in claim 8 wherein said attribute is representative of a use of said data.

10. A system as recited in claim 7 wherein said authorization request includes one of said identifying codes.

11. A method for distributing data to a user comprising the steps of:

providing encrypted data on a data storage unit, an access code being required to decrypt said encrypted data to provide access to the encrypted data, wherein at least a portion of said encrypted data is correlated with a corresponding access code identifier for identifying access codes, and wherein update instructions and an update counter value are stored on the data storage unit, the instructions and counter value enabling a controller to use said transmitted access code to generate an updated access code for enabling access to previously inaccessible parts of said encrypted data on said data storage unit;

at a remote location, storing a plurality of access codes together with corresponding access code identifiers;

at the remote location, generating an authorization signal when predetermined conditions are met, wherein said authorization signal causes one of said access codes to be transmitted to said user to enable said user to access a portion of said encrypted data by decrypting a portion of said encrypted data and wherein said predetermined conditions include the receipt of one of said access code identifiers from said user;

applying said access code to said encrypted data to decrypt a portion of said encrypted data; and

processing said decrypted portion of said encrypted data.

12. A method of distributing information in the form of data sets and providing access thereto, comprising the steps of:

encrypting said data sets so that different access codes are required to decrypt different portions of said data sets;

correlating said data sets with access code identifiers which identify particular access codes which will decrypt said data sets;

storing said data sets in a data storage unit;

providing a controller which is capable of applying said access codes to said data storage unit;

remotely providing the controller with one of said different access codes to decrypt a selected one of said encrypted data sets in response to the receipt of one of said access code identifiers, said controller accessing said data sets stored in said data storage unit, wherein;

said access codes are further stored with attributes defined in a manner which corresponds to particular properties of said data sets, both the access codes and the attributes being transmitted to said controller in response to the provision to the controller of one of said access code identifiers; and

said data storage unit stores update instructions and an update counter value for enabling said controller to use said access codes to generate an updated access code for enabling access to previously inaccessible parts of said data on said data storage unit.

13. A system for encrypting data, comprising:

a memory medium including programming codes stored thereon for encrypting individual data sets and for assigning access code identifiers to said individual data sets, each of said access code identifiers associated with and used in identifying a particular access code for decrypting one of said individual data sets, said access code identifier for identifying said particular access code;

a processor in communication with said memory medium for writing said encrypted individual data sets to a data storage unit so that at least some of said individual data sets are stored in conjunction with access code identifiers on said data storage unit; and

a remote access code distribution controller for transferring a particular one of said access codes for use with said data storage unit on receipt of one of said access code identifiers, wherein said data storage unit stores update instructions and an update counter value for enabling said controller to use said access codes to generate an updated access code for enabling access to previously inaccessible parts of said data on said data storage unit.

14. A method for encrypting data sets to control access thereto, comprising the steps of:

defining attributes that correspond to particular properties of said data sets;

binding said attributes to access codes and storing attributes and access codes in a first location;

encoding said data sets so the data sets may be decrypted by said access codes when said access codes are applied to said data sets by a processor;

storing said encoded data sets on a data storage unit;

transmitting to a second location from said first location one of said access codes bound to one of said attributes;

providing a controller for communication with said data storage unit and wherein, upon transmitting one of said identifying codes to a remote authorization center, one of said access codes is downloaded to said controller wherein said controller provides access to said data sets stored on said data storage unit, wherein said data storage unit stores thereon instructions and an update counter value for enabling said controller to use said access codes to generate an updated access code for enabling access to previously inaccessible parts of said data stored on said data storage unit.

15. A data retrieval system for use by a user comprising:

a data storage unit including data stored thereon including portions selected by said user, said selected portions on said data storage unit being accessible by a set of access codes, wherein one of said set of access codes is transmitted by a remote central processing unit to a user at a different location, the access code transmitted to said user to provide access to said selected portions of said data stored on said data storage unit; and

wherein said data storage unit stores update instructions and an update counter value for enabling said controller to use said transmitted access code to automatically generate an updated access code for enabling access to a previously inaccessible one of said selected portions of said data on said data storage unit.

16. A system as recited in claim 15 wherein each of said access codes is correlated with an identifying code and wherein an authorization request includes said identifying code.

17. A system as recited in claim 16 wherein said identifying code is representative of an attribute.

18. A system as recited in claim 17 wherein said attribute is reprentative of a use of said data.

19. A system as recited in claim 15 wherein said data stored on said data storage unit includes identifying codes for identifying data.

20. A system as recited in claim 19 wherein said identifying codes are codes are associated with attibutes.

21. A system as recited in claim 20 wherein said attribute is representative of a use of said data.

22. A system for providing authentication of electronic transmissions, comprising:

an authorization center for transmitting access codes to different locations upon receipt of authenticated requests for said access codes, wherein one of said access codes is electronically transmitted to a different location when said authenticated request meets particular electronic signature conditions; and

a controller at each of said different locations for receiving said access code from said authorization center, said controller capable of identifying when said access code is received, wherein said access codes provide for the decryption of encrypted data stored on a data storage unit, and wherein on said data storage unit, update instructions and an update counter value are stored, the instructions and counter value enabling said controller to use said transmitted access code to generate an updated access code for enabling access to previously inaccessible data on said data storage unit.

23. A method for providing authentication of electronic transmissions, comprising the steps of:

providing an authorization center for transmitting access codes to different locations upon receipt of authentication requests for said access codes, wherein one of said access codes is electronically transmitted to a different location when said authentication request meets particular electronic signature conditions; and

providing a controller at each of said different locations for receiving said access code from said authorization center, said controller capable of identifying when said access code is received, wherein said access codes provide for the decryption of encrypted data stored on a data storage unit, and wherein on said data storage unit, update instructions and an update counter value are stored, the instructions and counter value enabling said controller to use said transmitted access code to generate an updated access code for enabling access to previously inaccessible parts of said data on said data storage unit.